I set ‘create process notify routine’ with PsSetCreateProcessNotifyRoutine.
I need to get PEPROCESS pointer for a process destroyed. So, when Create
parameter is FALSE I call
PsLookupProcessByProcessId with ProcessId parameter. However
PsLookupProcessByProcessId fails with STATUS_INVALID_PARAMETER. Seems like
process is completely destroyed when my callback routine is called (which is
strange for I call ObReferenceObject for interesting PEPROCESS pointer).
This algo works for ‘create thread notify routine’ (PsLookupThreadByThreadId
works fine). Here’s my code.
CClientManager::CClientManager()
{
…
PsSetCreateProcessNotifyRoutine(
_CreateProcessNotifyRoutine, FALSE);
}
VOID CClientManager::_CreateProcessNotifyRoutine(
HANDLE ParentId, HANDLE ProcessId, BOOLEAN Create)
{
if (FALSE == Create)
{
PEPROCESS ProcessPtr;
NTSTATUS Status = PsLookupProcessByProcessId(
ProcessId, &ProcessPtr);
if (!NT_SUCCESS(Status))
{
return;
}
_ClientManager.UnregisterClient(ProcessPtr);
ObDereferenceObject(ProcessPtr);
}
}