[WIN32K] Attach to the target process before unhooking

CORE-16083
This commit is contained in:
Mark Jansen 2019-06-10 19:47:50 +02:00
parent 7a3937ddaf
commit 97d1590914
No known key found for this signature in database
GPG key ID: B39240EE84BEAE8B

View file

@ -1037,12 +1037,15 @@ BOOLEAN
IntRemoveHook(PVOID Object)
{
INT HookId;
PTHREADINFO ptiHook;
PTHREADINFO ptiHook, pti;
PDESKTOP pdo;
PHOOK Hook = Object;
BOOL bOtherProcess;
NT_ASSERT(UserIsEnteredExclusive());
HookId = Hook->HookId;
pti = PsGetCurrentThreadWin32Thread();
if (Hook->ptiHooked) // Local
{
@ -1053,6 +1056,10 @@ IntRemoveHook(PVOID Object)
if (IsListEmpty(&ptiHook->aphkStart[HOOKID_TO_INDEX(HookId)]))
{
ptiHook->fsHooks &= ~HOOKID_TO_FLAG(HookId);
bOtherProcess = (ptiHook->ppi != pti->ppi);
if (bOtherProcess)
KeAttachProcess(&ptiHook->ppi->peProcess->Pcb);
_SEH2_TRY
{
@ -1064,6 +1071,9 @@ IntRemoveHook(PVOID Object)
(void)0;
}
_SEH2_END;
if (bOtherProcess)
KeDetachProcess();
}
}
else // Global