threadmonitor.h

来自「远程网络监视程序的源码」· C头文件 代码 · 共 89 行

//---------------------------------------------------------------------------
//
// ThreadMonitor.h
//
// SUBSYSTEM: 
//              Monitoring process creation and termination  
//				
// MODULE:    
//              Thread management
//
// DESCRIPTION:
//              Implement abstract interface provided by CCustomThread
//
// AUTHOR:		Ivo Ivanov
//                                                                         
//---------------------------------------------------------------------------
#if !defined(_THREADMONITOR_H_)
#define _THREADMONITOR_H_

#if _MSC_VER > 1000
#pragma once
#endif // _MSC_VER > 1000
//---------------------------------------------------------------------------
//
// Includes
//
//---------------------------------------------------------------------------
#include "CustomThread.h"

//---------------------------------------------------------------------------
//
// Aplication scope consts and typedefs
//
//---------------------------------------------------------------------------

#define FILE_DEVICE_UNKNOWN             0x00000022
#define IOCTL_UNKNOWN_BASE              FILE_DEVICE_UNKNOWN
#define IOCTL_PROCOBSRV_GET_PROCINFO    \
	CTL_CODE(IOCTL_UNKNOWN_BASE, 0x0800, METHOD_BUFFERED, FILE_READ_ACCESS | FILE_WRITE_ACCESS)


class CQueueContainer;
//---------------------------------------------------------------------------
//
// class CDrvEventThread
//
//---------------------------------------------------------------------------
class CDrvEventThread: public CCustomThread  
{
public:
	CDrvEventThread(
		TCHAR*               pszThreadGuid,     // Thread unique ID
		CQueueContainer*     pRequestManager    // The underlying store
		);
	virtual ~CDrvEventThread();

protected:
	// A user supplied implementation of the thread function.
	// Override Run() and insert the code that should be executed when 
	// the thread runs.
	virtual void Run();

	// Perform action prior to activate the thread  
	virtual BOOL OnBeforeActivate();

	// Called after the thread function exits
	virtual void OnAfterDeactivate();

	// Attach to kernel mode created event handle
	BOOL OpenKernelModeEvent();

	// Retrieve data from the kernel mode driver.
	void RetrieveFromKernelDriver();

	// The underlying store wrapped up by the custom template
	CQueueContainer* m_pQueueManager;

	// Kernel mode created event
	HANDLE m_hEventKernel;

	// A handle for accessing the kernel driver
	HANDLE m_hDriverFile;

	// Keep the state of the last received event
	QUEUED_ITEM  m_LastCallbackInfo;
};

#endif // !defined(_THREADMONITOR_H_)
//----------------------------End of the file -------------------------------