admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

* started NProcessHacker

Browse Source 
* renamed the ordinal shell32.dll import to RunFileDlg
* modified tooltips and verify info to work with Re-analyze even if "Verify signatures and perform additional checks" is disabled

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1062 21ef857c-d57f-4fe0-8362-d861dc6d29cd
This commit is contained in:
wj32
2009-04-15 07:27:24 +00:00
parent 5315a08bb2
commit 61d3cbec2d
14 changed files with 563 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
trunk/NProcessHacker/NProcessHacker.vcproj
+28 -1
View File
@@ -40,11 +40,13 @@
<Tool
Name="VCCLCompilerTool"
Optimization="0"
PreprocessorDefinitions="NPH_EXPORTS;DEBUG"
MinimalRebuild="true"
BasicRuntimeChecks="3"
RuntimeLibrary="3"
WarningLevel="3"
DebugInformationFormat="4"
CompileAs="1"
/>
<Tool
Name="VCManagedResourceCompilerTool"
@@ -57,6 +59,7 @@
/>
<Tool
Name="VCLinkerTool"
AdditionalDependencies="wintrust.lib"
GenerateDebugInformation="true"
TargetMachine="1"
/>
@@ -87,7 +90,7 @@
OutputDirectory="$(SolutionDir)$(ConfigurationName)"
IntermediateDirectory="$(ConfigurationName)"
ConfigurationType="2"
CharacterSet="2"
CharacterSet="1"
WholeProgramOptimization="1"
>
<Tool
@@ -109,10 +112,13 @@
Name="VCCLCompilerTool"
Optimization="2"
EnableIntrinsicFunctions="true"
FavorSizeOrSpeed="0"
PreprocessorDefinitions="NPH_EXPORTS"
RuntimeLibrary="2"
EnableFunctionLevelLinking="true"
WarningLevel="3"
DebugInformationFormat="3"
CompileAs="1"
/>
<Tool
Name="VCManagedResourceCompilerTool"
@@ -125,6 +131,7 @@
/>
<Tool
Name="VCLinkerTool"
AdditionalDependencies="wintrust.lib"
GenerateDebugInformation="true"
OptimizeReferences="2"
EnableCOMDATFolding="2"
@@ -161,18 +168,38 @@
Filter="cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx"
UniqueIdentifier="{4FC737F1-C7A5-4376-A066-2A32D752A2FF}"
>
<File
RelativePath=".\nph.c"
>
</File>
<File
RelativePath=".\verify.c"
>
</File>
</Filter>
<Filter
Name="Header Files"
Filter="h;hpp;hxx;hm;inl;inc;xsd"
UniqueIdentifier="{93995380-89BD-4b04-88EB-625FBE52EBFB}"
>
<File
RelativePath=".\nph.h"
>
</File>
<File
RelativePath=".\verify.h"
>
</File>
</Filter>
<Filter
Name="Resource Files"
Filter="rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav"
UniqueIdentifier="{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}"
>
<File
RelativePath=".\resource.rc"
>
</File>
</Filter>
</Files>
<Globals>
trunk/NProcessHacker/nph.c
+72
View File
@@ -0,0 +1,72 @@
/*
* Process Hacker Library -
* common code
*
* Copyright (C) 2009 wj32
*
* This file is part of Process Hacker.
*
* Process Hacker is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Process Hacker is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.
*/
#include "nph.h"
#include "verify.h"
NPHAPI PVOID PhAlloc(SIZE_T Size)
{
PVOID memory;
if (!(memory = malloc(Size)))
RaiseException(EXCEPTION_NO_MEMORY, 0, 0, NULL);
return memory;
}
NPHAPI PVOID PhRealloc(PVOID Memory, SIZE_T Size)
{
PVOID memory;
if (!(memory = realloc(Memory, Size)))
RaiseException(EXCEPTION_NO_MEMORY, 0, 0, NULL);
return memory;
}
NPHAPI VOID PhFree(PVOID Memory)
{
free(Memory);
}
PVOID PhGetProcAddress(PWSTR LibraryName, PSTR ProcName)
{
return GetProcAddress(GetModuleHandle(LibraryName), ProcName);
}
BOOL WINAPI DllMain(
HINSTANCE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved
)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
PhvInit();
break;
default:
break;
}
return TRUE;
}
trunk/NProcessHacker/nph.h
+49
View File
@@ -0,0 +1,49 @@
/*
* Process Hacker Library -
* main header file
*
* Copyright (C) 2009 wj32
*
* This file is part of Process Hacker.
*
* Process Hacker is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Process Hacker is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.
*/
#ifndef _NPH_H
#define _NPH_H
#include <ntstatus.h>
#define WIN32_LEAN_AND_MEAN
#define WIN32_NO_STATUS /* Need ntstatus.h instead */
#include <windows.h>
#include <stdlib.h>
#define NTSTATUS LONG
#define NT_SUCCESS(x) ((x) >= STATUS_SUCCESS)
#ifdef NPH_EXPORTS
#define NPHAPI __declspec(dllexport)
#else
#define NPHAPI __declspec(dllimport)
#endif
#define EXCEPTION_NO_MEMORY STATUS_NO_MEMORY
NPHAPI PVOID PhAlloc(SIZE_T Size);
NPHAPI PVOID PhRealloc(PVOID Memory, SIZE_T Size);
NPHAPI VOID PhFree(PVOID Memory);
PVOID PhGetProcAddress(PWSTR LibraryName, PSTR ProcName);
#endif
trunk/NProcessHacker/resource.rc
+50
View File
@@ -0,0 +1,50 @@
#include <windows.h>
#define VER_FILEVERSION 1,3,6,6
#define VER_FILEVERSION_STR "1.3.6.6\0"
#define VER_PRODUCTVERSION 1,3,6,6
#define VER_PRODUCTVERSION_STR "1.3.6.6\0"
#ifndef DEBUG
#define VER_DEBUG 0
#else
#define VER_DEBUG VS_FF_DEBUG
#endif
#define VER_PRIVATEBUILD 0
#define VER_PRERELEASE 0
#define VER_COMPANYNAME_STR "wj32\0"
#define VER_FILEDESCRIPTION_STR "Process Hacker Library\0"
#define VER_LEGALCOPYRIGHT_STR "Copyright (c) 2009 wj32. Licensed under the GNU GPL, v3.\0"
#define VER_ORIGINALFILENAME_STR "NProcessHacker.dll\0"
#define VER_PRODUCTNAME_STR "Process Hacker\0"
VS_VERSION_INFO VERSIONINFO
FILEVERSION VER_FILEVERSION
PRODUCTVERSION VER_PRODUCTVERSION
FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
FILEFLAGS (VER_PRIVATEBUILD | VER_PRERELEASE | VER_DEBUG)
FILEOS VOS__WINDOWS32
FILETYPE VFT_DLL
FILESUBTYPE VFT2_UNKNOWN
BEGIN
BLOCK "StringFileInfo"
BEGIN
BLOCK "040904E4"
BEGIN
VALUE "CompanyName", VER_COMPANYNAME_STR
VALUE "FileDescription", VER_FILEDESCRIPTION_STR
VALUE "FileVersion", VER_FILEVERSION_STR
VALUE "LegalCopyright", VER_LEGALCOPYRIGHT_STR
VALUE "OriginalFilename", VER_ORIGINALFILENAME_STR
VALUE "ProductName", VER_PRODUCTNAME_STR
VALUE "ProductVersion", VER_PRODUCTVERSION_STR
END
END
BLOCK "VarFileInfo"
BEGIN
VALUE "Translation", 0x409, 1252
END
END
trunk/NProcessHacker/verify.c
+194
View File
@@ -0,0 +1,194 @@
/*
* Process Hacker Library
*
* Copyright (C) 2009 wj32
*
* This file is part of Process Hacker.
*
* Process Hacker is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Process Hacker is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.
*/
#include "verify.h"
_CryptCATAdminCalcHashFromFileHandle CryptCATAdminCalcHashFromFileHandle;
_CryptCATAdminAcquireContext CryptCATAdminAcquireContext;
_CryptCATAdminEnumCatalogFromHash CryptCATAdminEnumCatalogFromHash;
_CryptCATCatalogInfoFromContext CryptCATCatalogInfoFromContext;
_CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseCatalogContext;
_CryptCATAdminReleaseContext CryptCATAdminReleaseContext;
VOID PhvInit()
{
LoadLibrary(L"wintrust.dll");
CryptCATAdminCalcHashFromFileHandle =
PhGetProcAddress(L"wintrust.dll", "CryptCATAdminCalcHashFromFileHandle");
CryptCATAdminAcquireContext =
PhGetProcAddress(L"wintrust.dll", "CryptCATAdminAcquireContext");
CryptCATAdminEnumCatalogFromHash =
PhGetProcAddress(L"wintrust.dll", "CryptCATAdminEnumCatalogFromHash");
CryptCATCatalogInfoFromContext =
PhGetProcAddress(L"wintrust.dll", "CryptCATCatalogInfoFromContext");
CryptCATAdminReleaseCatalogContext =
PhGetProcAddress(L"wintrust.dll", "CryptCATAdminReleaseCatalogContext");
CryptCATAdminReleaseContext =
PhGetProcAddress(L"wintrust.dll", "CryptCATAdminReleaseContext");
}
VERIFY_RESULT PhvStatusToVerifyResult(LONG Status)
{
switch (Status)
{
case 0:
return VrTrusted;
case TRUST_E_NOSIGNATURE:
return VrNoSignature;
case CERT_E_EXPIRED:
return VrExpired;
case CERT_E_REVOKED:
return VrRevoked;
case TRUST_E_EXPLICIT_DISTRUST:
return VrDistrust;
case CRYPT_E_SECURITY_SETTINGS:
return VrSecuritySettings;
default:
return VrSecuritySettings;
}
}
VERIFY_RESULT PhvVerifyFileBasic(PWSTR FileName)
{
WINTRUST_DATA trustData = { 0 };
WINTRUST_FILE_INFO fileInfo = { 0 };
GUID actionGenericVerifyV2 = WINTRUST_ACTION_GENERIC_VERIFY_V2;
fileInfo.cbStruct = sizeof(fileInfo);
fileInfo.pcwszFilePath = FileName;
trustData.cbStruct = sizeof(trustData);
trustData.dwUIChoice = WTD_UI_NONE;
trustData.dwProvFlags = WTD_SAFER_FLAG;
trustData.dwUnionChoice = WTD_CHOICE_FILE;
trustData.pFile = &fileInfo;
return PhvStatusToVerifyResult(WinVerifyTrust(NULL, &actionGenericVerifyV2, &trustData));
}
VERIFY_RESULT PhvVerifyFileCat(PWSTR FileName)
{
LONG status = TRUST_E_NOSIGNATURE;
WINTRUST_DATA trustData = { 0 };
WINTRUST_CATALOG_INFO catalogInfo = { 0 };
GUID driverActionVerify = DRIVER_ACTION_VERIFY;
HANDLE fileHandle;
PBYTE fileHash = NULL;
ULONG fileHashLength;
PWSTR fileHashTag = NULL;
HANDLE catAdminHandle = NULL;
HANDLE catInfoHandle = NULL;
ULONG i;
fileHandle = CreateFile(
FileName,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
OPEN_EXISTING,
FILE_ATTRIBUTE_NORMAL,
NULL
);
if (fileHandle == INVALID_HANDLE_VALUE)
return VrNoSignature;
fileHashLength = 256;
fileHash = (PBYTE)PhAlloc(fileHashLength);
if (!CryptCATAdminCalcHashFromFileHandle(fileHandle, &fileHashLength, fileHash, 0))
{
fileHash = (PBYTE)PhRealloc(fileHash, fileHashLength);
if (!CryptCATAdminCalcHashFromFileHandle(fileHandle, &fileHashLength, fileHash, 0))
{
CloseHandle(fileHandle);
PhFree(fileHash);
return VrNoSignature;
}
}
if (!CryptCATAdminAcquireContext(&catAdminHandle, &driverActionVerify, 0))
{
CloseHandle(fileHandle);
PhFree(fileHash);
return VrNoSignature;
}
fileHashTag = (PWSTR)PhAlloc((fileHashLength * 2 + 1) * sizeof(WCHAR));
for (i = 0; i < fileHashLength; i++)
wsprintfW(&fileHashTag[i * 2], L"%02X", fileHash[i]);
catInfoHandle = CryptCATAdminEnumCatalogFromHash(
catAdminHandle,
fileHash,
fileHashLength,
0,
NULL
);
PhFree(fileHash);
if (catInfoHandle)
{
CATALOG_INFO ci = { 0 };
if (CryptCATCatalogInfoFromContext(catInfoHandle, &ci, 0))
{
catalogInfo.cbStruct = sizeof(catalogInfo);
catalogInfo.pcwszCatalogFilePath = ci.wszCatalogFile;
catalogInfo.pcwszMemberFilePath = FileName;
catalogInfo.pcwszMemberTag = fileHashTag;
trustData.cbStruct = sizeof(trustData);
trustData.dwUIChoice = WTD_UI_NONE;
trustData.fdwRevocationChecks = WTD_STATEACTION_VERIFY;
trustData.dwUnionChoice = WTD_CHOICE_CATALOG;
trustData.pCatalog = &catalogInfo;
status = WinVerifyTrust(NULL, &driverActionVerify, &trustData);
}
CryptCATAdminReleaseCatalogContext(catAdminHandle, catInfoHandle, 0);
}
PhFree(fileHashTag);
CryptCATAdminReleaseContext(catAdminHandle, 0);
CloseHandle(fileHandle);
return PhvStatusToVerifyResult(status);
}
NPHAPI VERIFY_RESULT PhvVerifyFile(PWSTR FileName)
{
VERIFY_RESULT result = VrNoSignature;
result = PhvVerifyFileBasic(FileName);
if (result == VrNoSignature)
{
result = PhvVerifyFileCat(FileName);
}
return result;
}
trunk/NProcessHacker/verify.h
+91
View File
@@ -0,0 +1,91 @@
/*
* Process Hacker Library
*
* Copyright (C) 2009 wj32
*
* This file is part of Process Hacker.
*
* Process Hacker is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Process Hacker is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.
*/
#ifndef _VERIFY_H
#define _VERIFY_H
#include "nph.h"
#include <wintrust.h>
#include <softpub.h>
typedef enum _VERIFY_RESULT
{
VrUnknown = 0,
VrNoSignature,
VrTrusted,
VrTrustedInstaller,
VrExpired,
VrRevoked,
VrDistrust,
VrSecuritySettings
} VERIFY_RESULT, *PVERIFY_RESULT;
typedef struct _CATALOG_INFO
{
DWORD cbStruct;
WCHAR wszCatalogFile[MAX_PATH];
} CATALOG_INFO, *PCATALOG_INFO;
typedef BOOL (WINAPI *_CryptCATAdminCalcHashFromFileHandle)(
HANDLE hFile,
DWORD *pcbHash,
BYTE *pbHash,
DWORD dwFlags
);
typedef BOOL (WINAPI *_CryptCATAdminAcquireContext)(
HANDLE *phCatAdmin,
GUID *pgSubsystem,
DWORD dwFlags
);
typedef HANDLE (WINAPI *_CryptCATAdminEnumCatalogFromHash)(
HANDLE hCatAdmin,
BYTE *pbHash,
DWORD cbHash,
DWORD dwFlags,
HANDLE *phPrevCatInfo
);
typedef BOOL (WINAPI *_CryptCATCatalogInfoFromContext)(
HANDLE hCatInfo,
CATALOG_INFO *psCatInfo,
DWORD dwFlags
);
typedef BOOL (WINAPI *_CryptCATAdminReleaseCatalogContext)(
HANDLE hCatAdmin,
HANDLE hCatInfo,
DWORD dwFlags
);
typedef BOOL (WINAPI *_CryptCATAdminReleaseContext)(
HANDLE hCatAdmin,
DWORD dwFlags
);
VOID PhvInit();
VERIFY_RESULT PhvStatusToVerifyResult(LONG Status);
VERIFY_RESULT PhvVerifyFileBasic(PWSTR FileName);
VERIFY_RESULT PhvVerifyFileCat(PWSTR FileName);
NPHAPI VERIFY_RESULT PhvVerifyFile(PWSTR FileName);
#endif
trunk/ProcessHacker/Components/ProcessTree/ProcessToolTipProvider.cs
+6 -2
View File
@@ -162,13 +162,17 @@ namespace ProcessHacker
else if (pNode.ProcessItem.IsPacked)
otherNotes += "\n Image is probably packed - error reading PE file.";
if (Properties.Settings.Default.VerifySignatures && pNode.ProcessItem.FileName != null)
if (pNode.ProcessItem.FileName != null)
{
if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Trusted)
otherNotes += "\n Signature present and verified.";
else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.TrustedInstaller)
otherNotes += "\n Verified Windows component.";
else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Unknown)
else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Unknown &&
!Properties.Settings.Default.VerifySignatures)
otherNotes += "";
else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Unknown &&
Properties.Settings.Default.VerifySignatures)
otherNotes += "\n File has not been processed yet. Please wait...";
else if (pNode.ProcessItem.VerifyResult != Win32.VerifyResult.NoSignature)
otherNotes += "\n Signature present but invalid.";
trunk/ProcessHacker/Forms/HackerWindow.cs
+1 -1
View File
@@ -176,7 +176,7 @@ namespace ProcessHacker
private void runMenuItem_Click(object sender, EventArgs e)
{
Win32.SHRunDialog(this.Handle, 0, 0, null, null, 0);
Win32.RunFileDlg(this.Handle, 0, 0, null, null, 0);
}
private void runAsMenuItem_Click(object sender, EventArgs e)
trunk/ProcessHacker/Forms/ProcessWindow.cs
+19 -20
View File
@@ -321,27 +321,26 @@ namespace ProcessHacker
pictureIcon.Image = _processImage = ProcessHacker.Properties.Resources.Process.ToBitmap();
}
if (Properties.Settings.Default.VerifySignatures)
{
var verifyResult = _processItem.VerifyResult;
var verifyResult = _processItem.VerifyResult;
if (verifyResult == Win32.VerifyResult.Trusted)
textFileCompany.Text += " (verified)";
else if (verifyResult == Win32.VerifyResult.TrustedInstaller)
textFileCompany.Text += " (verified, Windows component)";
else if (verifyResult == Win32.VerifyResult.NoSignature)
textFileCompany.Text += " (not verified, no signature)";
else if (verifyResult == Win32.VerifyResult.Distrust)
textFileCompany.Text += " (not verified, distrusted)";
else if (verifyResult == Win32.VerifyResult.Expired)
textFileCompany.Text += " (not verified, expired)";
else if (verifyResult == Win32.VerifyResult.Revoked)
textFileCompany.Text += " (not verified, revoked)";
else if (verifyResult == Win32.VerifyResult.SecuritySettings)
textFileCompany.Text += " (not verified, security settings)";
else
textFileCompany.Text += " (not verified)";
}
if (verifyResult == Win32.VerifyResult.Unknown)
textFileCompany.Text += "";
else if (verifyResult == Win32.VerifyResult.Trusted)
textFileCompany.Text += " (verified)";
else if (verifyResult == Win32.VerifyResult.TrustedInstaller)
textFileCompany.Text += " (verified, Windows component)";
else if (verifyResult == Win32.VerifyResult.NoSignature)
textFileCompany.Text += " (not verified, no signature)";
else if (verifyResult == Win32.VerifyResult.Distrust)
textFileCompany.Text += " (not verified, distrusted)";
else if (verifyResult == Win32.VerifyResult.Expired)
textFileCompany.Text += " (not verified, expired)";
else if (verifyResult == Win32.VerifyResult.Revoked)
textFileCompany.Text += " (not verified, revoked)";
else if (verifyResult == Win32.VerifyResult.SecuritySettings)
textFileCompany.Text += " (not verified, security settings)";
else
textFileCompany.Text += " (not verified)";
}
catch
{
trunk/ProcessHacker/NProcessHacker.cs
+35
View File
@@ -0,0 +1,35 @@
/*
* Process Hacker -
* interfacing code to native library
*
* Copyright (C) 2009 wj32
*
* This file is part of Process Hacker.
*
* Process Hacker is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* Process Hacker is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.
*/
using System;
using System.Collections.Generic;
using System.Text;
using System.Runtime.InteropServices;
namespace ProcessHacker
{
public class NProcessHacker
{
[DllImport("nprocesshacker.dll", CallingConvention = CallingConvention.Cdecl, CharSet = CharSet.Unicode)]
public static extern Win32.VerifyResult PhvVerifyFile(string FileName);
}
}
trunk/ProcessHacker/ProcessHacker.csproj
+1
View File
@@ -590,6 +590,7 @@
<Compile Include="KProcessHacker.cs" />
<Compile Include="ColumnSettings.cs" />
<Compile Include="DeltaManager.cs" />
<Compile Include="NProcessHacker.cs" />
<Compile Include="Providers\Internal\IProvider.cs" />
<Compile Include="Providers\Internal\SharedThreadProvider.cs" />
<Compile Include="SharpDevelop\NDebugger.cs" />
trunk/ProcessHacker/Providers/ProcessSystemProvider.cs
+2 -1
View File
@@ -246,7 +246,7 @@ namespace ProcessHacker
// 1. the function-to-library ratio is lower than 4
// (on average less than 4 functions are imported from each library)
// 2. it references more than 3 libraries but less than 14 libraries.
if (fileName != null && (Properties.Settings.Default.VerifySignatures || forced))
if (fileName != null && (Properties.Settings.Default.VerifySignatures || forced) && false)
{
try
{
@@ -309,6 +309,7 @@ namespace ProcessHacker
try
{
fpResult.VerifyResult = Win32.VerifyFile(fileName);
//fpResult.VerifyResult = NProcessHacker.PhvVerifyFile(fileName);
}
catch
{
trunk/ProcessHacker/Win32/API/Functions.cs
+1 -1
View File
@@ -666,7 +666,7 @@ namespace ProcessHacker
#region Shell
[DllImport("shell32.dll", EntryPoint = "#61", CharSet = CharSet.Unicode)]
public static extern int SHRunDialog(IntPtr owner, int unknown, int unknown2,
public static extern int RunFileDlg(IntPtr hWnd, int unknown, int unknown2,
string title, string prompt, int flags);
[DllImport("shell32.dll")]
trunk/ProcessHacker/Win32/Win32.cs
+14 -3
View File
@@ -146,7 +146,7 @@ namespace ProcessHacker
#region Cryptography
public enum VerifyResult
public enum VerifyResult : int
{
Unknown = 0,
NoSignature,
@@ -299,7 +299,12 @@ namespace ProcessHacker
int hashLength = 256;
if (!CryptCATAdminCalcHashFromFileHandle(sourceFile, ref hashLength, hash, 0))
return VerifyResult.NoSignature;
{
hash = new byte[hashLength];
if (!CryptCATAdminCalcHashFromFileHandle(sourceFile, ref hashLength, hash, 0))
return VerifyResult.NoSignature;
}
StringBuilder memberTag = new StringBuilder(hashLength * 2);
@@ -321,7 +326,13 @@ namespace ProcessHacker
}
CATALOG_INFO ci = new CATALOG_INFO();
CryptCATCatalogInfoFromContext(catInfo, ref ci, 0);
if (!CryptCATCatalogInfoFromContext(catInfo, ref ci, 0))
{
CryptCATAdminReleaseCatalogContext(catAdmin, catInfo, 0);
CryptCATAdminReleaseContext(catAdmin, 0);
return VerifyResult.NoSignature;
}
WINTRUST_CATALOG_INFO wci = new WINTRUST_CATALOG_INFO();