From 558b25ad2b204ef04476ecb59bb82732864105bb Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Sun, 26 Dec 2010 20:51:05 +0000
Subject: [PATCH] fixed incorrect alignment specifications when probing

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3946 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 2.x/trunk/KProcessHacker/auto.cmd             |   2 +-
 .../bin/amd64/kprocesshacker.sys              | Bin 28160 -> 28160 bytes
 .../bin/i386/kprocesshacker.sys               | Bin 25600 -> 25600 bytes
 2.x/trunk/KProcessHacker/dynimp.c             |   5 ++
 2.x/trunk/KProcessHacker/object.c             |  14 ++++-
 2.x/trunk/KProcessHacker/process.c            |  49 ++++++++++++++----
 6 files changed, 57 insertions(+), 13 deletions(-)

diff --git a/2.x/trunk/KProcessHacker/auto.cmd b/2.x/trunk/KProcessHacker/auto.cmd
index 8c6a55733..436e21fb1 100644
--- a/2.x/trunk/KProcessHacker/auto.cmd
+++ b/2.x/trunk/KProcessHacker/auto.cmd
@@ -1,6 +1,6 @@
 @echo off
 
-build -cZ
+build -cZ dirty
 if not %errorlevel%==0 goto end
 copy bin\i386\kprocesshacker.sys ..\bin\Release32\
 copy bin\i386\kprocesshacker.pdb ..\bin\Release32\
diff --git a/2.x/trunk/KProcessHacker/bin/amd64/kprocesshacker.sys b/2.x/trunk/KProcessHacker/bin/amd64/kprocesshacker.sys
index 71c5fa4925d5f45e8728d7089cb7dc035458a03a..2ed125aa5b35874a36ad3dae40290b519289eb7a 100644
GIT binary patch
delta 4082
zcmZu!4Oo;_7QS~781ZLN{N#6F#1T<J2qgJa7#;8%7!d>!1;c#YbQ98SP;50(pu|s7
zJ639Ln)#Eux*D2*7VP7;=4Sq_8KvvrvW1SeW>#3~x9|OC{MnxMd0yUo&OPVcbMHO(
zd}GxGUUh-5x}_`Fx%zgFZpOxjQM{1zwGHcZ`#t#gl;af`{Lkr(ITI|^odFd=cE#eW
z<mqLlt9ALwj<;y3*Kl4<&0hI@7WMS*&xcc-cMSi6rg_Km7m4uq3jGy-W%|L}#9yGk
z`YJw>-qcs>2F#{jUBBU-bhm4%&QwN|eTMNYTIut9o=A6nhVVHwpj#?$X_(gSO!ugQ
zo&IAP{^@{Hz#az#Fg8Blnt!==0`>Q6$!V(ZvvTTE_7hDFs2tj3Ib;0*4r9R;z*4s?
zSg$bV2Z(t;g<cAZ7};|fW9fiU2@a}btUn-R!83p|w=8%&u*)s)s-w{0P~-bc82cCy
zE`l?cGL{PnIhVEuh8Z_kF?JjfniJp&uqp+FTuN60V?xVbVr&B-G=k3q9<UU$M->eX
z3Xk5mkg*m(s04>BVr&o~WWhUt58Uzxv?yrch`JXUYXF3WVC4^ttpS8A_<Nw!EenoE
z)Fk%`NpvMB%=m02V~YUcA=qaDV|@T2_aS3&n6Z35V^x6A2<`zZf47G}O@c+{JjUh#
z!eTDi4^~FEhml?nPBCW8VQexWEChc6eC?LMrkla@d(5k6?DngSMZCdS8a*E}&^Yx4
z#ufm=M{t^hF&iLc8yyHa7(Is=s|JKd@KG^d<B|>Fy}$vte1O&&`-l3xhRgurA^0oc
zl3Tv?8m%{m8#k|l6Cg|k&t1*fd_c(aDKIoGy1It3e*r=x*t?doKtRZXXT8kWCP2uW
zs1_dQ9E=UFaA^d`0HfXVeQ-PQty})K;k!_S*W!Zbk$(bXC1B$VjIG7k3|@s$l}|zj
z2jHx?Br;|KkHUGEz(xkA;C4(HTfvFA%l2WYd~gCPWDV?7!P8L%RnV7#hoTf?F&+kf
zqKdH_@oX_m#9$uK9?#f9aLp3N-otnW*n!$F6MFDXU>Snm0smCZ7)u6lDzQLk5)uG=
zy#j_!ckn471miaFSv)g6;#>gVz^iSHLmcq%RWaBJcA1U~*o4EsFdU16^@PWRu`l@Q
z8rWbgDrRj%bVNU$u4e+}Mh5G8B~W=}xXzeBt3iPYbRaT`->3gXp5UeQ(V(k*L&H0R
z^?IJ)ursd0^T}%&%4J#k*{*!Ie1o}BWPjc<q_GPI*822&mg-+UtcHwMWxshZRI+l;
zrW{kH0Ln@nXy|NF)v*eTKVwr)s8SqNB}zPs-bgeB_it6zMm=M#&T<i<qO|(HuEJz7
z9L!*JI&nz!J$Posx61Wvv?XQbq$)K*r?koSc5|XCl|hgdyE#^s_R*lEfiy0uqVKOC
zL7Aej@R65%hGeSJm;a(lC+VxC&^~*$sauX-a(#h0R~Gr)r0&T9{%bIybXt?YH`KI>
z4Iq53D&<g0a=+Mu2Xl^YZha6mDZeaSq)M?E*;6_keYJo#<ug?(rxnS=dq!hIWR|XU
zs*;{gC;Ra&^zY=Qd<V@;G4;NDSUZ#EbS!35j;oSCtxt(CzxSA0+wCPNl+N1L1qLmc
zD*bqv+EX0etDtvlDrkCY5#LWArUv;X9a7ciSj4o}k2<Txoln<OgNGJFZ#d{@Y1E0$
zDcO2elA&^XUOOoi*lm$bIcsSYt{oRCenc`)q31?q1bo=6oi;X-E7u-#bZgF@GjoC}
z4W&;<Ebu$tgw=dqtKE^6PgTi>CXP&u-KRO#wpNCT6mgD;P&j*wBT5&VB2_AMnVetH
zMLFW6E3)6<HxNu#^m3iuY|2oM<J#lTxOeFBFo|?ky4Xaawt>_?Et_wq*=eTGFB{$E
zrDfoUFj(2)b}ggbX#ugtTI^nOU4hwTRZh5LBj4VbP;P0CGc+4qm@2i?4{7ssTMyEl
zv_RTp^9sFi@bM-3V!_9jSV=q6gNE9nloi(!kJA4{mHaTFv^hNw4bZVxcUIrf?er-;
zka8{lgKUUh+iF<04d<vz@sMPt#9S$-v>9s9EpRzKGCxt(j@N0GB|dNK2dervt2q*v
zsBdPtP3^q24fKYqD3!_}Z58F5Doxa)xr;Cyu3BiPXUloKInC)~>N6_sY2~)8d}&?2
z-~1jH%&7U%F{b)w?(k{Rp0{$;+0`|wA9K&9d~Or3P&t6QSGJfp!C`D|yTf2rj>^gx
zTFK4EoU`|}dbD=U4|dcqH+b<n=(Rqet^5y2N?V=PoGx~s1>@>(xuNC=0-_5zd=Ggb
z$GQ@8dc1ng6SH!?6*UO^Soi)tZHVxoVk}Jz$>L&Nhk_!LRcY`4ED_d<&~o*3vx!-i
zlXir&Hun=MSB*}msiTK_h+J2X_K%viAA6V>cT841TR+A!wXJykTGUg^KXG<FbjY1t
z?fJ?mIyE{_bG$J+B(w#N;y@&EjNL7Dsb*&v+-JJ8ix|@@d1*Aw8f=UZ2duYf4b<sn
zX~YJR2)ZU(K?BuWO}^_J+^3~Am9q`>p>-OMBvXcwzeXc7BK&s20FBVK)mPs~zNK{C
zYRs-ocQ-e!mJ?uQX%ZJ{udmUXv!y;SRIWazs#2aSf~(hU5D`2N4e9c*O22xaE@ebg
z`{WQZXGWrZjm<RjmuXh!K;LaJe$>)$?Q7VaIg)#|?L|gM=$#mUx;JJxKTHX7w%?pT
z|F%i&A(9jPieT*YeY_`}p!0IzpbgMJxYb7wN!!a`5X!Y<Jkkwhw9V5`*(0*PwuWY>
z1Wvwyd3S-KL{DG}uVJS48dPaECPkx@#fy1RLp`2`(f@t6r!b*(x_x(1&#duAU-9Mn
zx#N$oi_&jHNmO_@iaKznDxTA6QPwoRk1l5g@U?U|D^dJsAUi(Txm&C%`W}`}w={|V
ziz-#6tGlTxJ5+alH*Lxe(f#@-`Y1b^m(z{x1ze$L>?Zy!y<!jNV`!(noHtRx*lm0#
zwTvB-_{=VR6YIz65Jd!@Dgw_`rBbLZ$wwU~d)-1b(D-ARM+2>2VQ$5esx*VbbB6Ob
zX>!g;UPSA1!nu(S=gh|6sBwk5b33SJ+;gG#w~N!*Z{7qKx%S5guUh*~UfoW<xlx9K
z9S_eK{WFuYb4PO>t;{v?ezZ4ti0<ZgdV2Jjo)@;^UQ*q~Ifml$Qg}8!m$!uH(XBj_
zp$ZE<Y6WvCZ2V;IPcM!)@h9o6@ew^+;Qp|-<LKo0F@3IY)m)lIDT}!Hh|HkD`N8}U
zW#*fbpT)G&hWj?kN&zkz7ATUC$K%Z3B6g>Jkj$`ln*`FP{8ZhY{d6(^G#^BJ3!-#)
zHq*s|Nd9;7o-mRVWlo6UpVGVu3w0OYr8^TM_#O%_3^dlfE9&4VIwH=eV~-*(dWH7F
z#1EgmLW$3%8HGdAo_a@Bmz8KG7snGz%uhIa!%fQ)t+XQzj!uK7!Sg@a5d(SEqeyG%
zbYXz+(ao;tm$7+Oy0V$>7DjLznI;DM&&QP0Q&tw5ix7O6qpSA2p^kDVhVU{fpE#X+
z)0v58zMOu-_;*xNG*DN*k#0^(9#FT@b)@1Gu6eaWp>)>OnAbvsvqTTwO6^6-d_9Ft
z+M>I+k){+ya8J51DP=&vw_VPr2hK%M{Kk0%*(WFK;@&3Hq$#v}TnO>vXmqcb;&8r^
z#urENQM9-?A}R%*HLVrhnmqBERH+L@dC3umv}Ak$a-E-R$Bf@ICpt`Yx;T13)`rIu
mM;$JK0w0qa?E~gY{2A(BlFW<gsgh|8hf6{{8uU{;d;AwFTKYHu

delta 3904
zcmZWs3s_Xu7T)_PIsyWQgS-Yt91v5K1eK?N40=XJKm<i0HS(r?W!G|0G!#s*;7F;<
zO4HBs5!uVI0Y$W&d-IlFU+FD1;dawoSCTC4VW{P~|2}gxD!%WZf3LOIT6>?h*ItKH
z)y}Kh`I@UzV8hz)b0q&&&T)Jy=kuH!rKTSI66N#?3OO~0vCdH$E4u>Ag6&F%pEB7X
zD}AhWCp(^_r+SUyi>bBO6rM&ty$A6DG_v;yew0dk$MPH^{5I1e{D#s`z0G_A1sJOM
zJ@lfXT)OcX_3LwqAEO(6W=TIjLNh$$c^EzC`7rmU8=gb?9E$Wx;ZA3%*J<xzfeiyD
zG5kruEWkbz2xKgOign7msg(oXPMkY#_mQJ3HhKDo(ConS;TLKd`w8GM7Hq3yY$_mR
z!R^2$UA|OD%Y&oFUVNId{?E8g1b++stjmIv5hh&^DfmgCQkN@hDJ&$+v}y%o8v(J3
z;NYhivj9T2(5pe=rbShZy#ff$Ht-Nw#Q{Q&qYFVJ!qS&Bwg3<s!S4WPE8X(hN*W#<
z5wpC4v2}nj5&RwSi!KYUSjJc_Am(dnS@7W0hn6z70T3F&PdthJ140&j258e|!2yU8
ztVax{3&G*0ndOW<4hRpyw*kWvw`?F&NVw^N#f&)sVWBZBymSvQnhuMkMU2e>gvCSP
z-mvbcd-S8{Ly}GL3mD4<goWT^K$|YN(Up+JeJ9p4_TjUPU4Nc2e|kK0u&H1nWAg#w
zBRI~%SSldoRB8_08)GHLrU61DcoXocF8>!?y&ic2#C$DnGz|*-d@W<w0HG1QYaL@w
zK*-K@^pYvUv}g^C0nG_K9%k9POEv|CrNvCEW^6AYECja!S9Do$+A1Up5c3YIfyY0w
z?XWVpM(`kDj4po<J_lUX<%`a1VZOa8ZI3h7IEt}6aKD8(U5o?4)d*ESnz7YjZ{&JM
z0;(H48u>1PO$vAfPRERK0(cnC^2>O};=w~uA?slu3(iCpR6%bS)qqlr#n=G$sABA!
zI9AELF_;K^8HY`Pi&ikU6XV%n8MXhY(1ZU5JcFQz!ADmz#*!HO1l$vu=t{&U!RL{U
z1lW85-ht~Fit$_Eow#NO#AyV(6vkR`{SSk^){MX+c*_1b00)xaJ_gk<7-zK^<1fK`
z*24y4Q8DwJF;N30>GOEXiw==4#MAuf2<b{Ztp$A@PtDPZ`~-a$eS(jm_lI2Mk2<&B
zYcTLZ&NoJuc?`XfrF6*3O}lcfZnLEYPf*?FFe^=#Mhs=;Oh!vj3~b5~)i{U>69z~2
zaH;Afg~gq=DJN88DkSAxjm!6$t(v{v5-TenV`yuFIb=BIS`2u$&iNTDf9+8=YvpaJ
z%$(u7x2J{L6NbhZFrO9YlIz!N>&nVW)p+Qjh$q+EEeWb|F$7sbNY!|N;u8l`Nundb
zAe705GEaHMaV%MtUUy41w$c9*!(tA+FQ%?K`pNYLmONSP?*>#Ed-(Ng%NH=_vU1#E
zNv}Jr8egINl8k%?O-LFTI~ztymo@1JhnHA6Pc=qClYFaUnQBbI$e!Hc2+(5Ml;f&#
z32jIk6Oo7svAJ}mOEva~kl;?=-58B@E$Jyk^8r=u^!WN`>Q~}V&nEY}=Nl-Hzt(i@
z$EF+;X>CZ3vNUy5YnkYTLg}h;E%DV>QH|1jbT!%Gy&8I5vw{|+6ji$3P}Qmf78l|%
z$MjYtoLQB>YcaC+t7>bkP}Gn6L|benG&ZHg;wRU%IU-yA+;cz5%2Cxg7jwRQ{WDr5
zXk{hapc)IH!tPHB1u|1)Q$ERP5dk|c?@-k>VjnaibtGPaOH;G>5ptyl@FY5$y2St7
zJ}mva@B#GT*aXXat?q&;4;RizwH1oadqj5Ag{DX~meRqo;d~qYXKb*quV$`4@8x|o
z(KeVyq-FD6^kka(p|4u>TGaL*jwNec<qqAt9HK00$!d}1TB{}YL#rhk&((LXHqlS6
zEwGra$_bQU+-WU97$%gf+Hj#}gVR-wSBa-Dl6LQ<inJhcf{7h_yRRC7J#<@j6GXYj
z<%kpc!n&y5JL?wFsq{c&I1H3?ogVumCFat%`UBlgzds|=9oJT$X;!{(<;b$FHuJD*
zEQDU%um)&UV;UqGCs-~gpYyFo+ri27%|EQF9b0L0MjYQwA7=!Q4uh4bp7LOA3FVAx
zd{A@L3wHP(JxZs?!8Tk`?V(SRd0ZOZ${i#%G?O_m*uSn>oXyuyV=o6q8<3SIa*Ycy
zH9@cS0L|@NNXj{6I9=@0N;P@m12|kn=JUE|-lLR;Wtx4D{LcOW6=$0GGFp;3oJLO$
z_O5Qino~v|K^ysuj%S9_mCPVoI=MduTfL<ACfYPPgU;p#&<bm)Ur@IOg`4yRwOY-7
zA362SX_u8Z(Pe8XFQiFXCVr3}$%^th2LsdvicMCH`|0JZSYApWXN3%0?w)YBfFtjU
z(%(O{=iO84?IiE<(OBF>dE=w`$FyX;iN8xPjvwrI8pgjh#n5-1C&rKEQqSGwBj@uD
zdO*(h-~7%WFT{B|D36M%Zp1o%-Ru7*G&s3gf2v%M!!*zq>~jT?-1|p$9wwV@5w9he
z%{;>ZNBvmPN^kDc!pzfaY!kfxT$A-Mk`?z|$Wo5!cL7EB3nr8<-S;ddP0Tl?h~9j&
z<H+;qh*-bIRo1&@zi96%ipLsyePSv9H+g3V@<SAvoxmTYnb~n614Ml7ZX>Jd8T&+Q
z!6K^BXBWMd9VP|rqGQ>iQuNz&IXi}Lq(J+Uh`n!$JvCX<MGe(lcLeMgwP#g6kd=RF
zP5lLO+9UWvI%A*Dzas0T27ZP*Ck+i;2gj`XTuFPW6j)}9$DOAd6&jus&WUnz#_$hl
zRnAymP5;P=;5O>W`73^la;Hkt8`PNlm~`(>QTLM1PD;re=3Djp-F%`wK0%A~GWl@Y
zpJ(Qis6B6}6tt6;X2yuB^)bALQ%uooY9Y;>oQw~MmnN@3VTb0Mec!_LZx?0@W#`Y}
znbeSPM&*5!ALY~8aOX%-k~8U6{)EZ^sNmA-zIR$<q*sL%O5-noE{#i=lNEz#IOdFf
z!U<Vu6`vMjQ|PlV+;KL^N&z|(v?w3B`@-AN({<}SFD;&ClSRj-q)6sw@+>%oi_~5)
zOfqjL&%$Vao#G0|;#NITID-F7+X^cr&mCl*8dZ3HJ0hVY$a3-rWnpN5qxim;P%5gi
z5i@q>Bb)Lmj<Vyt0=xRv+CLk36>JmIdi`II)fRl7Fx9vPT6=PZWdSWOH1|Yd*U`bL
zVdh8R+Ubi>=m9q6WJfXNHNV9=M88fA^!q`JxLSMptH!?DDRNpAFC+W3paI)4)#)KC
z6_%oe5=*?JkM_oFriy8yd;@KqHiyU2?P(UihXxhRk=AadYty4ppp8Yzk<Bl=k4C)S
zG_P-<P`YZXEgPW0`QQ*wk>B(r{vl;g-yscoML0|MZK2&oNs*JbxV_DHysM%3gZIN!
zJ|jt*xrOZ0@2AglLn)>>hQCk6#S!=lU0ytlKSpmBNBPZ#XSJ)$YoCXf+gQ3#9K!AN
xYjI5EqRrj+i1K|K3Uuje%g(!dTt~SjN&IQ5D=BqeEeY&F<{q(5!|blU{|5tsu^|8e

diff --git a/2.x/trunk/KProcessHacker/bin/i386/kprocesshacker.sys b/2.x/trunk/KProcessHacker/bin/i386/kprocesshacker.sys
index 556394bf8be878e7c6db9254c92d29ccd0c15e50..6affb212da9431cd9c6bae672e70269286e2216e 100644
GIT binary patch
delta 2589
zcmZux3s6+o89x8=*qsDr0T)*R#USd6gZHtIyZ7z`Fd)h!3mO8A;-gB}HDgp*M_UyX
zjSsZdo|+k}(b`na_>A6)j~GMoh4o33P_zb3Vim=tLsB74mD~U5S{)~M=G*T(-~XTg
zod4Xjx26ednqXb4Zqlyx*9vtj{-O?t0RZ{x7~L&h?4evjI^M4B2@jTN!6=Pu&!^sq
z_>rSWqdmH|Cn}iE?AZowb~pxK%|V-EcHigi7`iM%gfHolh+=4=FGnUpJGDfnz&%=k
zzkj83@b~w01O5i+(a0oS@7HK+WDri%Lj90Lsg#hrsXdxj+hd4cZb0$4G+VBcuG9C|
zMfvC+eZRyn#$(=Rk3xBeQT#tImwu^FhI3SB_<7>lv6yCkn%4LEv<$k$V1dbWw_z+i
zQo9U=20Rm*6H{TVTbY*7`nQSM`<9-3XZ7`Zzj{2z2r-FyK!zjOmhzCx=ohhlvzrQl
zv>=%KPvpBHP4M{uJ;p4yzYxgB2&OAu15$-x+Krq?opA}%m->KE1ar+LKr9HR=e-VO
z1%l}%<AMAZ!Svp7Ku#c-9)v7}G%W`5Cj|4qF9H%C(sQxiJbE-PL2g5JKUBT;4It|g
zESv4MDa34CSPEnUg6Wya3rcBQY<%@al>Z3X6Uu-D5I;42`J31fg2lE^0HPw89)(;K
z(%&I>g*03K&lqRS@(L&7@(89&%7IKnppMcmp?MvF54{m<l4nf<vJk-%_e=(I48b%@
zI2B?x9zF$#gkbtG^64p$`!P)gl7e9NM&z9#&89zp9OI`0nTlX}<rP5QLNFbNJSe1h
zBkvFC7w11j|D|6%nG@y*5`)0`ky;g+OX)^aLel;jcuNqh><`G1fhRg=CXn&8*_045
z@NFQOw9}LjTRj`dS_I2A&H>VA4jm95Ke`U(Mg+4H=K@JaF#Y0gzDB<@6th+W$wIKa
zgUI!jpvIIghlA$DI=D}(`yYfWR7kj@3$LQ#i7Q|oU6Xhfs%S;hU0A332ABY>YQ;bY
zSfYYJ+Am=l|5sH&-oM4+@Dny{WW#ng{E!X*pq@#-5*C*#Hq<UMhDHCbA-DEsSjMV}
z4}Em=;79sR=QXX-Ow?_uGXQR@FAog^)6jG1C6f#62}piJ3R{V$3{&9<{rj-3=1<OI
zyw8((o%VX&{gS$%p`<;N{@OAan@}xTa9HiKltNt115Hy-Rypc=nQ=pFt>7P_PD$IN
z)BX1pjZQCtYFd$g9B$K;kq%g`zBzI*K#<mOePDvRfzyL&BX-ni4DH11Z)ZEnpa=Mt
z_<bjyMJ@#T_>F@xG@iaEv_b=&C!T{&nqloqI`)yK)htRRRb_SAQMpwSf$-9fFtH({
zcKSo&qdB&$V!VPR&@-uSqEYNBS(|;!rv($Y<tGEtIQ%jjG*d3>RoO=6O!OK%=CV4`
z%QoXn4(Q6$&Q$e2n{5muq(SVu+lJ=a>?nH8HbQUk1qR`FlJ>HjBMhs;I{MQ~qvC0X
zJvJ>$Gxfoef$;K<H-v_|UhGvVm#Xwy@Rruxp~rF`VL4~exX?!D+voDmW7w%VbOs~*
z^I4-ekFvJRq$>9(+ERNvsv&jNkr!T)7Bp@<{<tsPSAbw|?KxDHY`V6?^qw>rPN~t(
zEzmbm|7^Jnfkb~RThCZe-{may8~Jqn^h3`M9?zYmVmRs$-6D9Y-nF)0Eq+&?zOg5F
z!%uijsZjU2M(cEK2dHH8sX5*vh_Au>`LwYM0khxFN)1u>W}F1rN#|shz&o@ls~q;I
zLr3A|Y@zF4t$@q4Fgt<9Wy`PtRT^xezsy!)ikhDDBjCW2J0DWjKjs#I?#>6ab4(mu
zq7h@eO$j@mtrdv!ClA4;8fi>kw<&u2a}l#YmqqGnQvOx^BX;NSgazu>0+&vW@cqVE
zeLy}fH_Knk8OlOsweqgARryir=aO7yu9>bCu8ppXu2xsOE5<Fm^WA0cO7}~iIFH3M
z&NJE5%lnFVtM`icp_ljwxsMkmjVt0NaI?65TqGaIC-XMGn4iYK#V_Dj@;mr?eyA{3
zC=+G~t->9lTc{A{iz}<eFzX1bV$HLDX#L#!oi*OJ%XZv$+16(J);7+*$$rFs#y-fw
zIoyr{$3%zUaoF*x<BsEdN4R8^21r9CPI_Nzkp3e@IAfiIoFko?&JE7J&X1kvoh{C9
zoDs4~PLb2)9JyTHEgz9j%D3f*a&M)dVo}_RU#VBB8<lRQw`-Vdmg`rpPhEZ8S?<N|
zI=AMI^Q3#6p5>kmo^753o{JvQTjbs1-R;FTClk_&beX%uh4Zm|fUo42@ay@_d<Sn3
zGKB)+XTo%$QdlfB3++ObsEE1ZI58-05x0xy#1`?M_&_vSU$NS)nby_SR=usC&0$++
zTW>pKyJq{r=CO~ludz4V|79QMusU`)jygVb+;CW>OsPnkCe4$UNUJ3(9h1&V%~HG6
zDQQwK=Rl|A%yTYvy5uSHV);G!fP74DlCR6(%A1rE%6aAAO0jF8+vi^3zUhA8j`7$%
zQ$0b?CeK%%>~2qwr@%YIyU4rQOJ)<|!p`)Zg)8Rfa`oIv?kd;G+4ypPG2h5v#tt9x
bnZg`lov=%|BHR#)#By<-xJLbaY8w0xDkU(3

delta 2454
zcmZuv3sh9s6}@K!W<pQ_of#57qTmN~$@|RA`_0U=HV7gJDk8OhkW?I}u>yj%Rg1<F
z>p~;RO;QsRtwmG}S&cqT@Du+LQDUR@AGJnZ5sOLGEEQal>A7Z%uCBhd_S^gHbMCq4
z-uD(Afkj84_MB;1{TmlXn+`V_sgMBB&lqXCZi;TmB&2=zlCF@-f<R?NfNL8@^-x=y
zmVtK0lCFr#q0BC|1WH3NDUU##W48TSJCy!8RD{#CDRe9}(&xkC;V4ZBOM=TZ2j73A
zW%w?oZ{vFy-4PaVx;~no3#)|HbhLRuT#rIRZuajA1eSDJdRALdJZ{al8%b-;FPg6A
z(nj+OaYjDYoq80k`xM2`bqVxqb0VyzCd<olA7o*f<4KwQ*)khlY)OH9`k^HY?ilwi
zqb+zRbVO81WX2B-uPc8j&wZnt@7ktEYtI_Hqaq=y=O`fY2sV-zIh$UJwx{pT0df?<
z-1Eqnf|}s72|dOvS2r5S76j81bAk8}O!LS(ReHrvpPL6{DT28X1-KW2Y5#a2^ASu}
z<^y>R!SuRuK(->7wjvJ*>ZN0WtU@sV#uy+S2&PN0pP%mN6|0^^btTyS_Y;6rBUlBS
z^+=FeJiHJ{9)jtq$g>LR<!D>gew6<V+IhbMG6nJfmcR0AAb&)#+|o%v-bOH;iYy29
zDdclO&9>i$dB&_RX)+KV!SvuMKokV(h(H~hTM+ore@9!@m!<+4i(rMX76GY6FwF`M
z1^ID24M-0J(<_iyPkVfxc9fk#dv-C9g@`B1pS_OM={Prn<s2nIh9j81iQa>tzZkvh
zpwG5{cKu28uLN`FX8^f@!1ZB)EEI+GU2AN7^-LfX!P*{2z8KVTzXg&?Pgr9^@BI#l
zo!+s=MvpHA@-l+eeuMm<Qkr11WlSprG8@6{yU6#0`hTa{Q4XXT!Ro^20Es~`{TJlr
zbHIoytcI;Ie=@-VTJ_>q*g%EYFHINb(2%&LP(qi-orf%15`Pm)jJyOZK)6xTM}m~A
z6+qgKV;f%+s=DhOhI?7KiiK?~{FsGvjl+pwb_<JHHu*<?2yIAyWZ85q5I7J+T8)qT
z&jh$@*avn4tJs2OB57rhU-ns&aQy|EHpqZO^xB}cF~^!Q-}|S0O<;V@t%90LOF>%>
zeJ>>$I_Tb%;c(C}r4~Z3<@W*s?O=se(>(@<Sm6Ml$(S{`(PT1zPGg4_Kn*P)x*P7&
zv@{9cF=nJCgKhBvY##Sh^HzVNZy(#;XRPDQV6DeP9f%AL7UOGUsciZgf5x_R&(ln+
zzqc<k8B;~HK{yAk^i{D19?@*aebeDxG*Qok$+S%G^+I+ckO1c=fl5ojnu)=(^vLRc
zJ(u(JxHG|g9zWfRbPN5#IV3zH&)@fP)gs!dkL=?QnbJO1*jLk?-E4JBg*i}pJ#eDk
z+?*b{i;#Wv9anksgq=7LUhLyL9O9eD=IPoI2rOC{Ln^c-(|;uX5JQowz_P6gEAckz
zUO66qLodlrlckCFR+8a6Ls8a%?X6Fqwrcgq`OdLkD*aad-nw%8(_`bQNq@|^=pF3~
z_=xUx+o9Gt>&`HlEL)94eI3{~<6rP(s8)ZB&&TTXjI+ZI0-T_$hZn#kdUyB~IAe_Y
zCH@YLbk|EI&`JBHkB2%sFMTi^q3hEPs4)shJOm8JWzK_Kqct-JY*7u^`sdFU;p<?n
zJ7`+g16%rrr@Q(ie2D`vbE}?mSu1GEsF_x!{+V=)FO#LO(2VT!@R0V+*$8z;OOD$_
zZ<|t$(7ctARqNFz^^kf-6}8#gLT#D$ruLoI-95ye<DTlC?_S~F?{0NpbccF|dWLy&
zJTp999<w*zo8is(f^O5Pen`KqlRQFh;Ro)+rE_^)G52@wA!p`$^C|oYzK}2CXYmX8
z_xR0xtl$-Lgvmmy@RiUmOcY-c7gUK4#6(A$LwBrqv^c(Tgge(bKXx8;o^)PyX1G?m
z8eKbGRw-HHrC&&6q)F0;QnU1xbVKTpLgZ*UR!)}xDsPj&l{@7y#i}GJPGy<0PT8XD
zRgNlOE1k-7s$K1;s_IyEt=g!5s$NiUt0t|x7O(MIuJ*oG)u3J0?rA;U<K4yX?e0#u
z-80Tp<T>SO^K|p}@J{sly>q><dF#B-=>zo&eX)+mEF$D0Qa$$>cY$l;hVdi$3H%Jc
zoZru1=Iug~zzLc#QpguJ3VVdBLX?;wrii1&3UR);R%{gaiO0ltu|te-*d0Yxj!Ta3
z9o?N1oim*8<H?UZd%OC$id`FBpS!wT;nD(WrL<YvE``f>d7!My+42OrNS-Oz${)xZ
z<vnt<d|JLH-;;YNeU(BbT9wp%b&k4JtyR~kTk*q|X>V!kw4>S}_dWLjPp;<^&oR#p
zPlQ+Yj`Egyo4n~?cu#qgbX^~(m+P1GfKEyYk@0kcxJ+(2_b&Gju9<tDckucAD!v|1
c_%A$RhEO6b5;h3ig@K|&%odA{)5U|~zj`zQdjJ3c

diff --git a/2.x/trunk/KProcessHacker/dynimp.c b/2.x/trunk/KProcessHacker/dynimp.c
index 4daaffe93..8d18f394c 100644
--- a/2.x/trunk/KProcessHacker/dynimp.c
+++ b/2.x/trunk/KProcessHacker/dynimp.c
@@ -42,6 +42,11 @@ VOID KphDynamicImport(
     PsIsProtectedProcess_I = KphGetSystemRoutineAddress(L"PsIsProtectedProcess");
     PsResumeProcess_I = KphGetSystemRoutineAddress(L"PsResumeProcess");
     PsSuspendProcess_I = KphGetSystemRoutineAddress(L"PsSuspendProcess");
+
+    dprintf("ObGetObjectType: 0x%Ix\n", ObGetObjectType_I);
+    dprintf("PsIsProtectedProcess: 0x%Ix\n", PsIsProtectedProcess_I);
+    dprintf("PsResumeProcess: 0x%Ix\n", PsResumeProcess_I);
+    dprintf("PsSuspendProcess: 0x%Ix\n", PsSuspendProcess_I);
 }
 
 /**
diff --git a/2.x/trunk/KProcessHacker/object.c b/2.x/trunk/KProcessHacker/object.c
index 55386f939..183147eae 100644
--- a/2.x/trunk/KProcessHacker/object.c
+++ b/2.x/trunk/KProcessHacker/object.c
@@ -1021,9 +1021,21 @@ NTSTATUS KpiSetInformationObject(
 
     if (AccessMode != KernelMode)
     {
+        ULONG alignment;
+
+        switch (ObjectInformationClass)
+        {
+        case KphObjectHandleFlagInformation:
+            alignment = sizeof(BOOLEAN);
+            break;
+        default:
+            alignment = sizeof(ULONG);
+            break;
+        }
+
         __try
         {
-            ProbeForRead(ObjectInformation, ObjectInformationLength, sizeof(ULONG));
+            ProbeForRead(ObjectInformation, ObjectInformationLength, alignment);
         }
         __except (EXCEPTION_EXECUTE_HANDLER)
         {
diff --git a/2.x/trunk/KProcessHacker/process.c b/2.x/trunk/KProcessHacker/process.c
index 4f1540ac5..1de7bcecd 100644
--- a/2.x/trunk/KProcessHacker/process.c
+++ b/2.x/trunk/KProcessHacker/process.c
@@ -515,9 +515,21 @@ NTSTATUS KpiQueryInformationProcess(
 
     if (AccessMode != KernelMode)
     {
+        ULONG alignment;
+
+        switch (ProcessInformationClass)
+        {
+        case KphProcessProtectionInformation:
+            alignment = sizeof(KPH_PROCESS_PROTECTION_INFORMATION);
+            break;
+        default:
+            alignment = sizeof(ULONG);
+            break;
+        }
+
         __try
         {
-            ProbeForWrite(ProcessInformation, ProcessInformationLength, sizeof(ULONG));
+            ProbeForWrite(ProcessInformation, ProcessInformationLength, alignment);
 
             if (ReturnLength)
                 ProbeForWrite(ReturnLength, sizeof(ULONG), sizeof(ULONG));
@@ -561,21 +573,24 @@ NTSTATUS KpiQueryInformationProcess(
                 status = STATUS_NOT_SUPPORTED;
             }
 
-            if (ProcessInformationLength == sizeof(KPH_PROCESS_PROTECTION_INFORMATION))
+            if (NT_SUCCESS(status))
             {
-                __try
+                if (ProcessInformationLength == sizeof(KPH_PROCESS_PROTECTION_INFORMATION))
                 {
-                    ((PKPH_PROCESS_PROTECTION_INFORMATION)ProcessInformation)->IsProtectedProcess = protectedProcess;
+                    __try
+                    {
+                        ((PKPH_PROCESS_PROTECTION_INFORMATION)ProcessInformation)->IsProtectedProcess = protectedProcess;
+                    }
+                    __except (EXCEPTION_EXECUTE_HANDLER)
+                    {
+                        status = GetExceptionCode();
+                    }
                 }
-                __except (EXCEPTION_EXECUTE_HANDLER)
+                else
                 {
-                    status = GetExceptionCode();
+                    status = STATUS_INFO_LENGTH_MISMATCH;
                 }
             }
-            else
-            {
-                status = STATUS_INFO_LENGTH_MISMATCH;
-            }
 
             returnLength = sizeof(KPH_PROCESS_PROTECTION_INFORMATION);
         }
@@ -679,9 +694,21 @@ NTSTATUS KpiSetInformationProcess(
 
     if (AccessMode != KernelMode)
     {
+        ULONG alignment;
+
+        switch (ProcessInformationClass)
+        {
+        case KphProcessProtectionInformation:
+            alignment = sizeof(KPH_PROCESS_PROTECTION_INFORMATION);
+            break;
+        default:
+            alignment = sizeof(ULONG);
+            break;
+        }
+
         __try
         {
-            ProbeForRead(ProcessInformation, ProcessInformationLength, sizeof(ULONG));
+            ProbeForRead(ProcessInformation, ProcessInformationLength, alignment);
         }
         __except (EXCEPTION_EXECUTE_HANDLER)
         {