* named KPH functions properly (according to MS)

* added support for version-specific info for service packs

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1091 21ef857c-d57f-4fe0-8362-d861dc6d29cd

trunk/KProcessHacker/include/kprocesshacker.h

@@ -62,10 +62,10 @@
 #define SET_BIT(integer, bit) ((integer) |= 1 << (bit))
 #define CLEAR_BIT(integer, bit) ((integer) &= ~(1 << (bit)))
 
-NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp);
-NTSTATUS KphClose(PDEVICE_OBJECT DeviceObject, PIRP Irp);
-NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp);
-NTSTATUS KphRead(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchRead(PDEVICE_OBJECT DeviceObject, PIRP Irp);
 NTSTATUS KphUnsupported(PDEVICE_OBJECT DeviceObject, PIRP Irp);
 
 #endif

trunk/KProcessHacker/include/version.h

@@ -39,7 +39,7 @@ NTSTATUS KvInit();
 #endif
 
 EXT ULONG WindowsVersion;
-EXT RTL_OSVERSIONINFOW RtlWindowsVersion;
+EXT RTL_OSVERSIONINFOEXW RtlWindowsVersion;
 EXT ACCESS_MASK ProcessAllAccess;
 EXT ACCESS_MASK ThreadAllAccess;
 

trunk/KProcessHacker/kprocesshacker.c

@@ -26,10 +26,10 @@
 #include "include/ps.h"
 #include "include/version.h"
 
-#pragma alloc_text(PAGE, KphCreate)
-#pragma alloc_text(PAGE, KphClose)
-#pragma alloc_text(PAGE, KphIoControl)
-#pragma alloc_text(PAGE, KphRead)
+#pragma alloc_text(PAGE, KphDispatchCreate)
+#pragma alloc_text(PAGE, KphDispatchClose)
+#pragma alloc_text(PAGE, KphDispatchDeviceControl)
+#pragma alloc_text(PAGE, KphDispatchRead)
 #pragma alloc_text(PAGE, KphUnsupported)
 
 VOID DriverUnload(PDRIVER_OBJECT DriverObject)
@@ -69,10 +69,10 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
     for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
         DriverObject->MajorFunction[i] = NULL;
     
-    DriverObject->MajorFunction[IRP_MJ_CLOSE] = KphClose;
-    DriverObject->MajorFunction[IRP_MJ_CREATE] = KphCreate;
-    DriverObject->MajorFunction[IRP_MJ_READ] = KphRead;
-    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KphIoControl;
+    DriverObject->MajorFunction[IRP_MJ_CLOSE] = KphDispatchClose;
+    DriverObject->MajorFunction[IRP_MJ_CREATE] = KphDispatchCreate;
+    DriverObject->MajorFunction[IRP_MJ_READ] = KphDispatchRead;
+    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KphDispatchDeviceControl;
     DriverObject->DriverUnload = DriverUnload;
     
     deviceObject->Flags |= DO_BUFFERED_IO;
@@ -85,7 +85,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
     return STATUS_SUCCESS;
 }
 
-NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     
@@ -95,7 +95,7 @@ NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
     return status;
 }
 
-NTSTATUS KphClose(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     
@@ -215,7 +215,7 @@ PCHAR GetIoControlName(ULONG ControlCode)
         return "Unknown";
 }
 
-NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     PIO_STACK_LOCATION ioStackIrp = NULL;
@@ -956,7 +956,7 @@ IoControlEnd:
     return status;
 }
 
-NTSTATUS KphRead(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchRead(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     PIO_STACK_LOCATION ioStackIrp = NULL;

trunk/KProcessHacker/version.c

@@ -27,19 +27,25 @@
 NTSTATUS KvInit()
 {
     NTSTATUS status = STATUS_SUCCESS;
+    ULONG majorVersion, minorVersion, servicePack;
     
     RtlWindowsVersion.dwOSVersionInfoSize = sizeof(RtlWindowsVersion);
-    status = RtlGetVersion(&RtlWindowsVersion);
+    status = RtlGetVersion((PRTL_OSVERSIONINFOW)&RtlWindowsVersion);
     
     if (!NT_SUCCESS(status))
         return status;
     
+    majorVersion = RtlWindowsVersion.dwMajorVersion;
+    minorVersion = RtlWindowsVersion.dwMinorVersion;
+    servicePack = RtlWindowsVersion.wServicePackMajor;
+    
     /* Windows XP */
-    if (RtlWindowsVersion.dwMajorVersion == 5 && RtlWindowsVersion.dwMinorVersion == 1)
+    if (majorVersion == 5 && minorVersion == 1)
     {
         WindowsVersion = WINDOWS_XP;
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff;
         ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff;
+        
         OffEtClientId = 0x1ec;
         OffEtStartAddress = 0x224;
         OffEtWin32StartAddress = 0x228;
@@ -48,11 +54,12 @@ NTSTATUS KvInit()
         OffEpProtectedProcessOff = 0;
         OffEpProtectedProcessBit = 0;
         OffEpRundownProtect = 0x80;
-        OffOtiGenericMapping = 0x68;
-        dprintf("Initialized version-specific data for Windows XP\n");
+        OffOtiGenericMapping = 0x60 + 0x8;
+        
+        dprintf("Initialized version-specific data for Windows XP SP%d\n", servicePack);
     }
     /* Windows Vista */
-    else if (RtlWindowsVersion.dwMajorVersion == 6 && RtlWindowsVersion.dwMinorVersion == 0)
+    else if (majorVersion == 6 && minorVersion == 0)
     {
         WindowsVersion = WINDOWS_VISTA;
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff;
@@ -65,8 +72,24 @@ NTSTATUS KvInit()
         OffEpProtectedProcessOff = 0x224;
         OffEpProtectedProcessBit = 0xb;
         OffEpRundownProtect = 0x98;
-        OffOtiGenericMapping = 0x34;
-        dprintf("Initialized version-specific data for Windows Vista\n");
+        
+        /* SP0 */
+        if (servicePack == 0)
+        {
+            OffOtiGenericMapping = 0x60 + 0xc;
+        }
+        /* SP1 */
+        else if (servicePack == 1)
+        {
+            /* They got rid of the Mutex (an ERESOURCE) */
+            OffOtiGenericMapping = 0x28 + 0xc;
+        }
+        else
+        {
+            return STATUS_NOT_SUPPORTED;
+        }
+        
+        dprintf("Initialized version-specific data for Windows Vista SP%d\n", servicePack);
     }
     else
     {

trunk/ProcessHacker/Win32/API/Enums.cs

@@ -408,11 +408,12 @@ namespace ProcessHacker
 
         public enum OBJECT_INFORMATION_CLASS : int
         {
-            ObjectBasicInformation,
-            ObjectNameInformation,
-            ObjectTypeInformation,
-            ObjectAllTypesInformation,
-            ObjectHandleInformation
+            ObjectBasicInformation = 0,
+            ObjectNameInformation = 1,
+            ObjectTypeInformation = 2,
+            ObjectTypesInformation = 3,
+            ObjectHandleFlagInformation = 4,
+            ObjectSessionInformation = 5
         }
 
         public enum PeekMessageFlags : int