diff --git a/trunk/NProcessHacker/NProcessHacker.vcproj b/trunk/NProcessHacker/NProcessHacker.vcproj index e743ef2ac..4784abe05 100644 --- a/trunk/NProcessHacker/NProcessHacker.vcproj +++ b/trunk/NProcessHacker/NProcessHacker.vcproj @@ -40,11 +40,13 @@ @@ -87,7 +90,7 @@ OutputDirectory="$(SolutionDir)$(ConfigurationName)" IntermediateDirectory="$(ConfigurationName)" ConfigurationType="2" - CharacterSet="2" + CharacterSet="1" WholeProgramOptimization="1" > + + + + + + + + + + diff --git a/trunk/NProcessHacker/nph.c b/trunk/NProcessHacker/nph.c new file mode 100644 index 000000000..67fa34e20 --- /dev/null +++ b/trunk/NProcessHacker/nph.c @@ -0,0 +1,72 @@ +/* + * Process Hacker Library - + * common code + * + * Copyright (C) 2009 wj32 + * + * This file is part of Process Hacker. + * + * Process Hacker is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Process Hacker is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Process Hacker. If not, see . + */ + +#include "nph.h" +#include "verify.h" + +NPHAPI PVOID PhAlloc(SIZE_T Size) +{ + PVOID memory; + + if (!(memory = malloc(Size))) + RaiseException(EXCEPTION_NO_MEMORY, 0, 0, NULL); + + return memory; +} + +NPHAPI PVOID PhRealloc(PVOID Memory, SIZE_T Size) +{ + PVOID memory; + + if (!(memory = realloc(Memory, Size))) + RaiseException(EXCEPTION_NO_MEMORY, 0, 0, NULL); + + return memory; +} + +NPHAPI VOID PhFree(PVOID Memory) +{ + free(Memory); +} + +PVOID PhGetProcAddress(PWSTR LibraryName, PSTR ProcName) +{ + return GetProcAddress(GetModuleHandle(LibraryName), ProcName); +} + +BOOL WINAPI DllMain( + HINSTANCE hinstDLL, + DWORD fdwReason, + LPVOID lpvReserved + ) +{ + switch (fdwReason) + { + case DLL_PROCESS_ATTACH: + PhvInit(); + break; + default: + break; + } + + return TRUE; +} diff --git a/trunk/NProcessHacker/nph.h b/trunk/NProcessHacker/nph.h new file mode 100644 index 000000000..1201064d9 --- /dev/null +++ b/trunk/NProcessHacker/nph.h @@ -0,0 +1,49 @@ +/* + * Process Hacker Library - + * main header file + * + * Copyright (C) 2009 wj32 + * + * This file is part of Process Hacker. + * + * Process Hacker is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Process Hacker is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Process Hacker. If not, see . + */ + +#ifndef _NPH_H +#define _NPH_H + +#include + +#define WIN32_LEAN_AND_MEAN +#define WIN32_NO_STATUS /* Need ntstatus.h instead */ +#include +#include + +#define NTSTATUS LONG +#define NT_SUCCESS(x) ((x) >= STATUS_SUCCESS) + +#ifdef NPH_EXPORTS +#define NPHAPI __declspec(dllexport) +#else +#define NPHAPI __declspec(dllimport) +#endif + +#define EXCEPTION_NO_MEMORY STATUS_NO_MEMORY + +NPHAPI PVOID PhAlloc(SIZE_T Size); +NPHAPI PVOID PhRealloc(PVOID Memory, SIZE_T Size); +NPHAPI VOID PhFree(PVOID Memory); +PVOID PhGetProcAddress(PWSTR LibraryName, PSTR ProcName); + +#endif diff --git a/trunk/NProcessHacker/resource.rc b/trunk/NProcessHacker/resource.rc new file mode 100644 index 000000000..d5fe0e65f --- /dev/null +++ b/trunk/NProcessHacker/resource.rc @@ -0,0 +1,50 @@ +#include + +#define VER_FILEVERSION 1,3,6,6 +#define VER_FILEVERSION_STR "1.3.6.6\0" +#define VER_PRODUCTVERSION 1,3,6,6 +#define VER_PRODUCTVERSION_STR "1.3.6.6\0" + +#ifndef DEBUG +#define VER_DEBUG 0 +#else +#define VER_DEBUG VS_FF_DEBUG +#endif + +#define VER_PRIVATEBUILD 0 +#define VER_PRERELEASE 0 + +#define VER_COMPANYNAME_STR "wj32\0" +#define VER_FILEDESCRIPTION_STR "Process Hacker Library\0" +#define VER_LEGALCOPYRIGHT_STR "Copyright (c) 2009 wj32. Licensed under the GNU GPL, v3.\0" +#define VER_ORIGINALFILENAME_STR "NProcessHacker.dll\0" +#define VER_PRODUCTNAME_STR "Process Hacker\0" + +VS_VERSION_INFO VERSIONINFO +FILEVERSION VER_FILEVERSION +PRODUCTVERSION VER_PRODUCTVERSION +FILEFLAGSMASK VS_FFI_FILEFLAGSMASK +FILEFLAGS (VER_PRIVATEBUILD | VER_PRERELEASE | VER_DEBUG) +FILEOS VOS__WINDOWS32 +FILETYPE VFT_DLL +FILESUBTYPE VFT2_UNKNOWN +BEGIN + BLOCK "StringFileInfo" + BEGIN + BLOCK "040904E4" + BEGIN + VALUE "CompanyName", VER_COMPANYNAME_STR + VALUE "FileDescription", VER_FILEDESCRIPTION_STR + VALUE "FileVersion", VER_FILEVERSION_STR + VALUE "LegalCopyright", VER_LEGALCOPYRIGHT_STR + VALUE "OriginalFilename", VER_ORIGINALFILENAME_STR + VALUE "ProductName", VER_PRODUCTNAME_STR + VALUE "ProductVersion", VER_PRODUCTVERSION_STR + END + END + + BLOCK "VarFileInfo" + BEGIN + VALUE "Translation", 0x409, 1252 + END +END diff --git a/trunk/NProcessHacker/verify.c b/trunk/NProcessHacker/verify.c new file mode 100644 index 000000000..d15d99555 --- /dev/null +++ b/trunk/NProcessHacker/verify.c @@ -0,0 +1,194 @@ +/* + * Process Hacker Library + * + * Copyright (C) 2009 wj32 + * + * This file is part of Process Hacker. + * + * Process Hacker is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Process Hacker is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Process Hacker. If not, see . + */ + +#include "verify.h" + +_CryptCATAdminCalcHashFromFileHandle CryptCATAdminCalcHashFromFileHandle; +_CryptCATAdminAcquireContext CryptCATAdminAcquireContext; +_CryptCATAdminEnumCatalogFromHash CryptCATAdminEnumCatalogFromHash; +_CryptCATCatalogInfoFromContext CryptCATCatalogInfoFromContext; +_CryptCATAdminReleaseCatalogContext CryptCATAdminReleaseCatalogContext; +_CryptCATAdminReleaseContext CryptCATAdminReleaseContext; + +VOID PhvInit() +{ + LoadLibrary(L"wintrust.dll"); + + CryptCATAdminCalcHashFromFileHandle = + PhGetProcAddress(L"wintrust.dll", "CryptCATAdminCalcHashFromFileHandle"); + CryptCATAdminAcquireContext = + PhGetProcAddress(L"wintrust.dll", "CryptCATAdminAcquireContext"); + CryptCATAdminEnumCatalogFromHash = + PhGetProcAddress(L"wintrust.dll", "CryptCATAdminEnumCatalogFromHash"); + CryptCATCatalogInfoFromContext = + PhGetProcAddress(L"wintrust.dll", "CryptCATCatalogInfoFromContext"); + CryptCATAdminReleaseCatalogContext = + PhGetProcAddress(L"wintrust.dll", "CryptCATAdminReleaseCatalogContext"); + CryptCATAdminReleaseContext = + PhGetProcAddress(L"wintrust.dll", "CryptCATAdminReleaseContext"); +} + +VERIFY_RESULT PhvStatusToVerifyResult(LONG Status) +{ + switch (Status) + { + case 0: + return VrTrusted; + case TRUST_E_NOSIGNATURE: + return VrNoSignature; + case CERT_E_EXPIRED: + return VrExpired; + case CERT_E_REVOKED: + return VrRevoked; + case TRUST_E_EXPLICIT_DISTRUST: + return VrDistrust; + case CRYPT_E_SECURITY_SETTINGS: + return VrSecuritySettings; + default: + return VrSecuritySettings; + } +} + +VERIFY_RESULT PhvVerifyFileBasic(PWSTR FileName) +{ + WINTRUST_DATA trustData = { 0 }; + WINTRUST_FILE_INFO fileInfo = { 0 }; + GUID actionGenericVerifyV2 = WINTRUST_ACTION_GENERIC_VERIFY_V2; + + fileInfo.cbStruct = sizeof(fileInfo); + fileInfo.pcwszFilePath = FileName; + + trustData.cbStruct = sizeof(trustData); + trustData.dwUIChoice = WTD_UI_NONE; + trustData.dwProvFlags = WTD_SAFER_FLAG; + trustData.dwUnionChoice = WTD_CHOICE_FILE; + trustData.pFile = &fileInfo; + + return PhvStatusToVerifyResult(WinVerifyTrust(NULL, &actionGenericVerifyV2, &trustData)); +} + +VERIFY_RESULT PhvVerifyFileCat(PWSTR FileName) +{ + LONG status = TRUST_E_NOSIGNATURE; + WINTRUST_DATA trustData = { 0 }; + WINTRUST_CATALOG_INFO catalogInfo = { 0 }; + GUID driverActionVerify = DRIVER_ACTION_VERIFY; + HANDLE fileHandle; + PBYTE fileHash = NULL; + ULONG fileHashLength; + PWSTR fileHashTag = NULL; + HANDLE catAdminHandle = NULL; + HANDLE catInfoHandle = NULL; + ULONG i; + + fileHandle = CreateFile( + FileName, + GENERIC_READ, + FILE_SHARE_READ, + NULL, + OPEN_EXISTING, + FILE_ATTRIBUTE_NORMAL, + NULL + ); + + if (fileHandle == INVALID_HANDLE_VALUE) + return VrNoSignature; + + fileHashLength = 256; + fileHash = (PBYTE)PhAlloc(fileHashLength); + + if (!CryptCATAdminCalcHashFromFileHandle(fileHandle, &fileHashLength, fileHash, 0)) + { + fileHash = (PBYTE)PhRealloc(fileHash, fileHashLength); + + if (!CryptCATAdminCalcHashFromFileHandle(fileHandle, &fileHashLength, fileHash, 0)) + { + CloseHandle(fileHandle); + PhFree(fileHash); + return VrNoSignature; + } + } + + if (!CryptCATAdminAcquireContext(&catAdminHandle, &driverActionVerify, 0)) + { + CloseHandle(fileHandle); + PhFree(fileHash); + return VrNoSignature; + } + + fileHashTag = (PWSTR)PhAlloc((fileHashLength * 2 + 1) * sizeof(WCHAR)); + + for (i = 0; i < fileHashLength; i++) + wsprintfW(&fileHashTag[i * 2], L"%02X", fileHash[i]); + + catInfoHandle = CryptCATAdminEnumCatalogFromHash( + catAdminHandle, + fileHash, + fileHashLength, + 0, + NULL + ); + + PhFree(fileHash); + + if (catInfoHandle) + { + CATALOG_INFO ci = { 0 }; + + if (CryptCATCatalogInfoFromContext(catInfoHandle, &ci, 0)) + { + catalogInfo.cbStruct = sizeof(catalogInfo); + catalogInfo.pcwszCatalogFilePath = ci.wszCatalogFile; + catalogInfo.pcwszMemberFilePath = FileName; + catalogInfo.pcwszMemberTag = fileHashTag; + + trustData.cbStruct = sizeof(trustData); + trustData.dwUIChoice = WTD_UI_NONE; + trustData.fdwRevocationChecks = WTD_STATEACTION_VERIFY; + trustData.dwUnionChoice = WTD_CHOICE_CATALOG; + trustData.pCatalog = &catalogInfo; + + status = WinVerifyTrust(NULL, &driverActionVerify, &trustData); + } + + CryptCATAdminReleaseCatalogContext(catAdminHandle, catInfoHandle, 0); + } + + PhFree(fileHashTag); + CryptCATAdminReleaseContext(catAdminHandle, 0); + CloseHandle(fileHandle); + + return PhvStatusToVerifyResult(status); +} + +NPHAPI VERIFY_RESULT PhvVerifyFile(PWSTR FileName) +{ + VERIFY_RESULT result = VrNoSignature; + + result = PhvVerifyFileBasic(FileName); + + if (result == VrNoSignature) + { + result = PhvVerifyFileCat(FileName); + } + + return result; +} diff --git a/trunk/NProcessHacker/verify.h b/trunk/NProcessHacker/verify.h new file mode 100644 index 000000000..8f4d73743 --- /dev/null +++ b/trunk/NProcessHacker/verify.h @@ -0,0 +1,91 @@ +/* + * Process Hacker Library + * + * Copyright (C) 2009 wj32 + * + * This file is part of Process Hacker. + * + * Process Hacker is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Process Hacker is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Process Hacker. If not, see . + */ + +#ifndef _VERIFY_H +#define _VERIFY_H + +#include "nph.h" +#include +#include + +typedef enum _VERIFY_RESULT +{ + VrUnknown = 0, + VrNoSignature, + VrTrusted, + VrTrustedInstaller, + VrExpired, + VrRevoked, + VrDistrust, + VrSecuritySettings +} VERIFY_RESULT, *PVERIFY_RESULT; + +typedef struct _CATALOG_INFO +{ + DWORD cbStruct; + WCHAR wszCatalogFile[MAX_PATH]; +} CATALOG_INFO, *PCATALOG_INFO; + +typedef BOOL (WINAPI *_CryptCATAdminCalcHashFromFileHandle)( + HANDLE hFile, + DWORD *pcbHash, + BYTE *pbHash, + DWORD dwFlags + ); + +typedef BOOL (WINAPI *_CryptCATAdminAcquireContext)( + HANDLE *phCatAdmin, + GUID *pgSubsystem, + DWORD dwFlags + ); + +typedef HANDLE (WINAPI *_CryptCATAdminEnumCatalogFromHash)( + HANDLE hCatAdmin, + BYTE *pbHash, + DWORD cbHash, + DWORD dwFlags, + HANDLE *phPrevCatInfo + ); + +typedef BOOL (WINAPI *_CryptCATCatalogInfoFromContext)( + HANDLE hCatInfo, + CATALOG_INFO *psCatInfo, + DWORD dwFlags + ); + +typedef BOOL (WINAPI *_CryptCATAdminReleaseCatalogContext)( + HANDLE hCatAdmin, + HANDLE hCatInfo, + DWORD dwFlags + ); + +typedef BOOL (WINAPI *_CryptCATAdminReleaseContext)( + HANDLE hCatAdmin, + DWORD dwFlags + ); + +VOID PhvInit(); +VERIFY_RESULT PhvStatusToVerifyResult(LONG Status); +VERIFY_RESULT PhvVerifyFileBasic(PWSTR FileName); +VERIFY_RESULT PhvVerifyFileCat(PWSTR FileName); +NPHAPI VERIFY_RESULT PhvVerifyFile(PWSTR FileName); + +#endif \ No newline at end of file diff --git a/trunk/ProcessHacker/Components/ProcessTree/ProcessToolTipProvider.cs b/trunk/ProcessHacker/Components/ProcessTree/ProcessToolTipProvider.cs index a02252838..8548eb31e 100644 --- a/trunk/ProcessHacker/Components/ProcessTree/ProcessToolTipProvider.cs +++ b/trunk/ProcessHacker/Components/ProcessTree/ProcessToolTipProvider.cs @@ -162,13 +162,17 @@ namespace ProcessHacker else if (pNode.ProcessItem.IsPacked) otherNotes += "\n Image is probably packed - error reading PE file."; - if (Properties.Settings.Default.VerifySignatures && pNode.ProcessItem.FileName != null) + if (pNode.ProcessItem.FileName != null) { if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Trusted) otherNotes += "\n Signature present and verified."; else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.TrustedInstaller) otherNotes += "\n Verified Windows component."; - else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Unknown) + else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Unknown && + !Properties.Settings.Default.VerifySignatures) + otherNotes += ""; + else if (pNode.ProcessItem.VerifyResult == Win32.VerifyResult.Unknown && + Properties.Settings.Default.VerifySignatures) otherNotes += "\n File has not been processed yet. Please wait..."; else if (pNode.ProcessItem.VerifyResult != Win32.VerifyResult.NoSignature) otherNotes += "\n Signature present but invalid."; diff --git a/trunk/ProcessHacker/Forms/HackerWindow.cs b/trunk/ProcessHacker/Forms/HackerWindow.cs index 7ef3ef5ad..b3d8d9398 100644 --- a/trunk/ProcessHacker/Forms/HackerWindow.cs +++ b/trunk/ProcessHacker/Forms/HackerWindow.cs @@ -176,7 +176,7 @@ namespace ProcessHacker private void runMenuItem_Click(object sender, EventArgs e) { - Win32.SHRunDialog(this.Handle, 0, 0, null, null, 0); + Win32.RunFileDlg(this.Handle, 0, 0, null, null, 0); } private void runAsMenuItem_Click(object sender, EventArgs e) diff --git a/trunk/ProcessHacker/Forms/ProcessWindow.cs b/trunk/ProcessHacker/Forms/ProcessWindow.cs index 032ff511a..ae199906a 100644 --- a/trunk/ProcessHacker/Forms/ProcessWindow.cs +++ b/trunk/ProcessHacker/Forms/ProcessWindow.cs @@ -321,27 +321,26 @@ namespace ProcessHacker pictureIcon.Image = _processImage = ProcessHacker.Properties.Resources.Process.ToBitmap(); } - if (Properties.Settings.Default.VerifySignatures) - { - var verifyResult = _processItem.VerifyResult; + var verifyResult = _processItem.VerifyResult; - if (verifyResult == Win32.VerifyResult.Trusted) - textFileCompany.Text += " (verified)"; - else if (verifyResult == Win32.VerifyResult.TrustedInstaller) - textFileCompany.Text += " (verified, Windows component)"; - else if (verifyResult == Win32.VerifyResult.NoSignature) - textFileCompany.Text += " (not verified, no signature)"; - else if (verifyResult == Win32.VerifyResult.Distrust) - textFileCompany.Text += " (not verified, distrusted)"; - else if (verifyResult == Win32.VerifyResult.Expired) - textFileCompany.Text += " (not verified, expired)"; - else if (verifyResult == Win32.VerifyResult.Revoked) - textFileCompany.Text += " (not verified, revoked)"; - else if (verifyResult == Win32.VerifyResult.SecuritySettings) - textFileCompany.Text += " (not verified, security settings)"; - else - textFileCompany.Text += " (not verified)"; - } + if (verifyResult == Win32.VerifyResult.Unknown) + textFileCompany.Text += ""; + else if (verifyResult == Win32.VerifyResult.Trusted) + textFileCompany.Text += " (verified)"; + else if (verifyResult == Win32.VerifyResult.TrustedInstaller) + textFileCompany.Text += " (verified, Windows component)"; + else if (verifyResult == Win32.VerifyResult.NoSignature) + textFileCompany.Text += " (not verified, no signature)"; + else if (verifyResult == Win32.VerifyResult.Distrust) + textFileCompany.Text += " (not verified, distrusted)"; + else if (verifyResult == Win32.VerifyResult.Expired) + textFileCompany.Text += " (not verified, expired)"; + else if (verifyResult == Win32.VerifyResult.Revoked) + textFileCompany.Text += " (not verified, revoked)"; + else if (verifyResult == Win32.VerifyResult.SecuritySettings) + textFileCompany.Text += " (not verified, security settings)"; + else + textFileCompany.Text += " (not verified)"; } catch { diff --git a/trunk/ProcessHacker/NProcessHacker.cs b/trunk/ProcessHacker/NProcessHacker.cs new file mode 100644 index 000000000..0c6c8b9af --- /dev/null +++ b/trunk/ProcessHacker/NProcessHacker.cs @@ -0,0 +1,35 @@ +/* + * Process Hacker - + * interfacing code to native library + * + * Copyright (C) 2009 wj32 + * + * This file is part of Process Hacker. + * + * Process Hacker is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * Process Hacker is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with Process Hacker. If not, see . + */ + +using System; +using System.Collections.Generic; +using System.Text; +using System.Runtime.InteropServices; + +namespace ProcessHacker +{ + public class NProcessHacker + { + [DllImport("nprocesshacker.dll", CallingConvention = CallingConvention.Cdecl, CharSet = CharSet.Unicode)] + public static extern Win32.VerifyResult PhvVerifyFile(string FileName); + } +} diff --git a/trunk/ProcessHacker/ProcessHacker.csproj b/trunk/ProcessHacker/ProcessHacker.csproj index 86da039af..3b48aa5d7 100644 --- a/trunk/ProcessHacker/ProcessHacker.csproj +++ b/trunk/ProcessHacker/ProcessHacker.csproj @@ -590,6 +590,7 @@ + diff --git a/trunk/ProcessHacker/Providers/ProcessSystemProvider.cs b/trunk/ProcessHacker/Providers/ProcessSystemProvider.cs index c43f9527a..e01f73b15 100644 --- a/trunk/ProcessHacker/Providers/ProcessSystemProvider.cs +++ b/trunk/ProcessHacker/Providers/ProcessSystemProvider.cs @@ -246,7 +246,7 @@ namespace ProcessHacker // 1. the function-to-library ratio is lower than 4 // (on average less than 4 functions are imported from each library) // 2. it references more than 3 libraries but less than 14 libraries. - if (fileName != null && (Properties.Settings.Default.VerifySignatures || forced)) + if (fileName != null && (Properties.Settings.Default.VerifySignatures || forced) && false) { try { @@ -309,6 +309,7 @@ namespace ProcessHacker try { fpResult.VerifyResult = Win32.VerifyFile(fileName); + //fpResult.VerifyResult = NProcessHacker.PhvVerifyFile(fileName); } catch { diff --git a/trunk/ProcessHacker/Win32/API/Functions.cs b/trunk/ProcessHacker/Win32/API/Functions.cs index 3b95abb89..63798c325 100644 --- a/trunk/ProcessHacker/Win32/API/Functions.cs +++ b/trunk/ProcessHacker/Win32/API/Functions.cs @@ -666,7 +666,7 @@ namespace ProcessHacker #region Shell [DllImport("shell32.dll", EntryPoint = "#61", CharSet = CharSet.Unicode)] - public static extern int SHRunDialog(IntPtr owner, int unknown, int unknown2, + public static extern int RunFileDlg(IntPtr hWnd, int unknown, int unknown2, string title, string prompt, int flags); [DllImport("shell32.dll")] diff --git a/trunk/ProcessHacker/Win32/Win32.cs b/trunk/ProcessHacker/Win32/Win32.cs index b11394875..2428a354f 100644 --- a/trunk/ProcessHacker/Win32/Win32.cs +++ b/trunk/ProcessHacker/Win32/Win32.cs @@ -146,7 +146,7 @@ namespace ProcessHacker #region Cryptography - public enum VerifyResult + public enum VerifyResult : int { Unknown = 0, NoSignature, @@ -299,7 +299,12 @@ namespace ProcessHacker int hashLength = 256; if (!CryptCATAdminCalcHashFromFileHandle(sourceFile, ref hashLength, hash, 0)) - return VerifyResult.NoSignature; + { + hash = new byte[hashLength]; + + if (!CryptCATAdminCalcHashFromFileHandle(sourceFile, ref hashLength, hash, 0)) + return VerifyResult.NoSignature; + } StringBuilder memberTag = new StringBuilder(hashLength * 2); @@ -321,7 +326,13 @@ namespace ProcessHacker } CATALOG_INFO ci = new CATALOG_INFO(); - CryptCATCatalogInfoFromContext(catInfo, ref ci, 0); + + if (!CryptCATCatalogInfoFromContext(catInfo, ref ci, 0)) + { + CryptCATAdminReleaseCatalogContext(catAdmin, catInfo, 0); + CryptCATAdminReleaseContext(catAdmin, 0); + return VerifyResult.NoSignature; + } WINTRUST_CATALOG_INFO wci = new WINTRUST_CATALOG_INFO();