diff --git a/trunk/ExtraTools/SysCallHacker/EventProperties.Designer.cs b/trunk/ExtraTools/SysCallHacker/EventProperties.Designer.cs index 35f87db0f..0ae12b35f 100644 --- a/trunk/ExtraTools/SysCallHacker/EventProperties.Designer.cs +++ b/trunk/ExtraTools/SysCallHacker/EventProperties.Designer.cs @@ -48,6 +48,8 @@ this.columnAddress = new System.Windows.Forms.ColumnHeader(); this.columnSymbol = new System.Windows.Forms.ColumnHeader(); this.buttonClose = new System.Windows.Forms.Button(); + this.labelClientID = new System.Windows.Forms.Label(); + this.textClientID = new System.Windows.Forms.TextBox(); this.tabControl.SuspendLayout(); this.tabEvent.SuspendLayout(); this.groupArguments.SuspendLayout(); @@ -136,6 +138,8 @@ // this.groupBasic.Anchor = ((System.Windows.Forms.AnchorStyles)(((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Left) | System.Windows.Forms.AnchorStyles.Right))); + this.groupBasic.Controls.Add(this.textClientID); + this.groupBasic.Controls.Add(this.labelClientID); this.groupBasic.Controls.Add(this.textSystemCall); this.groupBasic.Controls.Add(this.textMode); this.groupBasic.Controls.Add(this.textTime); @@ -166,7 +170,7 @@ | System.Windows.Forms.AnchorStyles.Right))); this.textMode.BackColor = System.Drawing.SystemColors.Window; this.textMode.BorderStyle = System.Windows.Forms.BorderStyle.None; - this.textMode.Location = new System.Drawing.Point(49, 57); + this.textMode.Location = new System.Drawing.Point(52, 57); this.textMode.Name = "textMode"; this.textMode.ReadOnly = true; this.textMode.Size = new System.Drawing.Size(435, 13); @@ -261,6 +265,27 @@ this.buttonClose.UseVisualStyleBackColor = true; this.buttonClose.Click += new System.EventHandler(this.buttonClose_Click); // + // labelClientID + // + this.labelClientID.AutoSize = true; + this.labelClientID.Location = new System.Drawing.Point(6, 76); + this.labelClientID.Name = "labelClientID"; + this.labelClientID.Size = new System.Drawing.Size(50, 13); + this.labelClientID.TabIndex = 5; + this.labelClientID.Text = "Client ID:"; + // + // textClientID + // + this.textClientID.Anchor = ((System.Windows.Forms.AnchorStyles)(((System.Windows.Forms.AnchorStyles.Top | System.Windows.Forms.AnchorStyles.Left) + | System.Windows.Forms.AnchorStyles.Right))); + this.textClientID.BackColor = System.Drawing.SystemColors.Window; + this.textClientID.BorderStyle = System.Windows.Forms.BorderStyle.None; + this.textClientID.Location = new System.Drawing.Point(62, 76); + this.textClientID.Name = "textClientID"; + this.textClientID.ReadOnly = true; + this.textClientID.Size = new System.Drawing.Size(428, 13); + this.textClientID.TabIndex = 6; + // // EventProperties // this.AutoScaleDimensions = new System.Drawing.SizeF(6F, 13F); @@ -310,5 +335,7 @@ private System.Windows.Forms.ColumnHeader columnValue; private System.Windows.Forms.ColumnHeader columnExtendedValue; private System.Windows.Forms.ColumnHeader columnType; + private System.Windows.Forms.TextBox textClientID; + private System.Windows.Forms.Label labelClientID; } } \ No newline at end of file diff --git a/trunk/ExtraTools/SysCallHacker/EventProperties.cs b/trunk/ExtraTools/SysCallHacker/EventProperties.cs index f6923a650..4c73a9923 100644 --- a/trunk/ExtraTools/SysCallHacker/EventProperties.cs +++ b/trunk/ExtraTools/SysCallHacker/EventProperties.cs @@ -29,6 +29,7 @@ namespace SysCallHacker textSystemCall.Text = MainWindow.SysCallNames.ContainsKey(even.Event.CallNumber) ? MainWindow.SysCallNames[even.Event.CallNumber] : "(unknown)"; textTime.Text = _event.Event.Time.ToString(); textMode.Text = _event.Event.Mode == KProcessorMode.UserMode ? "User-mode" : "Kernel-mode"; + textClientID.Text = "PID: " + _event.Event.ProcessId.ToString() + ", TID: " + _event.Event.ThreadId.ToString(); for (int i = 0; i < _event.Event.Arguments.Length; i++) { @@ -94,53 +95,59 @@ namespace SysCallHacker listArguments.Items.Add(item); } - SymbolProvider.Options = SymbolOptions.DeferredLoads | SymbolOptions.UndName; - - try - { - using (var phandle = new ProcessHandle(_event.Event.ProcessId, - ProcessAccess.QueryInformation | ProcessAccess.VmRead)) + WorkQueue.GlobalQueueWorkItemTag(new Action(() => { - _symbols = new SymbolProvider(phandle); + SymbolProvider.Options = SymbolOptions.DeferredLoads | SymbolOptions.UndName; - phandle.EnumModules((module) => - { - _symbols.LoadModule(module.FileName, module.BaseAddress, module.Size); - return true; - }); - Windows.EnumKernelModules((module) => - { - _symbols.LoadModule(module.FileName, module.BaseAddress); - return true; - }); - _symbols.PreloadModules = true; - - for (int i = 0; i < _event.Event.StackTrace.Length; i++) + try { - var address = _event.Event.StackTrace[i]; - string fileName; - IntPtr baseAddress; + using (var phandle = new ProcessHandle(_event.Event.ProcessId, + ProcessAccess.QueryInformation | ProcessAccess.VmRead)) + { + _symbols = new SymbolProvider(phandle); - fileName = _symbols.GetModuleFromAddress(address, out baseAddress); + phandle.EnumModules((module) => + { + _symbols.LoadModule(module.FileName, module.BaseAddress, module.Size); + return true; + }); + Windows.EnumKernelModules((module) => + { + _symbols.LoadModule(module.FileName, module.BaseAddress); + return true; + }); + _symbols.PreloadModules = true; - listStackTrace.Items.Add(new ListViewItem(new string[] + for (int i = 0; i < _event.Event.StackTrace.Length; i++) + { + var address = _event.Event.StackTrace[i]; + string fileName; + IntPtr baseAddress; + + fileName = _symbols.GetModuleFromAddress(address, out baseAddress); + + if (!this.IsHandleCreated) + return; + + listStackTrace.Items.Add(new ListViewItem(new string[] { "0x" + address.ToString("x"), (new System.IO.FileInfo(fileName)).Name + "+0x" + address.Decrement(baseAddress).ToString("x") })); - WorkQueue.GlobalQueueWorkItemTag(new Action((i_, address_) => - { - string symbol = _symbols.GetSymbolFromAddress(address_.ToUInt64()); + WorkQueue.GlobalQueueWorkItemTag(new Action((i_, address_) => + { + string symbol = _symbols.GetSymbolFromAddress(address_.ToUInt64()); - if (this.IsHandleCreated) - this.BeginInvoke(new Action(() => listStackTrace.Items[i_].SubItems[1].Text = symbol)); - }), "resolve-symbol", i, address); + if (this.IsHandleCreated) + this.BeginInvoke(new Action(() => listStackTrace.Items[i_].SubItems[1].Text = symbol)); + }), "resolve-symbol", i, address); + } + } } - } - } - catch - { } + catch + { } + }), "load-symbols"); listArguments.SetDoubleBuffered(true); listStackTrace.SetDoubleBuffered(true); diff --git a/trunk/ExtraTools/SysCallHacker/MainWindow.resx b/trunk/ExtraTools/SysCallHacker/MainWindow.resx index 4d5355967..ae50d5bd3 100644 --- a/trunk/ExtraTools/SysCallHacker/MainWindow.resx +++ b/trunk/ExtraTools/SysCallHacker/MainWindow.resx @@ -135,24 +135,24 @@ A+wB/wP+Af8D8wH/A+gB/wPnAf8D8QH/A/sB/wPhAf8DZAHxAz0BZxAAAz0BZwNkAfED7AH/A/4B/wPz Af8D6AH/A+cB/wPxAf8D+wH/A+EB/wNkAfEDPQFnjAADIwE0A14B1QPwBf8D5QH/A+UB/wPvAf8D4wH/ A+IB/wPhAf8D/gH/A+IB/wNeAdUDIwE0CAADIwE0A14B1QPwBf8D5QH/A+UB/wPkAf8D4wH/A+IB/wPh - Af8D/gH/A+IB/wNeAdUDIwE0iAADRwGAA+QB/wP+Af8D6AH/A+cB/wPmAf8DWwH/A+8B/wPkAf8D4wH/ + Af8D/gH/A+IB/wNeAdUDIwE0iAADRwGAA+QB/wP+Af8D6AH/A+cB/wPmAf8DWAH/A+8B/wPkAf8D4wH/ A+IB/wP7Af8DxgH/A0cBgAgAA0cBgAPkAf8D/gH/A+gB/wPnAf8D5gH/A+UB/wPlAf8D5AH/A+MB/wPi - Af8D+wH/A8YB/wNHAYCIAANaAcAD8gH/A/UB/wPpAf8D6QH/A+gB/wNgAf8BXAJbAf8D7wH/A+UB/wPk + Af8D+wH/A8YB/wNHAYCIAANaAcAD8gH/A/UB/wPpAf8D6QH/A+gB/wNdAf8BWQJYAf8D7wH/A+UB/wPk Af8D8gH/A+EB/wNaAcAIAANaAcAD8gH/A/UB/wPpAf8D6QH/A4MB/wOCAf8DggH/A4EB/wPlAf8D5AH/ - A/IB/wPhAf8DWgHAiAADYgHtA/wB/wPvAf8D6wH/A+oB/wPpAf8DXQH/AWECYAH/AVwCWwH/A+8B/wPl - Af8D6AH/A/QB/wNeAe0IAANiAe0D/AH/A+8B/wPrAf8D6gH/A1YB/wNWAf8DVQH/A4IB/wPlAf8D5QH/ - A+gB/wP0Af8DXgHtiAADYgHtA/wB/wPwAf8D7QH/A+sB/wPqAf8DXQH/A10B/wFiAmEB/wPNAf8D5gH/ - A+kB/wP6Af8DXgHtCAADYgHtA/wB/wPwAf8D7QH/A+sB/wNWAf8DVgH/A1YB/wODAf8D5wH/A+YB/wPp - Af8D+gH/A14B7YgAA1oBwAP1Af8D9wH/A+0B/wPtAf8D7AH/AV4CXQH/AV4CXQH/A8AB/wPpAf8D6AH/ - A/QB/wPuAf8DWgHACAADWgHAA/UB/wP3Af8D7QH/A+0B/wNXAf8DVwH/A1YB/wODAf8D6QH/A+gB/wP0 - Af8D7gH/A1oBwIgAA0cBgAPrBf8D7wH/A+4B/wPtAf8BXwJeAf8DwgH/A+sB/wPpAf8D6QX/A90B/wNH + A/IB/wPhAf8DWgHAiAADXwHtA/wB/wPvAf8D6wH/A+oB/wPpAf8DWgH/AV4CXQH/AVkCWAH/A+8B/wPl + Af8D6AH/A/QB/wNdAe0IAANfAe0D/AH/A+8B/wPrAf8D6gH/A1MB/wNTAf8DUgH/A4IB/wPlAf8D5QH/ + A+gB/wP0Af8DXQHtiAADXwHtA/wB/wPwAf8D7QH/A+sB/wPqAf8DWgH/A1oB/wFfAl4B/wPNAf8D5gH/ + A+kB/wP6Af8DXQHtCAADXwHtA/wB/wPwAf8D7QH/A+sB/wNTAf8DUwH/A1MB/wODAf8D5wH/A+YB/wPp + Af8D+gH/A10B7YgAA1oBwAP1Af8D9wH/A+0B/wPtAf8D7AH/AVsCWgH/AVsCWgH/A8AB/wPpAf8D6AH/ + A/QB/wPuAf8DWgHACAADWgHAA/UB/wP3Af8D7QH/A+0B/wNUAf8DVAH/A1MB/wODAf8D6QH/A+gB/wP0 + Af8D7gH/A1oBwIgAA0cBgAPrBf8D7wH/A+4B/wPtAf8BXAJbAf8DwgH/A+sB/wPpAf8D6QX/A90B/wNH AYAIAANHAYAD6wX/A+8B/wPuAf8D7QH/A+0B/wPsAf8D6wH/A+kB/wPpBf8D3QH/A0cBgIgAAyMBNANe AdUD+AX/A+8B/wPuAf8DwwH/A+0B/wPsAf8D6wX/A/UB/wNeAdUDIwE0CAADIwE0A14B1QP4Bf8D7wH/ - A+4B/wPtAf8D7QH/A+wB/wPrBf8D9QH/A14B1QMjATSMAAM9AWcDaQHxA/gF/wP4Af8D8gH/A/EB/wP3 - Bf8D9QH/A2cB8QM9AWcQAAM9AWcDaQHxA/gF/wP4Af8D8gH/A/EB/wP3Bf8D9QH/A2cB8QM9AWeUAAM9 + A+4B/wPtAf8D7QH/A+wB/wPrBf8D9QH/A14B1QMjATSMAAM9AWcDZAHxA/gF/wP4Af8D8gH/A/EB/wP3 + Bf8D9QH/A2QB8QM9AWcQAAM9AWcDZAHxA/gF/wP4Af8D8gH/A/EB/wP3Bf8D9QH/A2QB8QM9AWeUAAM9 AWcDXgHVA+sB/wP1Af8D/AH/A/wB/wP0Af8D6AH/A14B1QM9AWcYAAM9AWcDXgHVA+sB/wP1Af8D/AH/ - A/wB/wP0Af8D6AH/A14B1QM9AWecAAMjATQDRwGAA1oBwANiAe0DYgHtA1oBwANHAYADIwE0IAADIwE0 - A0cBgANaAcADYgHtA2IB7QNaAcADRwGAAyMBNP8AkQABQgFNAT4HAAE+AwABKAMAAUADAAEQAwABAQEA + A/wB/wP0Af8D6AH/A14B1QM9AWecAAMjATQDRwGAA1oBwANfAe0DXwHtA1oBwANHAYADIwE0IAADIwE0 + A0cBgANaAcADXwHtA18B7QNaAcADRwGAAyMBNP8AkQABQgFNAT4HAAE+AwABKAMAAUADAAEQAwABAQEA AQEFAAGAFwAD/wEABP8EAAHwAQ8B8AEPBAAB4AEHAeABBwQAAcABAwHAAQMEAAGAAQEBgAEBBAABgAEB AYABAQQAAYABAQGAAQEEAAGAAQEBgAEBBAABgAEBAYABAQQAAYABAQGAAQEEAAGAAQEBgAEBBAABgAEB AYABAQQAAcABAwHAAQMEAAHgAQcB4AEHBAAB8AEPAfABDwQABP8EAAs= diff --git a/trunk/ProcessHacker/Program/Program.cs b/trunk/ProcessHacker/Program/Program.cs index fc49e5306..60f75293d 100644 --- a/trunk/ProcessHacker/Program/Program.cs +++ b/trunk/ProcessHacker/Program/Program.cs @@ -169,7 +169,7 @@ namespace ProcessHacker ThreadPool.SetMinThreads(1, 1); ThreadPool.SetMaxThreads(2, 2); - WorkQueue.GlobalWorkQueue.MaxWorkerThreads = 3; + WorkQueue.GlobalWorkQueue.MaxWorkerThreads = 2; // Create or open the Process Hacker mutex, used only by the installer. try