[TCPIP] Save the SubProcessTag when an ADDRESS_FILE is created

This commit is contained in:
Pierre Schweitzer 2018-12-31 10:21:14 +01:00
parent 1a93d83f92
commit d98001de17
No known key found for this signature in database
GPG Key ID: 7545556C3D585B0B
2 changed files with 6 additions and 0 deletions

View File

@ -155,6 +155,7 @@ typedef struct _ADDRESS_FILE {
IP_ADDRESS AddrCache; /* One entry address cache (destination
address of last packet transmitted) */
HANDLE ProcessId; /* Creator process ID */
PVOID SubProcessTag; /* Creator process tag */
LARGE_INTEGER CreationTime; /* Time of creation */
/* The following members are used to control event notification */

View File

@ -10,6 +10,10 @@
#include "precomp.h"
/* FIXME: including pstypes.h without ntifs fails */
#include <ntifs.h>
#include <ndk/pstypes.h>
/* Uncomment for logging of connections and address files every 10 seconds */
//#define LOG_OBJECTS
@ -425,6 +429,7 @@ NTSTATUS FileOpenAddress(
AddrFile->BCast = 1;
AddrFile->HeaderIncl = 1;
AddrFile->ProcessId = PsGetCurrentProcessId();
AddrFile->SubProcessTag = ((PTEB)PsGetCurrentThreadTeb())->SubProcessTag;
KeQuerySystemTime(&AddrFile->CreationTime);
/* Make sure address is a local unicast address or 0 */