#include "Remap.h" #include "BlackBoneDrv.h" #include "Routines.h" #pragma alloc_text(PAGE, BBProcessNotify) /// /// Process termination handler /// /// Parent PID /// PID /// TRUE if process was created VOID BBProcessNotify( IN HANDLE ParentId, IN HANDLE ProcessId, IN BOOLEAN Create ) { UNREFERENCED_PARAMETER( ParentId ); PPROCESS_MAP_ENTRY pProcessEntry = NULL; PMEM_PHYS_PROCESS_ENTRY pPhysProcessEntry = NULL; if (Create == FALSE) { pPhysProcessEntry = BBLookupPhysProcessEntry( ProcessId ); if (pPhysProcessEntry != NULL) { DPRINT( "BlackBone: %s: Target process %u shutdown. Physical memory Cleanup\n", __FUNCTION__, ProcessId ); BBCleanupProcessPhysEntry( pPhysProcessEntry, TRUE ); } KeAcquireGuardedMutex( &g_globalLock ); pProcessEntry = BBLookupProcessEntry( ProcessId, FALSE ); // Target process shutdown if (pProcessEntry != NULL) { DPRINT( "BlackBone: %s: Target process %u shutdown. Cleanup\n", __FUNCTION__, pProcessEntry->target.pid ); BBCleanupProcessEntry( pProcessEntry ); } else { pProcessEntry = BBLookupProcessEntry( ProcessId, TRUE ); // Host process shutdown if (pProcessEntry != NULL) BBCleanupHostProcess( pProcessEntry ); } KeReleaseGuardedMutex( &g_globalLock ); } }