fix is_allow_process function win10 if fail

This commit is contained in:
2026-06-03 10:28:55 +08:00
parent 762cedc015
commit a514b17148
+4 -2
View File
@@ -1,4 +1,5 @@
#include "ob_reg_callback.h"
#include "protect_filter.h"
void* reg_ob_callback_handle;
@@ -8,7 +9,8 @@ auto is_allow_process(PUNICODE_STRING image_file_name) -> BOOL
if (!image_file_name->Buffer)
return FALSE;
if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe"))
if (wcsstr(image_file_name->Buffer, L"\\System32\\taskmgr.exe") ||
wcsstr(image_file_name->Buffer, L"\\System32\\Taskmgr.exe"))
return TRUE;
return FALSE;
@@ -32,7 +34,7 @@ auto ob_call_back::register_ob_reg_callback() -> NTSTATUS
if(is_allow_process(image_file_name))
goto end;
if (dwPid == ULongToHandle(1836))
if (protect_filter::is_protect_pid(HandleToLong(dwPid)))
{
pOperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = 0;
pOperationInformation->Parameters->DuplicateHandleInformation.OriginalDesiredAccess = 0;