PsGetThreadProcessId in ProcessPreCallback

JKornev / hidden

🇺🇦 Windows driver with usermode interface which can hide processes, file-system and registry objects, protect processes and etc

1.76k stars 481 forks source link

PsGetThreadProcessId in ProcessPreCallback #13

Closed hsheep closed 5 years ago

hsheep commented 5 years ago

hi, Is it correct to use PsGetThreadProcessId in ProcessPreCallback ?

`OB_PREOP_CALLBACK_STATUS ProcessPreCallback(PVOID RegistrationContext, POB_PRE_OPERATION_INFORMATION OperationInformation) { LogInfo("Allow protected process access from %d to %d", (ULONG)PsGetCurrentProcessId(), (ULONG)PsGetThreadProcessId(OperationInformation->Object));

JKornev commented 5 years ago

Hi,

Yup seems like a bug. Fixed as part of 8e4dd9556228a9f9657ff5bb2f7349b2ebe0e286

Thanks!