From 932bbb0b28653fecd471d3f4c19239524afccea0 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Sun, 5 Apr 2009 00:28:15 +0000
Subject: [PATCH] added highlighting for GUI threads

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1009 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 trunk/CHANGELOG.txt                           |   2 +
 trunk/KProcessHacker/i386/kprocesshacker.sys  | Bin 16384 -> 16896 bytes
 trunk/KProcessHacker/kph_nt.c                 |  42 ++++++++++++
 trunk/KProcessHacker/kph_nt.h                 |  14 +++-
 trunk/KProcessHacker/kprocesshacker.c         |  22 +++++++
 trunk/KProcessHacker/kprocesshacker.h         |   1 +
 trunk/ProcessHacker/Components/ThreadList.cs  |   6 +-
 trunk/ProcessHacker/Forms/HackerWindow.cs     |   8 +--
 trunk/ProcessHacker/Forms/OptionsWindow.cs    |  20 +++---
 trunk/ProcessHacker/KProcessHacker.cs         |  13 +++-
 .../Properties/Settings.Designer.cs           |  60 ++++++++++++++++--
 .../Properties/Settings.settings              |  16 ++++-
 .../ProcessHacker/Providers/ThreadProvider.cs |  22 +++++++
 trunk/ProcessHacker/app.config                |  16 ++++-
 14 files changed, 215 insertions(+), 27 deletions(-)

diff --git a/trunk/CHANGELOG.txt b/trunk/CHANGELOG.txt
index c7685705c..509c9d854 100644
--- a/trunk/CHANGELOG.txt
+++ b/trunk/CHANGELOG.txt
@@ -23,6 +23,8 @@ Process Hacker
    * Custom module information querying; can now display the modules for protected processes
    * Displays service DLL paths
    * Thread list displays cycles instead of context switches on Windows Vista
+   * GUI threads are highlighted (with KProcessHacker)
+   * Suspended and GUI thread highlighting can be configured
  * FIXED:
    * #2642442 - "System Information label text gets clipped"
    * #2694437 - "Crash when sorting the process list"
diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys
index 3f49db79ddba765d7603aa2dc1d49ebcf6cd1607..ed33b4dca74e393d4b04e592fade0203149632d2 100644
GIT binary patch
delta 4214
zcmc&%e_T{m7Qgp7zyN~`&I|%Gz@Yq?fe~ij`~u!EkU4~Xqz06<LWKku*-}Jkt&e;_
zM@)QD(1lIY3bj^uqpc0MWesgC3M?v0C@r@rvB2r0e#(k1l|6Uf7?}OjU;93v@4NSY
z&$;KGbMHO(zSq!z8@A#W8y;-U%B|n_M)ZG&r!X;m5!$1lZW(ra%dNx5y=B{QueaPh
z{5q6{YgSdzKIm7E(}B<;?2nX}KVEoUG=dl$jKv6<fC&;<zY-{=0DbFEiOi4VWDdUF
zuZBU$P1fUBJVIKr3?FWdQxZ28Tg1^m?HDLUfN75!p^DV%veKGTsDJ^a2T+|k<Qh)W
zCPHo6lY>yd^OoDdON0*2gqIUQ{m_s*m?+Czv||atACL~1_NWp1GPSz={&lMmdW#NJ
z1)%!&uBVwwOr)Yfra?=TqWA!(7NfDl3X&^&GwB0Agqj?quDVfFC*~ca;~znniV@Ig
zc8obE6%sv070{3MTg&7Wll^|V0dCqoSWYhb-HES}Z2!4)K7nzX922g(2^6}s6%173
z=KOC8Dp4iF7hNtKdpL+}^)F|XvM!Im6*CvYNW7S<FVSH%?#2j>zY4F-bz+fv_wL%z
zZYSjrQT~9yiv?a!`4-Ca0xuDGHRU%_euKbE1zt+|63X8z@N$8_lmdJnt_Q)bf*?W=
z3{nBai^ics9a0JWOO%hGyiDNL0^dS;MERc~X3&op_$tbe0X2SB;57p8r2HV|-+@;>
zbkGR`Jr#6QL6^`$FYr>zcTj$hz?%gAQZn${Den^abjk;I4+8Jm;8_orZ35$_OsQuj
zFgXI#L76)}`J0RC#0vzffl^r>4wUi)ri3yn9xX771SW?vk)GMWI0Z&cnE;Ppw-hSN
zUl*YP`j7&VJgD+o#h?N9jXIH}1wE5C0t+#=aB_0;fG!7EH*IFprkXZ8XfuU2HMCi!
zBUghenddNB6TE_XER>uG)`f$?OM*d+%JxCb$m!}GC4Wy;sn5_>=rM=XHGyjv^f|83
zb|tP9@%fU1NkthsAxlzh1r9{lV3bPKTr^r(iT2sZzL_!-BbVI181}t$><HvrlVgO>
zADvX>!7c!OSXu;T_@a@fFkg4i+-}Og!IzKqIffv4+&%&C81e*>9dZ>TLF9b!#@J0@
zgJ)cBlaqSV+@1r27dAI;gaYzvBiSrjtrm1ZL0T~OhY%RQF&)Is?Nq67Qc*<$LNqv*
z=tGQARn(kU>|OL`$g3TW2qz!1iPVLt<P{+H^}aqt6?q{f5m%9+kd@?YXbj#+3TNJd
zH$m9Rzz)nTg?DPGO4mRwiy>Qm<5nWxaT#0`OxmbJ&D0^7%_{O>=mW9ay&YV~O$B_B
z1VW;bIe*dFNEj&{ra+o36P%_dJnQ-V39zu0JSvS$^;!snRq)LRodCY*3WPju(5X0v
zrM=+&lVR0icfdK_)ado8sKGl!(X$ewB)_np+0BkCFrRY1Km_8Qq<B^YgjqYwkT}h<
z(3M7!e??eqPgt{~0b+)EnYAb&f)zGztZcos4b(XNr%=8~I-^LwuZ?ubG??zHTf9?A
zcTg;D>9WhU7*CQ4#d+L87KiKL-4JfYdr5b=J|O4!*t;-03Ad2&h`sm_>5BLlzC!*O
zxh&!&>^j~d$yg?-nN@)xQI_&2`Tntw$fuDR5o<trgl_JP#gdvGKJhzajYJovN+^K<
zys0@bnQ;HKdd;-@E>aq$X7V(|71fT5NTjlXxu_v~l=q4|eOlxv<!SkC<uywxs>@5u
zmabWAWQA&1pDJSpaWgIT>QaPs06X9=z*@jIz%IZcz{`LEzzARhAh{2raDWalA5aLW
z0z3-%3*dFYM}YGHf4J3D01F@&umZ3N@HpTQ;MgjZhTen9CxFWUaT!AKfJ}fBuo|!l
z@F-v};7D0(TzL5P?*Il;`fh;60GLbOR_DSJgvBZGpUJ$q#bIi=rt>ri(J2Nk)I(b1
zZZ#eZ$LIwBeXdJ-eHygA0j`XP0JMGy${!*y`8-Y`Q^aAU1W^76l<qizKNk-NDuD7k
z5-@5>z+HwpyYb8M2~4DPIh>O34Np$Gdc_q8PT-1>VqkiPi9HcE7?m~-liI|&vR%JA
zC^z?>A<rk?6>WoW8+w=(NScZUU3G(~R?_DfI0q-#cw7*PNz&crTme@8Iz-2SGjFu1
zeE?kH8|m8*jjUeX<gL1nQo<SfNM|4zY^IISS6WBmj-8Be-wB1Q?u=*ywLO>GewuV7
z#WDp$<am-!?SwAA^KyIv)NfQ}14)P`f%)ttF=^(h&p=Z9bblUy9~z)6p0azCY}RN(
z2~2pCW5886fa?6lw~=nmN+wZEBDFbql-#3D!QEt=mJN{7$hZ&5Yg%i-Af2nLACRls
zL?$YLBqXQe^JGb~N%`yzwhqEKR-faP2o`sI4>^!*$HnB!<VD7q6Vpe8Z^>V@zK7d@
z`dIDnsvDX%1OFkVDF$U_-}HV@f$nwdt>lH2+4v#yW{M6kBHyN@%A*BKepAr~`w^4Q
zia#Xx>#}5R;M9$iv4!;Lw5p{8-XX@Ff_$0_b`inz6pLPYM^K2pNg)InK7Wu8YiifS
z_TwAr+d1~!+d_v6GrS|pryM#%?wePp+}1D1*WDyvPQC#7$G!nCL4w`r@n@tY)ezY!
z@S<N&SsVFVDu<VmuTmGtWj>v$u`xsJY4c@AA@#uMv@oA1B+Y~$B>ic+sD*;`rqwWD
zGE<*APkP+zxo_iq2djL2IlhMajlK?(HTsko@lhexeK*M;1BP_!HT7GBHTJBaZuw#g
z^d*94p>KW%Az|nhJLu$_X}w_V=bkBF7*Cwf5l;l<U|~fE-L7xKIzZxsDfk(1!#%*~
zpK8ie!S%~K2Abwa@c9F9e+Gei6;*%YZ8F<XyS(EbjLrhIkd#QFP+$N9m;n$0`~d!d
z0Du?}2nYfM10;YDz)V0WKne&0%mT;&a&peFB%p!jRpp7U9JY1_{9*W!Ad3t?OJXc6
z?j!{k<^TImNd0|xLYKligVF95IXC>)O@~ma$XUJazVh64)k~|_)RdFi8Q*uQGW#&W
zwg>88G#@vgG@mp7Xb!X}E%BB-OTJ~LWt-&*%LU7X<*FsXDzS!JmDU97zpee&@2nB&
z(dlXFtJC+V|08`U-IlRG!<}&<BPlaC^O4L0nLU}OGr!6FK2yZWxMFSt*UF7>7r9`Y
z%BHoMZ1>n6u+`ai*!J80X**_<WX;XGr9P`A>zS-qv);`*o%MAVw#)6&_G0@n`)PYX
zc20J2_MYs+*#p^MW&e;pnT^y4?SxGmtY4;Iu3x8b*AMDH*NY9e8}2sL8Fm`r3Sr~e
z4A#Lu#BOK1*e_UYj5H<~A2vR2eA0N(_?q#o@kgV`q%qAiWt+-P9i|se^`}fxX05r%
zTx_l|zh?f-JZk>de9atW3AeBosdbfglXbhb&Dvq@w7zRSZ9SJR%TQ&^&j2s<!mqc=
zpf+?GUNUqWdJMgWe#59?%phXLtdy0rI#$o7vo>}KyNoSi%UJqfydAp6>J#)<{aXDl
z{Zr)qtZYjv%+)$>C)dKYal5#^TnG0ocZlocUg8dO-CPgn=6bn)Zh#x)hPYGQ8JN>1
M+q<@|1@;d7Ki3e#_5c6?

delta 3743
zcmc(ieRNah9mk*NHf>V~ZPKLlB>{phC2iA^o2E&Vo2DI@T38E7p~^%dK*7+1QlL!c
zC=C{rdWom?2WRw*VR@ONsB?BG$EmbhZI#wlL5KLVs;J4L8&i&_9;(^z>1`$I{_wx$
zoX>sk^ZmU%@AuvWcGEzBwma!SM_J|C!!OPFX6PEDLm{kRdiU<3p7C<`Q15uTf2eP~
z+%@zfmbDw!`dJK__<7ufRMQ0V>Pv4eoYY1LN2gLbA?A*MIk?+SLOxxTw45X4NfRNu
zj@dd5mKBrUti<}09kaEmMNR9rH(~vt7B5Of2N&tgWD~|RA0k8akigBQIZ(u9S#L^4
z!Gkd0TqNeFC&agK@xo<HI>7>cNCIMoom^J(qbz45!c5NYhqwmXVUmMVmc*G1pq1q$
z5(6cnCJj`|UY`5sctYCTms*=Ik!HE*z7&2Nqx|jY5p;(<(KLmL5<kY7<L}@uuYjZR
zm5Gfk{A?=xJAMiM0Ll}xuX`4oYIBdaHjk2&eI1yffd*?n_co9QPOQ698*(JU?u2#R
zyQ=O;f{k)dC?Q8Kv|P@oBz%Gr5<Z5PUCnZtzO!>%%IOiNw=-Robh)JWFnv4Iw@SJ~
z(w}6ykLfEUT`B2ZOs``40!i0MdVuLB+Jc4x$&eu#e9Vx+0@RYOlk^Iv6Q*Cqv0+E`
zlCEcZ2&M4HlAa^!gz3XfKP%}5Ngv5W{WR0N@zR2cjFO>;8M>I^_jp0wB<WpD-^=t?
zNw+XP>2v_~$kxba^emMWA5&IGR-xjQ6c1CDL~2l}kQ5VB$|3?P*Q2r&6DgTg5XnQS
zN^-i4iyO&|q@z+TDZ@-jjKrVr!JAuOl##)hpBSwZKX3TX-^1fJ8OebqQy!exh_f16
z7>!1c87olru&RSq^{i@Q)dE&Euqr8l8B-g$Jp|gOuH-f)LwKqYN~YaDs|h!r$hG!Z
zJYtQ)8$3{fA+^Ch+p)lH*$BPU*6Sr7bWnOjE2iNd+*69?-~r}T8%^`W4ao+ohQ{RL
zEI&&(ZXTb@Aa2Y1+!-EmS`$2<tkd|=JP|$Fgde_0&ZU0Pq^z2?okh!Ado5nEPJz8(
zo$&;NtQ{}w%mXQlX%l>yl8^oh<!Zd%q0||rC_DxeJ!&AL`wDhmYRt*HI+?-`Pb+VS
zttm5UBg|K^WF4w}wbW_m7}+e=jABze;B{4IQGj(vRf~zG&aw#*>&9@%F{!VOBQ3QL
z(_T#7qMDD-uC_hnE!PFcXXsY-oGkLa8c7ej$8bJ1qF09I-Ec^qfrB}v=5u2*OQEa}
zHDl4VD!hrPg6;s03`ei2P8^xo468JomF;L1=$$EIoieUYbEF+cGzPj4lG1)LK4EHD
znKp~=?cSM|N9k8^V){SnA%JuvUVGAQ^dO9;n-b+_X><Lod_|da>0Y=o^AJ4_Uu8Z+
zFT=^K<r)2WdPTRwzFg6i>L<AIZW7Ol1EJSItF>p`ipFQZ!&$a3RW#i<VLluB4Q$lv
zGV5^w(uR-D*%))bA0F50xv^aMoAv-*4eN9P?$})TOt(UI0=;0-jCZ;h%q)y+(XA%L
zfH;s^qyf1b*^eAYo<IhW_mC@yd<`L~hyigSi;<1UeaKPd1>{ZSQ-oVfNCsj;79;h@
zT}V69g*>*F{F1zaHy4qw5k)<|c@Q&Fg{(vxk)6mPWb!xp(&JG06_UXtv*F@(l{5ge
zv$YhUEPJVHB!`eOd^@qZW1&58BzwWsd#B^e1Hm7Z=cJ{+HH(sW5$1K5o|1qbTshO#
zf6S)jB*NrHIh1&EXtyf&4f<5>94@ox7JN$Fe?A&*?UVZnK8XD7OxbZBTn1C(Wp?jA
z58Djc>b=rtqon=_Ytgf-Zv;*nZk%yB30J&EA$k>Ub;GUA!(^MH-#z#Vb~5}{63omq
z-bhwrmJR1v8w#=RQrm%H?25RDUE|5f`t@z&x2?}Jp*rPWA4?cym6WGD_T#H2nscB6
zi`M4%WLsJ8Y?iwgy7Fdms&mkrXVl9uq~AS;A<^(C9<m?0ekzA)`E$6#Z-OPiP~VRB
z3E!*XR>@g@E$?R7m2XJd+82$sxd&UD2T5~$*a4^WS8*2;A+w+YkIKyj1#~0aQ(#W)
z!5tmCIt*tDY>5GO|NJm~Tae4Wo&a-<Mf5N%Gg`FuFU96sfgce4?h7)U!tfF}W^_>{
zd}ORH{-8hB>lA)1OnN<n_c$Q=mW0;k^D#5f0jmpnZT>5<ao(6XH#}aLP7C4XLL;7&
zFAIw_Z(ysKDgN4M&&a@1WTW@M#-cKHm1K^Y3@bcWl&4ESJKjWCCfQ@U@MRp(d1=+Z
zeob;X7x&|-??pwd85UJ-2TZs);vRPOgx0+(1ss(EG}k)R4r}JsYb&M62xtGqu7VHI
z{=10=kK?&vQ*$l;0q~jlOrNC7emrGW@Tf_k3i#A?y@oxhez;FgQE>6|)ti4}SOvga
zXg&<^#;k8~;r`cZd_o}ETvRxGCU!X<M(4?8WM3RV>}wlrFc)Nmo*R#dEFU)}P3-T;
zLU_t-SWqRcZX`pjx#abG*cN*O=ME1m`r#*Q556Wv_l36kI(7u>2HU(DqI(cuEa<Ig
z-p5{rwZ+@&{%|uT?;}K`(NKg#;t&}Uk0c<8h#W~mrXW)h1u_juMp6(ZqC!#;HF#yy
z;Reh6L=!vUcMWv6Teii)Fz3N<;CPr)s-|5qv(!xQ2XCqN|NVT<|M}17?o4|e2bIE=
zl+`lNmQ8EcRc_jH)0PcQ>$>gE0g3~h3Dk9a%OfR!Eg35LN6CLm;;ag*!CGi7x30I|
zX?@*#!TP@SGwbKpudP?D@wQIe3EMf_m~BmIp!A8-&q@>QH`v$Oci21akJ(Sz`|RiJ
zI!Cd?>*#X)$#K^4o+IqI;>Z#Tg)(80utwM>>=Xutj|J-VI9EA;>kK+Ooew*Eo#$Je
z?>lv6JIgxD`pbw*=UU-va_w_H<a*k5#&y<}Q9h%5UU^-4d-;Rq1LZ_d$adU+Q%sqr
zGE=o_xvAImq3Ih_Ja6Z#_^tdAzL$T8|Acp#Yt1*CZ!@=;kC~q__nAZHFU(Q%oMK<`
zrs9Le7mLHiX%?NuU}>=&wk$brdCKyF<u%LOmM<;CCD~S|waU88>a*^$2Cbd8e%r9^
zYa9E|WyFRRyplh}ckw6q$N0bSr}^{z1^x;@$`iB9tTXG)2D1_VUcS`&kwYnD3l+lk
zLX}W0c!Xuba^V)iC)5jmVWZF}Gzr^<9YR3ZE$kKc3GIU2+3X~w+gH)W)<ySU6`L3&

diff --git a/trunk/KProcessHacker/kph_nt.c b/trunk/KProcessHacker/kph_nt.c
index a1345e46a..02f8d270a 100644
--- a/trunk/KProcessHacker/kph_nt.c
+++ b/trunk/KProcessHacker/kph_nt.c
@@ -100,6 +100,48 @@ NTSTATUS KphGetContextThread(
     return status;
 }
 
+NTSTATUS KphGetThreadWin32Thread(
+    HANDLE ThreadHandle,
+    PVOID *Win32Thread,
+    KPROCESSOR_MODE AccessMode
+    )
+{
+    NTSTATUS status = STATUS_SUCCESS;
+    PETHREAD threadObject;
+    PVOID win32Thread;
+    
+    if (AccessMode == UserMode)
+    {
+        __try
+        {
+            ProbeForWrite(Win32Thread, sizeof(PVOID), 1);
+        }
+        __except (EXCEPTION_EXECUTE_HANDLER)
+        {
+            return STATUS_ACCESS_VIOLATION;
+        }
+    }
+    
+    status = ObReferenceObjectByHandle(ThreadHandle, 0, *PsThreadType, KernelMode, &threadObject, NULL);
+    
+    if (!NT_SUCCESS(status))
+        return status;
+    
+    win32Thread = PsGetThreadWin32Thread(threadObject);
+    ObDereferenceObject(threadObject);
+    
+    __try
+    {
+        *Win32Thread = win32Thread;
+    }
+    __except (EXCEPTION_EXECUTE_HANDLER)
+    {
+        return STATUS_ACCESS_VIOLATION;
+    }
+    
+    return status;
+}
+
 NTSTATUS KphOpenProcess(
     PHANDLE ProcessHandle,
     ACCESS_MASK DesiredAccess,
diff --git a/trunk/KProcessHacker/kph_nt.h b/trunk/KProcessHacker/kph_nt.h
index 22cf9c0ee..4f797bea9 100644
--- a/trunk/KProcessHacker/kph_nt.h
+++ b/trunk/KProcessHacker/kph_nt.h
@@ -36,19 +36,23 @@ NTSTATUS NTAPI ObOpenObjectByName(
     PHANDLE Handle
     );
 
-NTSTATUS PsGetContextThread(
+NTSTATUS NTAPI PsGetContextThread(
     PETHREAD Thread,
     PCONTEXT ThreadContext,
     KPROCESSOR_MODE PreviousMode
     );
 
+PVOID NTAPI PsGetThreadWin32Thread(
+    PETHREAD Thread
+    );
+
 NTSTATUS NTAPI PsLookupProcessThreadByCid(
     PCLIENT_ID ClientId,
     PEPROCESS *Process,
     PETHREAD *Thread
     );
 
-NTSTATUS PsSetContextThread(
+NTSTATUS NTAPI PsSetContextThread(
     PETHREAD Thread,
     PCONTEXT ThreadContext,
     KPROCESSOR_MODE PreviousMode
@@ -104,6 +108,12 @@ NTSTATUS KphGetContextThread(
     KPROCESSOR_MODE AccessMode
     );
 
+NTSTATUS KphGetThreadWin32Thread(
+    HANDLE ThreadHandle,
+    PVOID *Win32Thread,
+    KPROCESSOR_MODE AccessMode
+    );
+
 NTSTATUS KphOpenProcess(
     PHANDLE ProcessHandle,
     ACCESS_MASK DesiredAccess,
diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c
index 9a006c9b0..6384caafb 100644
--- a/trunk/KProcessHacker/kprocesshacker.c
+++ b/trunk/KProcessHacker/kprocesshacker.c
@@ -294,6 +294,8 @@ char *GetIoControlName(ULONG ControlCode)
         return "KphGetContextThread";
     else if (ControlCode == KPH_SETCONTEXTTHREAD)
         return "KphSetContextThread";
+    else if (ControlCode == KPH_GETTHREADWIN32THREAD)
+        return "KphGetThreadWin32Thread";
     else
         return "Unknown";
 }
@@ -853,6 +855,26 @@ NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
         }
         break;
         
+        case KPH_GETTHREADWIN32THREAD:
+        {
+            HANDLE threadHandle;
+            
+            if (inLength < 4 || outLength < 4)
+            {
+                status = STATUS_BUFFER_TOO_SMALL;
+                goto IoControlEnd;
+            }
+            
+            threadHandle = *(HANDLE *)dataBuffer;
+            status = KphGetThreadWin32Thread(threadHandle, (PVOID *)dataBuffer, KernelMode);
+            
+            if (!NT_SUCCESS(status))
+                goto IoControlEnd;
+            
+            retLength = 4;
+        }
+        break;
+        
         default:
         {
             dprintf("KProcessHacker: unrecognized IOCTL code 0x%08x\n", controlCode);
diff --git a/trunk/KProcessHacker/kprocesshacker.h b/trunk/KProcessHacker/kprocesshacker.h
index a9adb4248..d58a3d2fd 100644
--- a/trunk/KProcessHacker/kprocesshacker.h
+++ b/trunk/KProcessHacker/kprocesshacker.h
@@ -65,6 +65,7 @@ typedef struct _SYSTEM_HANDLE_INFORMATION
 #define KPH_OPENPROCESSJOB KPH_CTL_CODE(17)
 #define KPH_GETCONTEXTTHREAD KPH_CTL_CODE(18)
 #define KPH_SETCONTEXTTHREAD KPH_CTL_CODE(19)
+#define KPH_GETTHREADWIN32THREAD KPH_CTL_CODE(20)
 
 NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp);
 NTSTATUS KphClose(PDEVICE_OBJECT DeviceObject, PIRP Irp);
diff --git a/trunk/ProcessHacker/Components/ThreadList.cs b/trunk/ProcessHacker/Components/ThreadList.cs
index 8bba70843..a87ba5a4d 100644
--- a/trunk/ProcessHacker/Components/ThreadList.cs
+++ b/trunk/ProcessHacker/Components/ThreadList.cs
@@ -260,8 +260,10 @@ namespace ProcessHacker
 
         private System.Drawing.Color GetThreadColor(ThreadItem titem)
         {
-            if (titem.WaitReason == Win32.KWAIT_REASON.Suspended)
-                return System.Drawing.Color.LightGray;
+            if (Properties.Settings.Default.UseColorSuspended && titem.WaitReason == Win32.KWAIT_REASON.Suspended)
+                return Properties.Settings.Default.ColorSuspended;
+            else if (Properties.Settings.Default.UseColorGuiThreads && titem.IsGuiThread)
+                return Properties.Settings.Default.ColorGuiThreads;
 
             return System.Drawing.SystemColors.Window;
         }
diff --git a/trunk/ProcessHacker/Forms/HackerWindow.cs b/trunk/ProcessHacker/Forms/HackerWindow.cs
index 66d2e92eb..ecde1f1fa 100644
--- a/trunk/ProcessHacker/Forms/HackerWindow.cs
+++ b/trunk/ProcessHacker/Forms/HackerWindow.cs
@@ -1799,10 +1799,10 @@ namespace ProcessHacker
             ColumnSettings.LoadSettings(Properties.Settings.Default.ServiceListViewColumns, listServices.List);
             ColumnSettings.LoadSettings(Properties.Settings.Default.NetworkListViewColumns, listNetwork.List);
 
-            HighlightingContext.Colors[ListViewItemState.New] = Properties.Settings.Default.ColorNewProcesses;
-            HighlightingContext.Colors[ListViewItemState.Removed] = Properties.Settings.Default.ColorRemovedProcesses;
-            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.New] = Properties.Settings.Default.ColorNewProcesses;
-            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.Removed] = Properties.Settings.Default.ColorRemovedProcesses;
+            HighlightingContext.Colors[ListViewItemState.New] = Properties.Settings.Default.ColorNew;
+            HighlightingContext.Colors[ListViewItemState.Removed] = Properties.Settings.Default.ColorRemoved;
+            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.New] = Properties.Settings.Default.ColorNew;
+            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.Removed] = Properties.Settings.Default.ColorRemoved;
 
             Program.ImposterNames = new System.Collections.Specialized.StringCollection();
 
diff --git a/trunk/ProcessHacker/Forms/OptionsWindow.cs b/trunk/ProcessHacker/Forms/OptionsWindow.cs
index cee69650d..8fbd88415 100644
--- a/trunk/ProcessHacker/Forms/OptionsWindow.cs
+++ b/trunk/ProcessHacker/Forms/OptionsWindow.cs
@@ -65,8 +65,8 @@ namespace ProcessHacker
             textImposterNames.Text = Properties.Settings.Default.ImposterNames;
 
             textHighlightingDuration.Value = Properties.Settings.Default.HighlightingDuration;
-            colorNewProcesses.Color = Properties.Settings.Default.ColorNewProcesses;
-            colorRemovedProcesses.Color = Properties.Settings.Default.ColorRemovedProcesses;
+            colorNewProcesses.Color = Properties.Settings.Default.ColorNew;
+            colorRemovedProcesses.Color = Properties.Settings.Default.ColorRemoved;
             this.InitializeHighlightingColors();
 
             checkPlotterAntialias.Checked = Properties.Settings.Default.PlotterAntialias;
@@ -193,6 +193,10 @@ namespace ProcessHacker
                 "Executables are sometimes \"packed\" to reduce their size.\n" +
                 "\"Dangerous processes\" includes processes with invalid signatures and unverified " + 
                 "processes with the name of a system process.");
+            AddToList("ColorSuspended", "Suspended Threads",
+                "Threads that are suspended from execution.");
+            AddToList("ColorGuiThreads", "GUI Threads",
+                "Threads that have made at least one GUI-related system call.");
 
             foreach (ListViewItem item in listHighlightingColors.Items)
             {
@@ -280,8 +284,8 @@ namespace ProcessHacker
             Program.HackerWindow.NetworkProvider.Interval = Properties.Settings.Default.RefreshInterval;
 
             Properties.Settings.Default.HighlightingDuration = (int)textHighlightingDuration.Value;
-            Properties.Settings.Default.ColorNewProcesses = colorNewProcesses.Color;
-            Properties.Settings.Default.ColorRemovedProcesses = colorRemovedProcesses.Color;
+            Properties.Settings.Default.ColorNew = colorNewProcesses.Color;
+            Properties.Settings.Default.ColorRemoved = colorRemovedProcesses.Color;
 
             foreach (ListViewItem item in listHighlightingColors.Items)
             {
@@ -299,10 +303,10 @@ namespace ProcessHacker
 
             // apply the settings immediately if we can
             HighlightingContext.HighlightingDuration = Properties.Settings.Default.HighlightingDuration;
-            HighlightingContext.Colors[ListViewItemState.New] = Properties.Settings.Default.ColorNewProcesses;
-            HighlightingContext.Colors[ListViewItemState.Removed] = Properties.Settings.Default.ColorRemovedProcesses;
-            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.New] = Properties.Settings.Default.ColorNewProcesses;
-            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.Removed] = Properties.Settings.Default.ColorRemovedProcesses;
+            HighlightingContext.Colors[ListViewItemState.New] = Properties.Settings.Default.ColorNew;
+            HighlightingContext.Colors[ListViewItemState.Removed] = Properties.Settings.Default.ColorRemoved;
+            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.New] = Properties.Settings.Default.ColorNew;
+            TreeNodeAdv.StateColors[TreeNodeAdv.NodeState.Removed] = Properties.Settings.Default.ColorRemoved;
 
             if (checkReplaceTaskManager.Enabled)
             {
diff --git a/trunk/ProcessHacker/KProcessHacker.cs b/trunk/ProcessHacker/KProcessHacker.cs
index 284629634..524898f22 100644
--- a/trunk/ProcessHacker/KProcessHacker.cs
+++ b/trunk/ProcessHacker/KProcessHacker.cs
@@ -60,7 +60,8 @@ namespace ProcessHacker
             GetHandleObjectName,
             KphOpenProcessJob,
             KphGetContextThread,
-            KphSetContextThread
+            KphSetContextThread,
+            KphGetThreadWin32Thread
         }
 
         private string _deviceName;
@@ -224,6 +225,16 @@ namespace ProcessHacker
             _fileHandle.IoControl(CtlCode(Control.KphGetContextThread), data, null);
         }
 
+        public int KphGetThreadWin32Thread(Win32.ThreadHandle threadHandle)
+        {
+            byte[] inData = Misc.IntToBytes(threadHandle, Misc.Endianness.Little);
+            byte[] outData = new byte[4];
+
+            _fileHandle.IoControl(CtlCode(Control.KphGetThreadWin32Thread), inData, outData);
+
+            return Misc.BytesToInt(outData, Misc.Endianness.Little);
+        }
+
         public int KphOpenProcess(int pid, Win32.PROCESS_RIGHTS desiredAccess)
         {
             byte[] inData = new byte[8];
diff --git a/trunk/ProcessHacker/Properties/Settings.Designer.cs b/trunk/ProcessHacker/Properties/Settings.Designer.cs
index 5e35e6ff9..1a56dd8a3 100644
--- a/trunk/ProcessHacker/Properties/Settings.Designer.cs
+++ b/trunk/ProcessHacker/Properties/Settings.Designer.cs
@@ -362,24 +362,24 @@ namespace ProcessHacker.Properties {
         [global::System.Configuration.UserScopedSettingAttribute()]
         [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
         [global::System.Configuration.DefaultSettingValueAttribute("Chartreuse")]
-        public global::System.Drawing.Color ColorNewProcesses {
+        public global::System.Drawing.Color ColorNew {
             get {
-                return ((global::System.Drawing.Color)(this["ColorNewProcesses"]));
+                return ((global::System.Drawing.Color)(this["ColorNew"]));
             }
             set {
-                this["ColorNewProcesses"] = value;
+                this["ColorNew"] = value;
             }
         }
         
         [global::System.Configuration.UserScopedSettingAttribute()]
         [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
         [global::System.Configuration.DefaultSettingValueAttribute("255, 60, 40")]
-        public global::System.Drawing.Color ColorRemovedProcesses {
+        public global::System.Drawing.Color ColorRemoved {
             get {
-                return ((global::System.Drawing.Color)(this["ColorRemovedProcesses"]));
+                return ((global::System.Drawing.Color)(this["ColorRemoved"]));
             }
             set {
-                this["ColorRemovedProcesses"] = value;
+                this["ColorRemoved"] = value;
             }
         }
         
@@ -1200,5 +1200,53 @@ namespace ProcessHacker.Properties {
                 this["ServiceMiniListColumns"] = value;
             }
         }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("Silver")]
+        public global::System.Drawing.Color ColorSuspended {
+            get {
+                return ((global::System.Drawing.Color)(this["ColorSuspended"]));
+            }
+            set {
+                this["ColorSuspended"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("True")]
+        public bool UseColorSuspended {
+            get {
+                return ((bool)(this["UseColorSuspended"]));
+            }
+            set {
+                this["UseColorSuspended"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("255, 255, 128")]
+        public global::System.Drawing.Color ColorGuiThreads {
+            get {
+                return ((global::System.Drawing.Color)(this["ColorGuiThreads"]));
+            }
+            set {
+                this["ColorGuiThreads"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("True")]
+        public bool UseColorGuiThreads {
+            get {
+                return ((bool)(this["UseColorGuiThreads"]));
+            }
+            set {
+                this["UseColorGuiThreads"] = value;
+            }
+        }
     }
 }
diff --git a/trunk/ProcessHacker/Properties/Settings.settings b/trunk/ProcessHacker/Properties/Settings.settings
index bb1994c04..e631f1d1d 100644
--- a/trunk/ProcessHacker/Properties/Settings.settings
+++ b/trunk/ProcessHacker/Properties/Settings.settings
@@ -86,10 +86,10 @@
     <Setting Name="SearchEngine" Type="System.String" Scope="User">
       <Value Profile="(Default)">http://www.google.com/search?q=%s</Value>
     </Setting>
-    <Setting Name="ColorNewProcesses" Type="System.Drawing.Color" Scope="User">
+    <Setting Name="ColorNew" Type="System.Drawing.Color" Scope="User">
       <Value Profile="(Default)">Chartreuse</Value>
     </Setting>
-    <Setting Name="ColorRemovedProcesses" Type="System.Drawing.Color" Scope="User">
+    <Setting Name="ColorRemoved" Type="System.Drawing.Color" Scope="User">
       <Value Profile="(Default)">255, 60, 40</Value>
     </Setting>
     <Setting Name="ColorOwnProcesses" Type="System.Drawing.Color" Scope="User">
@@ -296,5 +296,17 @@
     <Setting Name="ServiceMiniListColumns" Type="System.String" Scope="User">
       <Value Profile="(Default)" />
     </Setting>
+    <Setting Name="ColorSuspended" Type="System.Drawing.Color" Scope="User">
+      <Value Profile="(Default)">Silver</Value>
+    </Setting>
+    <Setting Name="UseColorSuspended" Type="System.Boolean" Scope="User">
+      <Value Profile="(Default)">True</Value>
+    </Setting>
+    <Setting Name="ColorGuiThreads" Type="System.Drawing.Color" Scope="User">
+      <Value Profile="(Default)">255, 255, 128</Value>
+    </Setting>
+    <Setting Name="UseColorGuiThreads" Type="System.Boolean" Scope="User">
+      <Value Profile="(Default)">True</Value>
+    </Setting>
   </Settings>
 </SettingsFile>
\ No newline at end of file
diff --git a/trunk/ProcessHacker/Providers/ThreadProvider.cs b/trunk/ProcessHacker/Providers/ThreadProvider.cs
index 8bd5fa3d4..84c40479d 100644
--- a/trunk/ProcessHacker/Providers/ThreadProvider.cs
+++ b/trunk/ProcessHacker/Providers/ThreadProvider.cs
@@ -46,6 +46,7 @@ namespace ProcessHacker
         public uint StartAddressI;
         public string StartAddress;
         public Win32.KWAIT_REASON WaitReason;
+        public bool IsGuiThread;
 
         public Win32.ThreadHandle ThreadQueryLimitedHandle;
     }
@@ -170,6 +171,16 @@ namespace ProcessHacker
                         catch
                         { }
 
+                        if (Program.KPH != null)
+                        {
+                            try
+                            {
+                                item.IsGuiThread = Program.KPH.KphGetThreadWin32Thread(item.ThreadQueryLimitedHandle) != 0;
+                            }
+                            catch
+                            { }
+                        }
+
                         if (Program.WindowsVersion != WindowsVersion.XP)
                         {
                             try
@@ -237,6 +248,16 @@ namespace ProcessHacker
                     catch
                     { }
 
+                    if (Program.KPH != null)
+                    {
+                        try
+                        {
+                            newitem.IsGuiThread = Program.KPH.KphGetThreadWin32Thread(newitem.ThreadQueryLimitedHandle) != 0;
+                        }
+                        catch
+                        { }
+                    }
+
                     if (Program.WindowsVersion != WindowsVersion.XP)
                     {
                         try
@@ -266,6 +287,7 @@ namespace ProcessHacker
                         newitem.ContextSwitchesDelta != item.ContextSwitchesDelta ||
                         newitem.Cycles != item.Cycles || 
                         newitem.CyclesDelta != item.CyclesDelta || 
+                        newitem.IsGuiThread != item.IsGuiThread || 
                         newitem.Priority != item.Priority || 
                         newitem.StartAddress != item.StartAddress ||
                         newitem.WaitReason != item.WaitReason
diff --git a/trunk/ProcessHacker/app.config b/trunk/ProcessHacker/app.config
index 456369319..16b22e8fd 100644
--- a/trunk/ProcessHacker/app.config
+++ b/trunk/ProcessHacker/app.config
@@ -91,10 +91,10 @@
             <setting name="SearchEngine" serializeAs="String">
                 <value>http://www.google.com/search?q=%s</value>
             </setting>
-            <setting name="ColorNewProcesses" serializeAs="String">
+            <setting name="ColorNew" serializeAs="String">
                 <value>Chartreuse</value>
             </setting>
-            <setting name="ColorRemovedProcesses" serializeAs="String">
+            <setting name="ColorRemoved" serializeAs="String">
                 <value>255, 60, 40</value>
             </setting>
             <setting name="ColorOwnProcesses" serializeAs="String">
@@ -301,6 +301,18 @@
             <setting name="ServiceMiniListColumns" serializeAs="String">
                 <value />
             </setting>
+            <setting name="ColorSuspended" serializeAs="String">
+                <value>Silver</value>
+            </setting>
+            <setting name="UseColorSuspended" serializeAs="String">
+                <value>True</value>
+            </setting>
+            <setting name="ColorGuiThreads" serializeAs="String">
+                <value>255, 255, 128</value>
+            </setting>
+            <setting name="UseColorGuiThreads" serializeAs="String">
+                <value>True</value>
+            </setting>
         </ProcessHacker.Properties.Settings>
     </userSettings>
 </configuration>
\ No newline at end of file