diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt index accb32466..fa0980d59 100644 --- a/trunk/CHANGELOG.txt +++ b/trunk/CHANGELOG.txt @@ -12,6 +12,8 @@ Process Hacker * Shows groups and privileges for token handles owned by other processes * Major refactoring of Win32 code + * Now shows more information about processes (e.g. audiodg.exe) - uses + PROCESS_QUERY_LIMITED_INFORMATION on Vista 1.2.6.0 * Fixed the fix for the huge regression - the cause was a double "free" of the same handle diff --git a/trunk/ProcessHacker/Forms/HackerWindow.cs b/trunk/ProcessHacker/Forms/HackerWindow.cs index a8298e02c..a7bce3d8b 100644 --- a/trunk/ProcessHacker/Forms/HackerWindow.cs +++ b/trunk/ProcessHacker/Forms/HackerWindow.cs @@ -1186,7 +1186,7 @@ namespace ProcessHacker try { using (Win32.ProcessHandle process = new Win32.ProcessHandle(processSelectedPID, - Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) + Program.MinProcessQueryRights)) { TokenWindow tokForm = new TokenWindow(process); @@ -1379,18 +1379,17 @@ namespace ProcessHacker ProcessItem parent = new ProcessItem(); string parentText = ""; - try + if (item.ParentPID != -1) { - using (Win32.ProcessHandle phandle = - new Win32.ProcessHandle(item.PID, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) + try { - parent = processP.Dictionary[phandle.GetParentPID()]; + parent = processP.Dictionary[item.ParentPID]; parentText += " started by " + parent.Name + " (PID " + parent.PID.ToString() + ")"; } + catch + { } } - catch - { } this.QueueMessage("New Process: " + item.Name + " (PID " + item.PID.ToString() + ")" + parentText, item.Icon); @@ -2508,7 +2507,8 @@ namespace ProcessHacker using (Win32.ProcessHandle phandle = new Win32.ProcessHandle(p.Id, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) { - Win32.GetProcessDEPPolicy(phandle.Handle, out flags, out perm); + if (!Win32.GetProcessDEPPolicy(phandle.Handle, out flags, out perm)) + throw new Exception(Win32.GetLastErrorMessage()); return flags == Win32.DEPFLAGS.PROCESS_DEP_DISABLE ? "Disabled" : (flags == Win32.DEPFLAGS.PROCESS_DEP_ENABLE ? "Enabled" : @@ -2527,7 +2527,8 @@ namespace ProcessHacker using (Win32.ProcessHandle phandle = new Win32.ProcessHandle(p.Id, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) { - Win32.GetProcessDEPPolicy(phandle.Handle, out flags, out perm); + if (!Win32.GetProcessDEPPolicy(phandle.Handle, out flags, out perm)) + throw new Exception(Win32.GetLastErrorMessage()); return perm == 0 ? "No" : "Yes"; } @@ -2546,7 +2547,7 @@ namespace ProcessHacker delegate (Process p) { using (Win32.ProcessHandle phandle = - new Win32.ProcessHandle(p.Id, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) + new Win32.ProcessHandle(p.Id, Program.MinProcessQueryRights)) { Win32.IO_COUNTERS counters = Win32.GetProcessIoCounters(phandle); @@ -2558,7 +2559,7 @@ namespace ProcessHacker delegate (Process p) { using (Win32.ProcessHandle phandle = - new Win32.ProcessHandle(p.Id, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) + new Win32.ProcessHandle(p.Id, Program.MinProcessQueryRights)) { Win32.IO_COUNTERS counters = Win32.GetProcessIoCounters(phandle); @@ -2570,7 +2571,7 @@ namespace ProcessHacker delegate (Process p) { using (Win32.ProcessHandle phandle = - new Win32.ProcessHandle(p.Id, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION)) + new Win32.ProcessHandle(p.Id, Program.MinProcessQueryRights)) { Win32.IO_COUNTERS counters = Win32.GetProcessIoCounters(phandle); diff --git a/trunk/ProcessHacker/Forms/ThreadWindow.cs b/trunk/ProcessHacker/Forms/ThreadWindow.cs index 7db0d6fe2..921fb83f8 100644 --- a/trunk/ProcessHacker/Forms/ThreadWindow.cs +++ b/trunk/ProcessHacker/Forms/ThreadWindow.cs @@ -75,7 +75,7 @@ namespace ProcessHacker try { - using (Win32.ThreadHandle thandle = new Win32.ThreadHandle(TID, Win32.THREAD_RIGHTS.THREAD_QUERY_INFORMATION)) + using (Win32.ThreadHandle thandle = new Win32.ThreadHandle(TID, Program.MinThreadQueryRights)) { try { @@ -338,7 +338,7 @@ namespace ProcessHacker { try { - using (Win32.ThreadHandle thread = new Win32.ThreadHandle(_tid, Win32.THREAD_RIGHTS.THREAD_QUERY_INFORMATION)) + using (Win32.ThreadHandle thread = new Win32.ThreadHandle(_tid, Program.MinThreadQueryRights)) { TokenWindow tokForm = new TokenWindow(thread); diff --git a/trunk/ProcessHacker/Providers/ThreadProvider.cs b/trunk/ProcessHacker/Providers/ThreadProvider.cs index b88dc4bce..8eb57dc83 100644 --- a/trunk/ProcessHacker/Providers/ThreadProvider.cs +++ b/trunk/ProcessHacker/Providers/ThreadProvider.cs @@ -128,7 +128,7 @@ namespace ProcessHacker try { using (Win32.ThreadHandle handle = - new Win32.ThreadHandle(t.Id, Win32.THREAD_RIGHTS.THREAD_QUERY_INFORMATION)) + new Win32.ThreadHandle(t.Id, Program.MinThreadQueryRights)) { int retLen; diff --git a/trunk/ProcessHacker/Win32/Win32.cs b/trunk/ProcessHacker/Win32/Win32.cs index 3af68cf28..3abd987ac 100644 --- a/trunk/ProcessHacker/Win32/Win32.cs +++ b/trunk/ProcessHacker/Win32/Win32.cs @@ -275,7 +275,7 @@ namespace ProcessHacker if (ZwDuplicateObject(process.Handle, handle.Handle, Program.CurrentProcess, out process_handle, - (STANDARD_RIGHTS)PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION, 0, 0) != 0) + (STANDARD_RIGHTS)Program.MinProcessQueryRights, 0, 0) != 0) throw new Exception("Could not duplicate process handle!"); try @@ -305,7 +305,7 @@ namespace ProcessHacker if (ZwDuplicateObject(process.Handle, handle.Handle, Program.CurrentProcess, out thread_handle, - (STANDARD_RIGHTS)THREAD_RIGHTS.THREAD_QUERY_INFORMATION, 0, 0) != 0) + (STANDARD_RIGHTS)Program.MinThreadQueryRights, 0, 0) != 0) throw new Exception("Could not duplicate thread handle!"); try