now saves pe window column settings

fixed crash when opening the same file twice

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@81 21ef857c-d57f-4fe0-8362-d861dc6d29cd

trunk/ProcessHacker/Components/ProcessList.cs

@@ -49,54 +49,6 @@ namespace ProcessHacker
                 this.KeyDown(sender, e);
         }
 
-        private string GetKernelFileName()
-        {
-            int RequiredSize = 0;
-            int[] ImageBases;
-
-            Win32.EnumDeviceDrivers(null, 0, ref RequiredSize);
-            ImageBases = new int[RequiredSize];
-            Win32.EnumDeviceDrivers(ImageBases, RequiredSize * sizeof(int), ref RequiredSize);
-
-            for (int i = 0; i < RequiredSize; i++)
-            {
-                if (ImageBases[i] == 0)
-                    continue;
-
-                StringBuilder name = new StringBuilder(256);
-                StringBuilder filename = new StringBuilder(256);
-                string realname = "";
-
-                Win32.GetDeviceDriverBaseName(ImageBases[i], name, 255);
-                Win32.GetDeviceDriverFileName(ImageBases[i], filename, 255);
-
-                try
-                {
-                    System.IO.FileInfo fi = new System.IO.FileInfo(Misc.GetRealPath(filename.ToString()));
-                    bool kernel = false;
-
-                    realname = fi.FullName;
-
-                    foreach (string k in Misc.KernelNames)
-                    {
-                        if (realname.ToLower() == Environment.SystemDirectory.ToLower() + "\\" + k.ToLower())
-                        {
-                            kernel = true;
-
-                            break;
-                        }
-                    }
-
-                    if (kernel)
-                        return realname;
-                }
-                catch
-                { }
-            }
-
-            return "";
-        }
-
         #region Properties
 
         public bool DoubleBuffered
@@ -196,7 +148,7 @@ namespace ProcessHacker
 
                 if (pitem.PID == 4)
                 {
-                    filename = GetKernelFileName();
+                    filename = Misc.GetKernelFileName();
                 }
                 else
                 {

trunk/ProcessHacker/Forms/HackerWindow.Designer.cs

@@ -758,7 +758,7 @@
             // splitMain.Panel2
             // 
             this.splitMain.Panel2.Controls.Add(this.tabControl);
-            this.splitMain.Size = new System.Drawing.Size(804, 423);
+            this.splitMain.Size = new System.Drawing.Size(804, 489);
             this.splitMain.SplitterDistance = 355;
             this.splitMain.TabIndex = 3;
             // 
@@ -772,7 +772,7 @@
             this.tabControl.Location = new System.Drawing.Point(0, 0);
             this.tabControl.Name = "tabControl";
             this.tabControl.SelectedIndex = 0;
-            this.tabControl.Size = new System.Drawing.Size(445, 423);
+            this.tabControl.Size = new System.Drawing.Size(445, 489);
             this.tabControl.TabIndex = 5;
             // 
             // tabProcess
@@ -782,7 +782,7 @@
             this.tabProcess.Location = new System.Drawing.Point(4, 22);
             this.tabProcess.Name = "tabProcess";
             this.tabProcess.Padding = new System.Windows.Forms.Padding(3);
-            this.tabProcess.Size = new System.Drawing.Size(437, 397);
+            this.tabProcess.Size = new System.Drawing.Size(437, 463);
             this.tabProcess.TabIndex = 4;
             this.tabProcess.Text = "Process";
             this.tabProcess.UseVisualStyleBackColor = true;
@@ -844,7 +844,7 @@
             this.treeMisc.Location = new System.Drawing.Point(6, 59);
             this.treeMisc.Name = "treeMisc";
             this.treeMisc.ShowNodeToolTips = true;
-            this.treeMisc.Size = new System.Drawing.Size(425, 332);
+            this.treeMisc.Size = new System.Drawing.Size(425, 398);
             this.treeMisc.TabIndex = 1;
             // 
             // tabThreads
@@ -853,7 +853,7 @@
             this.tabThreads.Location = new System.Drawing.Point(4, 22);
             this.tabThreads.Name = "tabThreads";
             this.tabThreads.Padding = new System.Windows.Forms.Padding(3);
-            this.tabThreads.Size = new System.Drawing.Size(437, 391);
+            this.tabThreads.Size = new System.Drawing.Size(437, 229);
             this.tabThreads.TabIndex = 6;
             this.tabThreads.Text = "Threads";
             this.tabThreads.UseVisualStyleBackColor = true;
@@ -864,7 +864,7 @@
             this.tabModules.Location = new System.Drawing.Point(4, 22);
             this.tabModules.Name = "tabModules";
             this.tabModules.Padding = new System.Windows.Forms.Padding(3);
-            this.tabModules.Size = new System.Drawing.Size(437, 391);
+            this.tabModules.Size = new System.Drawing.Size(437, 229);
             this.tabModules.TabIndex = 0;
             this.tabModules.Text = "Modules";
             this.tabModules.UseVisualStyleBackColor = true;
@@ -883,7 +883,7 @@
             this.listModules.Location = new System.Drawing.Point(3, 3);
             this.listModules.Name = "listModules";
             this.listModules.ShowItemToolTips = true;
-            this.listModules.Size = new System.Drawing.Size(431, 385);
+            this.listModules.Size = new System.Drawing.Size(431, 223);
             this.listModules.TabIndex = 1;
             this.listModules.UseCompatibleStateImageBehavior = false;
             this.listModules.View = System.Windows.Forms.View.Details;
@@ -915,7 +915,7 @@
             this.tabMemory.Location = new System.Drawing.Point(4, 22);
             this.tabMemory.Name = "tabMemory";
             this.tabMemory.Padding = new System.Windows.Forms.Padding(3);
-            this.tabMemory.Size = new System.Drawing.Size(437, 391);
+            this.tabMemory.Size = new System.Drawing.Size(437, 229);
             this.tabMemory.TabIndex = 1;
             this.tabMemory.Text = "Memory";
             this.tabMemory.UseVisualStyleBackColor = true;
@@ -935,7 +935,7 @@
             this.listMemory.Location = new System.Drawing.Point(3, 3);
             this.listMemory.Name = "listMemory";
             this.listMemory.ShowItemToolTips = true;
-            this.listMemory.Size = new System.Drawing.Size(431, 385);
+            this.listMemory.Size = new System.Drawing.Size(431, 223);
             this.listMemory.TabIndex = 2;
             this.listMemory.UseCompatibleStateImageBehavior = false;
             this.listMemory.View = System.Windows.Forms.View.Details;
@@ -1058,7 +1058,7 @@
             this.listProcesses.Location = new System.Drawing.Point(0, 0);
             this.listProcesses.Name = "listProcesses";
             this.listProcesses.Provider = null;
-            this.listProcesses.Size = new System.Drawing.Size(355, 422);
+            this.listProcesses.Size = new System.Drawing.Size(355, 488);
             this.listProcesses.TabIndex = 4;
             this.listProcesses.SelectedIndexChanged += new System.EventHandler(this.listProcesses_SelectedIndexChanged);
             this.listProcesses.KeyDown += new System.Windows.Forms.KeyEventHandler(this.listProcesses_KeyDown);
@@ -1082,7 +1082,7 @@
             this.listThreads.Location = new System.Drawing.Point(3, 3);
             this.listThreads.Name = "listThreads";
             this.listThreads.Provider = null;
-            this.listThreads.Size = new System.Drawing.Size(431, 385);
+            this.listThreads.Size = new System.Drawing.Size(431, 223);
             this.listThreads.TabIndex = 0;
             this.listThreads.DoubleClick += new System.EventHandler(this.listThreads_DoubleClick);
             // 
@@ -1094,7 +1094,7 @@
             // 
             this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F);
             this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font;
-            this.ClientSize = new System.Drawing.Size(804, 423);
+            this.ClientSize = new System.Drawing.Size(804, 489);
             this.Controls.Add(this.splitMain);
             this.Controls.Add(this.panelVirtualProtect);
             this.Controls.Add(this.panelProc);

trunk/ProcessHacker/Forms/HackerWindow.cs

@@ -555,6 +555,29 @@ namespace ProcessHacker
             Win32.ShellExecuteEx(ref info);
         }
 
+        private void inspectModuleMenuItem_Click(object sender, EventArgs e)
+        {
+            try
+            {
+                PEWindow pw = Program.GetPEWindow(listModules.SelectedItems[0].ToolTipText,
+                    new Program.PEWindowInvokeAction(delegate(PEWindow f)
+                    {
+                        try
+                        {
+                            f.Show();
+                            f.Activate();
+                        }
+                        catch
+                        { }
+                    }));
+            }
+            catch (Exception ex)
+            {
+                MessageBox.Show("Error inspecting:\n\n" + ex.Message, "Process Hacker", MessageBoxButtons.OK,
+                    MessageBoxIcon.Error);
+            }
+        }
+
         private void goToInMemoryViewModuleMenuItem_Click(object sender, EventArgs e)
         {
             string address = listModules.SelectedItems[0].SubItems[1].Text;
@@ -886,6 +909,40 @@ namespace ProcessHacker
             }
         }
 
+        private void inspectProcessMenuItem_Click(object sender, EventArgs e)
+        {
+            try
+            {
+                string path;
+
+                if (processSelectedPID == 4)
+                {
+                    path = Misc.GetKernelFileName();
+                }
+                else
+                {
+                    path = Misc.GetRealPath(processSelected.MainModule.FileName);
+                }
+
+                PEWindow pw = Program.GetPEWindow(path,
+                    new Program.PEWindowInvokeAction(delegate(PEWindow f)
+                    {
+                        try
+                        {
+                            f.Show();
+                            f.Activate();
+                        }
+                        catch
+                        { }
+                    }));
+            }
+            catch (Exception ex)
+            {
+                MessageBox.Show("Error inspecting:\n\n" + ex.Message, "Process Hacker", MessageBoxButtons.OK,
+                    MessageBoxIcon.Error);
+            }
+        }
+
         private void privilegesMenuItem_Click(object sender, EventArgs e)
         {
             ProcessPrivileges privForm = new ProcessPrivileges(processSelectedPID);
@@ -2156,49 +2213,5 @@ namespace ProcessHacker
 
             LoadSettings(); 
         }
-
-        private void inspectProcessMenuItem_Click(object sender, EventArgs e)
-        {
-            try
-            {
-                PEWindow pw = Program.GetPEWindow(Misc.GetRealPath(processSelected.MainModule.FileName),
-                    new Program.PEWindowInvokeAction(delegate(PEWindow f)
-                {
-                    try
-                    {
-                        f.Show();
-                    }
-                    catch
-                    { }
-                }));
-            }
-            catch (Exception ex)
-            {
-                MessageBox.Show("Error inspecting:\n\n" + ex.Message, "Process Hacker", MessageBoxButtons.OK,
-                    MessageBoxIcon.Error);
-            }
-        }
-
-        private void inspectModuleMenuItem_Click(object sender, EventArgs e)
-        {
-            try
-            {
-                PEWindow pw = Program.GetPEWindow(listModules.SelectedItems[0].ToolTipText,
-                    new Program.PEWindowInvokeAction(delegate(PEWindow f)
-                    {
-                        try
-                        {
-                            f.Show();
-                        }
-                        catch
-                        { }
-                    }));
-            }
-            catch (Exception ex)
-            {
-                MessageBox.Show("Error inspecting:\n\n" + ex.Message, "Process Hacker", MessageBoxButtons.OK,
-                    MessageBoxIcon.Error);
-            }
-        }
     }
 }

trunk/ProcessHacker/Forms/PEWindow.Designer.cs

@@ -101,7 +101,7 @@
             this.tabControl.Location = new System.Drawing.Point(0, 0);
             this.tabControl.Name = "tabControl";
             this.tabControl.SelectedIndex = 0;
-            this.tabControl.Size = new System.Drawing.Size(423, 405);
+            this.tabControl.Size = new System.Drawing.Size(423, 402);
             this.tabControl.TabIndex = 0;
             // 
             // tabCOFFHeader
@@ -110,7 +110,7 @@
             this.tabCOFFHeader.Location = new System.Drawing.Point(4, 22);
             this.tabCOFFHeader.Name = "tabCOFFHeader";
             this.tabCOFFHeader.Padding = new System.Windows.Forms.Padding(3);
-            this.tabCOFFHeader.Size = new System.Drawing.Size(415, 379);
+            this.tabCOFFHeader.Size = new System.Drawing.Size(415, 376);
             this.tabCOFFHeader.TabIndex = 0;
             this.tabCOFFHeader.Text = "COFF Header";
             this.tabCOFFHeader.UseVisualStyleBackColor = true;
@@ -126,7 +126,7 @@
             this.listCOFFHeader.Location = new System.Drawing.Point(3, 3);
             this.listCOFFHeader.Name = "listCOFFHeader";
             this.listCOFFHeader.ShowItemToolTips = true;
-            this.listCOFFHeader.Size = new System.Drawing.Size(409, 373);
+            this.listCOFFHeader.Size = new System.Drawing.Size(409, 370);
             this.listCOFFHeader.Sorting = System.Windows.Forms.SortOrder.Ascending;
             this.listCOFFHeader.TabIndex = 0;
             this.listCOFFHeader.UseCompatibleStateImageBehavior = false;
@@ -148,7 +148,7 @@
             this.tabCOFFOptionalHeader.Location = new System.Drawing.Point(4, 22);
             this.tabCOFFOptionalHeader.Name = "tabCOFFOptionalHeader";
             this.tabCOFFOptionalHeader.Padding = new System.Windows.Forms.Padding(3);
-            this.tabCOFFOptionalHeader.Size = new System.Drawing.Size(415, 343);
+            this.tabCOFFOptionalHeader.Size = new System.Drawing.Size(415, 376);
             this.tabCOFFOptionalHeader.TabIndex = 1;
             this.tabCOFFOptionalHeader.Text = "COFF Optional Header";
             this.tabCOFFOptionalHeader.UseVisualStyleBackColor = true;
@@ -164,7 +164,7 @@
             this.listCOFFOptionalHeader.Location = new System.Drawing.Point(3, 3);
             this.listCOFFOptionalHeader.Name = "listCOFFOptionalHeader";
             this.listCOFFOptionalHeader.ShowItemToolTips = true;
-            this.listCOFFOptionalHeader.Size = new System.Drawing.Size(409, 337);
+            this.listCOFFOptionalHeader.Size = new System.Drawing.Size(409, 370);
             this.listCOFFOptionalHeader.Sorting = System.Windows.Forms.SortOrder.Ascending;
             this.listCOFFOptionalHeader.TabIndex = 1;
             this.listCOFFOptionalHeader.UseCompatibleStateImageBehavior = false;
@@ -186,7 +186,7 @@
             this.tabImageData.Location = new System.Drawing.Point(4, 22);
             this.tabImageData.Name = "tabImageData";
             this.tabImageData.Padding = new System.Windows.Forms.Padding(3);
-            this.tabImageData.Size = new System.Drawing.Size(415, 343);
+            this.tabImageData.Size = new System.Drawing.Size(415, 376);
             this.tabImageData.TabIndex = 5;
             this.tabImageData.Text = "Image Data";
             this.tabImageData.UseVisualStyleBackColor = true;
@@ -203,7 +203,7 @@
             this.listImageData.Location = new System.Drawing.Point(3, 3);
             this.listImageData.Name = "listImageData";
             this.listImageData.ShowItemToolTips = true;
-            this.listImageData.Size = new System.Drawing.Size(409, 337);
+            this.listImageData.Size = new System.Drawing.Size(409, 370);
             this.listImageData.TabIndex = 2;
             this.listImageData.UseCompatibleStateImageBehavior = false;
             this.listImageData.View = System.Windows.Forms.View.Details;
@@ -229,7 +229,7 @@
             this.tabSections.Location = new System.Drawing.Point(4, 22);
             this.tabSections.Name = "tabSections";
             this.tabSections.Padding = new System.Windows.Forms.Padding(3);
-            this.tabSections.Size = new System.Drawing.Size(415, 343);
+            this.tabSections.Size = new System.Drawing.Size(415, 376);
             this.tabSections.TabIndex = 2;
             this.tabSections.Text = "Sections";
             this.tabSections.UseVisualStyleBackColor = true;
@@ -248,7 +248,7 @@
             this.listSections.Location = new System.Drawing.Point(3, 3);
             this.listSections.Name = "listSections";
             this.listSections.ShowItemToolTips = true;
-            this.listSections.Size = new System.Drawing.Size(409, 337);
+            this.listSections.Size = new System.Drawing.Size(409, 370);
             this.listSections.TabIndex = 1;
             this.listSections.UseCompatibleStateImageBehavior = false;
             this.listSections.View = System.Windows.Forms.View.Details;
@@ -283,7 +283,7 @@
             this.tabExports.Location = new System.Drawing.Point(4, 22);
             this.tabExports.Name = "tabExports";
             this.tabExports.Padding = new System.Windows.Forms.Padding(3);
-            this.tabExports.Size = new System.Drawing.Size(415, 343);
+            this.tabExports.Size = new System.Drawing.Size(415, 376);
             this.tabExports.TabIndex = 3;
             this.tabExports.Text = "Exports";
             this.tabExports.UseVisualStyleBackColor = true;
@@ -301,7 +301,7 @@
             this.listExports.Location = new System.Drawing.Point(3, 3);
             this.listExports.Name = "listExports";
             this.listExports.ShowItemToolTips = true;
-            this.listExports.Size = new System.Drawing.Size(409, 337);
+            this.listExports.Size = new System.Drawing.Size(409, 370);
             this.listExports.SmallImageList = this.imageList;
             this.listExports.Sorting = System.Windows.Forms.SortOrder.Ascending;
             this.listExports.TabIndex = 0;
@@ -341,7 +341,7 @@
             this.tabImports.Location = new System.Drawing.Point(4, 22);
             this.tabImports.Name = "tabImports";
             this.tabImports.Padding = new System.Windows.Forms.Padding(3);
-            this.tabImports.Size = new System.Drawing.Size(415, 343);
+            this.tabImports.Size = new System.Drawing.Size(415, 376);
             this.tabImports.TabIndex = 4;
             this.tabImports.Text = "Imports";
             this.tabImports.UseVisualStyleBackColor = true;
@@ -357,7 +357,7 @@
             this.listImports.Location = new System.Drawing.Point(3, 3);
             this.listImports.Name = "listImports";
             this.listImports.ShowItemToolTips = true;
-            this.listImports.Size = new System.Drawing.Size(409, 337);
+            this.listImports.Size = new System.Drawing.Size(409, 370);
             this.listImports.Sorting = System.Windows.Forms.SortOrder.Ascending;
             this.listImports.TabIndex = 1;
             this.listImports.UseCompatibleStateImageBehavior = false;
@@ -381,7 +381,7 @@
             // 
             this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F);
             this.AutoScaleMode = System.Windows.Forms.AutoScaleMode.Font;
-            this.ClientSize = new System.Drawing.Size(423, 405);
+            this.ClientSize = new System.Drawing.Size(423, 402);
             this.Controls.Add(this.tabControl);
             this.FormBorderStyle = System.Windows.Forms.FormBorderStyle.SizableToolWindow;
             this.Icon = ((System.Drawing.Icon)(resources.GetObject("$this.Icon")));

trunk/ProcessHacker/Forms/PEWindow.cs

@@ -20,17 +20,28 @@ namespace ProcessHacker
 
             Misc.SetDoubleBuffered(listCOFFHeader, typeof(ListView), true);
             listCOFFHeader.ContextMenu = ListViewMenu.GetMenu(listCOFFHeader);
+            ColumnSettings.LoadSettings(Properties.Settings.Default.PECOFFHColumns, listCOFFHeader);
+
             Misc.SetDoubleBuffered(listCOFFOptionalHeader, typeof(ListView), true);
             listCOFFOptionalHeader.ContextMenu = ListViewMenu.GetMenu(listCOFFOptionalHeader);
+            ColumnSettings.LoadSettings(Properties.Settings.Default.PECOFFOHColumns, listCOFFOptionalHeader);
+
             Misc.SetDoubleBuffered(listImageData, typeof(ListView), true);
             listImageData.ContextMenu = ListViewMenu.GetMenu(listImageData);
+            ColumnSettings.LoadSettings(Properties.Settings.Default.PEImageDataColumns, listImageData);
+
             Misc.SetDoubleBuffered(listSections, typeof(ListView), true);
             listSections.ContextMenu = ListViewMenu.GetMenu(listSections);
+            ColumnSettings.LoadSettings(Properties.Settings.Default.PESectionsColumns, listSections);
+
             Misc.SetDoubleBuffered(listExports, typeof(ListView), true);
-            listExports.ContextMenu = ListViewMenu.GetMenu(listExports, 
+            listExports.ContextMenu = ListViewMenu.GetMenu(listExports,
                 new RetrieveVirtualItemEventHandler(listExports_RetrieveVirtualItem));
+            ColumnSettings.LoadSettings(Properties.Settings.Default.PEExportsColumns, listExports);
+
             Misc.SetDoubleBuffered(listImports, typeof(ListView), true);
             listImports.ContextMenu = ListViewMenu.GetMenu(listImports);
+            ColumnSettings.LoadSettings(Properties.Settings.Default.PEImportsColumns, listImports);
 
             _path = path;
             this.Text = "PE File - " + path;
@@ -52,6 +63,12 @@ namespace ProcessHacker
 
         private void PEWindow_FormClosing(object sender, FormClosingEventArgs e)
         {
+            Properties.Settings.Default.PECOFFHColumns = ColumnSettings.SaveSettings(listCOFFHeader);
+            Properties.Settings.Default.PECOFFOHColumns = ColumnSettings.SaveSettings(listCOFFOptionalHeader);
+            Properties.Settings.Default.PEImageDataColumns = ColumnSettings.SaveSettings(listImageData);
+            Properties.Settings.Default.PESectionsColumns = ColumnSettings.SaveSettings(listSections);
+            Properties.Settings.Default.PEExportsColumns = ColumnSettings.SaveSettings(listExports);
+            Properties.Settings.Default.PEImportsColumns = ColumnSettings.SaveSettings(listImports);
             Properties.Settings.Default.PEWindowSize = this.Size;
         }
 
@@ -211,8 +228,8 @@ namespace ProcessHacker
 
                 item.Text = sh.Name;
                 item.SubItems.Add(new ListViewItem.ListViewSubItem(item, "0x" + sh.VirtualAddress.ToString("x8")));
-                item.SubItems.Add(new ListViewItem.ListViewSubItem(item, "0x" + sh.PointerToRawData.ToString("x8")));
                 item.SubItems.Add(new ListViewItem.ListViewSubItem(item, "0x" + sh.VirtualSize.ToString("x")));
+                item.SubItems.Add(new ListViewItem.ListViewSubItem(item, "0x" + sh.PointerToRawData.ToString("x8")));
                 item.SubItems.Add(new ListViewItem.ListViewSubItem(item, 
                     Misc.FlagsToString(typeof(SectionFlags), (long)sh.Characteristics)));
 
@@ -231,7 +248,7 @@ namespace ProcessHacker
                 for (int i = 0; i < _peFile.ImportData.ImportLookupTable.Count; i++)
                 {
                     listImports.Groups.Add(new ListViewGroup(_peFile.ImportData.ImportDirectoryTable[i].Name));
-
+                             
                     for (int j = 0; j < _peFile.ImportData.ImportLookupTable[i].Count; j++)
                     {
                         ImportLookupEntry entry = _peFile.ImportData.ImportLookupTable[i][j];

trunk/ProcessHacker/Forms/PEWindow.resx

@@ -127,20 +127,19 @@
     <value>
         AAEAAAD/////AQAAAAAAAAAMAgAAAFdTeXN0ZW0uV2luZG93cy5Gb3JtcywgVmVyc2lvbj0yLjAuMC4w
         LCBDdWx0dXJlPW5ldXRyYWwsIFB1YmxpY0tleVRva2VuPWI3N2E1YzU2MTkzNGUwODkFAQAAACZTeXN0
-        ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADM
+        ZW0uV2luZG93cy5Gb3Jtcy5JbWFnZUxpc3RTdHJlYW1lcgEAAAAERGF0YQcCAgAAAAkDAAAADwMAAADK
         AgAAAk1TRnQBSQFMAwEBAAEEAQABBAEAARABAAEQAQAE/wEhAQAI/wFCAU0BNgcAATYDAAEoAwABQAMA
-        ARADAAEBAQABIAYAARD/AP8A/wD/AEIAAVYBVwFWAbgDBAEG9AADJgE4AVEBaQFRAfcBWwFeAVsB2dAA
-        AQoBvgEWAf8BBgG4AREB/wEBAbEBCwH/AQABqQEFAf8BAAGhAQAB/wEAAZkBAAH/AQABkQEAAf8BAAGI
-        AQAB/wEAAYABAAH/AQABiAEAAf8BAgGhAQcB/wEAAYsBAAH/AVkBXAFZAc/MAAEOAcMBGgH/AaAB1wGp
-        Af8BnAHVAaUB/wGYAdMBoQH/AZQB0AGdAf8BkAHOAZgB/wGLAcsBkwH/AYcByQGOAf8BggHGAYkB/wEn
-        AcMBhAH/ASMBwQGAAf8BHwG+ASUB/wEAAYwBAAH/AVkBWwFZAcTIAAERAccBHQH/AaUB2gGuAf8BogHY
-        AasB/wGeAdYBpwH/AZoB1AGjAf8BlgHSAZ8B/wGTAc8BmgH/AY4BzAGVAf8BiQHKAZAB/wGFAccBiwH/
-        AYEBxQGHAf8BJgHCAYIB/wEAAZEBAAH/AVkBXAFZAcnIAAERAccBHQH/AREBxwEdAf8BDgHDARoB/wEK
-        Ab4BFgH/AQYBuAERAf8BAQGxAQsB/wEAAakBBQH/AQABoQEAAf8BAAGZAQAB/wEAAZEBAAH/AQMBowEL
-        Af8BAAGdAQUB/wFYAVwBWAHR9AABUQFtAVEB9wFaAV8BWgHb+AABVgFYAVYBuwMEAQb/AP8A/wD/ANAA
-        AUIBTQE+BwABPgMAASgDAAFAAwABEAMAAQEBAAEBBQABgBcAA/8BAAL/BgAC/wYAAv8GAAL/BgAB/wHn
-        BgAB/wHHBgABgAEDBgABgAEBBgABgAEBBgABgAEDBgAB/wHnBgAB/wHnBgAC/wYAAv8GAAL/BgAC/wYA
-        Cw==
+        ARADAAEBAQABIAYAARD/AP8A/wD/AEIAAVYBVwFWAbgDBAEG9AADJgE4AVEBaQFRAfcBWwFeAVsB2dEA
+        Ab4BCgH/AQABuAEFAf8BAAGxAQAB/wEAAakBAAH/AQABoQEAAf8BAAGZAQAB/wEAAZEBAAH/AQABiAEA
+        Af8BAAGAAQAB/wEAAYgBAAH/AQABoQEAAf8BAAGLAQAB/wFZAVwBWQHPzAABAgHDAQ4B/wGgAdcBqQH/
+        AZwB1QGlAf8BmAHTAaEB/wGUAdABnQH/AZABzgGYAf8BiwHLAZMB/wGHAckBjgH/AYIBxgGJAf8BGwHD
+        AYQB/wEXAcEBgAH/ARMBvgEZAf8BAAGMAQAB/wFZAVsBWQHEyAABBQHHAREB/wGlAdoBrgH/AaIB2AGr
+        Af8BngHWAacB/wGaAdQBowH/AZYB0gGfAf8BkwHPAZoB/wGOAcwBlQH/AYkBygGQAf8BhQHHAYsB/wGB
+        AcUBhwH/ARoBwgGCAf8BAAGRAQAB/wFZAVwBWQHJyAABBQHHAREB/wEFAccBEQH/AQIBwwEOAf8BAAG+
+        AQoB/wEAAbgBBQH/AQABsQEAAf8BAAGpAQAB/wEAAaEBAAH/AQABmQEAAf8BAAGRAQAB/wEAAaMBAAH/
+        AQABnQEAAf8BWAFcAVgB0fQAAVEBbQFRAfcBWgFfAVoB2/gAAVYBWAFWAbsDBAEG/wD/AP8A/wDQAAFC
+        AU0BPgcAAT4DAAEoAwABQAMAARADAAEBAQABAQUAAYAXAAP/AQAC/wYAAv8GAAL/BgAC/wYAAf8B5wYA
+        Af8BxwYAAYABAwYAAYABAQYAAYABAQYAAYABAwYAAf8B5wYAAf8B5wYAAv8GAAL/BgAC/wYAAv8GAAs=
 </value>
   </data>
   <metadata name="vistaMenu.TrayLocation" type="System.Drawing.Point, System.Drawing, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a">

trunk/ProcessHacker/Misc/Misc.cs

@@ -104,6 +104,58 @@ namespace ProcessHacker
                 item.Enabled = true;
         }
 
+        /// <summary>
+        /// Gets the file name of the currently running kernel.
+        /// </summary>
+        /// <returns>The kernel file name.</returns>
+        public static string GetKernelFileName()
+        {
+            int RequiredSize = 0;
+            int[] ImageBases;
+
+            Win32.EnumDeviceDrivers(null, 0, ref RequiredSize);
+            ImageBases = new int[RequiredSize];
+            Win32.EnumDeviceDrivers(ImageBases, RequiredSize * sizeof(int), ref RequiredSize);
+
+            for (int i = 0; i < RequiredSize; i++)
+            {
+                if (ImageBases[i] == 0)
+                    continue;
+
+                StringBuilder name = new StringBuilder(256);
+                StringBuilder filename = new StringBuilder(256);
+                string realname = "";
+
+                Win32.GetDeviceDriverBaseName(ImageBases[i], name, 255);
+                Win32.GetDeviceDriverFileName(ImageBases[i], filename, 255);
+
+                try
+                {
+                    System.IO.FileInfo fi = new System.IO.FileInfo(Misc.GetRealPath(filename.ToString()));
+                    bool kernel = false;
+
+                    realname = fi.FullName;
+
+                    foreach (string k in Misc.KernelNames)
+                    {
+                        if (realname.ToLower() == Environment.SystemDirectory.ToLower() + "\\" + k.ToLower())
+                        {
+                            kernel = true;
+
+                            break;
+                        }
+                    }
+
+                    if (kernel)
+                        return realname;
+                }
+                catch
+                { }
+            }
+
+            return "";
+        }
+
         /// <summary>
         /// Formats a <see cref="DateTime"/> object into a string representation using the format "dd/MM/yy hh:mm:ss".
         /// </summary>

trunk/ProcessHacker/Program.cs

@@ -240,6 +240,15 @@ namespace ProcessHacker
             PEWindow pw = null;
             string id = "";
 
+            if (PEWindows.ContainsKey(path))
+            {
+                pw = PEWindows[path];
+
+                pw.Invoke(new MethodInvoker(delegate { action(pw); }));
+
+                return pw;
+            }
+
             Thread t = new Thread(new ThreadStart(delegate
             {
                 pw = new PEWindow(path);

trunk/ProcessHacker/Properties/Settings.Designer.cs

@@ -310,5 +310,77 @@ namespace ProcessHacker.Properties {
                 this["PEWindowSize"] = value;
             }
         }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("")]
+        public string PECOFFHColumns {
+            get {
+                return ((string)(this["PECOFFHColumns"]));
+            }
+            set {
+                this["PECOFFHColumns"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("")]
+        public string PECOFFOHColumns {
+            get {
+                return ((string)(this["PECOFFOHColumns"]));
+            }
+            set {
+                this["PECOFFOHColumns"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("")]
+        public string PEImageDataColumns {
+            get {
+                return ((string)(this["PEImageDataColumns"]));
+            }
+            set {
+                this["PEImageDataColumns"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("")]
+        public string PESectionsColumns {
+            get {
+                return ((string)(this["PESectionsColumns"]));
+            }
+            set {
+                this["PESectionsColumns"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("")]
+        public string PEExportsColumns {
+            get {
+                return ((string)(this["PEExportsColumns"]));
+            }
+            set {
+                this["PEExportsColumns"] = value;
+            }
+        }
+        
+        [global::System.Configuration.UserScopedSettingAttribute()]
+        [global::System.Diagnostics.DebuggerNonUserCodeAttribute()]
+        [global::System.Configuration.DefaultSettingValueAttribute("")]
+        public string PEImportsColumns {
+            get {
+                return ((string)(this["PEImportsColumns"]));
+            }
+            set {
+                this["PEImportsColumns"] = value;
+            }
+        }
     }
 }

trunk/ProcessHacker/Properties/Settings.settings

@@ -74,5 +74,23 @@
     <Setting Name="PEWindowSize" Type="System.Drawing.Size" Scope="User">
       <Value Profile="(Default)">439, 413</Value>
     </Setting>
+    <Setting Name="PECOFFHColumns" Type="System.String" Scope="User">
+      <Value Profile="(Default)" />
+    </Setting>
+    <Setting Name="PECOFFOHColumns" Type="System.String" Scope="User">
+      <Value Profile="(Default)" />
+    </Setting>
+    <Setting Name="PEImageDataColumns" Type="System.String" Scope="User">
+      <Value Profile="(Default)" />
+    </Setting>
+    <Setting Name="PESectionsColumns" Type="System.String" Scope="User">
+      <Value Profile="(Default)" />
+    </Setting>
+    <Setting Name="PEExportsColumns" Type="System.String" Scope="User">
+      <Value Profile="(Default)" />
+    </Setting>
+    <Setting Name="PEImportsColumns" Type="System.String" Scope="User">
+      <Value Profile="(Default)" />
+    </Setting>
   </Settings>
 </SettingsFile>

trunk/ProcessHacker/app.config

@@ -79,6 +79,24 @@
             <setting name="PEWindowSize" serializeAs="String">
                 <value>439, 413</value>
             </setting>
+            <setting name="PECOFFHColumns" serializeAs="String">
+                <value />
+            </setting>
+            <setting name="PECOFFOHColumns" serializeAs="String">
+                <value />
+            </setting>
+            <setting name="PEImageDataColumns" serializeAs="String">
+                <value />
+            </setting>
+            <setting name="PESectionsColumns" serializeAs="String">
+                <value />
+            </setting>
+            <setting name="PEExportsColumns" serializeAs="String">
+                <value />
+            </setting>
+            <setting name="PEImportsColumns" serializeAs="String">
+                <value />
+            </setting>
         </ProcessHacker.Properties.Settings>
     </userSettings>
 </configuration>