From 949417b506e894ee7cffe717de61ba5491c7ae95 Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Sat, 18 Apr 2009 23:06:36 +0000
Subject: [PATCH] * named KPH functions properly (according to MS) * added
 support for version-specific info for service packs

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1091 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 trunk/KProcessHacker/i386/kprocesshacker.sys  | Bin 14336 -> 14336 bytes
 trunk/KProcessHacker/include/kprocesshacker.h |   8 ++--
 trunk/KProcessHacker/include/version.h        |   2 +-
 trunk/KProcessHacker/kprocesshacker.c         |  24 ++++++------
 trunk/KProcessHacker/version.c                |  37 ++++++++++++++----
 trunk/ProcessHacker/Win32/API/Enums.cs        |  11 +++---
 6 files changed, 53 insertions(+), 29 deletions(-)

diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys
index 6c1e3392db14bf6fd8efc9ccebe266b0cc36fb26..890473ff9d843f2a21df112102427d575fef5663 100644
GIT binary patch
delta 1459
zcmZ8h4NOy46uzfWR)ta!ZTYtX1yscM?t5)t`}*TgaSKCX!J&+(OTerWoX&{>hY_hn
zv9PJvO~*_Yvq_vL(^;o8Ohu}z#NR3NXKpG{V;xR{Qv*YJyRT}N?IkDQIp25Ax#!(?
z@2g*0zjWiRu*Ic+Y`Q&Dadiv9kPjQlDkuYnT!TWWC*u`gg5c{?<N-`0n(#KbNe+e!
zdY1wrF`#K)j}R*H8dVG+cTFasmb}MB(q;EF60K}1Oa_FcF)pe#c4(R{H1et|rU3E`
zD!pUe)G5&%GA^GAsCt#>Z_qTx(hQHGfC>~C83IZd1&%HfP}Y$P%IRW2DNv?9#LT6h
zn|ky8p1}xB;}+^RUeq);%lP!LB#nJpZ=*z$x{ee_l=9V40i|45^`dSVUJ-nV_@N!4
zj`{vG@>4n5-N6D1?jxroET(o1LY?6#q_|aCl;0&uk~>IW`l}q;F!;F~o{~eo9Bz=q
zHlOvi-vA~M-H6EwUQON^xt-h@u|QiFMVrOHXm+MD%B{k*B8`-ed<K=ilE_wo4WvJ+
z7jBc^)fO-jU35B3A!2kPoFm?74#0OTIvb#l1T~YOjA&zWLGR0pS)+j6Brqx+R{DBJ
zB>>d;l%s1EVeXi8;?d4ihGr+%w6@q7I-GY_ly`<I>^v7G1QE&9EsJd#e!-T6SZi<<
z`9?P@HuryQDpAF60vBnG{|ufGHlZGReftwq6`PY!$R~*ek{8A#mp?_hkL`uWf+rph
zRL-m*wv^e*m~@0(<kJ*q#OOFc@p0tWl*BlP7SJ?mbP=hT;v6lIn<-;ri*$fyQ<M3H
z6c>?6sXFm!0-#Q6GJA>Qm6tyKcIYbQWR$hGL_oW#$^He3-HG6f)vtm5`cwrpkg;i1
ziV+t{OBxTCNN1Wsq4tyeX%iKCKhdUNhppsM`dctaTp1Z~i!91G1T|!wK^qr&R+4(}
zd4|F@4U?bK&Zb}~$v0%cBeKMhp}W~hRj+4ArD?eIjBaFvv?9DH*hh97cECJRkZAxv
zS(Z87I_H!m-8a+vQ0lisa;kSlcqNn+1uZA3mQSY+X`BC}MV=;onR>`0F<CtPMDnt7
z!AO>8G4#Uj%$gB@<Oppv&?wba6bGN2kff%Fmb?Q+K}^E3CnSCJN=z%3s=I>&|LT8|
zH?p&#+V??rd*tdp>;d*i_AJ}YUT5#Jee56`hSgYy$Ki?Ch)Z!fUWAw6TI|6scq`t4
z_u%jGaeNW?;^#P$Gjmh98C((fHn)JQ;NIufbFEwlcb>b)Me~{boBUxu$@reJ*0|Sr
z+4#UXU{sqDO$Jk~$!j`p3YvyZBUhUZ<{Y!xyv6*p`Ifog93~_QlLUt_Q&=pl6%Gm~
zg>%9UA=V;T3M{3T4=sI`MC*9#>((-BjkVdj&Dw4qwnmC6Vz%fKi^X@vW#TsRvUo%M
zOH|u9TfVKv=Cyrc`_9&3>$3IRlI=Nm-agCTU?=uA`(FET`|1n!yY_y2m?O?n;8^GQ
z#PPM`sN;@f$dTmCbvm50o#oCd=Q`&;r{CG_>~TJD($l6#p<juL(J@A*h$&~5Gi#V;
zrk&|xt}s2!LuM>HnYFTWSvR|s-M}7U&#^spX9rjnPR2R746nrX_+#9PcjC@eoW>!(
gn6Kh%__h2-emlR5@8W;qdyE=WyvgD78!d`|09KYHEdT%j

delta 1424
zcmZ8hYfKbZ6rQs$5n-3*xuC$xW1%QGb7y9Ec6VmS7nBem2$a~`Qfbhv)LJD#{GqT)
zZCzKQa${B0YOA)^Mj~!gQDSTHfhdg@`@ptFqou4dw$b9N+D`ARHcdOpx#v6IckVZL
z?!6h`Qs2^z*R&V6-`sR#rp8x+5tP7syb|UCg)hTwSdO35>;ikRPg4jGi%q%@;VAx0
zCs@-o6y@$UtzSz~RAqpVpn>uh+kk2<94S@4^TuMM-tUYDic%7$6OA2k_n6k3Ngar;
znG96RBYi_ti{vE`OlwAnNw0o7DcCTo$G_;OP4*|uAdEkOCS$K&Afqp=&Lzl8(8-oZ
zhK43*f@;#xcvMl+pP7h6^hej@8pDg}y?V8sQ`@_`DeA<@e)Xx1_nu&Y3LVCG3{LxT
z6GiptsIcN4Bp(sluPBPQi=aId$?VWJwcM(fR<&HGmW{#rqkaOgVrldwjXfIsB6r}(
z$X64aqKKL0sabz*ls5vA8CkeF@(C;st{Bq}WPg*QZ^01O8l5l^OU6u?imQ#Y;S}yP
zvY-tP8FK;Zu`wne=3p_V01|_*$E?!8ZhSj76P5<eamk=rqQf3zO0X!tN~7=Z_g>4u
zA0@tmW0H7t3RzuXR#c!ULVJOY5<-!<GO5nI<*%n~Wteq^-oclXW|@WmvAI~VY=U@v
z&hjoOxH{Pf-NEb0X__`I-8Sx&dQWigxCJq`4aeG6?j4-6_K3B0_Xoc}#A0fN{#ph_
z#pBJXvf<ZQpzg-vA5v4|EQvskBSGGy<de)K0=}A>V9rYds(^&b%Op?3`Dsb+t;s;`
zAfd7cN$z}x$>~vpgj2Js`BH#-i-d{~klc|1L9=xg946Nis&IP7V$F@Oacc$#2XRkE
zwr02o-^`ex`J)FXX8s7v@ZHQga0yS(%7SBfQPvSC!{f6P<A(Yb<<@Y^W1VUBq(6zX
zJ;dUY>@4WVZ)RsD9ql1%pyhFdY4xQiWG@X$qpmd6hYw`G4-P!TmJK^`oo$+nIjbl)
z9b|sEwd1kc8fetjLS<<v?ljR#$g0Cy+kdp7bNDx#71D7`4o8l<FsA@axITx5TD&i(
z$g<@)F?zU0Sy59Sx^PNS{D#)TPfJ5lSeu(S_Jx1MjB=&no6x|&dM_@{&4oF^Wx3sB
znh!Ev%xUHVbD6op+-4pyfX1K%G!~6V6ObDfqcSuXRUt2`Lo3kRXd`Mzdr=2EjlM@i
z$jpvqt!y4UiFL9bwwQg5t!LZWkJ&HT5KD2{9OmwEQ}}Y;&mZE?@B{oXKf)_~xqX3s
zyS>LgX#d%+G}{dhvtx<l6UQ;fdB+vUJ;x})BIF3q3su5KVVAI9=n`%Tu}+(lb<TA5
zIY*pY*LWB2DswG#)wwpi23<q02QG~}&7JRdxo5cR+=tv<?yua#?r1SfEE5-q4ProS
z7x#$g#rvW`GD^A9%hDT?Px4FKr2|s)7t(p@iga7Dd8$2&JWZahp3gnsdhU55WQ$xN
zOLCE1Ew7Vz${ljId`7-5-;pUR75>$j=sa4YXVLTMh4f~658X+3(`V^N^k^oYLCjR9
zgsEY+F#DNqrjHq5t~2);1L9EydWr02Jz9m{LwC`|6gHC+xniz@o6jxgmUG*<eOxDh
Ql@Ia8U@z~~Y@&6418)WxbN~PV

diff --git a/trunk/KProcessHacker/include/kprocesshacker.h b/trunk/KProcessHacker/include/kprocesshacker.h
index 4398be1f8..1ec6e4fd0 100644
--- a/trunk/KProcessHacker/include/kprocesshacker.h
+++ b/trunk/KProcessHacker/include/kprocesshacker.h
@@ -62,10 +62,10 @@
 #define SET_BIT(integer, bit) ((integer) |= 1 << (bit))
 #define CLEAR_BIT(integer, bit) ((integer) &= ~(1 << (bit)))
 
-NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp);
-NTSTATUS KphClose(PDEVICE_OBJECT DeviceObject, PIRP Irp);
-NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp);
-NTSTATUS KphRead(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp);
+NTSTATUS KphDispatchRead(PDEVICE_OBJECT DeviceObject, PIRP Irp);
 NTSTATUS KphUnsupported(PDEVICE_OBJECT DeviceObject, PIRP Irp);
 
 #endif
\ No newline at end of file
diff --git a/trunk/KProcessHacker/include/version.h b/trunk/KProcessHacker/include/version.h
index a6bca1c63..7d0985952 100644
--- a/trunk/KProcessHacker/include/version.h
+++ b/trunk/KProcessHacker/include/version.h
@@ -39,7 +39,7 @@ NTSTATUS KvInit();
 #endif
 
 EXT ULONG WindowsVersion;
-EXT RTL_OSVERSIONINFOW RtlWindowsVersion;
+EXT RTL_OSVERSIONINFOEXW RtlWindowsVersion;
 EXT ACCESS_MASK ProcessAllAccess;
 EXT ACCESS_MASK ThreadAllAccess;
 
diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c
index 03bd92903..9070a9dd5 100644
--- a/trunk/KProcessHacker/kprocesshacker.c
+++ b/trunk/KProcessHacker/kprocesshacker.c
@@ -26,10 +26,10 @@
 #include "include/ps.h"
 #include "include/version.h"
 
-#pragma alloc_text(PAGE, KphCreate)
-#pragma alloc_text(PAGE, KphClose)
-#pragma alloc_text(PAGE, KphIoControl)
-#pragma alloc_text(PAGE, KphRead)
+#pragma alloc_text(PAGE, KphDispatchCreate)
+#pragma alloc_text(PAGE, KphDispatchClose)
+#pragma alloc_text(PAGE, KphDispatchDeviceControl)
+#pragma alloc_text(PAGE, KphDispatchRead)
 #pragma alloc_text(PAGE, KphUnsupported)
 
 VOID DriverUnload(PDRIVER_OBJECT DriverObject)
@@ -69,10 +69,10 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
     for (i = 0; i < IRP_MJ_MAXIMUM_FUNCTION; i++)
         DriverObject->MajorFunction[i] = NULL;
     
-    DriverObject->MajorFunction[IRP_MJ_CLOSE] = KphClose;
-    DriverObject->MajorFunction[IRP_MJ_CREATE] = KphCreate;
-    DriverObject->MajorFunction[IRP_MJ_READ] = KphRead;
-    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KphIoControl;
+    DriverObject->MajorFunction[IRP_MJ_CLOSE] = KphDispatchClose;
+    DriverObject->MajorFunction[IRP_MJ_CREATE] = KphDispatchCreate;
+    DriverObject->MajorFunction[IRP_MJ_READ] = KphDispatchRead;
+    DriverObject->MajorFunction[IRP_MJ_DEVICE_CONTROL] = KphDispatchDeviceControl;
     DriverObject->DriverUnload = DriverUnload;
     
     deviceObject->Flags |= DO_BUFFERED_IO;
@@ -85,7 +85,7 @@ NTSTATUS DriverEntry(PDRIVER_OBJECT DriverObject, PUNICODE_STRING RegistryPath)
     return STATUS_SUCCESS;
 }
 
-NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     
@@ -95,7 +95,7 @@ NTSTATUS KphCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp)
     return status;
 }
 
-NTSTATUS KphClose(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchClose(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     
@@ -215,7 +215,7 @@ PCHAR GetIoControlName(ULONG ControlCode)
         return "Unknown";
 }
 
-NTSTATUS KphIoControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchDeviceControl(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     PIO_STACK_LOCATION ioStackIrp = NULL;
@@ -956,7 +956,7 @@ IoControlEnd:
     return status;
 }
 
-NTSTATUS KphRead(PDEVICE_OBJECT DeviceObject, PIRP Irp)
+NTSTATUS KphDispatchRead(PDEVICE_OBJECT DeviceObject, PIRP Irp)
 {
     NTSTATUS status = STATUS_SUCCESS;
     PIO_STACK_LOCATION ioStackIrp = NULL;
diff --git a/trunk/KProcessHacker/version.c b/trunk/KProcessHacker/version.c
index 7d96f9a53..b8f6eccad 100644
--- a/trunk/KProcessHacker/version.c
+++ b/trunk/KProcessHacker/version.c
@@ -27,19 +27,25 @@
 NTSTATUS KvInit()
 {
     NTSTATUS status = STATUS_SUCCESS;
+    ULONG majorVersion, minorVersion, servicePack;
     
     RtlWindowsVersion.dwOSVersionInfoSize = sizeof(RtlWindowsVersion);
-    status = RtlGetVersion(&RtlWindowsVersion);
+    status = RtlGetVersion((PRTL_OSVERSIONINFOW)&RtlWindowsVersion);
     
     if (!NT_SUCCESS(status))
         return status;
     
+    majorVersion = RtlWindowsVersion.dwMajorVersion;
+    minorVersion = RtlWindowsVersion.dwMinorVersion;
+    servicePack = RtlWindowsVersion.wServicePackMajor;
+    
     /* Windows XP */
-    if (RtlWindowsVersion.dwMajorVersion == 5 && RtlWindowsVersion.dwMinorVersion == 1)
+    if (majorVersion == 5 && minorVersion == 1)
     {
         WindowsVersion = WINDOWS_XP;
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xfff;
         ThreadAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0x3ff;
+        
         OffEtClientId = 0x1ec;
         OffEtStartAddress = 0x224;
         OffEtWin32StartAddress = 0x228;
@@ -48,11 +54,12 @@ NTSTATUS KvInit()
         OffEpProtectedProcessOff = 0;
         OffEpProtectedProcessBit = 0;
         OffEpRundownProtect = 0x80;
-        OffOtiGenericMapping = 0x68;
-        dprintf("Initialized version-specific data for Windows XP\n");
+        OffOtiGenericMapping = 0x60 + 0x8;
+        
+        dprintf("Initialized version-specific data for Windows XP SP%d\n", servicePack);
     }
     /* Windows Vista */
-    else if (RtlWindowsVersion.dwMajorVersion == 6 && RtlWindowsVersion.dwMinorVersion == 0)
+    else if (majorVersion == 6 && minorVersion == 0)
     {
         WindowsVersion = WINDOWS_VISTA;
         ProcessAllAccess = STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xffff;
@@ -65,8 +72,24 @@ NTSTATUS KvInit()
         OffEpProtectedProcessOff = 0x224;
         OffEpProtectedProcessBit = 0xb;
         OffEpRundownProtect = 0x98;
-        OffOtiGenericMapping = 0x34;
-        dprintf("Initialized version-specific data for Windows Vista\n");
+        
+        /* SP0 */
+        if (servicePack == 0)
+        {
+            OffOtiGenericMapping = 0x60 + 0xc;
+        }
+        /* SP1 */
+        else if (servicePack == 1)
+        {
+            /* They got rid of the Mutex (an ERESOURCE) */
+            OffOtiGenericMapping = 0x28 + 0xc;
+        }
+        else
+        {
+            return STATUS_NOT_SUPPORTED;
+        }
+        
+        dprintf("Initialized version-specific data for Windows Vista SP%d\n", servicePack);
     }
     else
     {
diff --git a/trunk/ProcessHacker/Win32/API/Enums.cs b/trunk/ProcessHacker/Win32/API/Enums.cs
index b0d719e25..94d05fa91 100644
--- a/trunk/ProcessHacker/Win32/API/Enums.cs
+++ b/trunk/ProcessHacker/Win32/API/Enums.cs
@@ -408,11 +408,12 @@ namespace ProcessHacker
 
         public enum OBJECT_INFORMATION_CLASS : int
         {
-            ObjectBasicInformation,
-            ObjectNameInformation,
-            ObjectTypeInformation,
-            ObjectAllTypesInformation,
-            ObjectHandleInformation
+            ObjectBasicInformation = 0,
+            ObjectNameInformation = 1,
+            ObjectTypeInformation = 2,
+            ObjectTypesInformation = 3,
+            ObjectHandleFlagInformation = 4,
+            ObjectSessionInformation = 5
         }
 
         public enum PeekMessageFlags : int