diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys index 81c1dcef1..73541c6e6 100644 Binary files a/trunk/KProcessHacker/i386/kprocesshacker.sys and b/trunk/KProcessHacker/i386/kprocesshacker.sys differ diff --git a/trunk/KProcessHacker/include/kprocesshacker.h b/trunk/KProcessHacker/include/kprocesshacker.h index 1ec6e4fd0..b06d3ce9b 100644 --- a/trunk/KProcessHacker/include/kprocesshacker.h +++ b/trunk/KProcessHacker/include/kprocesshacker.h @@ -25,6 +25,9 @@ #include +/* KPH Configuration */ +//#define KPH_REQUIRE_DEBUG_PRIVILEGE + #define KPH_TAG 'KPHT' /* I like 0x9999. */ #define KPH_DEVICE_TYPE (0x9999) diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c index 5d60c77a9..f170d2caa 100644 --- a/trunk/KProcessHacker/kprocesshacker.c +++ b/trunk/KProcessHacker/kprocesshacker.c @@ -95,6 +95,16 @@ NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) { NTSTATUS status = STATUS_SUCCESS; +#ifdef KPH_REQUIRE_DEBUG_PRIVILEGE + if (!SeSinglePrivilegeCheck(SeExports->SeDebugPrivilege, UserMode)) + { + dprintf("Client (PID %d) was refused\n", PsGetCurrentProcessId()); + Irp->IoStatus.Status = STATUS_PRIVILEGE_NOT_HELD; + + return STATUS_PRIVILEGE_NOT_HELD; + } +#endif + dprintf("Client (PID %d) connected\n", PsGetCurrentProcessId()); dprintf("Base IOCTL is 0x%08x\n", KPH_CTL_CODE(0)); diff --git a/trunk/ProcessHacker/Program/Program.cs b/trunk/ProcessHacker/Program/Program.cs index 8ef8c9556..37c9d2d54 100644 --- a/trunk/ProcessHacker/Program/Program.cs +++ b/trunk/ProcessHacker/Program/Program.cs @@ -178,38 +178,13 @@ namespace ProcessHacker //Asm.Lowercase = true; //Asm.ExtraSpace = true; - try - { - KPH = new KProcessHacker("KProcessHacker"); - } - catch - { } - Win32.CreateMutex(0, false, "Global\\ProcessHackerMutex"); Version.Initialize(); - if (Version.HasQueryLimitedInformation) - { - MinProcessQueryRights = Win32.PROCESS_RIGHTS.PROCESS_QUERY_LIMITED_INFORMATION; - MinThreadQueryRights = Win32.THREAD_RIGHTS.THREAD_QUERY_LIMITED_INFORMATION; - } - - if (KPH != null) - { - MinProcessGetHandleInformationRights = MinProcessQueryRights; - } - - if (KPH != null && Version.HasMmCopyVirtualMemory) - { - MinProcessReadMemoryRights = MinProcessQueryRights; - MinProcessWriteMemoryRights = MinProcessQueryRights; - } - try { - using (var thandle = new Win32.ProcessHandle(System.Diagnostics.Process.GetCurrentProcess().Id, - MinProcessQueryRights).GetToken()) + using (var thandle = Win32.ProcessHandle.FromHandle(-1).GetToken()) { try { thandle.SetPrivilege("SeDebugPrivilege", Win32.SE_PRIVILEGE_ATTRIBUTES.SE_PRIVILEGE_ENABLED); } catch { } @@ -239,19 +214,44 @@ namespace ProcessHacker Logging.Log(ex); } - CurrentUsername = System.Security.Principal.WindowsIdentity.GetCurrent().Name; + try + { + KPH = new KProcessHacker("KProcessHacker"); + } + catch + { } - CurrentProcess = Win32.OpenProcess( - Win32.PROCESS_RIGHTS.PROCESS_ALL_ACCESS, 0, - System.Diagnostics.Process.GetCurrentProcess().Id); + if (Version.HasQueryLimitedInformation) + { + MinProcessQueryRights = Win32.PROCESS_RIGHTS.PROCESS_QUERY_LIMITED_INFORMATION; + MinThreadQueryRights = Win32.THREAD_RIGHTS.THREAD_QUERY_LIMITED_INFORMATION; + } - if (CurrentProcess == 0) - CurrentProcess = - System.Diagnostics.Process.GetCurrentProcess().Handle.ToInt32(); + if (KPH != null) + { + MinProcessGetHandleInformationRights = MinProcessQueryRights; + } + + if (KPH != null && Version.HasMmCopyVirtualMemory) + { + MinProcessReadMemoryRights = MinProcessQueryRights; + MinProcessWriteMemoryRights = MinProcessQueryRights; + } try { - CurrentSessionId = Win32.GetProcessSessionId(System.Diagnostics.Process.GetCurrentProcess().Id); + CurrentUsername = System.Security.Principal.WindowsIdentity.GetCurrent().Name; + } + catch (Exception ex) + { + Logging.Log(ex); + } + + CurrentProcess = Win32.GetCurrentProcess(); + + try + { + CurrentSessionId = Win32.GetProcessSessionId(Win32.GetCurrentProcessId()); System.Threading.Thread.CurrentThread.Priority = ThreadPriority.Highest; } catch (Exception ex) @@ -259,132 +259,8 @@ namespace ProcessHacker Logging.Log(ex); } - { - if (pArgs.ContainsKey("-a")) - { - Aggressive = true; - - try - { - Unhook(); - } - catch - { } - } - - if (pArgs.ContainsKey("-e")) - { - try - { - ExtendedCmd.Run(pArgs); - } - catch (Exception ex) - { - MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); - } - - return; - } - - if (pArgs.ContainsKey("-pw")) - { - int pid = int.Parse(pArgs["-pw"]); - - SharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); - SecondarySharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); - - ProcessProvider = new ProcessSystemProvider(); - ServiceProvider = new ServiceProvider(); - SharedThreadProvider.Add(ProcessProvider); - SharedThreadProvider.Add(ServiceProvider); - ProcessProvider.RunOnce(); - ServiceProvider.RunOnce(); - ProcessProvider.Enabled = true; - ServiceProvider.Enabled = true; - - Win32.LoadLibrary(Properties.Settings.Default.DbgHelpPath); - - if (!ProcessProvider.Dictionary.ContainsKey(pid)) - { - MessageBox.Show("The process (PID " + pid.ToString() + ") does not exist.", - "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); - return; - } - - ProcessWindow pw = new ProcessWindow(ProcessProvider.Dictionary[pid]); - - Application.Run(pw); - - SharedThreadProvider.Dispose(); - ProcessProvider.Dispose(); - ServiceProvider.Dispose(); - - Environment.Exit(0); - - return; - } - - if (pArgs.ContainsKey("-pt")) - { - int pid = int.Parse(pArgs["-pt"]); - - try - { - using (var phandle = new Win32.ProcessHandle(pid, Program.MinProcessQueryRights)) - Application.Run(new TokenWindow(phandle)); - } - catch (Exception ex) - { - MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); - } - - return; - } - - if (pArgs.ContainsKey("-o")) - { - OptionsWindow options = new OptionsWindow(true) - { - StartPosition = FormStartPosition.CenterScreen - }; - IWin32Window window; - - if (pArgs.ContainsKey("-hwnd")) - window = new WindowFromHandle(new IntPtr(int.Parse(pArgs["-hwnd"]))); - else - window = new WindowFromHandle(IntPtr.Zero); - - if (pArgs.ContainsKey("-rect")) - { - Rectangle rect = Misc.RectangleFromString(pArgs["-rect"]); - - options.Location = new Point(rect.X + 20, rect.Y + 20); - options.StartPosition = FormStartPosition.Manual; - } - - options.SelectedTab = options.TabPages["tabAdvanced"]; - options.ShowDialog(window); - - return; - } - - if (pArgs.ContainsKey("")) - if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe")) - StartVisible = true; - - if (pArgs.ContainsKey("-m")) - StartHidden = true; - if (pArgs.ContainsKey("-v")) - StartVisible = true; - - if (pArgs.ContainsKey("-t")) - { - if (pArgs["-t"] == "0") - SelectTab = "Processes"; - else if (pArgs["-t"] == "1") - SelectTab = "Services"; - } - } + if (ProcessCommandLine(pArgs)) + return; #if DEBUG #else @@ -401,6 +277,137 @@ namespace ProcessHacker Application.Run(); } + private static bool ProcessCommandLine(Dictionary pArgs) + { + if (pArgs.ContainsKey("-a")) + { + Aggressive = true; + + try + { + Unhook(); + } + catch + { } + } + + if (pArgs.ContainsKey("-e")) + { + try + { + ExtendedCmd.Run(pArgs); + } + catch (Exception ex) + { + MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); + } + + return true; + } + + if (pArgs.ContainsKey("-pw")) + { + int pid = int.Parse(pArgs["-pw"]); + + SharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); + SecondarySharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); + + ProcessProvider = new ProcessSystemProvider(); + ServiceProvider = new ServiceProvider(); + SharedThreadProvider.Add(ProcessProvider); + SharedThreadProvider.Add(ServiceProvider); + ProcessProvider.RunOnce(); + ServiceProvider.RunOnce(); + ProcessProvider.Enabled = true; + ServiceProvider.Enabled = true; + + Win32.LoadLibrary(Properties.Settings.Default.DbgHelpPath); + + if (!ProcessProvider.Dictionary.ContainsKey(pid)) + { + MessageBox.Show("The process (PID " + pid.ToString() + ") does not exist.", + "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); + Environment.Exit(0); + return true; + } + + ProcessWindow pw = new ProcessWindow(ProcessProvider.Dictionary[pid]); + + Application.Run(pw); + + SharedThreadProvider.Dispose(); + ProcessProvider.Dispose(); + ServiceProvider.Dispose(); + + Environment.Exit(0); + + return true; + } + + if (pArgs.ContainsKey("-pt")) + { + int pid = int.Parse(pArgs["-pt"]); + + try + { + using (var phandle = new Win32.ProcessHandle(pid, Program.MinProcessQueryRights)) + Application.Run(new TokenWindow(phandle)); + } + catch (Exception ex) + { + MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); + } + + return true; + } + + if (pArgs.ContainsKey("-o")) + { + OptionsWindow options = new OptionsWindow(true) + { + StartPosition = FormStartPosition.CenterScreen + }; + IWin32Window window; + + if (pArgs.ContainsKey("-hwnd")) + window = new WindowFromHandle(new IntPtr(int.Parse(pArgs["-hwnd"]))); + else + window = new WindowFromHandle(IntPtr.Zero); + + if (pArgs.ContainsKey("-rect")) + { + Rectangle rect = Misc.RectangleFromString(pArgs["-rect"]); + + options.Location = new Point(rect.X + 20, rect.Y + 20); + options.StartPosition = FormStartPosition.Manual; + } + + options.SelectedTab = options.TabPages["tabAdvanced"]; + options.ShowDialog(window); + + return true; + } + + if (pArgs.ContainsKey("")) + if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe")) + StartVisible = true; + + if (pArgs.ContainsKey("-m")) + StartHidden = true; + if (pArgs.ContainsKey("-v")) + StartVisible = true; + + if (pArgs.ContainsKey("-t")) + { + if (pArgs["-t"] == "0") + SelectTab = "Processes"; + else if (pArgs["-t"] == "1") + SelectTab = "Services"; + } + + return false; + } + public static void Unhook() { PE.PEFile file = new ProcessHacker.PE.PEFile(Environment.SystemDirectory + "\\ntdll.dll"); diff --git a/trunk/ProcessHacker/UI/Async/HandleFilter.cs b/trunk/ProcessHacker/UI/Async/HandleFilter.cs index 09c28325e..9ae01342e 100644 --- a/trunk/ProcessHacker/UI/Async/HandleFilter.cs +++ b/trunk/ProcessHacker/UI/Async/HandleFilter.cs @@ -118,7 +118,7 @@ namespace ProcessHacker.FormHelper if (!processHandles.ContainsKey(currhandle.ProcessId)) processHandles.Add(currhandle.ProcessId, - new Win32.ProcessHandle(currhandle.ProcessId, Win32.PROCESS_RIGHTS.PROCESS_DUP_HANDLE)); + new Win32.ProcessHandle(currhandle.ProcessId, Program.MinProcessGetHandleInformationRights)); Win32.ObjectInformation info = Win32.GetHandleInfo(processHandles[currhandle.ProcessId], currhandle);