{"action":"created","issue":{"url":"https://api.github.com/repos/godaddy/procfilter/issues/10","repository_url":"https://api.github.com/repos/godaddy/procfilter","labels_url":"https://api.github.com/repos/godaddy/procfilter/issues/10/labels{/name}","comments_url":"https://api.github.com/repos/godaddy/procfilter/issues/10/comments","events_url":"https://api.github.com/repos/godaddy/procfilter/issues/10/events","html_url":"https://github.com/godaddy/procfilter/issues/10","id":299828196,"number":10,"title":"Breaking down the source code into smaller pieces","user":{"login":"ha0x7c7","id":10879511,"avatar_url":"https://avatars3.githubusercontent.com/u/10879511?v=4","gravatar_id":"","url":"https://api.github.com/users/ha0x7c7","html_url":"https://github.com/ha0x7c7","followers_url":"https://api.github.com/users/ha0x7c7/followers","following_url":"https://api.github.com/users/ha0x7c7/following{/other_user}","gists_url":"https://api.github.com/users/ha0x7c7/gists{/gist_id}","starred_url":"https://api.github.com/users/ha0x7c7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ha0x7c7/subscriptions","organizations_url":"https://api.github.com/users/ha0x7c7/orgs","repos_url":"https://api.github.com/users/ha0x7c7/repos","events_url":"https://api.github.com/users/ha0x7c7/events{/privacy}","received_events_url":"https://api.github.com/users/ha0x7c7/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-02-23T19:44:11Z","updated_at":"2018-02-24T06:48:07Z","closed_at":null,"author_association":"NONE","body":"After compiling the source code successfully, I am trying to understand the core functionality of this tool which is blocking process execution on some criteria.\r\n\r\nIn [this ](https://github.com/godaddy/procfilter/blob/560a7b97b2eeaf9fa5ba7f19b7aa07ff4bc167ca/driver/kmdriver.cpp#L414) line of code we are requesting the user-land to tell us what should we do with this newly created process, I was wondering if the driver is blocked in this line of code? Say if we have 10 newly created processes what really happens?\r\n\r\nThis method defined [here](https://github.com/godaddy/procfilter/blob/560a7b97b2eeaf9fa5ba7f19b7aa07ff4bc167ca/service/umdriver.cpp#L380) does the job of informing the driver which is mostly called in `pfworker.cpp` like [here](https://github.com/godaddy/procfilter/blob/560a7b97b2eeaf9fa5ba7f19b7aa07ff4bc167ca/service/pfworker.cpp#L200). When the service is started running, the call to `DriverInit()` initializes the driver and loads it and create a thread which runs the `WINAPI` function `ep_DriverService`. this function also runs `PfWorkerWork` in another thread, `PfWorkerWork` is the function that writes the response to the driver back. How this `PfWorkerWork` is connected with `core` api's `ProcFilterEvent` defined [here](https://github.com/godaddy/procfilter/blob/560a7b97b2eeaf9fa5ba7f19b7aa07ff4bc167ca/core/core.cpp#L439)?"},"comment":{"url":"https://api.github.com/repos/godaddy/procfilter/issues/comments/368205611","html_url":"https://github.com/godaddy/procfilter/issues/10#issuecomment-368205611","issue_url":"https://api.github.com/repos/godaddy/procfilter/issues/10","id":368205611,"user":{"login":"ha0x7c7","id":10879511,"avatar_url":"https://avatars3.githubusercontent.com/u/10879511?v=4","gravatar_id":"","url":"https://api.github.com/users/ha0x7c7","html_url":"https://github.com/ha0x7c7","followers_url":"https://api.github.com/users/ha0x7c7/followers","following_url":"https://api.github.com/users/ha0x7c7/following{/other_user}","gists_url":"https://api.github.com/users/ha0x7c7/gists{/gist_id}","starred_url":"https://api.github.com/users/ha0x7c7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ha0x7c7/subscriptions","organizations_url":"https://api.github.com/users/ha0x7c7/orgs","repos_url":"https://api.github.com/users/ha0x7c7/repos","events_url":"https://api.github.com/users/ha0x7c7/events{/privacy}","received_events_url":"https://api.github.com/users/ha0x7c7/received_events","type":"User","site_admin":false},"created_at":"2018-02-24T06:48:07Z","updated_at":"2018-02-24T06:48:07Z","author_association":"NONE","body":"Yeah, Pretty sure it helped a lot, Since I am very new to driver development I find a lot of things going on here strange. Are you using Inverted Call model for communicating between driver and service?"}}
{"actor":{"display_login":"ha0x7c7"}}