#include "create_thread_callback.h"
#include "protect_filter.h"




namespace thread_notify_routine
{
	//保护的进程ID
	auto protect_id = ULongToHandle(8976);


	void thread_notify_routine(HANDLE ProcessId, HANDLE ThreadId, BOOLEAN Create)
	{
		if (Create)
		{
			PEPROCESS process{ 0 };
			auto status = PsLookupProcessByProcessId(ProcessId, &process);
			if (!NT_SUCCESS(status))
				goto end;


			
			
			/*PEPROCESS protect_process{ 0 };
			status = PsLookupProcessByProcessId(protect_id, &protect_process);
			if (!NT_SUCCESS(status))
				goto end;*/

			if(!protect_filter::is_protect_pid(0, process))
				goto end;

			/*if (protect_process != process)
				goto end;*/

			auto cutor_process_id = PsGetCurrentProcessId();
			if (HandleToLong(cutor_process_id) == 4)
				goto end;

			if (ProcessId != cutor_process_id)
			{
				DbgPrintEx(77, 0, "[!] 恶意远程线程检测！\n");

				DbgPrintEx(77, 0, "[!] 目标进程ID: %d\n", ProcessId);

				DbgPrintEx(77, 0, "[!] 创建者进程ID: %d\n", cutor_process_id);

				DbgPrintEx(77, 0, "[!] 被创建线程ID: %d\n", ThreadId);
			}


		end:
			ObDereferenceObject(process);
		}
	}

	auto create_thread_routine() -> NTSTATUS
	{
		return PsSetCreateThreadNotifyRoutine(thread_notify_routine);
	}

	auto unload_thread_routine() -> NTSTATUS
	{
		return PsRemoveCreateThreadNotifyRoutine(thread_notify_routine);
	}

}