From 9287af19d270fd620bee2acd29e38daca7fa13cf Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Wed, 26 May 2010 11:10:00 +0000
Subject: [PATCH] added names (GUIDs) for EtwRegistration objects

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@3152 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 .../KProcessHacker/i386/kprocesshacker.sys    | Bin 27136 -> 27648 bytes
 2.x/trunk/KProcessHacker/include/kph.h        |  23 ++++
 .../KProcessHacker/include/kprocesshacker.h   |   1 +
 2.x/trunk/KProcessHacker/include/version.h    |   8 +-
 2.x/trunk/KProcessHacker/kprocesshacker.c     |  78 +++++++++++
 2.x/trunk/KProcessHacker/ob.c                 | 125 ++++++++++++++++++
 2.x/trunk/KProcessHacker/version.c            |  12 +-
 2.x/trunk/ProcessHacker/include/providers.h   |  19 +++
 2.x/trunk/ProcessHacker/memprv.c              |   5 +
 2.x/trunk/phlib/hndlinfo.c                    |  24 +++-
 2.x/trunk/phlib/include/kph.h                 |  25 ++++
 2.x/trunk/phlib/kph.c                         |  38 ++++++
 12 files changed, 351 insertions(+), 7 deletions(-)

diff --git a/2.x/trunk/KProcessHacker/i386/kprocesshacker.sys b/2.x/trunk/KProcessHacker/i386/kprocesshacker.sys
index cad5af8b66bfb738364d95df66085685a5ac0687..c6a6339b42b2fac89c059acc66dbd17c642c932b 100644
GIT binary patch
delta 9094
zcmb_h3wRS%_Mb_UHibY+X`wHmrR5>dNoM*;lSx`3JmeKA6w0dz6hiGHv<a-zn$ian
zLtXHq)CCpfVMWAhK?+o;P$@`NL_}6ue4!>5m0i17pgRBGowTK^{{R1Pzi;z>C-=-b
z=bn4cx#ymH=T7lOw)ir;$;5uXSsdfKdFXA;>la_nz6<-Zui^Qr(DT`c<@Qqc8*+O(
zyBh7W{X?_glv_)7johZn?eyh~?NkTzo1e|fFq7FJW)}O)qz=~SjDqdX1~beIX7kU6
zfOpq1gl8wRvq=$~teDJhj*BAaS+(M3Z}JH{SP`ot3dPiJAp*MF07+zyqJPf=YM`3{
z-2j<ny<!NvkQ`7%^(+Ylp&CF1megEQ3}v6}A4oLHV79WRk5b15o!7IBHzkBjRo$n!
zFNFM6b-&`Ow&r`)!T`li4Ve~PFf>-fFr^KeW(|KfZh~^DTfNjhK{5ZNnrWiH+%S79
zRk6K$&3C~^+1`U-!pR6f&m+zBT;I8y9PU0U=mrm=zXp@*-Ct2W5KOjdRx4`Nq<4=`
z6)i#JMvsD^p#lVAf=F)9jJVzDEF<QJdcSRxBu|fncv`A`L#b}odOz}0$km?tiiZQq
zbZwfeFo0po>K&mww?NJ#q?F%u2F~)X2Q}MsdcpjYO208pxe4|Obc~ZK_#@IGOa<L)
zk1<TWZ!ya-{7r*XqkSv`XmL>t<GA1LZ1c<yF<y0Oa#_h4mLY|wa4chRMmT!pvbjph
z86i_hkx8v+jwkP{qFp`~z0oPN!Wv`C%*>RWYAHMdz1-Go#?#u3Ut$&{XN-619qLyl
zwKt4)&%Edv%PQU0%l1q0EK^}^vO%$qWq4`)Ec#Soy$DJJ)RfgbdwZtDNZ}?t)Fx2V
z{{ofnqBhv>2(~p^ufgs5<|VK?wX`TK%sF!Bb~?(G7>`ozxnn%-=;i5A3rdB+?!k}0
z*&N8%zl@)|Af!16{gvqNu|`00KqEu)x~GiZ2vWz4Hpx>8x4a{Nm89}|r&3?v+%E&+
zk(?otQ)BaPBUiM1U(0Ptntw8+Jw+1il{E0@1IXZzTZ*Uv64$FB_&i*YCx;aE>Z@RM
z<c(hGJ%_?=Ijx$Sq(Nas70M}MV@Yyo0vR7RB-kiPlJ9kdm~0D8?bQkkJX1BEaq58g
zc}<GfOTGym%WfpYdygFBZ0BXlyi{)veYUn{FPQ83dj6?KYb&D0G@tcM(RddtFlAPa
zVYbE*YTuE@GP67%dd_&4l5M?X68ro{PoS))#WO+e`Pg?0mK+5^GGu5RkGJ<d=M5*<
zdq=67n(VUWb4g%W#8_!i72NfECJj2%1^>JY?(KqK?}B5UqAxif7Ol8EkbD~U6q`j>
zg%>Ma@#LrQxvmjlTNwwlhMCUfFw2<bOaY$qnFsK{oOy^@L7naVJzmK$4!{CHC4l}G
zJjpPt0Z#&60Mr340lon!2*bnxQUDVG3jvP;9tXStIOxJ(1K@MO4Zv+c=oW?<1{e#N
z4X^_W0h<6-fY$-10iOU`0NtK~aty|ywE>m_9tCUxQ~~M$7XaS@n5Q8R7zjuLxF+K-
z7q9_P3D^s$1H1?D0s^<f1He$gSio$+YQRRoZa^*I9l)1>RzN7CG8iBLrUUdaEQ&?~
z@ZDzMFyb=W_8%>+3@zzoR%A{{j<Vmf13msW@u?$!-xB}jCznZ6<P2AAEP4!Nm}^KD
zDm=TrrOC4f6{j3P@g->U+wo&FSmrE%()XaPX~(%tmN5e;Jqqp6cKql}mN^5U^xbG*
zZ^x(2Wwp%wxqb#gyK^qN8r7%!(M2qC9DpBrH9DL$McIZIEn}Id0rb~lYw<6Bo2lMc
zmb1+J0Q_j5(BluX%t-*{eTepp2g!=)KEoE|u}mI-lJ}xL*pA<zZ95+SCzjFui5!UT
z6Uwb%8391Wt!Oh=kW0~v`q$x+jzr1PF)VWrfa2Zzu}ow?+H=z2RV*_MK*>h5mUf(W
z>)QQCbom89<sR<OGLHc${s!6x0DjaT<M09$cmU<CMEhtvP6bwiMqA2zXD!QI22lK5
zA<O)&kR|_6eDQk!o(k9TVp_vn+iSQVGwD!+t!indQVJgn+&k^0B%STpnWS(5G`_xL
zOSNynF!rHzSIv2!)-8?OTFp!DqI!2xo%_!b?mx$P(iR#Uo!w4+O}Bu8?x<i>sy$g6
zk4-(;vr_4H)_T%3M=Il<dB*sb_OWBw@U&&m;{V9?SU*Wk_Qj^V_Tbb}dRwV2!6IQK
z-aGCdhVgl^ftTJ^YfILFSo*6nzc81{kP4LGbJ%g3r-GSpr;Np5<T8HN%u!(RaYaph
zeMQlEx}m&G<<h8}u{5Wa@dUW72XhgbgV@io!xbnq=6hqYCOoa>l6IpLqc&RWu+=cW
z<-qy+TxFK=9|he`#8VeDK{BX9uyHv8`1&-17$&2oXB6%L_mnzcl5Dgx{{vY0#SrL-
z??xKq`nz7n;w-%#mcIjActMC%ppgpHeuMuR38`yx0K)Ru{f;e0gZ;Ljtu0xAdH$V9
zRRly{kVOzJx;ObX|1b>n$7Q+;v5g14^jB6}5(T8fT5FSdDLf6;-S7Ak2zs2gJNMIV
zS{dl+u>r`3-UN0-fag8`Mvu7A6!jS(dW318)Ie-o+OjoZh&M2)+OlYhw#ewakQQ5k
zy0m5cDBecN<vW7pU}#G=BX3LBD&rj8PV}JB{Q^;nD{7-2(g1lxdeD(R_KXQBuXhB|
z!;Ve*IQQ2DI1x2k+o&zS31)T^(zKN(sI$#Spv_~w?qNKP%Wd6(={n`H?r84SPIFr~
z`bir-IbOH59vbN~^0fNq%9Djy{u3p~A4^Lw_?_NC{{-}kayys^qIVTmxIcyiA&{#q
zJ*CXZ9hfV5PoJX<D(Hfw_i4!a=mA*H>aA4A?`Gi(gvMj7_4J_Az+VV>>)!T>__BDd
zl5r@5Lz<O8Ux*9wOsVzHiSN~pV2*=A1hbE}{5ALiZ!j@Tdnj}MzgXh5_S;zg`VKwh
zKvieFHu&SU!S`-g>V7|Uzwa<Pkr3~yqNiHAY@cbP`G&;X1f+B6PR26wWrOnDC8{m4
zcXXg^x=d?Ja}F~9zEr&{;?REpmAoCIElH$^?DGzI51#{Fcb&$OcPR3wGhYxW_}IDf
zr0@iAeKqLV>ER~7FPnVtb){DNsg=H38e%%`ah#iJ;%dw9@sCUEg&b=aUD*FVE&|eZ
zT<=q75m>S709F10s(iD%Qg{2QyM6b{!y=>;FswfxKNx~AY^9adKG0uD-<8+lY8RR#
z)$MEZ3P#qJ9ml`89VBhpHj3^5>Uc!lO`9ySiZ&y}{ghw+1M)yF#Gm2ZEKlAgAawG0
zZ+HxbtfKVW5r_b#W1WWmW(B&oQp+U7Lr#Lqb}?GDZw&<J>kiJNT{s^_fpe~dvjiN!
zmpiGhnhyHpPWk{UzYTP8HoVuC(bI!CPexrQsf!DNI|OkFC6!0ZPQ_?TH0?u1{NC(Z
zT0`%XN786ZzPd%d2l5G!3Tp#h<&IjqnCTWV2x2>9Y2lo5#;A4%t(yb_Q(RG?sj$|$
zY*@af^)0r{_6i>!14-mERpTwBO00G6F-muVy0oa4DGV&N)@kSqPaWQF>C$%x_}-Qc
z#(dAaJN(VV9mBr}?jH=#*V`(l)ZXv1+323;f7?Uxp`!+2RBHGN^n{7FOuQ%6dLMp^
zYV0f|24|gi{bV}wuNZj@kfpG6sXG9sp=L2Yj`C>oH@5nxzH=pc-)TTb_XPj6)m4iv
zv!dw8zS7%>-?I?CTPTH2AHGJGdd8@$Scmeo^$1&~plvOi%gPn8K<Ujs4UPLTUq=$+
z{rQb3BA0v6na-1E`YSroD`j*&MICg`hq=U9bkLR$gP?3ev}`Rs9<*<`Gmk?xec6%|
zwC!g))$sTyAnj9K@kU3i%@F&8SXYd}M#Om!A!*zJa)|e$i|-=JqD$8LqO29Q@435L
zQ#!T!VA~&P#k6^&@2Z?ZRZgUeXf>S)L|zn9cqKw%^SWrvpY8B632eF?)u=yot@Swt
zE)IZ<IFyE?Y#~KQ$Y>%(IT`IuQ2{76;1Ie2+dz<)_qR9kHn~;}I%c)rmje3Td3@*)
zjSqj*_^Wm!J+%6LsmOzcM%Ud1k(rqrR$)C)SAx=ew4V0C&fKoXy9P?Af~z#`CuxlD
zIjq>{OIyS8MbvScak;GRe*axZt}3g-dET>D^V1%GHTM+NH%E3>?d|?Tx!o7vik%h`
zo-twN_1dyBD1k1VR-lWX9psA>FdLaL(0peRv`!^k{7Sa?KI;hi*Z=azl*V)6o08O=
zh!dQ)<h^$Czn$U~N5K!rOzE{H2fFlg9ieVxA>mx?PLFXv9HGA;g>&>6-sruJNy1s1
z_=csk92q`5(K;E|WUzeW%P`OT(qVeDq22f#9%gx8#UiHlr%2;HkI;D<edVCzhy-2s
zoAOz|1*aqX@nW)Pc)B8L9`O!e=)zkJqdnZ?(!F@yYQT{qLwmU2MLf)s5}W8jPdtPF
z`!i<Q>@TdNWvb149!8ZmMA)Civ-e|Ewq0#$EQ3oU`Cw-+q2zi>jzCXJR??g)YEx;;
zgXyA@SZ(<oShkaPo1Ggn=Lo}uFpVmD&&7k@sJepjCG7xU)u2fM6x#tzfTBhfy*z7x
zoI8;of!vAo7}}`Xg#Ti>cNMVfEEzB|BJv>6$uhAHm>t+@RXs*!$+VGiq<B;hb~1Tl
zRP^Ypjy}fE9HFIm6xy=Iw2Ivc(3Z^sB44^?&s}i#RH>wJ{=>d>9h`fbG>+^)m6|Ka
zy8kzGV>`{g2)W;zORqs2Rn**Tvbo*6m`gH8Ww@?t%jVLE-C?z5(}5U2^EIP_AeMpJ
z@^67*d6bXDC~_!s)!Dfbb9ObsKRKc*hPfm8!)m%~=YY<z$^oV~Y;<4o2Uyc-F+CUr
zG^+NKp`&AZi1cR8Z>dH>(nrsBU3JDcs_3m?n%uXG;h^P#<}*MQ40i<6pq77t1BzRu
z9U4_sn69oy6`d3sLLVJh&Wo2IXCJ%{L7oZ{O&)p*_In1WV$q4l-6hKX<-q@+4kbW~
zKVw?t9yDX}5XnXr%^JLo0;8EjFP`09+#CTJclbtd{?KZTY<5R3ZRG~Zxl~4TNpn?O
zzLy?Pt*yRY<OY|~yPCcp|A0LOmys3LE40XvOx*~@t>dIj7wg(lins8hGxUyg>7Lx6
ztmDNp;gg^C@bydgEOlG4MW3;GSE0YnZUb*uD`wa`1q!pW>>LQ*nKG{%<tbsZSLf$_
zR|4E1^BREeQd3^IpZ5ag^#gCV&He~wYAEy8o5(Kt!dcA9%8#+np;Gkr(q<Q^5JQD7
zLMSVX|1_l^T}qA^J8is=%TnE_6n**i9w2M=kujIo;W>;xKQ8yOUj(7Tx<d{^wSKlD
zvxaoz2P*V6WE3C69wL+YHbt+aWTM~<isjL*;23#Zn4#GA5{XXS+4GT?=oY-&hAUj}
z^(yjC;^_X{P*-v1k17rWWTtl*q;R2q5ihT#Z;~PGn<`1-KQ+w1=+H>crgp}Xq|C^-
zP<v0t_%A!{3o+&PG&<(a!{o!HV~W8ql1<6R__HXh7@(qj(=YTLZQhIYz#`+)p=yx4
zXZDgGlFbozzg&kQ?cyza$=H+$ihX;@6Divin-7uUhCw~){%pMA48Z++hIcVpU`Xya
z=^#?(G;V$8cNo-^8)9Eb%~}5jNiY?VL8;MfB}q?R)b}!~d*?NGZmfL+m3s6LIhuM-
zGhjD-pGD)NIz%=b3;V2q;=95j_A^vCjJ#%WkgcXTXgp$?r&wA;`ihJ3uvXlL|Gws-
ziUCz5-Q1V0BU$EsecKMuOQ2YPq+r)dRAO)c*GQB_QY@+_(P@$WFT<xyiM#tD!Fakb
z68G%#hlPt|dRk)NuV0X)Vl(3&XLI(<#cNyXX(3Yzze1i%i()U6BWZE$cjVKw35shR
zd3M4ekS3)^vsGkS`lz7ubinNg$oBLhpf{wavKNSyZc&H_NZP%tVCC!g=CDtZh%o}Y
ziA)(&tx)VE(wJevEwIYN1gPpr>iEHA_Sk%O2RS#^9C8Enit+@yHt<DYXA6n6PGO%R
z%dAU-sU!X_m#jLrnyAMOmuc|LyNZ~`jnowE!&V+Ft-%?(l{m*yOSg?%&fX!a@d8Xq
z9X|<__2ZM-HgX*QH^|NL^VnBN#)OAJKQ$pvp{ycT(gqOK#5{I4$)A{s|FaY0*(UP+
z#DPJr)YXA|NuT?+f^y)#Y5Jq9ur15QqYUdN1lxJ8BBR1ujO!^%(13uiO1(4iqnB1v
zxSEWfbdSQchs>EYL-FozQax#4!WB9{p2Q|J(j}Ys95NTJ6ds1&Hv2(ZMtE{_l8EUS
zCTFqN$P<%wYy_#FJT!_%1jl0z$H$JZMCJ8`dMUh#D5i{sPvfWLMYhj>7a1hL8Y<H?
zC2q93h-L?^e|4QM;L}qbUPU_W55-p~kgm)2$4s3P91F|t&Ryly2iO>Lduo3+mPAgQ
z#%`@yK5e`5$$;01YDRB1fke*G4T-|#PE*qky05nX##S;+7>5h=F0{R5)r@G@fBoYE
zz9swz-xgf|^^Xhx*|&x9|D}%$<lUKTMyM1M9~z(I7~{;(&spKH<v+AIr=WllmD3hw
z<TxfguwqGGPP)U9zkHF?kyEoW^XY)TgH+QUdDd0V2l8gFSibn7B{>;juUJ;2n)7`?
zP0s~416VInE!yUK(|E?%X6$L2WLjccZ7McBX?ost*7T`ql=v6%Rq+GyD>24A!aUJD
z$9&x!V@a@>EMqMhmIBMemd7kxEITawEwz@nEnix2a$t}KjGhb8E!Gw4+`7FwudYSM
z=r#HXeS)6ToAmSb%k@rv7r&psz*FJ<xM~ktJjk_Oze8W8->+}bpV42_d-XT;EqV<f
z!bk8iyuhdMGx*uOga0#M%$M=o`5k-}G#un>`Fg&Azrugcd-?0UQcw#aLYNRE#0n-M
zO_(Pv6zoEtP$p~;HVIpV{X(@+E7S=M!WrS3;1zBNErKR7Brzf}#+67vpI?XZJ-G;O
zAUBG;m&@dK=?>`1^;==u0ew8L7NUj0f&~hT61OF`Bz~COmVAFoe#&zxM-AH4iK(BY
zCK}fngG`yGM@%P74W{=^KbllxcQI6q6k|n`I7^%_E)&;^#o`78_9^i>@qkz>zAe5l
z{wTVB5rfRV%+cmS=F#Rvv(aodPcvtk7n}cNUSodLTw>l}t}qkxGv?>bd(HdI)#gLy
zW9GNaKbiw9y)FGLLo7Or(PFhsvfOW(Yss-Zgt;lTRA6>0EzenYTlQJ1Er%_~EN@v(
zTbe8vEX+cNG2zt4avCm%8_aPoE|nY0P32~Di?}>)HCM>3=QeVL+sZx5y~w@7)o@3-
z<6HxGmV2N3i2IE5aX(>_`{-hI$-0@kY~6BQfv!mRm~OLfn{JQpRox-o3EkVebGnao
zpXt8QeW$yjyQPzKDt&i-sJ@RrMjxjiq93W>tly=7P5-t2pL$mSKY&l*Io`;p@ss&k
z{5;;y7ht|i`3k<0e-^V{!yo5Q@#p!E`7ilz`Jeb-_+glg`-BC;63p@np+Im6<$@bC
zx;jyl^jOm0lA4p)WIlOG@`K5*C7(!+N?D(xGGrTW8SJUgrQS*%ZOk<086P%2VccV6
zT_(<yZhFh~ptw^!BVHAo#XxgkbD{Z+`5Uv^5{uwwSe97!TIwzTvLH!TG7OGmjFJmM
z@E+hcaND_;xKrHUxtY2W-CuOi>-OoIb%FYDJ+Ggx&(^Qf7wRkZFX|8KPwT(ZOZr}X
zKe)J?|CyKgzJgAeFSs1S%ffNt1L1q2O;9Hq5|<>dNpvM{PrQ)$RpQM=MN&l4$fUHS
zSxHNi{+#4VdM_zDIX>B#JTrM+a%J+#<d2fQ$;y=8DFaf{Qu0z<DUYS>PN`4%Fy&gx
z&nevveGMZFV+_*`OAKoawT5$sD+ZsT#SoG@AXQAAo%&#EVXE7ex+Qgg>WS1qV;^Ix
zaX#|6#(2jVYSNkRMOnx)<(djjEv8s;h?pXp#T>CfTqiyuJ}({;KNWuwdzd54Npi|Q
zXkKmJV%}wb*W7GoEm}*YMUU7`w9K+Bx2(04BNY!@PFSv3=vyT2SeQ^Qo=f7!bLtFk
PDfb9h!PTgj)hYf5p%?Ea

delta 8412
zcmd^Edt6jy`afqFZaO$97ZJfgv8eTOX3oGc%$zfL8N7m{C~97?40a++L@;ZiAugNa
zNSUwK)m%*6@Umv23FaE9D_HENrY<F0{uJApz|G2xl=bZQJu?us{r0clf4}qjJo7&1
zd7k%qpWAym@07N(rI*<CCbso8VS@e2(Lbv;T-u-YBkap+!u!!d=d-rR?Uk&}a(gyw
zJ=*OD;<H|tTXPnX+hn<&_4HC3)xmfltA$~vv;Iu1|IKMVv}=rl?au}>%q&pCWh(J!
zH9l_)V~LTS5*X#nFjfu2M7<U}l+?1JiplJ2v62186lSk3g!HUI<U0GX;+m55Q=})J
z(t>0K=m0T*K2Hq8ESZu%Wi};k2*A&JKtI52@`~b-M;8O@^Q17$_%Q|9dCQkFOsXFk
zhXAzKlXagd;@Q`@fDOa^h)NmAhSr5EHLQQVmStS+Dw6IyRgpV@{LXi#Vy&v~mhTcD
z#ryrpjKG!gDHyE$jH*M$pNpNW%y9(dI3_C=oeE%D=#v|2yGB(^4ygMw@HiWC0fU~3
z@bH|{9B1dQYI3aq82?rtLaBbFv;Q9zpZk;Ts#S`od`U>qRYj;DxgE69KUfEWW*?F}
zAS1SV9Lop=gIxdUmLzA;A-v_N-%$p1s9l#m6!O`C0>wxlGE1E@wUcF-ipIi0yEa13
zsY|N7TjV#_br;ku=h?-JPANUcw8+*-MFFlqNs?6ASftc8c0^}LMWIqruvDb7y7rR1
zf&Ac)?n~05Q^8*E;%xJ%T`C26XW$QtOqRSoXk}mv$1<{B5)?96(an+6kZ}XzG^}@^
z7HQ;GvMGd9R1YK0umyo~oahf38k#)N^#DGltDLC;J|FR_Bv&iR37yEUA^Sr|PssN2
zGG$(}YYu(4bY(4G;Jmr$bd#kEiDWv?Inz|GECs_jEh@u2RpB68bqdSOb$;w@c0Eak
zhD9a#{Y=l@e^EVmoRb5be{+9_$Q*}&WXMnzuJ!i)&^3_cg+-Dt!XkWIT5PiAaik;U
zk!3T`*R6oO?1nV57S4M-l185CgSYj;+xy_IJ~-1Gqm0bC&e?In&WUlM&gpRxb7om*
z&a};rC0XH{*fjE8c&XxkEO~D50-tydTQ_j_Tde)rtqd~{Fdk40pwGe$3{wDj1+WuP
z54Z@p4tM~FAed5siGYQG7XZHn>;xPFGy>WHoq)T50UH_SVL%FCHsC41YQVaUjGd_g
zau9F|a0PH1;I|3NG0-Tq(*aKcUI45I)Bx%Me+7I2=mz+0W|&9-2S^9x0g3@@0o8!R
zfEK`)0A>rrr~vT*)0X)R^Ei-vz#6~~z(K%SKpWsLpdX?V0Z0Ulfl=W!3a?>sKsW}!
zg!bnTmNYVVNOth&y9dp@!_7)NQ8aqN#M1}gA}vE^+pC8m46#sxVxb+^cw73uGJ|Da
z0#JMr+Go7@f!Qo`96;%t(bjnJ*i4og3!wD=Xoq<5{c~8R0YK@S(C+r)7>*o^4D!o+
zf@SibARk2L`i;$DnaMdMd1$0xmJOrZK#k1E&t;iH098<lmUwY$a3g56rM%#0SY{Z2
z;`7kvc=0#T9`fRs(cXB5B_BnG4Z5DkGG73w{P$>mmyv%CeUh|Bs#05*vrHR+vTmXM
z+KbbnPJq@kWL6Z*ECWzEH`?#L_`}gGql>228~?t7WjX*<WOxC~Z~%%^75RNs6~DkT
zYXOv3@*AvkzhUd%9u~_U9yUN>&$qKom8Hunh3PQCJXjJirzJqjS4v?iz+E#=Nz%EV
z#ZU_4K;s*GSMhnac)E(W{zZ~_$x+gVrNyy2!m&EanX<&#RMhXin~0`+2DSn$KF$>?
zr!~MiPw80H?o3fdH*AgFw$1py`sJh8^wbqw@Y~QC<017Ubur`YdDtk+?<v(~w63K@
z7aPwo?lUqmKwb6{h~@W{1;x2crnE{4e#daEbLr*x0t#%Du@sD4#={C84Hh3;Qq4D3
zmDKE~50y)ya>nxPcE;)Fuw2VU7_M2XEY()@${gjo8UxF_Dkb&0nHaUn(x$|iZVPa}
zF;_X?_{qwC?~R}?Y6HpdV~0feInvtPgFIFjT!2M89)`RWK+eYwvln1PEx#99P@T(4
ztAeFfDrr@K$GAU6K&sKpe(68hT|>a$<zcJK79*GcA+mHZL|&9d5E&yxJev1D3VM!A
zw<C@tKrg?~s>>pQR9V`sQX=w<rPkwQ3Iv^&c4ts6-4jCtoIz`VeEenUb#_g-vsnr=
zK@?HIR=~JJAl$%sQ}_TRbp;BV5pE-e>WUDG-jUG{AuV*p*eSV|;@y;7ne8u!LtXYN
zs<Zq>Wo%);_kw6F-vuMKq?`IkL*x{aFsk%7XKHX|W1)X8o2#@+f6INaz_F;i$<j@2
z`B^xxe1Ltc%Tdw_3HLH+b6Pr`jNQpNESLDkl+(_VOJH^kl*yEO-a|d_%yvN|oh)v>
zY#n0x4K^}QEbpn|b#xE?Q_!m{TM<E531+V+fH>_jxytgh%FNv1xsq$VYzUQd?KxqG
z*6TRtpzPFTugkrE9{<x|_r{;U==1(~Zw9WHzNlmhm4U$>%I`1620PQ*J-KkdCMyh8
zmraL41TkD)*#P_D1vYx-Cn3!G-(%?WpD`>s2XpCu-y5VBPmo&Nr}|QxJ=A9RDe~92
z5%wZXV%fpp<HUuzg{cdqcY+3Cg1WOo`T0atmp$9lfwJjjY%kBg#{6_by2i$!|41r%
zFBoM`5!vTjcn_cb?0uY;!s1aky>)`jpiX+{oD>!ZuKQhd?Dg=B$Coqi(|xIp9%`dZ
zmB&4UvmPy2b*08LE?pJmSlj88{^_^~NZ)Z?q0I=arSAYIJOi9?r}d@Qd#Lp?RSs!7
zhV@k92D+*|k5L<*8tz#yi;!-0MXDW5!vXJ{Y{1Cs3hd^LumhyRl|nUbW(hU4(FnC@
z)RkwE{PKGd>ayGSJnKs6&t_8v9V`fg$wqwOm7>e-7qQ@cEB8l99|Fftqd-}w=#uqG
z4{I}69{MX(+50jbwece8a*-5KtyskqUCSdOFbS{1A!=U5BD#*ugO}<G>@<w9P)22^
zmQb|PUsk44mub++UVa}~JTULn{II@fYR-V%t{CLpnYP0iP~`toI?Y;X)nZkZrOk?2
zSKfHXn&DlN!=fOF5|pRz$5e-<&5^2fEDk6yX=jT4$}MfG4u7nKD(FC8hoAc^gudKP
z=k~rIdWTQz9sUB?zc4)CXst?XpJ}zy4Mz%#p!Rjiqb^2Qy76p9M`~e4rc~7KI{!ZP
zr+5Av7PYB=yNZr{9|JE_p#F1UYL3GXwqbo{+>cWxoh)Ins%Jg$<l?o{sKg|hkIvt9
z_2j6W?j<oYJxX2nchG6S2x-;ND`R3f1iwdC8e&Fx%FvEu7i!K#Gi8%Ab%T~)o{Z9Z
z6!L)<E)fdl+|7WTTvg9w5ZQ%%Al}r49P3Hl7Kr^q?5a|+5pb?sFxTNH$83}xecV29
zMAjN7Yek(6{ZZ@5cY3sr|7ER+jVt3vm7hZ1efE2=#*0AY;7MVjNR`!9L}Pdtj-9o%
z<4j<$D!I9@{2pp>FC@K=Oz$1?JOuFtSIZVE&suJ>wF=s{v$?Fi6=UFkP<8dll&m8g
zI<Vbg`S6|-YX1bbgN88<0WZuI;%PHo7)6_r0yhGCY@z>q!PrGRY;p)j$SOSfe)FUx
zb<DsCL|vxxl7Dgvnes09W94q0cRfj`Q~B(1kRxP+E_=ydbH;dz(b9&)onu^-<N1gX
z?L{eU6g@*Wxi-QVdQc=`qsFnL$lOs0mdCJLRW_>E?S~7l%k}hoTD@*3Ugo;4HhA(<
zqH=Z9cs02zX|M!(G_}>rC)GRH_HFrga$(ds#Xlb>p`(}BalmHO$AYdPm%Gm3sFLA~
zZbma#N@zi&J|<iOXXe}tt8I2EozUH`VpvsvCc-um@2;a*0(N)fE7*8eT`>f@Y&uHb
zNy!mVK*<V_%S*a_vC_!%j8#|u0LymKZj*9@A4gROGflqq?turr$+rzdO6rGz9RN-8
zp;!&DPAF>f-2qG|WAxtP40<>cY6&+cjAV}uji7fH(`7A3fZ2epiEhL|q<Bnh(3<F0
zpcnwZ)5&|>Q2T?zaO3^LLFJM{T`_^KgOZQBA{j{iyC{LI1&hy}F2AoR`q~yz3b$5)
zQMHC)?n^M+5!3=Tvhlw3OUL7Z?!S7_-s?e(j73owE_qx4=18EY#U|hN_+8JCC&otf
z@8b`t7@J{#psp~|C`v4rb0Eh1?hc$L5MMua<v)NKKT}r@gK{~%xe<@=?rY_Jua%}B
zt$e6A&T_<QoK?{4iL<IV&TVp!S~8!DB9+`6`-7qpO}<+poFX&&m<d`QXzo$y3o{D?
zX>cps={_%apo?mgFYOR2V>C}RYVP~^p-1b=ddS*ZQL!!oI%o;~0TlRxV8@^@D#gwS
za%Z_ze!+!Ny)MM{x^PGCK@aA6GMC1>zf7a?ruTJ@uyw%xyP4i{YS)bP^OO?_)(%%a
zz%hWHx-4Dp(?rx}glwf>b*>Xw?1}>D=7Uc}QllMZ{}!a4k3sojth{r{E_#i`{~41D
zw=*YamElveq<IgXoISbz^G|AJ!l&Qv;Tv=I<TxzY-I}eg6;N%pDZty^h3>AQSexe0
zw_Se;_#Byc0_bif9CArm^}yTl65{4E$jnug89<pgJj~f3xT0m=D9Te&UK4obf_y7D
ze||xfO+|&eP-Rxz7o`wlsL&g-0{&`}JkbiHY;?Z4*2+>Rs8leODwd_VBzX!#h|WY;
zjx4m63WZXkd9sl0w;;%$kO<lXex9P{2$`oFt|&c1igi)!O0rGYt@x;cY)L5c58%;l
zSpx}4oUL&0BTpyp8qmCtZX7jMTrawk_mK$w*kOTKfpL}U{WPIW*J?=NKyV440VG>*
z2-V@8ziL=?sZb>qwRjna^_fH7J%)@$d9L1UOHetscsk~^1`?a}uA;D(e3oP!p~q5;
z0jet3{|mu!?W=_e9$Y$l2qaf{EioCyh$~Rm#}Kdh_*$~TFj>*{CTTNlR~V0x=aWYc
zpxdMIc9D;BQE-MUmK;ddM+F{1iJir*<f0yfT5^MJlc_nSWQ9;jRvL%0q2yKLlY=kT
z!D{bya7%8CEuRXlt|I}a4^_+d!1cK_JS&fo&rQXHZHM~`2ip!&;Q@y?7*~>;LM$};
ziwhM?-X_`NQoNiKx8pb49Isfmm%M5o%pM_cn)eMpevsaC#CY#-gKZoZX;;Ks#Fio%
z7J}Eq^4te!@^>?<ECJSCm*8fm#32<p_tVpx@oe!BTno$Z=SlUrgu#4`B$bMcBh^|o
zAQvAr<!5!7QdleL92d!6BL3rJ*>}jJ<0mVwain9)NRYOTAIjE{qvOZ;uct<AK0v-4
z{|M-VCM2^vN!kRnLVtj~GGPUKWW&U4_6d?RQO7PM+b14UH0~v7md65b!wx6o<9mdZ
zTDGz~$dFVqxD&Lh$~ZbhaCg1yHu-gG8atO9P0b0UK6u3ACTZ9MBy-ZQWE$LZ31sc0
z(JC{lt0Pc)4ky$*<n$zJq<hlSYy-)dtV8@tEf14}lPUGmWIfwOR8#b9Cz&{9A^Qy3
zHDx*I1E<C+&c8_>8~+f=n3~5{lg6o;_#HfL1lvrE(}w%kQ%|F6$Wzm{fYLo}hBhxB
z+qt~_RABj0;TVvs$f&ZE;&z4-0zkm^eMknLD$5a2l%!<(ql$esq;~pjMbjJP!SvyA
zt#B>Vnb3?zx?**Gh+0M~g$1Lx)s}<h$HkI~X#y&uENwn}jkKj{fDcHIkEBt-(Tl^`
zw<ouijm26iteIHTC&H&q>3KuE>F*<h{69x!B4@;oJ&qeUS{YTA6TL2=Y);^?-(&xv
zOgvSVPTBt48EJu0u*{Q;#u+cO5oEG;7#l@?ZJoi+sXJ!fp(MVUA#4m8lBs#*pC8cM
z_3HIl`n^v)u5d#+Ts-%ottBfmhyH)R2A}YMa1Bl_%zch5o);17tC+HUQg-2lqJo0#
zXA7+b%a>-atSg+i*{5#!!cLzJK2dc8mfZDWTZ!*e+p{I(L#A=24AVN(4pW2a1Jgob
zov=|jARG}+3pWI}@V%fEgT*K@UQ7^YiHF7Y<{Rd2Gx8aOD||EoTqqaIiQJ3aT5dD<
z26vD<&V9n&<i6HCq>b06YZ;__2Z_#p#C||~NZX=4uWi+~Y42#ev<$E0qxcx!#Ha8J
z`6axK&*LljHT-&hBfo>M=4<%_{29KPKhIy{JNesu7vIe*bpg6KUA%6hZnDm*o2|>!
z<?B}KiggvbHM$yIt?rQSh^|F<Ue~H?)6st(<8eG0z(sJwxiNNbJeR@!PP0c-tbJ9x
zRr{tkivNLE=?3dK-6Gwy3F{JWCKT)U=<n%=CQVAx861YwhEJ0pGo~AfajS8+@wD+1
z<LAaNjJJ$;jKQW~nKUM&X@+UGX@TiU)6=E`QyD_I&9vKe+H}Em)pXPJmFWkQj}Rn;
z2t$Ms!f3&+7sd(Ggqgw|VS%tj$Pw~{0%5gKER+c^3snLU-WM(lH-)c+9|RvUNE|H2
zijRn+MZGvqoF>i@v&0-RSIieziN#`>=n$(!B5oCTiZ$ZL;#ILj{7#g_Ky!#W+Wd%F
zV>X&C=4s|x=1lWKbB;OBTws3QZZ0vGo7b3MF>f^QG}oFBn?Evtf@I#K$y~xPN`xwm
zdx(3K<2iww#LeUuaM|2)u86a94vui!xYxPe+yU+|SI?c~&T!4#U%8Kw>d(0enmL-K
znk||d%~8z-%@xgc%`MG0ng^Od?Er10cBJ+(ZGzUUwNKT~&@R?yYxA{5+A^&}yHUGM
zyGQ#Ls^M#Gw>Fp$=Oa-KBY6$4=Z*YHK3;cHXGm}+yq-{p)PyHSCoWA~k=T-$q(7z~
zn6y7B(qJ|0H~fzwAbD8wuaZ-e=O))BUr+uvd8IKL_56Zqz3FvRz3H53jPQc6RXA=J
zE(*5<Uol*qCl-iritmW0#8xrHoNP`vFEAIGUo|uN_=^lt@aJ^gIQYL19@leCC}yQ*
zpk{<-jAp84z9vVrTC+*>w&t|vBY2pp-K%|Ddro^ptL7i(7xDRgIsbe9Ab*_i;KOx~
z>NL7^6z3+Cru~TS1KsDkZ*+kP5ebha2nnSLe@VEUa4W$-kx!hOSeW>7;_njQN&Iu-
zg~V?Xhv_wXgFaJVps&<#*6-E-Nq<iNnf^PyGATUi(WKm@lB8FXwkQ1|=~U8%q_2|t
z8KMni3`Rq$VX<L_q2ADJ=rpL4`Q+^6KPI0^zL9(<`CrNX?ZznM7~>y|7g5Jw8gCm1
zn?{;=Q;KP(>DQ(z(_5zZF!^1k?@g=_EyN3{C{w%ex=@F*{7`5|<n9ZB;!wFDGsUOH
y72+%68S%2{5`PeV%@O8NW;3lLtn2i%!w*yLAuf&^jY#5Ee(IJyU9H&QWBNBf!}%is

diff --git a/2.x/trunk/KProcessHacker/include/kph.h b/2.x/trunk/KProcessHacker/include/kph.h
index 84bd08bc4..f8d3855d6 100644
--- a/2.x/trunk/KProcessHacker/include/kph.h
+++ b/2.x/trunk/KProcessHacker/include/kph.h
@@ -107,6 +107,20 @@ typedef struct _DRIVER_BASIC_INFORMATION
     ULONG DriverSize;
 } DRIVER_BASIC_INFORMATION, *PDRIVER_BASIC_INFORMATION;
 
+/* ETW registration object information */
+
+typedef enum _ETWREG_INFORMATION_CLASS
+{
+    EtwRegBasicInformation,
+    MaxEtwRegInfoClass
+} ETWREG_INFORMATION_CLASS;
+
+typedef struct _ETWREG_BASIC_INFORMATION
+{
+    GUID Guid;
+    ULONG_PTR SessionId;
+} ETWREG_BASIC_INFORMATION, *PETWREG_BASIC_INFORMATION;
+
 typedef struct _KPH_ATTACH_STATE
 {
     BOOLEAN Attached;
@@ -336,6 +350,15 @@ NTSTATUS KphQueryInformationDriver(
     __in KPROCESSOR_MODE AccessMode
     );
 
+NTSTATUS KphQueryInformationEtwReg(
+    __in HANDLE EtwRegHandle,
+    __in ETWREG_INFORMATION_CLASS EtwRegInformationClass,
+    __out_bcount_opt(EtwRegInformationLength) PVOID EtwRegInformation,
+    __in ULONG EtwRegInformationLength,
+    __out_opt PULONG ReturnLength,
+    __in KPROCESSOR_MODE AccessMode
+    );
+
 NTSTATUS KphQueryNameFileObject(
     __in PFILE_OBJECT FileObject,
     __inout_bcount(BufferLength) PUNICODE_STRING Buffer,
diff --git a/2.x/trunk/KProcessHacker/include/kprocesshacker.h b/2.x/trunk/KProcessHacker/include/kprocesshacker.h
index 703b074e9..9423c976a 100644
--- a/2.x/trunk/KProcessHacker/include/kprocesshacker.h
+++ b/2.x/trunk/KProcessHacker/include/kprocesshacker.h
@@ -91,6 +91,7 @@
 #define KPH_OPENDRIVER KPH_CTL_CODE(202)
 #define KPH_QUERYINFORMATIONDRIVER KPH_CTL_CODE(203)
 #define KPH_OPENTYPE KPH_CTL_CODE(204)
+#define KPH_QUERYINFORMATIONETWREG KPH_CTL_CODE(205)
 
 /* Standard Driver Routines */
 
diff --git a/2.x/trunk/KProcessHacker/include/version.h b/2.x/trunk/KProcessHacker/include/version.h
index 702b32457..7726dd96f 100644
--- a/2.x/trunk/KProcessHacker/include/version.h
+++ b/2.x/trunk/KProcessHacker/include/version.h
@@ -76,18 +76,22 @@ EXT ACCESS_MASK ThreadAllAccess;
 
 /* Offsets */
 /* Structures
- * Et: ETHREAD
+ * Ege: ETW_GUID_ENTRY
  * Ep: EPROCESS
+ * Ere: ETW_REG_ENTRY
+ * Et: ETHREAD
  * Oh: OBJECT_HEADER
  * Ot: OBJECT_TYPE
  * Oti: OBJECT_TYPE_INITIALIZER, offset measured from an OBJECT_TYPE
  */
-EXT ULONG OffEtClientId;
+EXT ULONG OffEgeGuid;
 EXT ULONG OffEpJob;
 EXT ULONG OffEpObjectTable;
 EXT ULONG OffEpProtectedProcessOff;
 EXT ULONG OffEpProtectedProcessBit;
 EXT ULONG OffEpRundownProtect;
+EXT ULONG OffEreGuidEntry;
+EXT ULONG OffEtClientId;
 EXT ULONG OffOhBody;
 EXT ULONG OffOtName;
 EXT ULONG OffOtIndex;
diff --git a/2.x/trunk/KProcessHacker/kprocesshacker.c b/2.x/trunk/KProcessHacker/kprocesshacker.c
index 6a985c357..6d5bd5441 100644
--- a/2.x/trunk/KProcessHacker/kprocesshacker.c
+++ b/2.x/trunk/KProcessHacker/kprocesshacker.c
@@ -260,6 +260,8 @@ PCHAR KphpGetControlCodeName(ULONG ControlCode)
             return "KphQueryInformationDriver";
         case KPH_OPENTYPE:
             return "KphOpenType";
+        case KPH_QUERYINFORMATIONETWREG:
+            return "KphQueryInformationEtwReg";
         
         default:
             return "Unknown";
@@ -1508,6 +1510,82 @@ NTSTATUS KphDispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
         }
         break;
         
+        case KPH_QUERYINFORMATIONETWREG:
+        {
+            struct
+            {
+                HANDLE ProcessHandle;
+                HANDLE EtwRegHandle;
+                ETWREG_INFORMATION_CLASS EtwRegInformationClass;
+                PVOID EtwRegInformation;
+                ULONG EtwRegInformationLength;
+                PULONG ReturnLength;
+            } *args = dataBuffer;
+            ETWREG_BASIC_INFORMATION basicInfo;
+            KPH_ATTACH_STATE attachState;
+            
+            CHECK_IN_LENGTH;
+            
+            if (args->EtwRegInformationClass != EtwRegBasicInformation)
+            {
+                status = STATUS_INVALID_INFO_CLASS;
+                goto IoControlEnd;
+            }
+            
+            status = KphAttachProcessHandle(args->ProcessHandle, &attachState);
+            
+            if (!NT_SUCCESS(status))
+                goto IoControlEnd;
+            
+            if (attachState.Process == PsInitialSystemProcess)
+                MakeKernelHandle(args->EtwRegHandle);
+            
+            status = KphQueryInformationEtwReg(
+                args->EtwRegHandle,
+                EtwRegBasicInformation,
+                &basicInfo,
+                sizeof(ETWREG_BASIC_INFORMATION),
+                NULL,
+                KernelMode
+                );
+            KphDetachProcess(&attachState);
+            
+            if (!NT_SUCCESS(status))
+                goto IoControlEnd;
+            
+            if (
+                args->EtwRegInformation &&
+                args->EtwRegInformationLength >= sizeof(ETWREG_BASIC_INFORMATION)
+                )
+            {
+                __try
+                {
+                    ProbeForWrite(args->EtwRegInformation, args->EtwRegInformationLength, 1);
+                    memcpy(args->EtwRegInformation, &basicInfo, sizeof(ETWREG_BASIC_INFORMATION));
+                }
+                __except (EXCEPTION_EXECUTE_HANDLER)
+                {
+                    status = GetExceptionCode();
+                    goto IoControlEnd;
+                }
+            }
+            
+            if (args->ReturnLength)
+            {
+                __try
+                {
+                    ProbeForWrite(args->ReturnLength, sizeof(ULONG), 1);
+                    *args->ReturnLength = sizeof(ETWREG_BASIC_INFORMATION);
+                }
+                __except (EXCEPTION_EXECUTE_HANDLER)
+                {
+                    status = GetExceptionCode();
+                    goto IoControlEnd;
+                }
+            }
+        }
+        break;
+        
         default:
         {
             dprintf("Unrecognized IOCTL code 0x%08x\n", controlCode);
diff --git a/2.x/trunk/KProcessHacker/ob.c b/2.x/trunk/KProcessHacker/ob.c
index ab72700f3..0cc7cc47c 100644
--- a/2.x/trunk/KProcessHacker/ob.c
+++ b/2.x/trunk/KProcessHacker/ob.c
@@ -890,3 +890,128 @@ PHANDLE_TABLE ObReferenceProcessHandleTable(
     
     return handleTable;
 }
+
+/* KphQueryInformationEtwReg
+ * 
+ * Queries information about an ETW registration entry.
+ */
+NTSTATUS KphQueryInformationEtwReg(
+    __in HANDLE EtwRegHandle,
+    __in ETWREG_INFORMATION_CLASS EtwRegInformationClass,
+    __out_bcount_opt(EtwRegInformationLength) PVOID EtwRegInformation,
+    __in ULONG EtwRegInformationLength,
+    __out_opt PULONG ReturnLength,
+    __in KPROCESSOR_MODE AccessMode
+    )
+{
+    NTSTATUS status = STATUS_SUCCESS;
+    PVOID etwRegEntry;
+    POBJECT_TYPE objectType;
+    UNICODE_STRING objectTypeName;
+    UNICODE_STRING etwRegistrationName;
+    
+    if (WindowsVersion < WINDOWS_VISTA)
+        return STATUS_NOT_SUPPORTED;
+    
+    if (
+        EtwRegInformationClass < EtwRegBasicInformation || 
+        EtwRegInformationClass >= MaxEtwRegInfoClass
+        )
+        return STATUS_INVALID_INFO_CLASS;
+    
+    /* Probe user input. */
+    if (AccessMode != KernelMode)
+    {
+        __try
+        {
+            if (EtwRegInformation)
+                ProbeForWrite(EtwRegInformation, EtwRegInformationLength, 1);
+            if (ReturnLength)
+                ProbeForWrite(ReturnLength, sizeof(ULONG), 1);
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER)
+        {
+            return GetExceptionCode();
+        }
+    }
+    
+    status = ObReferenceObjectByHandle(
+        EtwRegHandle,
+        0,
+        NULL,
+        KernelMode,
+        &etwRegEntry,
+        NULL
+        );
+    
+    if (!NT_SUCCESS(status))
+        return status;
+    
+    /* HACK: we can't get a pointer to the ETW registration type, so we have 
+     * to check this way.
+     */
+    objectType = KphGetObjectTypeNt(etwRegEntry);
+    objectTypeName = *(PUNICODE_STRING)KVOFF(objectType, OffOtName);
+    RtlInitUnicodeString(&etwRegistrationName, L"EtwRegistration");
+    
+    if (!RtlEqualUnicodeString(&objectTypeName, &etwRegistrationName, TRUE))
+    {
+        ObDereferenceObject(etwRegEntry);
+        return STATUS_OBJECT_TYPE_MISMATCH;
+    }
+    
+    __try
+    {
+        switch (EtwRegInformationClass)
+        {
+            case EtwRegBasicInformation:
+            {
+                if (EtwRegInformation)
+                {
+                    /* Check buffer length. */
+                    if (EtwRegInformationLength == sizeof(ETWREG_BASIC_INFORMATION))
+                    {
+                        PETWREG_BASIC_INFORMATION basicInfo;
+                        PVOID guidEntry;
+                        
+                        basicInfo = (PETWREG_BASIC_INFORMATION)EtwRegInformation;
+                        
+                        guidEntry = *(PVOID *)KVOFF(etwRegEntry, OffEreGuidEntry);
+                        
+                        if (guidEntry)
+                        {
+                            basicInfo->Guid = *(PGUID)KVOFF(guidEntry, OffEgeGuid);
+                        }
+                        else
+                        {
+                            memset(&basicInfo->Guid, 0, sizeof(GUID));
+                        }
+                        
+                        basicInfo->SessionId = 0; // TODO
+                    }
+                    else
+                    {
+                        status = STATUS_INFO_LENGTH_MISMATCH;
+                    }
+                }
+                
+                if (ReturnLength)
+                    *ReturnLength = sizeof(DRIVER_BASIC_INFORMATION);
+            }
+            break;
+            
+            default:
+            {
+                status = STATUS_INVALID_INFO_CLASS;
+            }
+        }
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        status = GetExceptionCode();
+    }
+    
+    ObDereferenceObject(etwRegEntry);
+    
+    return status;
+}
diff --git a/2.x/trunk/KProcessHacker/version.c b/2.x/trunk/KProcessHacker/version.c
index f7f785549..ea220f949 100644
--- a/2.x/trunk/KProcessHacker/version.c
+++ b/2.x/trunk/KProcessHacker/version.c
@@ -130,12 +130,12 @@ NTSTATUS KvInit()
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff;
         ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff;
         
-        OffEtClientId = 0x1ec;
         OffEpJob = 0x134;
         OffEpObjectTable = 0xc4;
         OffEpProtectedProcessOff = 0;
         OffEpProtectedProcessBit = 0;
         OffEpRundownProtect = 0x80;
+        OffEtClientId = 0x1ec;
         OffOhBody = 0x18;
         OffOtName = 0x40;
         OffOtIndex = 0x4c;
@@ -189,12 +189,12 @@ NTSTATUS KvInit()
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff;
         ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff;
         
-        OffEtClientId = 0x1e4;
         OffEpJob = 0x120;
         OffEpObjectTable = 0xd4;
         OffEpProtectedProcessOff = 0;
         OffEpProtectedProcessBit = 0;
         OffEpRundownProtect = 0x90;
+        OffEtClientId = 0x1e4;
         OffOhBody = 0x18;
         OffOtName = 0x40;
         OffOtIndex = 0x4c;
@@ -242,12 +242,14 @@ NTSTATUS KvInit()
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1fff;
         ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff;
         
-        OffEtClientId = 0x20c;
+        OffEgeGuid = 0xc;
         OffEpJob = 0x10c;
         OffEpObjectTable = 0xdc;
         OffEpProtectedProcessOff = 0x224;
         OffEpProtectedProcessBit = 0xb;
         OffEpRundownProtect = 0x98;
+        OffEreGuidEntry = 0x8;
+        OffEtClientId = 0x20c;
         OffOhBody = 0x18;
         
         INIT_SCAN(
@@ -304,12 +306,14 @@ NTSTATUS KvInit()
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x1fff;
         ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff;
         
-        OffEtClientId = 0x22c;
+        OffEgeGuid = 0xc;
         OffEpJob = 0x124;
         OffEpObjectTable = 0xf4;
         OffEpProtectedProcessOff = 0x26c;
         OffEpProtectedProcessBit = 0xb;
         OffEpRundownProtect = 0xb0;
+        OffEreGuidEntry = 0x8;
+        OffEtClientId = 0x22c;
         OffOhBody = 0x18;
         OffOtName = 0x8;
         OffOtIndex = 0x14; /* Now only a UCHAR, not a ULONG */
diff --git a/2.x/trunk/ProcessHacker/include/providers.h b/2.x/trunk/ProcessHacker/include/providers.h
index ea6a0effe..fa28bc525 100644
--- a/2.x/trunk/ProcessHacker/include/providers.h
+++ b/2.x/trunk/ProcessHacker/include/providers.h
@@ -482,4 +482,23 @@ typedef struct _PH_MEMORY_ITEM
     PPH_STRING Name;
 } PH_MEMORY_ITEM, *PPH_MEMORY_ITEM;
 
+typedef struct _PH_MEMORY_PROVIDER *PPH_MEMORY_PROVIDER;
+
+typedef BOOLEAN (NTAPI *PPH_MEMORY_PROVIDER_CALLBACK)(
+    __in PPH_MEMORY_PROVIDER Provider,
+    __in __assumeRefs(1) PPH_MEMORY_ITEM MemoryItem
+    );
+
+typedef struct _PH_MEMORY_PROVIDER
+{
+    PPH_MEMORY_PROVIDER_CALLBACK Callback;
+
+    HANDLE ProcessId;
+    HANDLE ProcessHandle;
+} PH_MEMORY_PROVIDER, *PPH_MEMORY_PROVIDER;
+
+VOID PhMemoryProviderUpdate(
+    __in PPH_MEMORY_PROVIDER Provider
+    );
+
 #endif
diff --git a/2.x/trunk/ProcessHacker/memprv.c b/2.x/trunk/ProcessHacker/memprv.c
index 921c7e3eb..c0a1e4c6e 100644
--- a/2.x/trunk/ProcessHacker/memprv.c
+++ b/2.x/trunk/ProcessHacker/memprv.c
@@ -23,4 +23,9 @@
 #define MEMPRV_PRIVATE
 #include <phapp.h>
 
+VOID PhMemoryProviderUpdate(
+    __in PPH_MEMORY_PROVIDER Provider
+    )
+{
 
+}
diff --git a/2.x/trunk/phlib/hndlinfo.c b/2.x/trunk/phlib/hndlinfo.c
index 119ac4521..f33199521 100644
--- a/2.x/trunk/phlib/hndlinfo.c
+++ b/2.x/trunk/phlib/hndlinfo.c
@@ -501,7 +501,29 @@ NTSTATUS PhpGetBestObjectName(
     NTSTATUS status;
     PPH_STRING bestObjectName = NULL;
 
-    if (PhStringEquals2(TypeName, L"File", TRUE))
+    if (PhStringEquals2(TypeName, L"EtwRegistration", TRUE))
+    {
+        if (PhKphHandle)
+        {
+            ETWREG_BASIC_INFORMATION basicInfo;
+
+            status = KphQueryInformationEtwReg(
+                PhKphHandle,
+                ProcessHandle,
+                Handle,
+                EtwRegBasicInformation,
+                &basicInfo,
+                sizeof(ETWREG_BASIC_INFORMATION),
+                NULL
+                );
+
+            if (NT_SUCCESS(status))
+            {
+                bestObjectName = PhFormatGuid(&basicInfo.Guid);
+            }
+        }
+    }
+    else if (PhStringEquals2(TypeName, L"File", TRUE))
     {
         // Convert the file name to a DOS file name.
         bestObjectName = PhResolveDevicePrefix(ObjectName);
diff --git a/2.x/trunk/phlib/include/kph.h b/2.x/trunk/phlib/include/kph.h
index 597b62d06..e36205345 100644
--- a/2.x/trunk/phlib/include/kph.h
+++ b/2.x/trunk/phlib/include/kph.h
@@ -60,6 +60,7 @@
 #define KPH_OPENDRIVER KPH_CTL_CODE(202)
 #define KPH_QUERYINFORMATIONDRIVER KPH_CTL_CODE(203)
 #define KPH_OPENTYPE KPH_CTL_CODE(204)
+#define KPH_QUERYINFORMATIONETWREG KPH_CTL_CODE(205)
 
 // Process handle information
 
@@ -107,6 +108,20 @@ typedef struct _DRIVER_SERVICE_KEY_NAME_INFORMATION
     UNICODE_STRING ServiceKeyName;
 } DRIVER_SERVICE_KEY_NAME_INFORMATION, *PDRIVER_SERVICE_KEY_NAME_INFORMATION;
 
+// ETW registration object information
+
+typedef enum _ETWREG_INFORMATION_CLASS
+{
+    EtwRegBasicInformation,
+    MaxEtwRegInfoClass
+} ETWREG_INFORMATION_CLASS;
+
+typedef struct _ETWREG_BASIC_INFORMATION
+{
+    GUID Guid;
+    ULONG_PTR SessionId;
+} ETWREG_BASIC_INFORMATION, *PETWREG_BASIC_INFORMATION;
+
 NTSTATUS KphInit();
 
 NTSTATUS KphConnect(
@@ -421,4 +436,14 @@ NTSTATUS KphOpenType(
     __in POBJECT_ATTRIBUTES ObjectAttributes
     );
 
+NTSTATUS KphQueryInformationEtwReg(
+    __in HANDLE KphHandle,
+    __in HANDLE ProcessHandle,
+    __in HANDLE EtwRegHandle,
+    __in ETWREG_INFORMATION_CLASS EtwRegInformationClass,
+    __out_bcount_opt(EtwRegInformationLength) PVOID EtwRegInformation,
+    __in ULONG EtwRegInformationLength,
+    __out_opt PULONG ReturnLength
+    );
+
 #endif
diff --git a/2.x/trunk/phlib/kph.c b/2.x/trunk/phlib/kph.c
index 9b77aa4e0..3cc0c2cec 100644
--- a/2.x/trunk/phlib/kph.c
+++ b/2.x/trunk/phlib/kph.c
@@ -1728,3 +1728,41 @@ NTSTATUS KphOpenType(
         NULL
         );
 }
+
+NTSTATUS KphQueryInformationEtwReg(
+    __in HANDLE KphHandle,
+    __in HANDLE ProcessHandle,
+    __in HANDLE EtwRegHandle,
+    __in ETWREG_INFORMATION_CLASS EtwRegInformationClass,
+    __out_bcount_opt(EtwRegInformationLength) PVOID EtwRegInformation,
+    __in ULONG EtwRegInformationLength,
+    __out_opt PULONG ReturnLength
+    )
+{
+    struct
+    {
+        HANDLE ProcessHandle;
+        HANDLE EtwRegHandle;
+        ETWREG_INFORMATION_CLASS EtwRegInformationClass;
+        PVOID EtwRegInformation;
+        ULONG EtwRegInformationLength;
+        PULONG ReturnLength;
+    } args;
+
+    args.ProcessHandle = ProcessHandle;
+    args.EtwRegHandle = EtwRegHandle;
+    args.EtwRegInformationClass = EtwRegInformationClass;
+    args.EtwRegInformation = EtwRegInformation;
+    args.EtwRegInformationLength = EtwRegInformationLength;
+    args.ReturnLength = ReturnLength;
+
+    return KphpDeviceIoControl(
+        KphHandle,
+        KPH_QUERYINFORMATIONETWREG,
+        &args,
+        sizeof(args),
+        NULL,
+        0,
+        NULL
+        );
+}