What's new Search

Recent content by Sn1p3r

S
Accessing File Object structure of Parent process

This link was very useful to me at least Terminus Project you should look EPROCESS struct (y)
- Sn1p3r
- Post #2
- Oct 12, 2021
- Forum: Programming
S
Accessing File Object structure of Parent process

Hi I have some problem to solve some problem In the Process notification callback routine i have some condition that i must access Parent process file object I Found some solution but i do not understand some cases yet in file object struct i have ParentProcessId that not really handle and just...
- Sn1p3r
- Thread
- Oct 2, 2021
- Replies: 1
- Forum: Programming
S
WorkItem in kernel

Hi, I apologize for my late response. I was sick for a while, I am a member of the team that reverse Sysmon and move forward accordingly. Exactly in Sysmon in process creation callback, work item is created just like that. thank you
- Sn1p3r
- Post #7
- Jul 25, 2021
- Forum: Programming
S
WorkItem in kernel

good ref for deep dive into work item i want to know because i have some other operation and i have to be sure that this(routine) operation is over for example size_calc(....){ PIO_WORKITEM WorkItem; IoAllocateWorkItem(pDeviceObject); IoInitializeWorkItem(pDeviceObject,WorkItem;)...
- Sn1p3r
- Post #5
- Jun 25, 2021
- Forum: Programming
S
WorkItem in kernel

I read this and but my issue how(standard way)can we understand this worker are done! i want to wait for work item to done i know we must do this with KeInitializeEvent but how ?
- Sn1p3r
- Post #3
- Jun 24, 2021
- Forum: Programming
S
WorkItem in kernel

I am implementing network monitoring with WFP driver. in some situation i need create workitem and waiting for completing.i looking for some statndard sample code.i saw some code that use some trick for example use Kernel event (KEVENT) and then this changed in workitem when completed. (using...
- Sn1p3r
- Thread
- Jun 24, 2021
- Replies: 6
- Forum: Programming

Sn1p3r

Recent content by Sn1p3r

Accessing File Object structure of Parent process

Accessing File Object structure of Parent process

WorkItem in kernel

WorkItem in kernel

WorkItem in kernel

WorkItem in kernel