I am "reviewing" some code that was written well before me and I'm noticing a pattern that I have some doubts about:
The result of the PsGetCurrentProcess()
function is stored and then comparisons are made with that pointer (which is a pointer to an EPROCESS
struct).
However, I'm not finding anything in the documentation, which suggests this function is guaranteed to return the same pointer each time. What is much more surprising to me is that this code has been apparently working for a long time.
Is this a bug, and would you recommend changing that logic to e.g. comparing Process IDs (Using PsGetProcessId)?