added PhIsExecutablePacked

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@2895 21ef857c-d57f-4fe0-8362-d861dc6d29cd

2.x/trunk/ProcessHacker/include/ph.h

@@ -1835,6 +1835,13 @@ VOID PhSetFileDialogFileName(
     __in PWSTR FileName
     );
 
+NTSTATUS PhIsExecutablePacked(
+    __in PWSTR FileName,
+    __out PBOOLEAN IsPacked,
+    __out_opt PULONG NumberOfModules,
+    __out_opt PULONG NumberOfFunctions
+    );
+
 typedef struct _PH_COMMAND_LINE_OPTION
 {
     ULONG Id;

2.x/trunk/ProcessHacker/mainwnd.c

@@ -1186,10 +1186,12 @@ VOID PhMainWndOnCreate()
     PhAddListViewColumn(ProcessListViewHandle, 3, 3, 3, LVCFMT_LEFT, 300, L"File Name");
     PhAddListViewColumn(ProcessListViewHandle, 4, 4, 4, LVCFMT_LEFT, 300, L"Command Line");
     PhAddListViewColumn(ProcessListViewHandle, 5, 5, 5, LVCFMT_LEFT, 60, L"CPU");
-    PhAddListViewColumn(ProcessListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"Verified Signer");
+    PhAddListViewColumn(ProcessListViewHandle, 6, 6, 6, LVCFMT_LEFT, 100, L"Packed");
+
     PhAddListViewColumn(ServiceListViewHandle, 0, 0, 0, LVCFMT_LEFT, 100, L"Name");
     PhAddListViewColumn(ServiceListViewHandle, 1, 1, 1, LVCFMT_LEFT, 140, L"Display Name");
     PhAddListViewColumn(ServiceListViewHandle, 2, 2, 2, LVCFMT_LEFT, 50, L"PID");
+
     PhAddListViewColumn(NetworkListViewHandle, 0, 0, 0, LVCFMT_LEFT, 100, L"Process Name");
 
     PhSetExtendedListView(ServiceListViewHandle);
@@ -1798,7 +1800,7 @@ VOID PhMainWndOnProcessModified(
     if (lvItemIndex != -1)
     {
         PhSetListViewSubItem(ProcessListViewHandle, lvItemIndex, 5, ProcessItem->CpuUsageString);
-        PhSetListViewSubItem(ProcessListViewHandle, lvItemIndex, 6, PhGetString(ProcessItem->VerifySignerName));
+        PhSetListViewSubItem(ProcessListViewHandle, lvItemIndex, 6, ProcessItem->IsPacked ? L"Yes" : L"No");
     }
 }
 

2.x/trunk/ProcessHacker/mapimg.c

@@ -154,7 +154,7 @@ NTSTATUS PhLoadMappedImage(
     status = PhGetFileSize(FileHandle, &size);
 
     if (!NT_SUCCESS(status))
-        goto ExitAndCleanup;
+        goto CleanupExit;
 
     status = NtCreateSection(
         &sectionHandle,
@@ -167,7 +167,7 @@ NTSTATUS PhLoadMappedImage(
         );
 
     if (!NT_SUCCESS(status))
-        goto ExitAndCleanup;
+        goto CleanupExit;
 
     // Map the section.
 
@@ -188,7 +188,7 @@ NTSTATUS PhLoadMappedImage(
         );
 
     if (!NT_SUCCESS(status))
-        goto ExitAndCleanup;
+        goto CleanupExit;
 
     // Initialize the mapped file.
 
@@ -203,7 +203,7 @@ NTSTATUS PhLoadMappedImage(
         NtUnmapViewOfSection(NtCurrentProcess(), MappedImage->ViewBase);
     }
 
-ExitAndCleanup:
+CleanupExit:
     if (sectionHandle)
         NtClose(sectionHandle);
     if (openedFile)

2.x/trunk/ProcessHacker/procprv.c

@@ -432,6 +432,13 @@ VOID PhpProcessQueryStage2(
             processItem->FileName->Buffer,
             &Data->VerifySignerName
             );
+
+        PhIsExecutablePacked(
+            processItem->FileName->Buffer,
+            &Data->IsPacked,
+            NULL,
+            NULL
+            );
     }
 }
 

2.x/trunk/ProcessHacker/support.c

@@ -1633,6 +1633,93 @@ VOID PhSetFileDialogFileName(
     }
 }
 
+NTSTATUS PhIsExecutablePacked(
+    __in PWSTR FileName,
+    __out PBOOLEAN IsPacked,
+    __out_opt PULONG NumberOfModules,
+    __out_opt PULONG NumberOfFunctions
+    )
+{
+    // An image is packed if:
+    //
+    // 1. It references fewer than 3 modules, and 
+    // 2. It imports fewer than 5 functions.
+    //
+    // Or:
+    //
+    // 1. The function-to-module ratio is lower than 4 
+    //    (on average fewer than 4 functions are imported 
+    //    from each module), and
+    // 2. It references more than 3 modules but fewer than 
+    //    30 modules.
+
+    NTSTATUS status;
+    PH_MAPPED_IMAGE mappedImage;
+    PH_MAPPED_IMAGE_IMPORTS imports;
+    PH_MAPPED_IMAGE_IMPORT_DLL importDll;
+    ULONG i;
+    ULONG numberOfModules;
+    ULONG numberOfFunctions = 0;
+    BOOLEAN isPacked;
+
+    status = PhLoadMappedImage(
+        FileName,
+        NULL,
+        TRUE,
+        &mappedImage
+        );
+
+    if (!NT_SUCCESS(status))
+        return status;
+
+    status = PhInitializeMappedImageImports(
+        &imports,
+        &mappedImage
+        );
+
+    if (!NT_SUCCESS(status))
+        goto CleanupExit;
+
+    // Get the module and function totals.
+
+    numberOfModules = imports.NumberOfDlls;
+
+    for (i = 0; i < numberOfModules; i++)
+    {
+        if (!NT_SUCCESS(status = PhGetMappedImageImportDll(
+            &imports,
+            i,
+            &importDll
+            )))
+            goto CleanupExit;
+
+        numberOfFunctions += importDll.NumberOfEntries;
+    }
+
+    // Determine if the image is packed.
+
+    if (
+        (numberOfModules < 3 && numberOfFunctions < 5) ||
+        (((FLOAT)numberOfFunctions / numberOfModules) < 4 &&
+        numberOfModules > 3 && numberOfModules < 30)
+        )
+    {
+        isPacked = TRUE;
+    }
+
+    *IsPacked = isPacked;
+
+    if (NumberOfModules)
+        *NumberOfModules = numberOfModules;
+    if (NumberOfFunctions)
+        *NumberOfFunctions = numberOfFunctions;
+
+CleanupExit:
+    PhUnloadMappedImage(&mappedImage);
+
+    return status;
+}
+
 VOID PhParseCommandLine(
     __in PPH_STRINGREF CommandLine,
     __in PPH_COMMAND_LINE_OPTION Options,