From 723c42eb4eebf23da09fdd397937b07ecb7724ab Mon Sep 17 00:00:00 2001 From: wj32 Date: Sat, 23 May 2009 23:29:26 +0000 Subject: [PATCH] updated KPH version-specific information for Windows 7 RC git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1324 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- trunk/CHANGELOG.txt | 1 + trunk/KProcessHacker/i386/kprocesshacker.sys | Bin 23040 -> 22528 bytes trunk/KProcessHacker/version.c | 29 ++++--------------- 3 files changed, 6 insertions(+), 24 deletions(-) diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt index 15c558bad..cef3b181d 100644 --- a/trunk/CHANGELOG.txt +++ b/trunk/CHANGELOG.txt @@ -3,6 +3,7 @@ Process Hacker 1.3.8.1 * FIXED: * #2795871 - "Hidden Processes window resizing problem" + * Windows 7 RC BSOD (Windows 7 Beta is no longer supported) 1.3.8.0 * NEW/IMPROVED: diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys index 7255da576d2bc41daccfac6baf18358688f9666e..ea558cae683ebc298d071331f03780a09dbd2482 100644 GIT binary patch delta 2317 zcmZ`&2~<|c6@K&J|3Mai#0b<4e-*(P^=B2ul2f=gA1(HdhSp0@hC)Zkhb!|Q#hZF){R=iFuP+`0F=ckblx zM)^BYc}w@D#WAC(=c|RHQ78(gsMo*{x$22XztK!MG>UEsB)Mo3nn%7y--n!c!D%^= z+xI11iO>L&6PQGog^{{IOczJ^?gpkHdj9~D$C8h~Hg= zCXjhSQF9+^4W&tsJj*i?MR{t%_l!eS<;Jmy8duh9D~MDZe+I%+W9){Ll+7JCxbbB8faCSz)HJiIULUcUeaqmaPnPn&pccRT27SKmJ?ZE z)1JaK8Zy`cp2B2M_SR9flM%PCWWll%*9MGJ{ygtO~mks?o zN0x-ds9`VK=WDm^tlv3}e$#1WgQu_(EL!_d)d3~+p-6McjJyt<&+<4;XmmMw(n0%i z+b8}H^#9X(xC+qAJ6`A~>+uxr{K2-%k{(^(4)QO~DkI;7e$f3*6F_gZ0sauss+L0- z|2k(I<|_+pcG2S9s;QAQJ+sv}?Ij!0cVo%)sBZ2FUPK+3<69C{i|F>gJ}D+N6bZiJ z{jx*oe8sn8@OcE1>=@jiY#X{7CHPDx8qsHTUn=`YdUZhgE+G>Iz^5X!@QjG|;w|e| z$_a`4|JF78?B;+5atV)jmO7fyix zK$^uKT@qhL)N4S_`7c1GksripC22#HJrb41-sW0CN1iAmhjwDZ1-i z22t+-Io1l0>lsAu(50*8DWNGT<0fR5;r;-UWXTH3_kAMIK`4ZH)Y)|L1+qltQ3~0q z_N4FEkkjfQ6hxk=>rfn7qb1WN&E%@)rMI6Wo%FpgpE(P!^yoSdBVN!J=vh_{uVst= zeP7!4&1)T&+-H_xa#N2**(B76jT+Smr)vw^f<4P#aZVQn!j(9ZXuL<)?Iv}`z_5gK zPS_PmJCprgNUITp=8#TiJl(XLaHc_@Iz`?wV|wm5VcXYvsIMc^i8kBLM$ckxY9gD= zSTuz*=GC?{_E9;T(Nqi)YXYU?>_n%;8^hVIgXGgFDhDfjJ%bYL_e${pC8#^#>r9gyr z!pFi!;ZtF!ut(S@92AZUCxvFAU5LeTcn~)52%Lf^;~DsE{2ngAEAWT75^uqu<6U?! zK8%my)A$_z8ehhL$2V{*euQbUyVzgU#8h#L_$zUNxK#YDxJs-LH;FsMTCrX{C7u<( z6|af^6z}AT{}L(5Erm&uQjFA7>MO-dgC$;CD{Ya!kgiBKrB>;QWJ@7(gd8n<<#>6h ztjOc#neuYELiWiQ<-2mUQlwl{SapKBPi;^isGYPP+ElGjyP`eTbUj(0rC-+X>4K4B zOg3g1ZyWC#<;Gg0!l*WCjl4$Vym7+_G9%3x(`ybf1#^r!-b^>An=8$2X0=&s9x!j2 z!B#(OkR@1#HQUOyKDIVnbymG~+&XVvu^wCSRr*lWeGrJ5#4KPIGj+^i<~Y;JmwI$nTFaUH&e?_ot8A$}rumR3mDq+I!i+(%igR4W&h z+e(`fp~kC=)oS&EdRuK%qqKPF$RVu>x^hno)qCkfbVHw_=jG^|^)K`T`f0tJkzo`Y ze=xQfhYZ8qWww}pGtlZ{d97Ehkyfg;&{|_vT0ZN5b_W57W*4^D^z@vy~4J#k6ADG2A9rda=F|tuAV#3UFPm^R36`r_wqbH zoL|D%@PFpN;&1aW34?^u!c<|NPzb~Mkx(PF2!4UWU2%WRVjWM!vv3jKfPMG~ZpN4J zeH_&hMUQJ@CtZH&ViON zQ!rgEqa)ONlC1z>H<@K}vfU%dUK3GmPs{Z1yX3-jr@)7};03C=D>y5}C$wy?5Vib-x_29s;YIr-poy zw1!LyQJ2t29+jkpq9KRPiSz{UnTJsono9i}~iMDGFY2YtL-x>zjWkk|WcP8b{M@Wu^34X7q@ zgZq;1Lso!V@8?6h05(hY`nbQdJB6trh`wMl15S%Po!^+r6lRQBbl}<;CmRw)et_f5 zkq+8$1fq<7qhkRxmX5$juh$6Z#K$@?U-cYdJ||VEyZPGzfN3NRsC%dSL4f&=j==g) zR5z0csEbseK)rOdd#P@IYzHFN|1RSC7XVXEM_^wS)zxGa?()n7jy@jSBX0uLLu`Pw zvYr*w<@m5n_~uFCPOdYW`lY6oR~M@w_B*-oE<%WtwSD5Iq^P}9g$hH<^I-827@ zXAQZo#DO+qQR8C%>7%QwT>en&g69LP1txl=nk1@o*_3LsR~;B$`+XqnQs<7;rV8@2 z8Vl}|4qAV9N;Tm%m3{35$=70g=*JAB*-ok3BOUb{Mhc zz7c#vop4GxCtMP)2-k!b;kMux2EZgZ2EGnwz&Bwbbi-wEEv$swVGTS0kHPQZMc52m z;2qco85E4dQD@W@^+bKpKr{qFq@YCfB1%DNCR*XUk-uYO3c)BQSqM!gy47F8X&7dXVFaOvD6 zZaSCGdAQ}=wIVLaX0fH%#@Z&?iftYFD83(`z;it0Wj={d;ZynX{A50hpUD^S@AAdG zn=j>;^Befh{5HOdui;yG#hz-PVn1)EO=^!3pr8q(gvmmlP%bC7^NM^caVZ}u z+m-!Fo$?>Wq$1U+j#e|(O=^o8qYcuqmZsHd$$Fk%sISy3^eTOyepYYP8IEDX=^vDt z>&w}=q1MD zo@KN(chSZ?4x8Xz7>zhI6pcf#qg+&iR-?11358&Yhtdw4mWkiM3ur@qiRi_@% diff --git a/trunk/KProcessHacker/version.c b/trunk/KProcessHacker/version.c index a1f955b29..dbe82069d 100644 --- a/trunk/KProcessHacker/version.c +++ b/trunk/KProcessHacker/version.c @@ -61,9 +61,9 @@ static char PsTerminateProcess60[] = }; static char PsTerminateProcess61[] = { - 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x53, 0x56, 0x57, - 0x33, 0xd2, 0x6a, 0x08, 0x42, 0x5e, 0x8d, 0xb9 -}; /* same as 6.0 */ + 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x51, 0x51, 0x53, + 0x56, 0x64, 0x8b, 0x35, 0x24, 0x01, 0x00, 0x00 +}; /* PspTerminateThreadByPointer */ static char PspTerminateThreadByPointer51[] = @@ -81,8 +81,8 @@ static char PspTerminateThreadByPointer61[] = { 0x8b, 0xff, 0x55, 0x8b, 0xec, 0x83, 0xe4, 0xf8, 0x51, 0x53, 0x56, 0x8b, 0x75, 0x08, 0x57, 0x8d, - 0xbe, 0x60, 0x02, 0x00, 0x00, 0xf6, 0x07, 0x40 -}; /* same as 6.0 */ + 0xbe, 0x80, 0x02, 0x00, 0x00, 0xf6, 0x07, 0x40 +}; /* The following offsets took me a long time to work out, so please do not steal them. If you want to use them, please @@ -140,11 +140,6 @@ NTSTATUS KvInit() OffOtiGenericMapping = 0x60 + 0x8; OffOtiOpenProcedure = 0x60 + 0x30; - INIT_SCAN( - PsExitSpecialApcScan, - PsExitSpecialApc51, - 16, searchOffset, SCAN_LENGTH, 0 - ); /* We are scanning for PspTerminateProcess which has the same signature as PsTerminateProcess because PsTerminateProcess is simply a wrapper on XP. @@ -193,12 +188,8 @@ NTSTATUS KvInit() /* Windows Vista, Windows Server 2008 */ else if (majorVersion == 6 && minorVersion == 0) { - ULONG_PTR psSearchOffset = (ULONG_PTR)GetSystemRoutineAddress(L"PsSetCreateProcessNotifyRoutine"); ULONG_PTR searchOffset = (ULONG_PTR)__NtClose; - if (!psSearchOffset) - return STATUS_NOT_SUPPORTED; - WindowsVersion = WINDOWS_VISTA; ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff; ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff; @@ -213,11 +204,6 @@ NTSTATUS KvInit() OffKtProcess = 0x144; OffOhBody = 0x18; - INIT_SCAN( - PsExitSpecialApcScan, - PsExitSpecialApc60, - 16, psSearchOffset, SCAN_LENGTH, 0 - ); INIT_SCAN( PsTerminateProcessScan, PsTerminateProcess60, @@ -273,11 +259,6 @@ NTSTATUS KvInit() OffOtiGenericMapping = 0x28 + 0xc; OffOtiOpenProcedure = 0x28 + 0x34; - INIT_SCAN( - PsExitSpecialApcScan, - PsExitSpecialApc61, - 16, psSearchOffset, psScanLength, 0 - ); INIT_SCAN( PsTerminateProcessScan, PsTerminateProcess61,