diff --git a/branches/ph-plugins/CHANGELOG.txt b/branches/ph-plugins/CHANGELOG.txt index 9b169170b..af6d4cd37 100644 --- a/branches/ph-plugins/CHANGELOG.txt +++ b/branches/ph-plugins/CHANGELOG.txt @@ -5,6 +5,7 @@ Process Hacker * #2817429 - "Add Port and IP Address columns to Network tab" * #2845829 - "System uptime" * #2853452 - "Find handles window: Minor usability improvements" + * KProcessHacker support for Windows Server 2003 * Update system * Network tools: ping, traceroute and whois * Object security editor diff --git a/branches/ph-plugins/KProcessHacker/i386/kprocesshacker.sys b/branches/ph-plugins/KProcessHacker/i386/kprocesshacker.sys index ae87f7343..3dcccc5bf 100644 Binary files a/branches/ph-plugins/KProcessHacker/i386/kprocesshacker.sys and b/branches/ph-plugins/KProcessHacker/i386/kprocesshacker.sys differ diff --git a/branches/ph-plugins/KProcessHacker/version.c b/branches/ph-plugins/KProcessHacker/version.c index e8a7a8410..ef2e9bb2b 100644 --- a/branches/ph-plugins/KProcessHacker/version.c +++ b/branches/ph-plugins/KProcessHacker/version.c @@ -51,6 +51,11 @@ static char KiFastCallEntry51[] = 0x8b, 0xf2, 0x8b, 0x5f, 0x0c, 0x33, 0xc9, 0x8a, 0x0c, 0x18, 0x8b, 0x3f, 0x8b, 0x1c, 0x87, 0x2b }; +static char KiFastCallEntry52[] = +{ + 0x8b, 0xf2, 0x8b, 0x5f, 0x0c, 0x33, 0xc9, 0x8a, + 0x0c, 0x18, 0x8b, 0x3f, 0x8b, 0x1c, 0x87, 0x2b +}; /* same as 5.1 */ static char KiFastCallEntry60[] = { 0x8b, 0xf2, 0x33, 0xc9, 0x8b, 0x57, 0x0c, 0x8b, @@ -60,7 +65,7 @@ static char KiFastCallEntry61[] = { 0x8b, 0xf2, 0x33, 0xc9, 0x8b, 0x57, 0x0c, 0x8b, 0x3f, 0x8a, 0x0c, 0x10, 0x8b, 0x14, 0x87, 0x2b -}; +}; /* same as 6.0 */ /* Below is the scan to find the start of KiFastCallEntry. */ /* static char KiFastCallEntry[] = { @@ -91,6 +96,11 @@ static char PspTerminateProcess51[] = 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x56, 0x64, 0xa1, 0x24, 0x01, 0x00, 0x00, 0x8b, 0x75, 0x08, 0x3b }; +static char PspTerminateProcess52[] = +{ + 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x56, 0x8b, 0x75, + 0x08, 0x57, 0x8d, 0xbe, 0x40, 0x02, 0x00, 0x00 +}; static char PsTerminateProcess60[] = { 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x53, 0x56, 0x57, @@ -113,6 +123,11 @@ static char PspTerminateThreadByPointer51[] = 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xec, 0x0c, 0x83, 0x4d, 0xf8, 0xff, 0x56, 0x57, 0x8b, 0x7d }; +static char PspTerminateThreadByPointer52[] = +{ + 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x53, 0x56, 0x57, + 0x8b, 0x7d, 0x08, 0x8d, 0xb7, 0x40, 0x02, 0x00 +}; static char PspTerminateThreadByPointer60[] = { 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xe4, 0xf8, @@ -193,6 +208,7 @@ NTSTATUS KvInit() SsNtContinue = 0x20; + /* KiFastCallEntry isn't hooked properly yet. Disabled for now. */ /* INIT_SCAN( KiFastCallEntryScan, KiFastCallEntry51, @@ -241,10 +257,67 @@ NTSTATUS KvInit() /* Windows Server 2003 */ else if (majorVersion == 5 && minorVersion == 2) { - WindowsVersion = WINDOWS_SERVER_2003; + ULONG_PTR psSearchOffset = (ULONG_PTR)GetSystemRoutineAddress(L"RtlCreateHeap"); - /* Not supported yet */ - return STATUS_NOT_SUPPORTED; + WindowsVersion = WINDOWS_SERVER_2003; + ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff; + ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff; + + OffEtClientId = 0x1e4; + OffEtSpareByteForSs = 0x24f; /* Padding, last */ + OffEtStartAddress = 0x21c; + OffEtWin32StartAddress = 0x220; + OffEpJob = 0x120; + OffEpObjectTable = 0xd4; + OffEpProtectedProcessOff = 0; + OffEpProtectedProcessBit = 0; + OffEpRundownProtect = 0x90; + OffOhBody = 0x18; + OffOtName = 0x40; + OffOtiGenericMapping = 0x60 + 0x8; + OffOtiOpenProcedure = 0x60 + 0x30; + + SsNtContinue = 0x22; + + /* Can't find on ntoskrnl *and* ntkrnlpa. Disabled for now. */ + /* INIT_SCAN( + KiFastCallEntryScan, + KiFastCallEntry52, + sizeof(KiFastCallEntry52), + (ULONG_PTR)__ZwClose, SCAN_LENGTH, -7 + ); */ + /* We are scanning for PspTerminateProcess which has + the same signature as PsTerminateProcess because + PsTerminateProcess is simply a wrapper on Server 2003. + */ + INIT_SCAN( + PsTerminateProcessScan, + PspTerminateProcess52, + sizeof(PspTerminateProcess52), + psSearchOffset - 0x50000, SCAN_LENGTH, 0 + ); + INIT_SCAN( + PspTerminateThreadByPointerScan, + PspTerminateThreadByPointer52, + sizeof(PspTerminateThreadByPointer52), + psSearchOffset - 0x20000, SCAN_LENGTH, 0 + ); + + if (servicePack == 0) + { + } + else if (servicePack == 1) + { + } + else if (servicePack == 2) + { + } + else + { + return STATUS_NOT_SUPPORTED; + } + + dprintf("Initialized version-specific data for Windows Server 2003 SP%d\n", servicePack); } /* Windows Vista, Windows Server 2008 */ else if (majorVersion == 6 && minorVersion == 0) @@ -252,8 +325,9 @@ NTSTATUS KvInit() ULONG_PTR searchOffset = (ULONG_PTR)__NtClose; WindowsVersion = WINDOWS_VISTA; - ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff; - ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff; + ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1fff; + ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff; + OffEtClientId = 0x20c; OffEtSpareByteForSs = 0x26f; /* Padding, second-last */ OffEtStartAddress = 0x1f8; @@ -441,7 +515,7 @@ NTSTATUS KvInit() dprintf("Initialized version-specific data for Windows Vista SP%d/Windows Server 2008\n", servicePack); } - /* Windows 7 */ + /* Windows 7, Windows Server 2008 R2 */ else if (majorVersion == 6 && minorVersion == 1) { ULONG_PTR psSearchOffset = (ULONG_PTR)GetSystemRoutineAddress(L"PsSetCreateProcessNotifyRoutine"); @@ -451,8 +525,9 @@ NTSTATUS KvInit() return STATUS_NOT_SUPPORTED; WindowsVersion = WINDOWS_7; - ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff; - ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff; + ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1fff; + ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff; + OffEtClientId = 0x22c; OffEtSpareByteForSs = 0x2b4; /* Padding, last */ OffEtStartAddress = 0x218; diff --git a/branches/ph-plugins/ProcessHacker.Native/KProcessHacker.cs b/branches/ph-plugins/ProcessHacker.Native/KProcessHacker.cs index ed4a0977b..be35b86b7 100644 --- a/branches/ph-plugins/ProcessHacker.Native/KProcessHacker.cs +++ b/branches/ph-plugins/ProcessHacker.Native/KProcessHacker.cs @@ -163,16 +163,28 @@ namespace ProcessHacker.Native { // Attempt to load the driver, then try again. ServiceHandle shandle; + bool created = false; - using (var scm = new ServiceManagerHandle(ScManagerAccess.CreateService)) + try { - shandle = scm.CreateService( - deviceName, - deviceName, - ServiceType.KernelDriver, - fileName - ); - shandle.Start(); + using (shandle = new ServiceHandle("KProcessHacker", ServiceAccess.Start)) + { + shandle.Start(); + } + } + catch + { + using (var scm = new ServiceManagerHandle(ScManagerAccess.CreateService)) + { + shandle = scm.CreateService( + deviceName, + deviceName, + ServiceType.KernelDriver, + fileName + ); + shandle.Start(); + created = true; + } } try @@ -185,8 +197,16 @@ namespace ProcessHacker.Native } finally { - // The SCM will delete the service when it is stopped. - shandle.Delete(); + if (shandle != null) + { + if (created) + { + // The SCM will delete the service when it is stopped. + shandle.Delete(); + } + + shandle.Dispose(); + } } } else diff --git a/branches/ph-plugins/ProcessHacker/Build/release.cmd b/branches/ph-plugins/ProcessHacker/Build/release.cmd index 6874fd393..ac242ecb6 100644 --- a/branches/ph-plugins/ProcessHacker/Build/release.cmd +++ b/branches/ph-plugins/ProcessHacker/Build/release.cmd @@ -26,8 +26,7 @@ IF NOT EXIST %ILMergePath% (FOR %%a IN (ILMerge.exe) DO IF %%~$PATH:a' NEQ ' ( SET ILMergePath="%%~$PATH:a") ELSE (SET "N_=T" ECHO:ILMerge IS NOT INSTALLED!!!&&(GOTO CLEANUP))) -SET RequiredDLLs="Aga.Controls.dll" "ProcessHacker.Common.dll"^ - "ProcessHacker.Native.dll" +SET RequiredDLLs="Aga.Controls.dll" REM Create a temporary directory for the merged files MD tmp >NUL 2>&1 diff --git a/branches/ph-plugins/ProcessHacker/Components/RestartRecoveryLib/RestartRecoveryInterop.cs b/branches/ph-plugins/ProcessHacker/Components/RestartRecoveryLib/RestartRecoveryInterop.cs index 4878a6528..34976f142 100644 --- a/branches/ph-plugins/ProcessHacker/Components/RestartRecoveryLib/RestartRecoveryInterop.cs +++ b/branches/ph-plugins/ProcessHacker/Components/RestartRecoveryLib/RestartRecoveryInterop.cs @@ -62,14 +62,12 @@ namespace ProcessHackerRestartRecovery ); [DllImport("kernel32.dll")] - [PreserveSig] internal static extern HResult ApplicationRecoveryInProgress( [Out, MarshalAs(UnmanagedType.Bool)] out bool canceled ); [DllImport("kernel32.dll")] - [PreserveSig] internal static extern HResult GetApplicationRecoveryCallback( IntPtr processHandle, [Out] RecoveryCallback recoveryCallback, @@ -79,7 +77,6 @@ namespace ProcessHackerRestartRecovery ); [DllImport("kernel32.dll", CharSet = CharSet.Unicode)] - [PreserveSig] internal static extern HResult RegisterApplicationRecoveryCallback( InternalRecoveryCallback callback, IntPtr param, uint pingInterval, @@ -88,15 +85,13 @@ namespace ProcessHackerRestartRecovery [DllImport("kernel32.dll")] - [PreserveSig] internal static extern HResult RegisterApplicationRestart( - [MarshalAs(UnmanagedType.BStr)] + [MarshalAs(UnmanagedType.LPWStr)] string commandLineArgs, RestartRestrictions flags ); [DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)] - [PreserveSig] internal static extern HResult GetApplicationRestartSettings( IntPtr process, IntPtr commandLine, @@ -105,11 +100,9 @@ namespace ProcessHackerRestartRecovery ); [DllImport("kernel32.dll")] - [PreserveSig] internal static extern HResult UnregisterApplicationRecoveryCallback(); [DllImport("kernel32.dll")] - [PreserveSig] internal static extern HResult UnregisterApplicationRestart(); #endregion diff --git a/branches/ph-plugins/ProcessHacker/Forms/HackerWindow.cs b/branches/ph-plugins/ProcessHacker/Forms/HackerWindow.cs index e449972b1..35837cfc3 100644 --- a/branches/ph-plugins/ProcessHacker/Forms/HackerWindow.cs +++ b/branches/ph-plugins/ProcessHacker/Forms/HackerWindow.cs @@ -3457,8 +3457,11 @@ namespace ProcessHacker { isFirstPaint = false; - ProcessHackerRestartRecovery.ApplicationRestartRecoveryManager.RegisterForRestart(); - ProcessHackerRestartRecovery.ApplicationRestartRecoveryManager.RegisterForRecovery(); + if (!Program.Recovered) + { + ProcessHackerRestartRecovery.ApplicationRestartRecoveryManager.RegisterForRestart(); + //ProcessHackerRestartRecovery.ApplicationRestartRecoveryManager.RegisterForRecovery(); + } this.CreateShutdownMenuItems(); this.LoadFixMenuItems(); diff --git a/branches/ph-plugins/ProcessHacker/Program/Program.cs b/branches/ph-plugins/ProcessHacker/Program/Program.cs index 24c3803e8..785429dd3 100644 --- a/branches/ph-plugins/ProcessHacker/Program/Program.cs +++ b/branches/ph-plugins/ProcessHacker/Program/Program.cs @@ -101,6 +101,7 @@ namespace ProcessHacker new System.Collections.Specialized.StringCollection(); public static int InspectPid = -1; public static bool NoKph = false; + public static bool Recovered = false; public static string SelectTab = "Processes"; public static bool StartHidden = false; public static bool StartVisible = false; @@ -150,9 +151,10 @@ namespace ProcessHacker return; } - if (pArgs.ContainsKey("-recovered")) //used for Windows Error Reporting recovery + if (pArgs.ContainsKey("-recovered")) // used for Windows Error Reporting recovery { - ProcessHackerRestartRecovery.ApplicationRestartRecoveryManager.RecoverLastSession(); + Recovered = true; + //ProcessHackerRestartRecovery.ApplicationRestartRecoveryManager.RecoverLastSession(); } if (pArgs.ContainsKey("-elevate"))