Hi!
in my driver i use KeStackAttachProcess ( (PKPROCESS) PeProcess,
&ApcState );
as I need to inspect some process properties but when Symantec AV is
installed it appears to fail -- I get a
BSOD (INVALID_PROCESS_DETACH_ATTEMPT (6) )
when calling KeUnstackDetachProcess (&ApcState);
Googling around I see that this should never happen but heck, it does.
Since KeStackAttachProcess does not return any value I guess that I have
to inspect the ApcState ... can anybody shed some light?
Platform: Windows XP SP2
thanks,