Commit Graph

26 Commits

Author SHA1 Message Date
wj32 5a9e1df893 * fixed KPH ref deadlock - replaced KphIsDestroyedObject with KphReferenceObjectSafe
* reorganized ExtraTools; added System Call Hacker
* fixed PH tab indicies

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1651 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-08-01 23:57:10 +00:00
wj32 3a75085d71 added many more Ss definitions
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1649 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-08-01 06:20:20 +00:00
wj32 d4d2bf8520 improved Ss logging
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1646 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-31 10:25:50 +00:00
wj32 2164a28615 added many more syscall entries
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1640 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-27 09:35:15 +00:00
wj32 28d23ec084 started argument capturing (BSODs still present!)
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1634 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-26 23:48:23 +00:00
wj32 9da61ad2c8 many improvements to KphSs
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1633 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-26 06:50:37 +00:00
wj32 bc1878d845 system service logging works!
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1629 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-24 02:24:21 +00:00
wj32 b41cf81165 * introduced guarded locks
* fixed KiFastCallEntry scanning
* fixed client entry (PhCl) pool leaks (now uses ref.c for client entries)
* fixed ref.c delete procedure synchronization

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1627 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-23 05:18:00 +00:00
wj32 3e3b458759 system service hooking works!
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1624 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-22 07:59:06 +00:00
wj32 4f8aabf04f added paged code sections to KPH
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1508 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-07-03 07:36:49 +00:00
wj32 b8f2e812ea * fixed several Windows 7 offsets
* fixed auxData size leading to a buffer overflow
* better credits screen

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1325 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-24 01:32:16 +00:00
wj32 963ac8990e added APC-related defs
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1319 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-22 10:52:53 +00:00
wj32 3812cfaab3 handle duplication is now protected (through object open hooks)
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1308 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-22 00:52:19 +00:00
wj32 91d061b663 added experimental feature: protect processes
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1287 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-17 02:59:06 +00:00
wj32 6eaaa3deb8 * added KphSetHandleGrantedAccess; KPH can finally bypass all protected process restrictions
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1254 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-09 11:57:47 +00:00
wj32 ac906ee65e more ULONG_PTR usage in KPH
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1247 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-08 08:46:00 +00:00
wj32 1384a506d1 * removed KPH ExpGetProcessInformation
* fixed PsTerminateProcess and PspTerminateThreadByPointer scanning for Windows 7 ntoskrnl

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1245 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-05-08 07:46:54 +00:00
wj32 4dba651028 added ExpGetProcessInformation (not used yet)
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1116 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-21 09:01:12 +00:00
wj32 69a6811b71 added KphTerminateThread -> PspTerminateThreadByPointer
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1102 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-19 22:36:44 +00:00
wj32 1aaf0c4b2f new KPH method: scans for PsTerminateProcess instead of using fixed offsets
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1101 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-19 11:26:44 +00:00
wj32 22bf8a798e KphTerminateProcess now uses PsTerminateProcess where possible; if the wrong address is found it should not BSOD the system because the first 5 bytes are checked against the known standard function prologue.
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1099 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-19 09:51:04 +00:00
wj32 2834affe18 * support for Windows 7 in KProcessHacker
* new Windows version system for Process Hacker

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1092 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-19 00:24:27 +00:00
wj32 949417b506 * named KPH functions properly (according to MS)
* added support for version-specific info for service packs

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1091 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-18 23:06:36 +00:00
wj32 2e1120a4a9 added version-dependent info for ProtectedProcess
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1089 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-18 09:26:08 +00:00
wj32 22e6c6ea83 fixed object manager offsets
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1088 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-18 08:17:33 +00:00
wj32 36d0d9299a * added new system for OS version-dependent data
* fixed GenericMapping offset for Windows XP

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1087 21ef857c-d57f-4fe0-8362-d861dc6d29cd
2009-04-18 08:02:21 +00:00