admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

added aggressive mode

Browse Source 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1042 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2009-04-10 01:54:50 +00:00
parent ffab572fcc
commit 449faec191
6 changed files with 101 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trunk/CHANGELOG.txt
+2
View File
@@ -1,6 +1,8 @@
Process Hacker
1.3.6.6
* NEW:
* Aggressive mode (start with "-a" command line option)
* FIXED:
* Service properties Key handle leak
* Handle deletion detection
trunk/ProcessHacker/Program.cs
+14
View File
@@ -91,6 +91,7 @@ namespace ProcessHacker
public static System.Collections.Specialized.StringCollection ImposterNames =
new System.Collections.Specialized.StringCollection();
public static bool Aggressive = false;
public static bool StartHidden = false;
public static bool StartVisible = false;
public static bool ShowOptions = false;
@@ -122,6 +123,7 @@ namespace ProcessHacker
"Usage: processhacker [-m]\n" +
"\t-m\tStarts Process Hacker hidden.\n" +
"\t-v\tStarts Process Hacker visible.\n" +
"\t-a\tAggressive mode.\n" +
"\t-o\tShows Options.\n" +
"\t-t n\tShows the specified tab. 0 is Processes, and 1 is Services.",
"Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Information);
@@ -261,6 +263,18 @@ namespace ProcessHacker
if (pArgs.ContainsKey("-o"))
ShowOptions = true;
if (pArgs.ContainsKey("-a"))
{
Aggressive = true;
try
{
Unhook();
}
catch
{ }
}
if (pArgs.ContainsKey(""))
if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe"))
StartVisible = true;
trunk/ProcessHacker/Win32/API/Functions.cs
+9 -9
View File
@@ -307,40 +307,40 @@ namespace ProcessHacker
ref PROCESS_BASIC_INFORMATION ProcessInformation, int ProcessInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
public static extern int ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
int TargetProcessHandle, int TargetHandle, STANDARD_RIGHTS DesiredAccess, int Attributes, int Options);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
public static extern int ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
int TargetProcessHandle, out int TargetHandle, STANDARD_RIGHTS DesiredAccess, int Attributes, int Options);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_BASIC_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_CACHE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_PERFORMANCE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
[MarshalAs(UnmanagedType.LPArray)] SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] SystemInformation,
int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
public static extern int ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_LOAD_AND_CALL_IMAGE SystemInformation, int SystemInformationLength);
[DllImport("ntdll.dll", SetLastError = true)]
public static extern uint ZwQueryObject(int Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
public static extern int ZwQueryObject(int Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
IntPtr ObjectInformation, int ObjectInformationLength, out int ReturnLength);
#endregion
trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
+37 -10
View File
@@ -143,13 +143,40 @@ namespace ProcessHacker
/// <param name="access">The desired access to the process.</param>
public ProcessHandle(int pid, PROCESS_RIGHTS access)
{
if (Program.KPH != null)
this.Handle = Program.KPH.KphOpenProcess(pid, access);
else
this.Handle = OpenProcess(access, 0, pid);
if (Program.Aggressive)
{
if (Program.KPH != null)
this.Handle = Program.KPH.KphOpenProcess(pid, Program.MinProcessQueryRights);
else
this.Handle = OpenProcess(Program.MinProcessQueryRights, 0, pid);
if (this.Handle == 0)
ThrowLastWin32Error();
if (this.Handle == 0)
ThrowLastWin32Error();
int newHandle;
try
{
if (ZwDuplicateObject(-1, this.Handle, -1, out newHandle, (STANDARD_RIGHTS)access, 0, 0) < 0)
ThrowLastWin32Error();
}
finally
{
CloseHandle(this.Handle);
}
this.Handle = newHandle;
}
else
{
if (Program.KPH != null)
this.Handle = Program.KPH.KphOpenProcess(pid, access);
else
this.Handle = OpenProcess(access, 0, pid);
if (this.Handle == 0)
ThrowLastWin32Error();
}
}
/// <summary>
@@ -258,7 +285,7 @@ namespace ProcessHacker
int retLen;
if (ZwQueryInformationProcess(this, PROCESS_INFORMATION_CLASS.ProcessBasicInformation,
ref pbi, Marshal.SizeOf(pbi), out retLen) != 0)
ref pbi, Marshal.SizeOf(pbi), out retLen) < 0)
ThrowLastWin32Error();
return pbi;
@@ -614,7 +641,7 @@ namespace ProcessHacker
using (MemoryAlloc data = new MemoryAlloc(retLen))
{
if (ZwQueryInformationProcess(this, PROCESS_INFORMATION_CLASS.ProcessImageFileName,
data, retLen, out retLen) != 0)
data, retLen, out retLen) < 0)
ThrowLastWin32Error();
UNICODE_STRING str = data.ReadStruct<UNICODE_STRING>();
@@ -827,7 +854,7 @@ namespace ProcessHacker
}
else
{
if (ZwResumeProcess(this) != 0)
if (ZwResumeProcess(this) < 0)
ThrowLastWin32Error();
}
}
@@ -890,7 +917,7 @@ namespace ProcessHacker
}
else
{
if (ZwSuspendProcess(this) != 0)
if (ZwSuspendProcess(this) < 0)
ThrowLastWin32Error();
}
}
trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs
+35 -8
View File
@@ -62,13 +62,40 @@ namespace ProcessHacker
/// <param name="access">The desired access to the thread.</param>
public ThreadHandle(int tid, THREAD_RIGHTS access)
{
if (Program.KPH != null)
this.Handle = Program.KPH.KphOpenThread(tid, access);
else
this.Handle = OpenThread(access, 0, tid);
if (Program.Aggressive)
{
if (Program.KPH != null)
this.Handle = Program.KPH.KphOpenThread(tid, Program.MinThreadQueryRights);
else
this.Handle = OpenThread(Program.MinThreadQueryRights, 0, tid);
if (this.Handle == 0)
ThrowLastWin32Error();
if (this.Handle == 0)
ThrowLastWin32Error();
int newHandle;
try
{
if (ZwDuplicateObject(-1, this.Handle, -1, out newHandle, (STANDARD_RIGHTS)access, 0, 0) < 0)
ThrowLastWin32Error();
}
finally
{
CloseHandle(this.Handle);
}
this.Handle = newHandle;
}
else
{
if (Program.KPH != null)
this.Handle = Program.KPH.KphOpenThread(tid, access);
else
this.Handle = OpenThread(access, 0, tid);
if (this.Handle == 0)
ThrowLastWin32Error();
}
}
/// <summary>
@@ -76,7 +103,7 @@ namespace ProcessHacker
/// </summary>
public void Alert()
{
if (ZwAlertThread(this) != 0)
if (ZwAlertThread(this) < 0)
ThrowLastWin32Error();
}
@@ -90,7 +117,7 @@ namespace ProcessHacker
int retLen;
if (ZwQueryInformationThread(this, THREAD_INFORMATION_CLASS.ThreadBasicInformation,
ref basicInfo, Marshal.SizeOf(basicInfo), out retLen) != 0)
ref basicInfo, Marshal.SizeOf(basicInfo), out retLen) < 0)
ThrowLastWin32Error();
return basicInfo;
trunk/ProcessHacker/Win32/Win32.cs
+4 -4
View File
@@ -509,7 +509,7 @@ namespace ProcessHacker
// This is needed because ZwQuerySystemInformation with SystemHandleInformation doesn't
// actually give a real return length when called with an insufficient buffer. This code
// tries repeatedly to call the function, doubling the buffer size each time it fails.
while (ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data.Memory,
while ((uint)ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data.Memory,
data.Size, out retLength) == STATUS_INFO_LENGTH_MISMATCH)
{
data.Resize(data.Size * 2);
@@ -551,7 +551,7 @@ namespace ProcessHacker
// duplicates the handle so we can query it
if (ZwDuplicateObject(process.Handle, handle.Handle,
Program.CurrentProcess, out objectHandle, 0, 0, 0) != 0)
Program.CurrentProcess, out objectHandle, 0, 0, 0) < 0)
throw new Exception("Could not duplicate object!");
using (Win32Handle objectHandleAuto = new Win32Handle(objectHandle))
@@ -834,10 +834,10 @@ namespace ProcessHacker
laci.ModuleName.Length = (ushort)(ntFileName.Length * 2);
laci.ModuleName.MaximumLength = laci.ModuleName.Length;
uint ret;
int ret;
if ((ret = ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS.SystemLoadAndCallImage,
ref laci, Marshal.SizeOf(laci))) != 0)
ref laci, Marshal.SizeOf(laci))) < 0)
throw new Exception("Failed to load the kernel image - error " + ret.ToString());
}
}