diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt
index 6c162ec77..35014cebf 100644
--- a/trunk/CHANGELOG.txt
+++ b/trunk/CHANGELOG.txt
@@ -1,6 +1,8 @@
Process Hacker
1.3.6.6
+ * NEW:
+ * Aggressive mode (start with "-a" command line option)
* FIXED:
* Service properties Key handle leak
* Handle deletion detection
diff --git a/trunk/ProcessHacker/Program.cs b/trunk/ProcessHacker/Program.cs
index cae720a05..dc03ad697 100644
--- a/trunk/ProcessHacker/Program.cs
+++ b/trunk/ProcessHacker/Program.cs
@@ -91,6 +91,7 @@ namespace ProcessHacker
public static System.Collections.Specialized.StringCollection ImposterNames =
new System.Collections.Specialized.StringCollection();
+ public static bool Aggressive = false;
public static bool StartHidden = false;
public static bool StartVisible = false;
public static bool ShowOptions = false;
@@ -122,6 +123,7 @@ namespace ProcessHacker
"Usage: processhacker [-m]\n" +
"\t-m\tStarts Process Hacker hidden.\n" +
"\t-v\tStarts Process Hacker visible.\n" +
+ "\t-a\tAggressive mode.\n" +
"\t-o\tShows Options.\n" +
"\t-t n\tShows the specified tab. 0 is Processes, and 1 is Services.",
"Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Information);
@@ -261,6 +263,18 @@ namespace ProcessHacker
if (pArgs.ContainsKey("-o"))
ShowOptions = true;
+ if (pArgs.ContainsKey("-a"))
+ {
+ Aggressive = true;
+
+ try
+ {
+ Unhook();
+ }
+ catch
+ { }
+ }
+
if (pArgs.ContainsKey(""))
if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe"))
StartVisible = true;
diff --git a/trunk/ProcessHacker/Win32/API/Functions.cs b/trunk/ProcessHacker/Win32/API/Functions.cs
index ef0298ed6..4b527a52d 100644
--- a/trunk/ProcessHacker/Win32/API/Functions.cs
+++ b/trunk/ProcessHacker/Win32/API/Functions.cs
@@ -307,40 +307,40 @@ namespace ProcessHacker
ref PROCESS_BASIC_INFORMATION ProcessInformation, int ProcessInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
+ public static extern int ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
int TargetProcessHandle, int TargetHandle, STANDARD_RIGHTS DesiredAccess, int Attributes, int Options);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
+ public static extern int ZwDuplicateObject(int SourceProcessHandle, int SourceHandle,
int TargetProcessHandle, out int TargetHandle, STANDARD_RIGHTS DesiredAccess, int Attributes, int Options);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
+ public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_BASIC_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
+ public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_CACHE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
+ public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_PERFORMANCE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
+ public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
[MarshalAs(UnmanagedType.LPArray)] SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] SystemInformation,
int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
+ public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
+ public static extern int ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass,
ref SYSTEM_LOAD_AND_CALL_IMAGE SystemInformation, int SystemInformationLength);
[DllImport("ntdll.dll", SetLastError = true)]
- public static extern uint ZwQueryObject(int Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
+ public static extern int ZwQueryObject(int Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass,
IntPtr ObjectInformation, int ObjectInformationLength, out int ReturnLength);
#endregion
diff --git a/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs b/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
index 48483a5e8..01d195e2b 100644
--- a/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
+++ b/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs
@@ -143,13 +143,40 @@ namespace ProcessHacker
/// The desired access to the process.
public ProcessHandle(int pid, PROCESS_RIGHTS access)
{
- if (Program.KPH != null)
- this.Handle = Program.KPH.KphOpenProcess(pid, access);
- else
- this.Handle = OpenProcess(access, 0, pid);
+ if (Program.Aggressive)
+ {
+ if (Program.KPH != null)
+ this.Handle = Program.KPH.KphOpenProcess(pid, Program.MinProcessQueryRights);
+ else
+ this.Handle = OpenProcess(Program.MinProcessQueryRights, 0, pid);
- if (this.Handle == 0)
- ThrowLastWin32Error();
+ if (this.Handle == 0)
+ ThrowLastWin32Error();
+
+ int newHandle;
+
+ try
+ {
+ if (ZwDuplicateObject(-1, this.Handle, -1, out newHandle, (STANDARD_RIGHTS)access, 0, 0) < 0)
+ ThrowLastWin32Error();
+ }
+ finally
+ {
+ CloseHandle(this.Handle);
+ }
+
+ this.Handle = newHandle;
+ }
+ else
+ {
+ if (Program.KPH != null)
+ this.Handle = Program.KPH.KphOpenProcess(pid, access);
+ else
+ this.Handle = OpenProcess(access, 0, pid);
+
+ if (this.Handle == 0)
+ ThrowLastWin32Error();
+ }
}
///
@@ -258,7 +285,7 @@ namespace ProcessHacker
int retLen;
if (ZwQueryInformationProcess(this, PROCESS_INFORMATION_CLASS.ProcessBasicInformation,
- ref pbi, Marshal.SizeOf(pbi), out retLen) != 0)
+ ref pbi, Marshal.SizeOf(pbi), out retLen) < 0)
ThrowLastWin32Error();
return pbi;
@@ -614,7 +641,7 @@ namespace ProcessHacker
using (MemoryAlloc data = new MemoryAlloc(retLen))
{
if (ZwQueryInformationProcess(this, PROCESS_INFORMATION_CLASS.ProcessImageFileName,
- data, retLen, out retLen) != 0)
+ data, retLen, out retLen) < 0)
ThrowLastWin32Error();
UNICODE_STRING str = data.ReadStruct();
@@ -827,7 +854,7 @@ namespace ProcessHacker
}
else
{
- if (ZwResumeProcess(this) != 0)
+ if (ZwResumeProcess(this) < 0)
ThrowLastWin32Error();
}
}
@@ -890,7 +917,7 @@ namespace ProcessHacker
}
else
{
- if (ZwSuspendProcess(this) != 0)
+ if (ZwSuspendProcess(this) < 0)
ThrowLastWin32Error();
}
}
diff --git a/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs b/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs
index 9a939a793..94797ce6c 100644
--- a/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs
+++ b/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs
@@ -62,13 +62,40 @@ namespace ProcessHacker
/// The desired access to the thread.
public ThreadHandle(int tid, THREAD_RIGHTS access)
{
- if (Program.KPH != null)
- this.Handle = Program.KPH.KphOpenThread(tid, access);
- else
- this.Handle = OpenThread(access, 0, tid);
+ if (Program.Aggressive)
+ {
+ if (Program.KPH != null)
+ this.Handle = Program.KPH.KphOpenThread(tid, Program.MinThreadQueryRights);
+ else
+ this.Handle = OpenThread(Program.MinThreadQueryRights, 0, tid);
- if (this.Handle == 0)
- ThrowLastWin32Error();
+ if (this.Handle == 0)
+ ThrowLastWin32Error();
+
+ int newHandle;
+
+ try
+ {
+ if (ZwDuplicateObject(-1, this.Handle, -1, out newHandle, (STANDARD_RIGHTS)access, 0, 0) < 0)
+ ThrowLastWin32Error();
+ }
+ finally
+ {
+ CloseHandle(this.Handle);
+ }
+
+ this.Handle = newHandle;
+ }
+ else
+ {
+ if (Program.KPH != null)
+ this.Handle = Program.KPH.KphOpenThread(tid, access);
+ else
+ this.Handle = OpenThread(access, 0, tid);
+
+ if (this.Handle == 0)
+ ThrowLastWin32Error();
+ }
}
///
@@ -76,7 +103,7 @@ namespace ProcessHacker
///
public void Alert()
{
- if (ZwAlertThread(this) != 0)
+ if (ZwAlertThread(this) < 0)
ThrowLastWin32Error();
}
@@ -90,7 +117,7 @@ namespace ProcessHacker
int retLen;
if (ZwQueryInformationThread(this, THREAD_INFORMATION_CLASS.ThreadBasicInformation,
- ref basicInfo, Marshal.SizeOf(basicInfo), out retLen) != 0)
+ ref basicInfo, Marshal.SizeOf(basicInfo), out retLen) < 0)
ThrowLastWin32Error();
return basicInfo;
diff --git a/trunk/ProcessHacker/Win32/Win32.cs b/trunk/ProcessHacker/Win32/Win32.cs
index d1f64e0d7..e441b4cab 100644
--- a/trunk/ProcessHacker/Win32/Win32.cs
+++ b/trunk/ProcessHacker/Win32/Win32.cs
@@ -509,7 +509,7 @@ namespace ProcessHacker
// This is needed because ZwQuerySystemInformation with SystemHandleInformation doesn't
// actually give a real return length when called with an insufficient buffer. This code
// tries repeatedly to call the function, doubling the buffer size each time it fails.
- while (ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data.Memory,
+ while ((uint)ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data.Memory,
data.Size, out retLength) == STATUS_INFO_LENGTH_MISMATCH)
{
data.Resize(data.Size * 2);
@@ -551,7 +551,7 @@ namespace ProcessHacker
// duplicates the handle so we can query it
if (ZwDuplicateObject(process.Handle, handle.Handle,
- Program.CurrentProcess, out objectHandle, 0, 0, 0) != 0)
+ Program.CurrentProcess, out objectHandle, 0, 0, 0) < 0)
throw new Exception("Could not duplicate object!");
using (Win32Handle objectHandleAuto = new Win32Handle(objectHandle))
@@ -834,10 +834,10 @@ namespace ProcessHacker
laci.ModuleName.Length = (ushort)(ntFileName.Length * 2);
laci.ModuleName.MaximumLength = laci.ModuleName.Length;
- uint ret;
+ int ret;
if ((ret = ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS.SystemLoadAndCallImage,
- ref laci, Marshal.SizeOf(laci))) != 0)
+ ref laci, Marshal.SizeOf(laci))) < 0)
throw new Exception("Failed to load the kernel image - error " + ret.ToString());
}
}