fix is_allow_process function win10 if fail
This commit is contained in:
@@ -1,4 +1,5 @@
|
||||
#include "ob_reg_callback.h"
|
||||
#include "protect_filter.h"
|
||||
|
||||
void* reg_ob_callback_handle;
|
||||
|
||||
@@ -8,7 +9,8 @@ auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL
|
||||
if (!image_file_name->Buffer)
|
||||
return FALSE;
|
||||
|
||||
if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe"))
|
||||
if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe") ||
|
||||
wcsstr(image_file_name->Buffer, L"\\System32\\Taskmgr.exe"))
|
||||
return TRUE;
|
||||
|
||||
return FALSE;
|
||||
@@ -32,7 +34,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
|
||||
if(is_allow_process(image_file_name))
|
||||
goto end;
|
||||
|
||||
if (dwPid == ULongToHandle(1836))
|
||||
if (protect_filter::is_protect_pid(HandleToLong(dwPid)))
|
||||
{
|
||||
pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
|
||||
pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;
|
||||
|
||||
Reference in New Issue
Block a user