diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt index 01d8c3fb0..eba3db518 100644 --- a/trunk/CHANGELOG.txt +++ b/trunk/CHANGELOG.txt @@ -23,6 +23,7 @@ Process Hacker * Limited user account weirdness * No longer deletes the KProcessHacker service if it's already started * Process Hacker no longer requires UAC elevation + * Memory searching now uses KProcessHacker if possible * Incorrect labeling of process files which can't be read (due to permissions) as packed * Disables "Show one graph per CPU" if there is only one CPU diff --git a/trunk/ProcessHacker/Forms/ResultsWindow.cs b/trunk/ProcessHacker/Forms/ResultsWindow.cs index 09f032414..dce4c2399 100644 --- a/trunk/ProcessHacker/Forms/ResultsWindow.cs +++ b/trunk/ProcessHacker/Forms/ResultsWindow.cs @@ -299,9 +299,13 @@ namespace ProcessHacker Win32.MEMORY_BASIC_INFORMATION info = new Win32.MEMORY_BASIC_INFORMATION(); Win32.MEMORY_BASIC_INFORMATION info2 = new Win32.MEMORY_BASIC_INFORMATION(); int address = 0; - int handle = Win32.OpenProcess(Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION, 0, _pid); + Win32.ProcessHandle phandle; - if (handle == 0) + try + { + phandle = new Win32.ProcessHandle(_pid, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION); + } + catch { this.Cursor = Cursors.Default; return; @@ -309,7 +313,7 @@ namespace ProcessHacker while (true) { - if (!Win32.VirtualQueryEx(handle, address, ref info, + if (!Win32.VirtualQueryEx(phandle, address, ref info, Marshal.SizeOf(typeof(Win32.MEMORY_BASIC_INFORMATION)))) { break; diff --git a/trunk/ProcessHacker/Searchers/LiteralSearcher.cs b/trunk/ProcessHacker/Searchers/LiteralSearcher.cs index 7ccaa1b85..982c7b368 100644 --- a/trunk/ProcessHacker/Searchers/LiteralSearcher.cs +++ b/trunk/ProcessHacker/Searchers/LiteralSearcher.cs @@ -34,7 +34,7 @@ namespace ProcessHacker Results.Clear(); byte[] text = (byte[])Params["text"]; - int handle = 0; + Win32.ProcessHandle phandle; int address = 0; Win32.MEMORY_BASIC_INFORMATION info = new Win32.MEMORY_BASIC_INFORMATION(); int count = 0; @@ -51,10 +51,13 @@ namespace ProcessHacker return; } - handle = Win32.OpenProcess(Win32.PROCESS_RIGHTS.PROCESS_VM_READ | - Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION, 0, PID); - - if (handle == 0) + try + { + phandle = new Win32.ProcessHandle(PID, + Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION | + Win32.PROCESS_RIGHTS.PROCESS_VM_READ); + } + catch { CallSearchError("Could not open process: " + Win32.GetLastErrorMessage()); return; @@ -62,7 +65,7 @@ namespace ProcessHacker while (true) { - if (!Win32.VirtualQueryEx(handle, address, ref info, + if (!Win32.VirtualQueryEx(phandle, address, ref info, Marshal.SizeOf(typeof(Win32.MEMORY_BASIC_INFORMATION)))) { break; @@ -92,7 +95,7 @@ namespace ProcessHacker CallSearchProgressChanged( String.Format("Searching 0x{0:x8} ({1} found)...", info.BaseAddress, count)); - Win32.ReadProcessMemory(handle, info.BaseAddress, data, info.RegionSize, out bytesRead); + Win32.ReadProcessMemory(phandle, info.BaseAddress, data, info.RegionSize, out bytesRead); if (bytesRead == 0) continue; @@ -129,7 +132,7 @@ namespace ProcessHacker } } - Win32.CloseHandle(handle); + phandle.Dispose(); CallSearchFinished(); } diff --git a/trunk/ProcessHacker/Searchers/RegexSearcher.cs b/trunk/ProcessHacker/Searchers/RegexSearcher.cs index e97bf237c..ad9f66ae6 100644 --- a/trunk/ProcessHacker/Searchers/RegexSearcher.cs +++ b/trunk/ProcessHacker/Searchers/RegexSearcher.cs @@ -36,7 +36,7 @@ namespace ProcessHacker Results.Clear(); string regex = (string)Params["regex"]; - int handle = 0; + Win32.ProcessHandle phandle; int address = 0; Win32.MEMORY_BASIC_INFORMATION info = new Win32.MEMORY_BASIC_INFORMATION(); int count = 0; @@ -67,10 +67,13 @@ namespace ProcessHacker return; } - handle = Win32.OpenProcess(Win32.PROCESS_RIGHTS.PROCESS_VM_READ | - Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION, 0, PID); - - if (handle == 0) + try + { + phandle = new Win32.ProcessHandle(PID, + Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION | + Win32.PROCESS_RIGHTS.PROCESS_VM_READ); + } + catch { CallSearchError("Could not open process: " + Win32.GetLastErrorMessage()); return; @@ -78,7 +81,7 @@ namespace ProcessHacker while (true) { - if (!Win32.VirtualQueryEx(handle, address, ref info, + if (!Win32.VirtualQueryEx(phandle, address, ref info, Marshal.SizeOf(typeof(Win32.MEMORY_BASIC_INFORMATION)))) { break; @@ -108,7 +111,7 @@ namespace ProcessHacker CallSearchProgressChanged( String.Format("Searching 0x{0:x8} ({1} found)...", info.BaseAddress, count)); - Win32.ReadProcessMemory(handle, info.BaseAddress, data, info.RegionSize, out bytesRead); + Win32.ReadProcessMemory(phandle, info.BaseAddress, data, info.RegionSize, out bytesRead); if (bytesRead == 0) continue; @@ -137,7 +140,7 @@ namespace ProcessHacker } } - Win32.CloseHandle(handle); + phandle.Dispose(); CallSearchFinished(); } diff --git a/trunk/ProcessHacker/Searchers/StringSearcher.cs b/trunk/ProcessHacker/Searchers/StringSearcher.cs index 015db92f0..2bdd08cd6 100644 --- a/trunk/ProcessHacker/Searchers/StringSearcher.cs +++ b/trunk/ProcessHacker/Searchers/StringSearcher.cs @@ -35,7 +35,7 @@ namespace ProcessHacker Results.Clear(); byte[] text = (byte[])Params["text"]; - int handle = 0; + Win32.ProcessHandle phandle; int address = 0; Win32.MEMORY_BASIC_INFORMATION info = new Win32.MEMORY_BASIC_INFORMATION(); int count = 0; @@ -46,10 +46,13 @@ namespace ProcessHacker bool opt_img = (bool)Params["image"]; bool opt_map = (bool)Params["mapped"]; - handle = Win32.OpenProcess(Win32.PROCESS_RIGHTS.PROCESS_VM_READ | - Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION, 0, PID); - - if (handle == 0) + try + { + phandle = new Win32.ProcessHandle(PID, + Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION | + Win32.PROCESS_RIGHTS.PROCESS_VM_READ); + } + catch { CallSearchError("Could not open process: " + Win32.GetLastErrorMessage()); return; @@ -57,7 +60,7 @@ namespace ProcessHacker while (true) { - if (!Win32.VirtualQueryEx(handle, address, ref info, + if (!Win32.VirtualQueryEx(phandle, address, ref info, Marshal.SizeOf(typeof(Win32.MEMORY_BASIC_INFORMATION)))) { break; @@ -87,7 +90,7 @@ namespace ProcessHacker CallSearchProgressChanged( String.Format("Searching 0x{0:x8} ({1} found)...", info.BaseAddress, count)); - Win32.ReadProcessMemory(handle, info.BaseAddress, data, info.RegionSize, out bytesRead); + Win32.ReadProcessMemory(phandle, info.BaseAddress, data, info.RegionSize, out bytesRead); if (bytesRead == 0) continue; @@ -119,7 +122,7 @@ namespace ProcessHacker } } - Win32.CloseHandle(handle); + phandle.Dispose(); CallSearchFinished(); } diff --git a/trunk/ProcessHacker/Searchers/StructSearcher.cs b/trunk/ProcessHacker/Searchers/StructSearcher.cs index 3082942c6..0b4f9077a 100644 --- a/trunk/ProcessHacker/Searchers/StructSearcher.cs +++ b/trunk/ProcessHacker/Searchers/StructSearcher.cs @@ -34,7 +34,7 @@ namespace ProcessHacker { Results.Clear(); - int handle = 0; + Win32.ProcessHandle phandle; int address = 0; Win32.MEMORY_BASIC_INFORMATION info = new Win32.MEMORY_BASIC_INFORMATION(); int count = 0; @@ -57,9 +57,11 @@ namespace ProcessHacker structDef.IOProvider = new ProcessMemoryIO(PID); - handle = Win32.OpenProcess(Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION, 0, PID); - - if (handle == 0) + try + { + phandle = new Win32.ProcessHandle(PID, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION); + } + catch { CallSearchError("Could not open process: " + Win32.GetLastErrorMessage()); return; @@ -67,7 +69,7 @@ namespace ProcessHacker while (true) { - if (!Win32.VirtualQueryEx(handle, address, ref info, + if (!Win32.VirtualQueryEx(phandle, address, ref info, Marshal.SizeOf(typeof(Win32.MEMORY_BASIC_INFORMATION)))) { break; @@ -112,7 +114,7 @@ namespace ProcessHacker } } - Win32.CloseHandle(handle); + phandle.Dispose(); CallSearchFinished(); }