From 449faec19154a59ef544fbecaf632a433adaa655 Mon Sep 17 00:00:00 2001 From: wj32 Date: Fri, 10 Apr 2009 01:54:50 +0000 Subject: [PATCH] added aggressive mode git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1042 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- trunk/CHANGELOG.txt | 2 + trunk/ProcessHacker/Program.cs | 14 ++++++ trunk/ProcessHacker/Win32/API/Functions.cs | 18 +++---- .../Win32/Handles/ProcessHandle.cs | 47 +++++++++++++++---- .../Win32/Handles/ThreadHandle.cs | 43 +++++++++++++---- trunk/ProcessHacker/Win32/Win32.cs | 8 ++-- 6 files changed, 101 insertions(+), 31 deletions(-) diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt index 6c162ec77..35014cebf 100644 --- a/trunk/CHANGELOG.txt +++ b/trunk/CHANGELOG.txt @@ -1,6 +1,8 @@ Process Hacker 1.3.6.6 + * NEW: + * Aggressive mode (start with "-a" command line option) * FIXED: * Service properties Key handle leak * Handle deletion detection diff --git a/trunk/ProcessHacker/Program.cs b/trunk/ProcessHacker/Program.cs index cae720a05..dc03ad697 100644 --- a/trunk/ProcessHacker/Program.cs +++ b/trunk/ProcessHacker/Program.cs @@ -91,6 +91,7 @@ namespace ProcessHacker public static System.Collections.Specialized.StringCollection ImposterNames = new System.Collections.Specialized.StringCollection(); + public static bool Aggressive = false; public static bool StartHidden = false; public static bool StartVisible = false; public static bool ShowOptions = false; @@ -122,6 +123,7 @@ namespace ProcessHacker "Usage: processhacker [-m]\n" + "\t-m\tStarts Process Hacker hidden.\n" + "\t-v\tStarts Process Hacker visible.\n" + + "\t-a\tAggressive mode.\n" + "\t-o\tShows Options.\n" + "\t-t n\tShows the specified tab. 0 is Processes, and 1 is Services.", "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Information); @@ -261,6 +263,18 @@ namespace ProcessHacker if (pArgs.ContainsKey("-o")) ShowOptions = true; + if (pArgs.ContainsKey("-a")) + { + Aggressive = true; + + try + { + Unhook(); + } + catch + { } + } + if (pArgs.ContainsKey("")) if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe")) StartVisible = true; diff --git a/trunk/ProcessHacker/Win32/API/Functions.cs b/trunk/ProcessHacker/Win32/API/Functions.cs index ef0298ed6..4b527a52d 100644 --- a/trunk/ProcessHacker/Win32/API/Functions.cs +++ b/trunk/ProcessHacker/Win32/API/Functions.cs @@ -307,40 +307,40 @@ namespace ProcessHacker ref PROCESS_BASIC_INFORMATION ProcessInformation, int ProcessInformationLength, out int ReturnLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwDuplicateObject(int SourceProcessHandle, int SourceHandle, + public static extern int ZwDuplicateObject(int SourceProcessHandle, int SourceHandle, int TargetProcessHandle, int TargetHandle, STANDARD_RIGHTS DesiredAccess, int Attributes, int Options); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwDuplicateObject(int SourceProcessHandle, int SourceHandle, + public static extern int ZwDuplicateObject(int SourceProcessHandle, int SourceHandle, int TargetProcessHandle, out int TargetHandle, STANDARD_RIGHTS DesiredAccess, int Attributes, int Options); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, + public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, ref SYSTEM_BASIC_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, + public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, ref SYSTEM_CACHE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, + public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, ref SYSTEM_PERFORMANCE_INFORMATION SystemInformation, int SystemInformationLength, out int ReturnLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, + public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, [MarshalAs(UnmanagedType.LPArray)] SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION[] SystemInformation, int SystemInformationLength, out int ReturnLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, + public static extern int ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, IntPtr SystemInformation, int SystemInformationLength, out int ReturnLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, + public static extern int ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS SystemInformationClass, ref SYSTEM_LOAD_AND_CALL_IMAGE SystemInformation, int SystemInformationLength); [DllImport("ntdll.dll", SetLastError = true)] - public static extern uint ZwQueryObject(int Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass, + public static extern int ZwQueryObject(int Handle, OBJECT_INFORMATION_CLASS ObjectInformationClass, IntPtr ObjectInformation, int ObjectInformationLength, out int ReturnLength); #endregion diff --git a/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs b/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs index 48483a5e8..01d195e2b 100644 --- a/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs +++ b/trunk/ProcessHacker/Win32/Handles/ProcessHandle.cs @@ -143,13 +143,40 @@ namespace ProcessHacker /// The desired access to the process. public ProcessHandle(int pid, PROCESS_RIGHTS access) { - if (Program.KPH != null) - this.Handle = Program.KPH.KphOpenProcess(pid, access); - else - this.Handle = OpenProcess(access, 0, pid); + if (Program.Aggressive) + { + if (Program.KPH != null) + this.Handle = Program.KPH.KphOpenProcess(pid, Program.MinProcessQueryRights); + else + this.Handle = OpenProcess(Program.MinProcessQueryRights, 0, pid); - if (this.Handle == 0) - ThrowLastWin32Error(); + if (this.Handle == 0) + ThrowLastWin32Error(); + + int newHandle; + + try + { + if (ZwDuplicateObject(-1, this.Handle, -1, out newHandle, (STANDARD_RIGHTS)access, 0, 0) < 0) + ThrowLastWin32Error(); + } + finally + { + CloseHandle(this.Handle); + } + + this.Handle = newHandle; + } + else + { + if (Program.KPH != null) + this.Handle = Program.KPH.KphOpenProcess(pid, access); + else + this.Handle = OpenProcess(access, 0, pid); + + if (this.Handle == 0) + ThrowLastWin32Error(); + } } /// @@ -258,7 +285,7 @@ namespace ProcessHacker int retLen; if (ZwQueryInformationProcess(this, PROCESS_INFORMATION_CLASS.ProcessBasicInformation, - ref pbi, Marshal.SizeOf(pbi), out retLen) != 0) + ref pbi, Marshal.SizeOf(pbi), out retLen) < 0) ThrowLastWin32Error(); return pbi; @@ -614,7 +641,7 @@ namespace ProcessHacker using (MemoryAlloc data = new MemoryAlloc(retLen)) { if (ZwQueryInformationProcess(this, PROCESS_INFORMATION_CLASS.ProcessImageFileName, - data, retLen, out retLen) != 0) + data, retLen, out retLen) < 0) ThrowLastWin32Error(); UNICODE_STRING str = data.ReadStruct(); @@ -827,7 +854,7 @@ namespace ProcessHacker } else { - if (ZwResumeProcess(this) != 0) + if (ZwResumeProcess(this) < 0) ThrowLastWin32Error(); } } @@ -890,7 +917,7 @@ namespace ProcessHacker } else { - if (ZwSuspendProcess(this) != 0) + if (ZwSuspendProcess(this) < 0) ThrowLastWin32Error(); } } diff --git a/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs b/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs index 9a939a793..94797ce6c 100644 --- a/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs +++ b/trunk/ProcessHacker/Win32/Handles/ThreadHandle.cs @@ -62,13 +62,40 @@ namespace ProcessHacker /// The desired access to the thread. public ThreadHandle(int tid, THREAD_RIGHTS access) { - if (Program.KPH != null) - this.Handle = Program.KPH.KphOpenThread(tid, access); - else - this.Handle = OpenThread(access, 0, tid); + if (Program.Aggressive) + { + if (Program.KPH != null) + this.Handle = Program.KPH.KphOpenThread(tid, Program.MinThreadQueryRights); + else + this.Handle = OpenThread(Program.MinThreadQueryRights, 0, tid); - if (this.Handle == 0) - ThrowLastWin32Error(); + if (this.Handle == 0) + ThrowLastWin32Error(); + + int newHandle; + + try + { + if (ZwDuplicateObject(-1, this.Handle, -1, out newHandle, (STANDARD_RIGHTS)access, 0, 0) < 0) + ThrowLastWin32Error(); + } + finally + { + CloseHandle(this.Handle); + } + + this.Handle = newHandle; + } + else + { + if (Program.KPH != null) + this.Handle = Program.KPH.KphOpenThread(tid, access); + else + this.Handle = OpenThread(access, 0, tid); + + if (this.Handle == 0) + ThrowLastWin32Error(); + } } /// @@ -76,7 +103,7 @@ namespace ProcessHacker /// public void Alert() { - if (ZwAlertThread(this) != 0) + if (ZwAlertThread(this) < 0) ThrowLastWin32Error(); } @@ -90,7 +117,7 @@ namespace ProcessHacker int retLen; if (ZwQueryInformationThread(this, THREAD_INFORMATION_CLASS.ThreadBasicInformation, - ref basicInfo, Marshal.SizeOf(basicInfo), out retLen) != 0) + ref basicInfo, Marshal.SizeOf(basicInfo), out retLen) < 0) ThrowLastWin32Error(); return basicInfo; diff --git a/trunk/ProcessHacker/Win32/Win32.cs b/trunk/ProcessHacker/Win32/Win32.cs index d1f64e0d7..e441b4cab 100644 --- a/trunk/ProcessHacker/Win32/Win32.cs +++ b/trunk/ProcessHacker/Win32/Win32.cs @@ -509,7 +509,7 @@ namespace ProcessHacker // This is needed because ZwQuerySystemInformation with SystemHandleInformation doesn't // actually give a real return length when called with an insufficient buffer. This code // tries repeatedly to call the function, doubling the buffer size each time it fails. - while (ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data.Memory, + while ((uint)ZwQuerySystemInformation(SYSTEM_INFORMATION_CLASS.SystemHandleInformation, data.Memory, data.Size, out retLength) == STATUS_INFO_LENGTH_MISMATCH) { data.Resize(data.Size * 2); @@ -551,7 +551,7 @@ namespace ProcessHacker // duplicates the handle so we can query it if (ZwDuplicateObject(process.Handle, handle.Handle, - Program.CurrentProcess, out objectHandle, 0, 0, 0) != 0) + Program.CurrentProcess, out objectHandle, 0, 0, 0) < 0) throw new Exception("Could not duplicate object!"); using (Win32Handle objectHandleAuto = new Win32Handle(objectHandle)) @@ -834,10 +834,10 @@ namespace ProcessHacker laci.ModuleName.Length = (ushort)(ntFileName.Length * 2); laci.ModuleName.MaximumLength = laci.ModuleName.Length; - uint ret; + int ret; if ((ret = ZwSetSystemInformation(SYSTEM_INFORMATION_CLASS.SystemLoadAndCallImage, - ref laci, Marshal.SizeOf(laci))) != 0) + ref laci, Marshal.SizeOf(laci))) < 0) throw new Exception("Failed to load the kernel image - error " + ret.ToString()); } }