PspProcessOpen

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//The "nt!PspOpenProcess" function is currently only used for filling the
//"OpenProcedure" field of the "_OBJECT_TYPE_INITIALIZER" substructure of
//the "_OBJECT_TYPE" structure. ---> nt!PsProcessType->TypeInfo.OpenProcedure

//The "PspProcessOpen" function is called by the "nt!ObpIncrementHandleCountEx"
//function as part of the "nt!ObpCreateHandle" function.

//The function's main duty is to sanitise requested access rights on protected
//processes (DRM scheme) whenever the "OpenProcess/NtOpenProcess" functions are
//called to get the handle of a protected process. Only If the caller process
//is itself protected, then no sanitisation is conducted.

//Also, it makes sure that the new "PROCESS_QUERY_LIMITED_INFORMATION" access
//right is added whenever only PROCESS_QUERY_INFORMATION is requested.

int PspProcessOpen(void*    Dummy,
                   BOOL     CheckDRM,
           _EPROCESS* pCallerProcess,
           _EPROCESS* pCalleeProcess,
               unsigned long* pRequestedAccessRights)
{

    if( CheckDRM == TRUE  && pCallerProcess->Flags2.ProtectedProcess==FALSE)
    {
     if(pCalleeProcess->Flags2.ProtectedProcess)
     {
            //For actions on protected processes, only PROCESS_TERMINATE,
            //PROCESS_SUSPEND_RESUME, PROCESS_QUERY_LIMITED_INFORMATION,
            //and SYNCHRONIZE are allowed.
            if(*pRequestedAccessRights && 0xFE7FE)
                  return STATUS_ACCESS_DENIED;
    }
     }

     if( *pRequestedAccessRights & PROCESS_QUERY_INFORMATION)
        *pRequestedAccessRights |= PROCESS_QUERY_LIMITED_INFORMATION;

     return 0;
}