From a6cecfdaee49d7cb040baa6949657276abbb89bf Mon Sep 17 00:00:00 2001
From: wj32 <wj32@21ef857c-d57f-4fe0-8362-d861dc6d29cd>
Date: Thu, 30 Apr 2015 04:31:12 +0000
Subject: [PATCH] Added CF Guard (Control Flow Guard) column

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@5848 21ef857c-d57f-4fe0-8362-d861dc6d29cd
---
 2.x/trunk/CHANGELOG.txt                    |  1 +
 2.x/trunk/ProcessHacker/include/uimodels.h |  3 ++-
 2.x/trunk/ProcessHacker/proctree.c         | 28 +++++++++++++++++++++-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/2.x/trunk/CHANGELOG.txt b/2.x/trunk/CHANGELOG.txt
index b6b9be2e1..7583d1f4d 100644
--- a/2.x/trunk/CHANGELOG.txt
+++ b/2.x/trunk/CHANGELOG.txt
@@ -2,6 +2,7 @@ Process Hacker
 
 2.35
  * NEW/IMPROVED:
+   * Added CF Guard (Control Flow Guard) column
    * Support for up to 64 processors when setting process/thread affinity
    * Updated ExtendedTools plugin:
      * Added Disk and Network graphs for all processes
diff --git a/2.x/trunk/ProcessHacker/include/uimodels.h b/2.x/trunk/ProcessHacker/include/uimodels.h
index e730178d6..d36c6e402 100644
--- a/2.x/trunk/ProcessHacker/include/uimodels.h
+++ b/2.x/trunk/ProcessHacker/include/uimodels.h
@@ -189,8 +189,9 @@ FORCEINLINE VOID PhChangeShStateTn(
 #define PHPRTLC_PACKAGENAME 72
 #define PHPRTLC_APPID 73
 #define PHPRTLC_DPIAWARENESS 74
+#define PHPRTLC_CFGUARD 75
 
-#define PHPRTLC_MAXIMUM 75
+#define PHPRTLC_MAXIMUM 76
 #define PHPRTLC_IOGROUP_COUNT 9
 
 #define PHPN_WSCOUNTERS 0x1
diff --git a/2.x/trunk/ProcessHacker/proctree.c b/2.x/trunk/ProcessHacker/proctree.c
index 9a7d41f60..d161937ae 100644
--- a/2.x/trunk/ProcessHacker/proctree.c
+++ b/2.x/trunk/ProcessHacker/proctree.c
@@ -196,6 +196,7 @@ VOID PhInitializeProcessTreeList(
     PhAddTreeNewColumn(hwnd, PHPRTLC_PACKAGENAME, FALSE, L"Package Name", 160, PH_ALIGN_LEFT, -1, 0);
     PhAddTreeNewColumn(hwnd, PHPRTLC_APPID, FALSE, L"App ID", 160, PH_ALIGN_LEFT, -1, 0);
     PhAddTreeNewColumn(hwnd, PHPRTLC_DPIAWARENESS, FALSE, L"DPI Awareness", 110, PH_ALIGN_LEFT, -1, 0);
+    PhAddTreeNewColumn(hwnd, PHPRTLC_CFGUARD, FALSE, L"CF Guard", 70, PH_ALIGN_LEFT, -1, 0);
 
     TreeNew_SetRedraw(hwnd, TRUE);
 
@@ -1792,6 +1793,17 @@ BEGIN_SORT_FUNCTION(DpiAwareness)
 }
 END_SORT_FUNCTION
 
+BEGIN_SORT_FUNCTION(CfGuard)
+{
+    PhpUpdateProcessNodeImage(node1);
+    PhpUpdateProcessNodeImage(node2);
+    sortResult = intcmp(
+        node1->ImageDllCharacteristics & IMAGE_DLLCHARACTERISTICS_GUARD_CF,
+        node2->ImageDllCharacteristics & IMAGE_DLLCHARACTERISTICS_GUARD_CF
+        );
+}
+END_SORT_FUNCTION
+
 BOOLEAN NTAPI PhpProcessTreeNewCallback(
     _In_ HWND hwnd,
     _In_ PH_TREENEW_MESSAGE Message,
@@ -1906,7 +1918,8 @@ BOOLEAN NTAPI PhpProcessTreeNewCallback(
                         SORT_FUNCTION(Subsystem),
                         SORT_FUNCTION(PackageName),
                         SORT_FUNCTION(AppId),
-                        SORT_FUNCTION(DpiAwareness)
+                        SORT_FUNCTION(DpiAwareness),
+                        SORT_FUNCTION(CfGuard)
                     };
                     static PH_INITONCE initOnce = PH_INITONCE_INIT;
                     int (__cdecl *sortFunction)(const void *, const void *);
@@ -2593,6 +2606,19 @@ BOOLEAN NTAPI PhpProcessTreeNewCallback(
                     break;
                 }
                 break;
+            case PHPRTLC_CFGUARD:
+                PhpUpdateProcessNodeImage(node);
+
+                if (WindowsVersion >= WINDOWS_81)
+                {
+                    if (node->ImageDllCharacteristics & IMAGE_DLLCHARACTERISTICS_GUARD_CF)
+                        PhInitializeStringRef(&getCellText->Text, L"CF Guard");
+                }
+                else
+                {
+                    PhInitializeStringRef(&getCellText->Text, L"N/A");
+                }
+                break;
             default:
                 return FALSE;
             }