diff --git a/2.x/trunk/ProcessHacker/ProcessHacker.rc b/2.x/trunk/ProcessHacker/ProcessHacker.rc
index 6f1e04288..e13146467 100644
--- a/2.x/trunk/ProcessHacker/ProcessHacker.rc
+++ b/2.x/trunk/ProcessHacker/ProcessHacker.rc
@@ -529,6 +529,21 @@ BEGIN
CONTROL "Sizes in bytes",IDC_SIZESINBYTES,"Button",BS_AUTOCHECKBOX | WS_TABSTOP,7,248,59,10
END
+IDD_HIDDENPROCESSES DIALOGEX 0, 0, 337, 221
+STYLE DS_SETFONT | DS_FIXEDSYS | WS_POPUP | WS_CAPTION | WS_SYSMENU | WS_THICKFRAME
+CAPTION "Hidden Processes"
+FONT 8, "MS Shell Dlg", 400, 0, 0x1
+BEGIN
+ DEFPUSHBUTTON "Close",IDOK,280,200,50,14
+ LTEXT "Processes highlighted red are hidden while those highlighted grey have terminated.",IDC_INTRO,7,7,323,12
+ CONTROL "",IDC_PROCESSES,"SysListView32",LVS_REPORT | LVS_SHOWSELALWAYS | LVS_ALIGNLEFT | WS_BORDER | WS_TABSTOP,7,23,323,162
+ RTEXT "",IDC_DESCRIPTION,7,187,323,11
+ PUSHBUTTON "&Scan",IDC_SCAN,225,200,50,14
+ PUSHBUTTON "Save...",IDC_SAVE,170,200,50,14
+ PUSHBUTTON "Terminate",IDC_TERMINATE,115,200,50,14
+ COMBOBOX IDC_METHOD,7,201,73,30,CBS_DROPDOWNLIST | CBS_SORT | WS_VSCROLL | WS_TABSTOP
+END
+
/////////////////////////////////////////////////////////////////////////////
//
@@ -657,6 +672,14 @@ BEGIN
TOPMARGIN, 7
BOTTOMMARGIN, 260
END
+
+ IDD_HIDDENPROCESSES, DIALOG
+ BEGIN
+ LEFTMARGIN, 7
+ RIGHTMARGIN, 330
+ TOPMARGIN, 7
+ BOTTOMMARGIN, 214
+ END
END
#endif // APSTUDIO_INVOKED
diff --git a/2.x/trunk/ProcessHacker/ProcessHacker.vcproj b/2.x/trunk/ProcessHacker/ProcessHacker.vcproj
index 0d8ec02ef..861c4c52b 100644
--- a/2.x/trunk/ProcessHacker/ProcessHacker.vcproj
+++ b/2.x/trunk/ProcessHacker/ProcessHacker.vcproj
@@ -386,6 +386,10 @@
RelativePath=".\guisup.c"
>
+
+
diff --git a/2.x/trunk/ProcessHacker/hidnproc.c b/2.x/trunk/ProcessHacker/hidnproc.c
new file mode 100644
index 000000000..fb5d89612
--- /dev/null
+++ b/2.x/trunk/ProcessHacker/hidnproc.c
@@ -0,0 +1,136 @@
+/*
+ * Process Hacker -
+ * hidden processes detection
+ *
+ * Copyright (C) 2010 wj32
+ *
+ * This file is part of Process Hacker.
+ *
+ * Process Hacker is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * Process Hacker is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with Process Hacker. If not, see .
+ */
+
+#include
+#include
+
+INT_PTR CALLBACK PhpHiddenProcessesDlgProc(
+ __in HWND hwndDlg,
+ __in UINT uMsg,
+ __in WPARAM wParam,
+ __in LPARAM lParam
+ );
+
+HWND PhHiddenProcessesWindowHandle = NULL;
+HWND PhHiddenProcessesListViewHandle = NULL;
+static PH_LAYOUT_MANAGER WindowLayoutManager;
+
+VOID PhShowHiddenProcessesDialog()
+{
+ if (!PhHiddenProcessesWindowHandle)
+ {
+ PhHiddenProcessesWindowHandle = CreateDialog(
+ PhInstanceHandle,
+ MAKEINTRESOURCE(IDD_HIDDENPROCESSES),
+ PhMainWndHandle,
+ PhpHiddenProcessesDlgProc
+ );
+ }
+
+ if (!IsWindowVisible(PhHiddenProcessesWindowHandle))
+ ShowWindow(PhHiddenProcessesWindowHandle, SW_SHOW);
+ else
+ BringWindowToTop(PhHiddenProcessesWindowHandle);
+}
+
+static INT_PTR CALLBACK PhpHiddenProcessesDlgProc(
+ __in HWND hwndDlg,
+ __in UINT uMsg,
+ __in WPARAM wParam,
+ __in LPARAM lParam
+ )
+{
+ switch (uMsg)
+ {
+ case WM_INITDIALOG:
+ {
+ HWND lvHandle;
+
+ PhCenterWindow(hwndDlg, GetParent(hwndDlg));
+ PhHiddenProcessesListViewHandle = lvHandle = GetDlgItem(hwndDlg, IDC_PROCESSES);
+
+ PhInitializeLayoutManager(&WindowLayoutManager, hwndDlg);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDC_INTRO),
+ NULL, PH_ANCHOR_LEFT | PH_ANCHOR_TOP | PH_ANCHOR_RIGHT | PH_FORCE_INVALIDATE);
+ PhAddLayoutItem(&WindowLayoutManager, lvHandle,
+ NULL, PH_ANCHOR_ALL);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDC_DESCRIPTION),
+ NULL, PH_ANCHOR_LEFT | PH_ANCHOR_RIGHT | PH_ANCHOR_BOTTOM | PH_FORCE_INVALIDATE);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDC_METHOD),
+ NULL, PH_ANCHOR_LEFT | PH_ANCHOR_BOTTOM);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDC_TERMINATE),
+ NULL, PH_ANCHOR_RIGHT | PH_ANCHOR_BOTTOM);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDC_SAVE),
+ NULL, PH_ANCHOR_RIGHT | PH_ANCHOR_BOTTOM);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDC_SCAN),
+ NULL, PH_ANCHOR_RIGHT | PH_ANCHOR_BOTTOM);
+ PhAddLayoutItem(&WindowLayoutManager, GetDlgItem(hwndDlg, IDOK),
+ NULL, PH_ANCHOR_RIGHT | PH_ANCHOR_BOTTOM);
+
+ PhRegisterDialog(hwndDlg);
+
+ PhSetListViewStyle(lvHandle, TRUE, TRUE);
+ PhSetControlTheme(lvHandle, L"explorer");
+ PhAddListViewColumn(lvHandle, 0, 0, 0, LVCFMT_LEFT, 320, L"Process");
+ PhAddListViewColumn(lvHandle, 1, 1, 1, LVCFMT_LEFT, 60, L"PID");
+
+ PhSetExtendedListView(lvHandle);
+
+ ComboBox_AddString(GetDlgItem(hwndDlg, IDC_METHOD), L"Brute Force");
+ ComboBox_AddString(GetDlgItem(hwndDlg, IDC_METHOD), L"CSR Handles");
+ ComboBox_SelectString(GetDlgItem(hwndDlg, IDC_METHOD), -1, L"CSR Handles");
+ }
+ break;
+ case WM_CLOSE:
+ {
+ // Hide, don't close.
+ ShowWindow(hwndDlg, SW_HIDE);
+ SetWindowLongPtr(hwndDlg, DWLP_MSGRESULT, 0);
+ }
+ return TRUE;
+ case WM_COMMAND:
+ {
+ switch (LOWORD(wParam))
+ {
+ case IDCANCEL:
+ case IDOK:
+ {
+ SendMessage(hwndDlg, WM_CLOSE, 0, 0);
+ }
+ break;
+ }
+ }
+ break;
+ case WM_SIZE:
+ {
+ PhLayoutManagerLayout(&WindowLayoutManager);
+ }
+ break;
+ case WM_SIZING:
+ {
+ PhResizingMinimumSize((PRECT)lParam, wParam, 476, 380);
+ }
+ break;
+ }
+
+ return FALSE;
+}
diff --git a/2.x/trunk/ProcessHacker/include/phgui.h b/2.x/trunk/ProcessHacker/include/phgui.h
index 8db83c19c..418367343 100644
--- a/2.x/trunk/ProcessHacker/include/phgui.h
+++ b/2.x/trunk/ProcessHacker/include/phgui.h
@@ -853,6 +853,10 @@ PPH_STRING PhGetDiagnosticsString();
VOID PhShowFindObjectsDialog();
+// hidnproc
+
+VOID PhShowHiddenProcessesDialog();
+
// hndlprp
VOID PhShowHandleProperties(
diff --git a/2.x/trunk/ProcessHacker/mainwnd.c b/2.x/trunk/ProcessHacker/mainwnd.c
index 25518c73f..05fc5d127 100644
--- a/2.x/trunk/ProcessHacker/mainwnd.c
+++ b/2.x/trunk/ProcessHacker/mainwnd.c
@@ -413,6 +413,11 @@ LRESULT CALLBACK PhMainWndProc(
PhBoostProvider(&PhPrimaryProviderThread, &ServiceProviderRegistration);
}
break;
+ case ID_TOOLS_HIDDENPROCESSES:
+ {
+ PhShowHiddenProcessesDialog();
+ }
+ break;
case ID_TOOLS_VERIFYFILESIGNATURE:
{
PH_FILETYPE_FILTER filters[] =
diff --git a/2.x/trunk/ProcessHacker/resource.h b/2.x/trunk/ProcessHacker/resource.h
index 4ba02356e..a384a0e82 100644
--- a/2.x/trunk/ProcessHacker/resource.h
+++ b/2.x/trunk/ProcessHacker/resource.h
@@ -31,6 +31,7 @@
#define IDD_HEAPS 132
#define IDR_PRIVILEGE 133
#define IDR_FINDOBJ 134
+#define IDD_HIDDENPROCESSES 135
#define IDC_TERMINATE 1003
#define IDC_FILEICON 1005
#define IDC_FILE 1006
@@ -94,6 +95,11 @@
#define IDC_PROPERTIES 1060
#define IDC_LIST 1061
#define IDC_SIZESINBYTES 1062
+#define IDC_PROCESSES 1063
+#define IDC_SCAN 1064
+#define IDC_SAVE 1065
+#define IDC_METHOD 1067
+#define IDC_INTRO 1068
#define ID_MAINWND_PROCESSTL 2001
#define ID_MAINWND_SERVICELV 2002
#define ID_MAINWND_NETWORKLV 2003
@@ -208,9 +214,9 @@
//
#ifdef APSTUDIO_INVOKED
#ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE 135
+#define _APS_NEXT_RESOURCE_VALUE 136
#define _APS_NEXT_COMMAND_VALUE 40125
-#define _APS_NEXT_CONTROL_VALUE 1063
+#define _APS_NEXT_CONTROL_VALUE 1069
#define _APS_NEXT_SYMED_VALUE 105
#endif
#endif