From fd240faf2aef2f3d1000e6224b8bf4ccc8132a3d Mon Sep 17 00:00:00 2001 From: wj32 Date: Sun, 19 Apr 2009 06:25:48 +0000 Subject: [PATCH] fixed handle filter to use KPH properly git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1098 21ef857c-d57f-4fe0-8362-d861dc6d29cd --- trunk/KProcessHacker/i386/kprocesshacker.sys | Bin 14336 -> 20992 bytes trunk/KProcessHacker/include/kprocesshacker.h | 3 + trunk/KProcessHacker/kprocesshacker.c | 10 + trunk/ProcessHacker/Program/Program.cs | 327 +++++++++--------- trunk/ProcessHacker/UI/Async/HandleFilter.cs | 2 +- 5 files changed, 181 insertions(+), 161 deletions(-) diff --git a/trunk/KProcessHacker/i386/kprocesshacker.sys b/trunk/KProcessHacker/i386/kprocesshacker.sys index 81c1dcef1b6df0b827cbf3e5ee61d1c825d297a8..73541c6e621838a47d591ac995ff28926440d85b 100644 GIT binary patch literal 20992 zcmeHv4S1B*weFr|0s{G4pGy9H`L7{l&sq55 z9QN#tA70a|sr}(K4epi>W4qV0#oM^u*won8=J6Rfxr| zqssgle-M&YcQLk@5{E#V6g>HJ3}t}tt7I&Da-Qma1o`+&eDKnjc$<=1>T~V#0UQ1z zzDO<-f{d&B7#VXf^)@&98X4K9!8sEEUCA7d6@rpzQl+sIs5XP zpmD~&Iu~CX0rLQP0M*BcoK>q=H4tiM8os&!q~vOV>SJW=-KE|RZxe7_chDi1?`BmY z%44i*sn^x&LBUs{OLh!E?N|*^eJW8-_4;}8G8&L#PU%A6g3jHSt6?GQxILDsuSCi= z?ucdTkdmA_sY(m97BB8YC>8$TYQ_R*wbHNdd{xT^l0P!N?0)MgaqYKWq(`_1W(rzI z1D&I+^Y8X{j(!il+CSTE&jYzfWpdWh$OS4JnVu-ClYspXVBJO(4Ozpod_r6xnxsr7}RBQM&Xd6d4DJ2k2k!*$=&IN6T=sd|e9(Yw7bdIBX zAgm2q4V-8`^G`STMabbmFX+4oq0>*+m{M&MLED6c_bOx1dNI&>k@-hClT_z~WX%Yo z`b3${uw#1fwJ>G04)l@3>5p&jCvrAj5V~=KT$Ks(k{pnWze0X!Egwx8w}+qn0x3h! zQAS9>dG!n37?N~DJ&o&UZ>NqKA9=)|-dkCqVG$!@ROAcz0$wZdCc^6opDOS=fj1C- z4BaFW#TUx!1)dRpi12RQCE)VzKmvz}bm@Dy3?Wx&W5_X$?r_fI)v+K2nQ$suC$!7r1hy&T@LSNYST1%@j`+ zBh|%m>yUCI73dsietj>++Q|E;5M2U{M#21qFjoPS;!lar!!s4nnWFRy$Rp=;vqFTc z-_0iv)kTg0OYQS7MB7sQ3q-r}&@NFcfc(h4qR_PT?o(WZF_zx_T`m?W!BiMmLM*NX zo+2gad4ov_YHk2BEEwT_#=Zx30=nxCMoperm7-WUVzA=@y9Q5s|A5h>&x z##mO%-2&t4#HSePqVs#vDt1PSSCum`dP}yk=HP51eA|Y*?wB%X;PN?S+U`E;ZmU4? zi6s!seT-g9>D5TDUG#bby)LF#JH2MpYYtu|xTCt^vIaPPjH0h$xs%xdsY|Rn-+alY z54@tKArx(~1ItTjCJ)BSc!T*-zjd72ASi9c{Aj{~IY#C>s+$s@Zd7u$AP9`J&NMhs zbb;j5W0;$;hdUrB#>`k|IcGOMb?8^eqhx->O~{%*m4Q`{;dH_gp7$p)koBQUe_q%9 zx^Fh9Vp;$ttOwys#YkR0aKYGbrO|?!`-0XBLF*VoBIYFsfxu@0uk;w3A!r+cdYmJ5 zG!28Ex!~bNGod?7cJz}6beVoW^))w5=4s{`z8`G?aReKde(*)oJJjf=wL{2y(H`ES z&VCTtTQwou7!0yCg*+pC5{nYK`krn5)*+POk`D*1BbW^atzonRc#=G1JMY-4A(4mb zwrVgT#0=BTwanS?xkj>`584L$tu!jKt-6qNpl<67xS2hCdj@BN0&tOyWLD=GRLN7w zms5O_Dsa?8FE!tTe~wJ?&+z5^lOiCLK0=Q`1vv}z%K;5O&eC79W_S0c?+YRuHb}K) zl-cy&>m{cl)tOP|Gk*0>I;UpnJ zU~-7cig#1qKVctT)#Uj3xqXuCLs4iHwlcsl6lc->|8LsIG{rune}ez;$RNiq-aVc0 zoSg1HpAFrHd`oor47tOjC-!5gCeIU{O5O9%Cv~dxk^fATL!Y+}(I7FKclxOBN#UNZd;# zFb?koRX7T7Vcb8kVswrK=PFH658+AvVH;AsYn1tB#GMVCr}~XC?l;N=g!|9l3nP$# zPd3co4|X>oe9KY!HS2rqHERrQ)-&HU63{;nO$m%>5Y8}b=!;<8ts1%Kkx~-FHmW0J zQ*qxv2<>#C>jkYt>CZdg>we2OGh`iwnrU!@A|ls<7U>lcA5V%r)LVr@QN{WmEI*St zh$?~3Ax4w_p~wdiUztAWee)=SA%KE1%^e`W24jHa7z;WF1D%7+KUeNWGtf#M8WG(g z*#=W*(_~H;kpCX9N2YGCP8&& zlb=T`b_p7xZjO&-`l!ve^TKxN&)Z@c?q`zViMH*TiIu!$8xHDdV?^%SXs#3@3z>fy zeif5y8nRSomB(vkenLHag7<6_@k7ssz7joKH4`!(K<|yuhHiju`Nl@_glNk2K& zf7ksP{tYV_0$A`=CpoiTc4npHt9^L#=(P`;m&>80V%*{lz09~(k4djRyjD*Q9ErON zsPIwArcd&^YgI$%qyQ3~DRaK0rzx6J?2#~p5@OKf6+?9Qbz-v#lTpkQW0?nePr;^A zvhJsB<*DbR`UHK&&{OFz1SRcnZ|}W8 z%jS5z@S!(i+sgcUV3&@i_q?({R74o3L8{URyUUU8?=HqS`H4JFhw8)|EwWhp^SlN; zz`$eR%w7|PmLsr;GKEj&OGO?wLp_xsRu}5tg$I0`dnacQIL+B~&XV|RjTMkw_O0 zw|ZET3~G;a7Y3z<1Wwa8BZE>RawQqmxqt7wpp$~tk@ev0g=`@lne1shILo#_XjAM- z0b%^JCbFEILOm>+Q>%Jw)%if53R#`irSp6st>gpvKV8tH_!6i4MI0ugc(Dm~d(cami? zdF)9^^3@s?#*C*c?x@r>Me~YXOQ^Q(P{L6U&&s6zx1jSdIqKnA); zP(X79Vj&z=2q7Hxt5}kX5EOEDDPBsxDZKPyq{vH)nQy+lWq`#@*cz`DoloN@ZLB+J z6@C;35ag5=%o9yZbew2=C`8@aaR4*D$K!($v6s3@x1dH*US;RFWbs%Wotq#l{O~Hp z?z6CQFYyS7AkDk66e5Gd6`x5Jrk7n&Jw7P&fj|Xq&EQZ$Y*gJudK2@5b>x+Ev53cn zC^0f&fKYFiaLI{+dfa<^xj7y<~Di4PLmsD3UQv8oX5x$#?A>XI>MH5+P6`!$cNdUFNj^B5%lll z)W4CBvdTWm@LfssfIlI=KSh%MdGY;cehJ|_$#s**Re2y)Toscktl?-fCHtv7WYSi+YRD{`O@Y~;@;}c+5W7{w zr~^lQTUo3?i|kkd6^i*M+`mPcSmv{kTlD(aBBn|k<7tsA&p$Kjr91U&r4F5$)45fe z78w7O7Iv7A!9Q5&UIT{H)!NiI&HCc-R>Tu&wO(4O6YsavyH)o|rFL_AH;ui}MaX#} zSU(}%p%482Q`&R1jrlf&RH94?Sbg!i#;O(Lx2B9w-IO7GTju|<7Go<&AqN7oJif(8$(zGNL% zes0pztUlUs%7TK=fUNen%e5E;8DIYR%;2YkZp`Px zYyJ?!jRbdAtX&^#H^kaA!WL)*=fijMGH6CHr5EE6JL3cyopfF7?(EpzS+Tnphco4Z zxRl^rduzS)fw|B8bMsr~Pt38{kMG!U*PUmi52XK+UfHS%-vR~MLF{McTX0#&iyZOZ!D?6|(%X>hMN{I{2R?&eoEyxHpM9mAK03cGR9asP?n6MSh2WyGv%Gs>&Ile!af~EpEPa0pvHhyxUva zV2?|cP|J^eAFSwtnd2X7zg&-=Q}RJyrEjhQ>n>G&IX`a65o)m}F zv4@OGcJ25bV{1NcY4alk3SAmAOq7=V3+u`2;z1XKey0qy}j4EQ&| zi-7+C{05-KzEK8XDWDio2iOeQ0XPWw7r={vLBKnJF~Cf0uVw>E0d~N8z%Ibo0LK9@ z0p0?P06qmMALWj33J|ve7B2^UN#xcjh5no;2J=HWhb6jo_0{!9-XHj6^?~PB?%%aP zr~DUdy&B+~OV_u1Jv7*KP=bbTHy^s!Z%ck{F&7t3!YyrY-ZWV(`%=dCVK z^B;QB`*5R%y$hi9x0*EUI{>BJfLxy5Z_UElJwT~P&vUALC+;)d0id$K!;@W|prbDL zG4Q{a^S<$S8g>kz@H?xbw+45jodC+a%BW#Rz@^Gvajk|e08ri`JRb&p{`u=_VD+yn zzxSO5FIOAW9$N6%mE?2o|1W5OuiusXS7P_a?jG~tW|j6wwA#_R>87o_k1!wokYmJ6 zD`gQBpQ(w&CFvR4QTy3T*5>7LzISAK^8JdvXEP8sE_Z}aM?~0O7!ePCl8;q-eTR% z=Y!56`Is=OK1&?Hdb>}~h@^m;lKupnL&>~Gfsw47*V*4m&f&lZS}+<6^l8ECtRt)w zync@?FpE4V2v?W0hzLH}f)4~ws!e*v#kUhw`yo+V79#0R zWl}@Tkgng_MV;IHdeF8n$WNt$wnIVNVVG9u#XXAis?L;(@?@8kAm2^omeB@#Xj8wx zo3;#zlEm|Z-R*eCW^Ra{*x98+1uDo}65i0KHsQB$(1=}OEow*pnbQ2~0TDC573^7$ zTEU);{JWWd(^ZCGPbi1x-;2`U#F7F2(*o`LP6fL5L1f6!vt|f?I*`Ih>z~b7A?EC0y69=J6Qn zE6Vss!9&Xpp-DK(J;VckF*n#l=g1+xYipN6^n#uFd{tLWi`b}ePdTzuGixz1l~SbH zbVK;6^ zLiidw{N=GJv=|H(tK?8RMBfgnhcfEIqi4A_B3B9;s_w5%&@fWH9{R2eo8=0>!ZswB zsw%tB~c-ZDu@`^ZJ@LWgFQM*qaii=U?@W=V+eNZ zkw*Ut(GzW$Im&X9?D7#67txvkg9f5=~VvH3G(AG-U6rT8>i+HCzYB> zKQ5q1NNCbd4<&Gd5~8|sU*a*1&IFTt#tXp6O&zBCA^KJh-c=F5hw!SPFPEd^^@v|k zRdw>F1l1v;Dt8~+Z4QNc@eKu1MqSwRZLUDM%{QPPbkuzwdANebFSLcIR{WH2Ak;(k z>%!Ac#7EJOQzwmWqJCn83K2coBhR5QS$p!3asqhL9wONZl;&Ma8w@>#G`bUwnB9~{ zC!%aec;zXz;9k^LV&!I;L&BRHh_(n=$B8z15QeKK1?_Hnf-Yq_!fj$s5iw4oGABXh zsEW!lnF>8Yg|Zys-j_wcdTbX{ z*ia!y`0P_^i+6#BJSPf->83CyP55O%4^@PKL<!xD%@K>Ja3J78vLN)5bkE6+o?H>@z6po|oz(r6#v5(#( zb6t!Y3RfM{p^zTm;7S>F;rmrwQ=(Q>;?waE6?KHIQx33XE~d-xv&XN>eLid*kk zm2|aZLRrbqoC85emSi1(DNx!@r89VGecoHhk7ee-7RaA^ z#aG7;9l@TIc9Vu#0sT$bTWZF;3+p$)dw^q`HEa}+xkbZP0=^HZc5B#vz>O^$)(yzp zs$qu#?*NS3G|U6YXw|Tf0Nb`>-wVJNELflcqySO@T0k0L8elp=2bckv377@Y17-u} z0MY>lz+AvQz!iWDKqlZyzC8d1sr~)#TaI#t%$H zzj@*p>Ldf`dl5?U_tg*{qRoCPyM_5UZ5R8oaw*f zzv}T5z;$59uviEQMtf8D$ zZ`xw_wzT;e`?Y43r`px(^0}&AJ6f7t_&)`4O#SZdn>;vju5D@ChHC?9b-q?QwsW?% zP*<+^fx;HXeva}h&<}jB{8k0yM-vd3laM@rvai|9UNj!=!RZAR&vyY(z zI)xP{-$I54(j(NcR-B@;1F5#{c&+C*3hF$5+%Iq`$KWNYw?H8{hgt5!w_BE#u{7vp ziYD1N(K@*ZXH|vT&NiH!Hf^hRCDng=+U+}6w0b&REEjsjS@o(m9N%uo-3E_x#Lv#5 zO#I4$ID%)5TF~F*TIunM^W#?_yR*aPUb@+LAdTHtfBeCUaew1qAb zid}@#qW`E%52mj62?;%NuSvSPz#b7;VO;fv2X?>6krjdN#r_qTB&&;BRl8TTAlE!e zE`D!;9Y-D9a^QM=GG1S)D4s;S7kN`IRu0n44~$l_bd*(S(|xE8+@&I(?cm)4K5bm4%ip=8f19LJ(OC;RUQkNZ&t*%&b15qX z&_%q5A+d(lqTCip)*8R(K%BSWKRO_sUjk>uzkF(9*D)icH}O^*c=Y%OZjt*|!m zcHw@85%(qNo(4%{1Wh+mM%=kr&7AycM~x*&?clOeLszpaAlDkMfi0lc#-&sALvM7G zgWv2gv0n;*@PrU_E0ZSlwSn$Pu`Tz|55C+oHvd^PBi zjgU~0Jke_y%c0+%vj*f+-{^q$8^d(cNX_@J3rWZ_S zOy^8*nLae-?r6eI8bo7;IV=y z3%*-$s^GPP!Gd=RMhk8%TwQo?VRzvJg^v_IQTTM>$--9(-zfY^;V%k5EYuWTRkXb5 zmLg}-hN70Dj-t+@uNFO6^k~t4EBbcP8%5(qe<(^XE-b#O__5+Ai=Qq&S$wMawcfwt|~AWG!}fL;Dv(U6WelNeYxm?qN7FsR@94j|GX$tq$$oQzPfmQ@k?m&aPiEN6(t)=9xFLn z@@7e-GWK3Zu+r#@wfJPvrLIp2|I+JCu7d zcRZKnY4fu4jCqUmmgH6E)#Tap8uD86+Vghh?a5;s#lLY|Xj)_{GI>mX(-G4@nZ9ds z`2R-zZJFWiQn6fFFD;mP9H zi{C3|B@0U$O178mDS5x-s?zI9kCwk*k%_icTWTz|7Q3avvd*&JveD9Pal_W_79Z@r z$I@llXW4H#XgOp#Y&l{%YB^>(Zh6wuvh3+)tV^_Ymg#C!j_Ep6o~Z<_|J(iiZ+3&E A*8l(j literal 14336 zcmeHO4Rlo1wLX(f!T=Ly!~}vu88Ip5|T+s?jWfN zBEzWTWvaF6)3$0;t+j$mEl;CT9DbUBpdzFeCAE1rwG+Z?X+eyT$9>;EcV;q)wtZcz z>-BXl?^^rbea_iu?|t^!XP;?^$m6F8_H{S73CgJouFIm(lvNJx+;&ZaIsTYTUY7IOi3A)5nC{PP~2mm8}{wk-E3)GJ~^JnZqm8@_L zV^ayKhb_s#!>_H3?Sh<;p0SC;+v3XIXfKE>lb(Cy%fs+Y!L?aH-MR6&X#wc~n%uZc z$Cx{_p|V^kXKX8U;A1D6VTu$mHZM~qV_RVwt_acV0C86VV}~8HZiB^PrV+R~05CI~ z0*JeGjIEi!XnrwOT_SmF0A%D_0CAU&u}?A^8XGE5$8A>+gy=E$_^W`i*_jQlnmQ0J zAscT65Sluj zc8p(gFQ-_RS|WN?;#{Tah(A;+wx|R40b#OJ@@h-LNlX0`s}q*rdRSrCiuQqEbIz5% z5xx$kuU4z{Z80+;Uu@UB=Fp1;y2Q8rA@6y`XscbjX++!gSRZ{;62DmIyNPLDo2z$7 zo6NWNmxiAl%b2)H=R2hKU-W)z3awtX;>ZDQyjH%msih_<&@vGIF$Qbx(Cl~=&u{{~ zgbMegP$Fj0Al*59%oiNe2a(~Q1&Z+mZ3B){H-&`iDM8x>M`?+aR)7xG*P24XlAPt@ zrSm&Q+d#+Mf@Ft+btLfn+`@UKD9o)NM|E?}$yx>T&6}tM;XP|6-YrQIu?pHCBP|ci zOrce)j~r0Rs=L<|pi>gvCqk^0RtO4zNVDT2N@9u|^_thxgjovGy%Htgl_ZUS560sA zLZR`0hmac-(DR^YHXtO3-XCK0OA;wXD(fwJeISKY4y2H}vZ`vX7OC3L8Ir06 zF;&&Pj#Ta93X&=0A(1sk^Ey)habR9`M-mO72KcIjzDuy*1Dt>=DSn{x3x&5SP9?)v zsx&R8QaZ;-r8O~?GGZ!S;M_^2mArMRO1p>1_MZ@v+TMiouR18NwCYrM$e>{1S2S=7 za?P&D67{(Tuwbb)555wx_4JK4g$fReuCUM5!#ZpOSKxA@ttb3*^o%ZC_hGnv_<6Lr zp9l8LG$<8*f{OQ3QAfoGsJM=bQ>l0tiqB*KGlgW8_}a&^SGOm_Q5_JTYf}l@;9R8x z3QB1UQPZBRSXCBv?qjhYrPWYb?Lf!YVo+5xNe`e-W)#JKzto&sB6-!}$01a-tEDtO z)px8OWH!i)IH51sV(QTD%l~3`Sr-JgtvO5>nn2#ZqtS*}0R< zymKd(yS5re?xzqLv~@$Uy2I8@J1kTPU&dC3#jGA0ho(9)7R*?`o3o8lg^uu6B0y8Kr&>Xyt7g>+lD9v+QjH)$^+jB(F6gs!XV9i{R4d4! zr|{(ZoZ|YVt%*oj-8>Nk^|>yvYE{5?E@(UFs2(YK2g1|f5#l+r`$_bp+W_7ArITVi z#nVVoI##WAca!f~QW!IxMo=y5$(=+l;~m9)wD&g{f#^-mDVr!bM4LLO)>{v2w!KKT zOSM6z(Rx6$?P)5d)sRkOt#51Ydk|&R-*+FLfwF- z+Is@3zUv|@B_gUViFTW`Nab5pimsoI@D>>VKzd|mVG)%P7Rf;6|6hx6I}F<8A8nBu z#M78X_K~7ZK8c|K+%^h+V=W%OgxBF)aq5HcUFXpM=~79 zbh2YsYu$SC%N?jRoyIy1ly!?Osn*NF#GJAWVLTQZtuYvfR#;$i#J#b;dSdIVx&RAI z%p&VaA6O4+c6=A6$}Q6h=^*PKLZ&5x<`#@m^6L25V3-Vf1$Il`p75vtElB~J7V>9B z7oII6Fd`zhZ`xO_zsy*rHf{x)PGiZ6I6073qP^RCR7e0~(}sVC$%&4idm+U_m7_HS zqhAHL`hG?*+z*Sefcz`zNv^&;p3PY@tkN!w4$+KLJ%+m`lv-t z#0JmzZ61-ri8R89VtjhN`@oabBp8CWy$+`{=$CtY(<9qRNw^GV75k$NY4sRauOFPC z#r7bcxvP~p&R`8wNGT0Z0eK%Z2|1)}DQzlQ;hgn+%T+@di0ysrNgx(`M2_6-M9rST zr9V_Emj0k;x5=Juz1*zAS{LoR0}6Q1*dbEd@ERP7MSvw(CPxmW$`K$Ehbg?p&jBKD zTk9jFbHu7n3dw_}EgUqh=`_v0}+mN`lEih^|48|ko z6r93hFN+a-g@)N{h|lgB?z8Y#_-w>slgMEy*hEb`XjR$_;vBY{+mzfh>ag@)Gm=}G zJ1jK`nNf$8d&7~4IpRuq7bcpF8evOD?W;p+6ND`^%S|qEQ;Ll;C?Ah4b0l_ zMcM>J6noq5rgd=}$O2{k(gy+C1*}8LD0JccPbrJAaEacUV*47VY&<^{4@hZ0AimxK z+VU!a;+(&F@Sy(}Vh4hBTkG>g{lAPIySSf!DRxK-O)Pf&mCzA&*`c9hMJa`hv}Z|; zXqJkx3p2EVnhb3aaBH`-q?E^LgKfa{ z3rD~e#`_oLl;rnz{-$}Z@)_!fBj35o08Yw`Enkg%m-xG~qDXQ;78$woSw!}WPTnPA zqsqi}EESV|{a4y;65gvQbHajmX@wMVkuvc;lR76n29ZZxq!#C@#~1tI#ix^dPjRk@p=z zIw1TT3;;)v++}KEtea+_R6Hpj4u2w7!}SC6)Wg|N8^(SjXMaJQrxJhF>qXBuP$A_y z)xrZ2mPfoi!-!vg;a52M*7kv z4y0a{H^zKK-ntJ33Nuudfg5PxAk~Y@RG^+_njqGzeOImsR`4+UE?p6n)<18`44O9u zSN=>Zj>h19cPW|om|H;xnWGB-0SsOT&I=4k-|or>$*Y;~P&y2J5Nws7&r(t*zK!Sv z6XdC28`I(N`2h*JVRyPzua@eyQhjQ81}uWiYZ<4(Fail}$f~k~OTk7Z-YjjLC~Zua zHckzvMF^2pSz1!+6wgo`G@USAG)dC?E0E1OD4r4jB<`D@VFv4`yX0D`a)75qB5c#Hv^Yo{gwofX^5WXpzf}Y#u8Iz5%Tb zP=%WCl)DqC*94fVpXmfNA>TIgd(uQ|Z$ zSraS4C>lWNg~l~#aiOgaHBF!!eoZZBY&u{Gpc=3Z@EG6+fL8(SfG)sUz$gfs3Mc@q z1k?lW2YeUs0-zo6G2j9~S;5#h06Bn#fD*tuKr`TBzzcv7;B7!R;1WPxiBCa*0>DCm z8?XiN2;e2a0l;y<9{}-J^c!CSDwhMM8UT}Iih1#be=iPadI+g6;=9CI=v=w$XM0lbRW*-NpuTeYN__9Ec2x+CgjBd18{Op<8(a-5Hw-OSnQ|<{>N4vqVX2|l z@#|r`8yTZ;L@m!oo>cyKhk|_%K=|$=1=|CN(jAMVJ8`vweE^^<+TI!0K0sOb@p9j* z@Jx%~L?2H#CSAeC0*J@;c-|DjiSBqDzvgR@w*U~`xAA;5f)m}TIJ(Mf@xcHB9u{06>82W(w9(FW~%iX7pi2XVZ_ zmnF@PO3?5OT4#|%Ov%9k02wr7f6c&<53=oXgg*u`k>-Llnz*!gnxx#OLhntvO$A11w8mp6qE10=l$w3N1Tp?bX1bm2P% z7mGF$I2O%O)@TiXZy#yRd3Q-Cd(R_qMhw%pE6~zLAE)-xE9Fk#WtC>zb7=N`q10@9 z5(vicb9FLtOu&8|FNXHxML~O85v;uQ?WiU0P}1;vaA&=XaQ`yL;wZ-jGDqUp>2n=t zLpZ*My{B&%SK<0-hij-qGF~vM6(!XS6Y$h~Ai59Jr`dJ|X<;N)tw%N6&I1*bgLceC zB&o*dD3l1#uyu+l^tn__Rf#F|we;kfDJSnACmxPic{ItooTS|Lf4iTh_q7=5z+w4fZR?Nfe!;yS!qV;X3(dgp_j4`U_gC~ZFSo+=*geU}>^ z4wuDci)46OW7merROH8WVv4RY$FRk952%Qy3w!^duVd*%_}e>sYoh`>FGogs6iC#a zASvw#Y>~}1h8i!)jho2V9O2J@fwtSD93CFhcH}79GI<-Oa#NIhEhnmG=$+UOieHm) zFHh8LE0%l5CUTWFP}V7~N)eh8g@#nn-3woT@2fsBjx4%oZIMJg;E z*-q#8MeTG7OE0(zS>+ywXzTWcF2GjaP97H~!rB2_Cyz&q-a-dkPXHlpmCD!B$(oaW zwjOmKzNGZv6C^E_Kyt4Lj62O!NC0u)c$6|h$+7vlD^%30|dYmfL8$OVg<_v zJPz0g_y}+jkiJyG?0|Oxqp{l*1K5NK6BK|1Kq5d1NCG4SMgUZRk$_Qv(Ev3d1uzDn z0cZhN0mcHZ2BZSg0OJ7T0qHzF!1FFN=2>e>@XI69MSLNdBo?XhQ;u=I%}S+rbhWZ0 zf$5%jVigR8Xd5z~2y7(dL`@_Aya5LMzrVQhJnP^Oy-p`W74>*we=K2s-MTq-we=)=iEE?R)hOV{t0V5X zllNJ?mR>#CZ17mO#I?=^))lTuB|8F%#qI`Id1Y}^Jv4p}<%M;18@%-q>9d;#)nK{c zF^mP;>#9703ki=|B%u)ehsntPs$TQTJ(V>s_8BZRx2h(hkF3LK)XjlPf@`SN-jCHs z?ORNCguzN&4UJWG9`-<@y%t4hQ={OjT~g;2sywb)m6Z*6<7T;u3t&3Dch3@VcSlCW zSQ4!FC7ZLKzzz`-uGDPwUg~M2{)Mg~{SC0Q()??N& zl;XM#F8l)dMbyoyscUqxawX{2y5`n3lr~feF18=KFKu)+@Y<--?3QFFyon}uRs|&v zFapq;VbR6)E{{BmgHvz=sAbE=Qy))UB*-%BBK}o}3EM2l^Ul~4a;;n}t@4FlOCRcJL0(~H~{`3dy7y>2bH}sg3@?hjq)3RNljd`M@p{lmLp-DEe6E@(OY#c6iCT6d=s$#>OIUjG5Z1p` zKT?SwiKA^zJ@SNwTlCD4y4OOX9sjk^swPA8ks7PCbt&&Pc(aJqi3{Nok+Wql$b zi6zILGkL50vu>Qh8U4IGdgVc$0{jHzHmi_TT@P+m$auQI*~8W$=ZUd!8a;l}sb{$W zGjt%0Zh;g9&zROCXIc*WCTLU6bFakzPUN0V%t$D>YCs$1O?lr&WP(X%J!Drwj{Nt7 zzn(EB`>Epilz>kII1TnUuuRCzWEKE@EP4zYE7(HNt>>BCXnvO@ug6bsu@S^_zJql- z{O_QG-OO~*Ue8CZi;X4|wF}Xka@roqb|Dk3L!Ov2(xi^4|qDStZ9V;Znc zTsN}EB6cX*`TzNfc1~cexv_v!LnULNDplb%VublC&gf zB7QFZmR-%~*vt-k4PzPnj|9bNCEsX-SCtQ$>yb+S;>`8` zm%d@aS1NF#(5LIC=ri?e_5ZC;Fr*kV4TXl=4Mm1!hSi3<3_-(p3{M(%8eTEHZg}5t z%J83tKEr1Q$uQD*wQ-X1CZoYT-mFXsv z!IW*vH{E6`GOaMVOm(Ivlg|`1{lxU9>4@nwoR^j6G3Kkylgv}h)68?t%gkHMLGzEy z$ILzEky&?UeVBEFCEHSKdBpO9@#KJ959D`(EzF+)>lVPd7||ar&w0zn`9DonW+-kc-4HPXh!9X+8KAx_|}YPX1qLO|BUx%jGAeiX`i`vX7kJ+&U}65hcnO4 z9H0QElLO~i{dM|V^ftXme~d))P7_KuI4KrcyCc}M(M-5LKb{T$c z_%B1hVVvG@cM5E3))i}*q z2uTiOv9ZQjZ`^EbHsVtgYeqkneuCbmuhC2Tk%n1@#fCc!f?=yc#BBfA_#eiT#!oQI zBTUClADPaY`b~-EYt6Tq*O?zMKb}=(`KD!yWt-(*%LA5gSsu1LX8Eq=Da#Kn&tV>4 zvb=)1e8aNOa=_AVdE4@?<%Hz}%SV=vE!(ppbPZ#vc#PIh(r4&z)*JP?7{%AuKiUHS E170{S=Kufz diff --git a/trunk/KProcessHacker/include/kprocesshacker.h b/trunk/KProcessHacker/include/kprocesshacker.h index 1ec6e4fd0..b06d3ce9b 100644 --- a/trunk/KProcessHacker/include/kprocesshacker.h +++ b/trunk/KProcessHacker/include/kprocesshacker.h @@ -25,6 +25,9 @@ #include +/* KPH Configuration */ +//#define KPH_REQUIRE_DEBUG_PRIVILEGE + #define KPH_TAG 'KPHT' /* I like 0x9999. */ #define KPH_DEVICE_TYPE (0x9999) diff --git a/trunk/KProcessHacker/kprocesshacker.c b/trunk/KProcessHacker/kprocesshacker.c index 5d60c77a9..f170d2caa 100644 --- a/trunk/KProcessHacker/kprocesshacker.c +++ b/trunk/KProcessHacker/kprocesshacker.c @@ -95,6 +95,16 @@ NTSTATUS KphDispatchCreate(PDEVICE_OBJECT DeviceObject, PIRP Irp) { NTSTATUS status = STATUS_SUCCESS; +#ifdef KPH_REQUIRE_DEBUG_PRIVILEGE + if (!SeSinglePrivilegeCheck(SeExports->SeDebugPrivilege, UserMode)) + { + dprintf("Client (PID %d) was refused\n", PsGetCurrentProcessId()); + Irp->IoStatus.Status = STATUS_PRIVILEGE_NOT_HELD; + + return STATUS_PRIVILEGE_NOT_HELD; + } +#endif + dprintf("Client (PID %d) connected\n", PsGetCurrentProcessId()); dprintf("Base IOCTL is 0x%08x\n", KPH_CTL_CODE(0)); diff --git a/trunk/ProcessHacker/Program/Program.cs b/trunk/ProcessHacker/Program/Program.cs index 8ef8c9556..37c9d2d54 100644 --- a/trunk/ProcessHacker/Program/Program.cs +++ b/trunk/ProcessHacker/Program/Program.cs @@ -178,38 +178,13 @@ namespace ProcessHacker //Asm.Lowercase = true; //Asm.ExtraSpace = true; - try - { - KPH = new KProcessHacker("KProcessHacker"); - } - catch - { } - Win32.CreateMutex(0, false, "Global\\ProcessHackerMutex"); Version.Initialize(); - if (Version.HasQueryLimitedInformation) - { - MinProcessQueryRights = Win32.PROCESS_RIGHTS.PROCESS_QUERY_LIMITED_INFORMATION; - MinThreadQueryRights = Win32.THREAD_RIGHTS.THREAD_QUERY_LIMITED_INFORMATION; - } - - if (KPH != null) - { - MinProcessGetHandleInformationRights = MinProcessQueryRights; - } - - if (KPH != null && Version.HasMmCopyVirtualMemory) - { - MinProcessReadMemoryRights = MinProcessQueryRights; - MinProcessWriteMemoryRights = MinProcessQueryRights; - } - try { - using (var thandle = new Win32.ProcessHandle(System.Diagnostics.Process.GetCurrentProcess().Id, - MinProcessQueryRights).GetToken()) + using (var thandle = Win32.ProcessHandle.FromHandle(-1).GetToken()) { try { thandle.SetPrivilege("SeDebugPrivilege", Win32.SE_PRIVILEGE_ATTRIBUTES.SE_PRIVILEGE_ENABLED); } catch { } @@ -239,19 +214,44 @@ namespace ProcessHacker Logging.Log(ex); } - CurrentUsername = System.Security.Principal.WindowsIdentity.GetCurrent().Name; + try + { + KPH = new KProcessHacker("KProcessHacker"); + } + catch + { } - CurrentProcess = Win32.OpenProcess( - Win32.PROCESS_RIGHTS.PROCESS_ALL_ACCESS, 0, - System.Diagnostics.Process.GetCurrentProcess().Id); + if (Version.HasQueryLimitedInformation) + { + MinProcessQueryRights = Win32.PROCESS_RIGHTS.PROCESS_QUERY_LIMITED_INFORMATION; + MinThreadQueryRights = Win32.THREAD_RIGHTS.THREAD_QUERY_LIMITED_INFORMATION; + } - if (CurrentProcess == 0) - CurrentProcess = - System.Diagnostics.Process.GetCurrentProcess().Handle.ToInt32(); + if (KPH != null) + { + MinProcessGetHandleInformationRights = MinProcessQueryRights; + } + + if (KPH != null && Version.HasMmCopyVirtualMemory) + { + MinProcessReadMemoryRights = MinProcessQueryRights; + MinProcessWriteMemoryRights = MinProcessQueryRights; + } try { - CurrentSessionId = Win32.GetProcessSessionId(System.Diagnostics.Process.GetCurrentProcess().Id); + CurrentUsername = System.Security.Principal.WindowsIdentity.GetCurrent().Name; + } + catch (Exception ex) + { + Logging.Log(ex); + } + + CurrentProcess = Win32.GetCurrentProcess(); + + try + { + CurrentSessionId = Win32.GetProcessSessionId(Win32.GetCurrentProcessId()); System.Threading.Thread.CurrentThread.Priority = ThreadPriority.Highest; } catch (Exception ex) @@ -259,132 +259,8 @@ namespace ProcessHacker Logging.Log(ex); } - { - if (pArgs.ContainsKey("-a")) - { - Aggressive = true; - - try - { - Unhook(); - } - catch - { } - } - - if (pArgs.ContainsKey("-e")) - { - try - { - ExtendedCmd.Run(pArgs); - } - catch (Exception ex) - { - MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); - } - - return; - } - - if (pArgs.ContainsKey("-pw")) - { - int pid = int.Parse(pArgs["-pw"]); - - SharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); - SecondarySharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); - - ProcessProvider = new ProcessSystemProvider(); - ServiceProvider = new ServiceProvider(); - SharedThreadProvider.Add(ProcessProvider); - SharedThreadProvider.Add(ServiceProvider); - ProcessProvider.RunOnce(); - ServiceProvider.RunOnce(); - ProcessProvider.Enabled = true; - ServiceProvider.Enabled = true; - - Win32.LoadLibrary(Properties.Settings.Default.DbgHelpPath); - - if (!ProcessProvider.Dictionary.ContainsKey(pid)) - { - MessageBox.Show("The process (PID " + pid.ToString() + ") does not exist.", - "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); - return; - } - - ProcessWindow pw = new ProcessWindow(ProcessProvider.Dictionary[pid]); - - Application.Run(pw); - - SharedThreadProvider.Dispose(); - ProcessProvider.Dispose(); - ServiceProvider.Dispose(); - - Environment.Exit(0); - - return; - } - - if (pArgs.ContainsKey("-pt")) - { - int pid = int.Parse(pArgs["-pt"]); - - try - { - using (var phandle = new Win32.ProcessHandle(pid, Program.MinProcessQueryRights)) - Application.Run(new TokenWindow(phandle)); - } - catch (Exception ex) - { - MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); - } - - return; - } - - if (pArgs.ContainsKey("-o")) - { - OptionsWindow options = new OptionsWindow(true) - { - StartPosition = FormStartPosition.CenterScreen - }; - IWin32Window window; - - if (pArgs.ContainsKey("-hwnd")) - window = new WindowFromHandle(new IntPtr(int.Parse(pArgs["-hwnd"]))); - else - window = new WindowFromHandle(IntPtr.Zero); - - if (pArgs.ContainsKey("-rect")) - { - Rectangle rect = Misc.RectangleFromString(pArgs["-rect"]); - - options.Location = new Point(rect.X + 20, rect.Y + 20); - options.StartPosition = FormStartPosition.Manual; - } - - options.SelectedTab = options.TabPages["tabAdvanced"]; - options.ShowDialog(window); - - return; - } - - if (pArgs.ContainsKey("")) - if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe")) - StartVisible = true; - - if (pArgs.ContainsKey("-m")) - StartHidden = true; - if (pArgs.ContainsKey("-v")) - StartVisible = true; - - if (pArgs.ContainsKey("-t")) - { - if (pArgs["-t"] == "0") - SelectTab = "Processes"; - else if (pArgs["-t"] == "1") - SelectTab = "Services"; - } - } + if (ProcessCommandLine(pArgs)) + return; #if DEBUG #else @@ -401,6 +277,137 @@ namespace ProcessHacker Application.Run(); } + private static bool ProcessCommandLine(Dictionary pArgs) + { + if (pArgs.ContainsKey("-a")) + { + Aggressive = true; + + try + { + Unhook(); + } + catch + { } + } + + if (pArgs.ContainsKey("-e")) + { + try + { + ExtendedCmd.Run(pArgs); + } + catch (Exception ex) + { + MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); + } + + return true; + } + + if (pArgs.ContainsKey("-pw")) + { + int pid = int.Parse(pArgs["-pw"]); + + SharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); + SecondarySharedThreadProvider = new SharedThreadProvider(Properties.Settings.Default.RefreshInterval); + + ProcessProvider = new ProcessSystemProvider(); + ServiceProvider = new ServiceProvider(); + SharedThreadProvider.Add(ProcessProvider); + SharedThreadProvider.Add(ServiceProvider); + ProcessProvider.RunOnce(); + ServiceProvider.RunOnce(); + ProcessProvider.Enabled = true; + ServiceProvider.Enabled = true; + + Win32.LoadLibrary(Properties.Settings.Default.DbgHelpPath); + + if (!ProcessProvider.Dictionary.ContainsKey(pid)) + { + MessageBox.Show("The process (PID " + pid.ToString() + ") does not exist.", + "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); + Environment.Exit(0); + return true; + } + + ProcessWindow pw = new ProcessWindow(ProcessProvider.Dictionary[pid]); + + Application.Run(pw); + + SharedThreadProvider.Dispose(); + ProcessProvider.Dispose(); + ServiceProvider.Dispose(); + + Environment.Exit(0); + + return true; + } + + if (pArgs.ContainsKey("-pt")) + { + int pid = int.Parse(pArgs["-pt"]); + + try + { + using (var phandle = new Win32.ProcessHandle(pid, Program.MinProcessQueryRights)) + Application.Run(new TokenWindow(phandle)); + } + catch (Exception ex) + { + MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error); + } + + return true; + } + + if (pArgs.ContainsKey("-o")) + { + OptionsWindow options = new OptionsWindow(true) + { + StartPosition = FormStartPosition.CenterScreen + }; + IWin32Window window; + + if (pArgs.ContainsKey("-hwnd")) + window = new WindowFromHandle(new IntPtr(int.Parse(pArgs["-hwnd"]))); + else + window = new WindowFromHandle(IntPtr.Zero); + + if (pArgs.ContainsKey("-rect")) + { + Rectangle rect = Misc.RectangleFromString(pArgs["-rect"]); + + options.Location = new Point(rect.X + 20, rect.Y + 20); + options.StartPosition = FormStartPosition.Manual; + } + + options.SelectedTab = options.TabPages["tabAdvanced"]; + options.ShowDialog(window); + + return true; + } + + if (pArgs.ContainsKey("")) + if (pArgs[""].Replace("\"", "").Trim().ToLower().EndsWith("taskmgr.exe")) + StartVisible = true; + + if (pArgs.ContainsKey("-m")) + StartHidden = true; + if (pArgs.ContainsKey("-v")) + StartVisible = true; + + if (pArgs.ContainsKey("-t")) + { + if (pArgs["-t"] == "0") + SelectTab = "Processes"; + else if (pArgs["-t"] == "1") + SelectTab = "Services"; + } + + return false; + } + public static void Unhook() { PE.PEFile file = new ProcessHacker.PE.PEFile(Environment.SystemDirectory + "\\ntdll.dll"); diff --git a/trunk/ProcessHacker/UI/Async/HandleFilter.cs b/trunk/ProcessHacker/UI/Async/HandleFilter.cs index 09c28325e..9ae01342e 100644 --- a/trunk/ProcessHacker/UI/Async/HandleFilter.cs +++ b/trunk/ProcessHacker/UI/Async/HandleFilter.cs @@ -118,7 +118,7 @@ namespace ProcessHacker.FormHelper if (!processHandles.ContainsKey(currhandle.ProcessId)) processHandles.Add(currhandle.ProcessId, - new Win32.ProcessHandle(currhandle.ProcessId, Win32.PROCESS_RIGHTS.PROCESS_DUP_HANDLE)); + new Win32.ProcessHandle(currhandle.ProcessId, Program.MinProcessGetHandleInformationRights)); Win32.ObjectInformation info = Win32.GetHandleInfo(processHandles[currhandle.ProcessId], currhandle);