admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
2,072 Commits 1 Branch 0 Tags
629b7cec4e6bc6647fb0d4d08e7cb840dede2bd7
Commit Graph

98 Commits

Author SHA1 Message Date
wj32 49fd621970 fixed critical KProcessHacker denial-of-service security issues 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1742 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-27 12:40:28 +00:00
wj32 bee0384557 reverted last revision 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1728 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-22 03:51:41 +00:00
wj32 32d8ee319b KPH resource locks don't work yet... 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1727 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-22 03:37:38 +00:00
wj32 32866905e6 fixed critical file object query hang bug 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1722 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-20 07:31:47 +00:00
wj32 abb8fb6915 added type option for delete procedures to run at PASSIVE_LEVEL 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1718 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-16 10:23:54 +00:00
wj32 d3adc7ad1d * added deferred object deletion to KPH 
* fixed potential sysservice.c deadlock

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1714 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-15 00:33:59 +00:00
wj32 0832f0ae5f * added handle properties for transaction manager objects 
* all push lock acquires now enter critical regions
* removed OUT LONG arguments from ref.c

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1677 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-07 11:25:54 +00:00
wj32 4201dfad3b fixed kernel handle viewing on Windows 7 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1670 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-06 09:11:03 +00:00
wj32 5a9e1df893 * fixed KPH ref deadlock - replaced KphIsDestroyedObject with KphReferenceObjectSafe 
* reorganized ExtraTools; added System Call Hacker
* fixed PH tab indicies

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1651 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-08-01 23:57:10 +00:00
wj32 945be0e039 added better rule matching (at the cost of performance) 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1641 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-27 11:14:46 +00:00
wj32 29a5b6f67a added KphSsQueryClientEntry, fixed critical handle referencing bugs 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1639 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-27 08:37:33 +00:00
wj32 7fd92d6f36 * found and fixed the Ss BSODs 
* fixed KphQueryNameFileObject

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1638 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-27 06:44:00 +00:00
wj32 f333c9e122 hacked around the bad File object names 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1637 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-27 01:16:21 +00:00
wj32 9da61ad2c8 many improvements to KphSs 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1633 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-26 06:50:37 +00:00
wj32 bc1878d845 system service logging works! 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1629 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-24 02:24:21 +00:00
wj32 b41cf81165 * introduced guarded locks 
* fixed KiFastCallEntry scanning
* fixed client entry (PhCl) pool leaks (now uses ref.c for client entries)
* fixed ref.c delete procedure synchronization

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1627 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-23 05:18:00 +00:00
wj32 9eb0d23fc4 made further progress on system service logging; removed test code in kprocesshacker.c 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1625 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-22 10:24:26 +00:00
wj32 3e3b458759 system service hooking works! 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1624 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-22 07:59:06 +00:00
wj32 2f51600da1 added KphOpenDirectoryObject 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1614 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-20 10:09:11 +00:00
wj32 bbdf6b3f49 added ability to unload drivers 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1613 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-20 09:45:43 +00:00
wj32 66333c166f added object/handle code to KPH 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1612 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-20 05:04:01 +00:00
wj32 4f8aabf04f added paged code sections to KPH 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1508 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-03 07:36:49 +00:00
wj32 3d8e9894c2 Terminator test: TT4 (dangerous thread termination) 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1467 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-25 10:26:50 +00:00
wj32 fe52a61b6b * kernel-mode stack traces! 
* pool tag cleanup

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1439 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-20 23:41:17 +00:00
wj32 f98148bd1f * updated version information 
* updated NPH with new functions and argument attributes
* fixed some KPH argument attributes
* fixed optional buffer support in KphQueryProcessHandles
* fixed NPH NtOpenProcessTokenEx hook

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1438 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-20 08:26:23 +00:00
wj32 a17e10d425 * added KphQueryProcessHandles 
* added KphOpenThreadProcess
* hidden processes scanner can now detect FUTo
* KPH cleanup - added argument attributes
* improved auto-ForeColor

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1436 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-20 02:47:04 +00:00
wj32 a0ecb1c49d Ability to set DEP status of processes in other sessions 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1432 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-19 06:58:46 +00:00
wj32 10113a1831 added KphUnsafeReadVirtualMemory, fixed very rare BSOD 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1425 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-16 11:18:39 +00:00
wj32 2c3c8a402f added ability to detach processes from debuggers 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1376 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-06 00:53:45 +00:00
wj32 860d7b751d * dynamic PEB offsets 
* hooking/unhooking is now completely safe on multi-processor systems

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1303 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-21 06:13:09 +00:00
wj32 c3625ea5fc * changed error when terminating self to STATUS_CANT_TERMINATE_SELF 
* fixed some outdated comments
* added lots of defs to NProcessHacker KPH
* added test program

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1297 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-19 08:25:38 +00:00
wj32 5a25f7aeeb fixed "don't allow kernel-mode to bypass protection" by allowing rule creators to bypass the rules 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1296 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-18 09:11:21 +00:00
wj32 03db5a1fd2 * removes protection when the process is terminated 
* new ObOpenObjectByPointer now checks if the object is a process/thread
* calling ProtectRemove and ProtectQuery no longer initializes process protection if it hasn't been initialized

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1295 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-18 08:24:49 +00:00
wj32 fdab46f9b0 added option to protect from kernel-mode callers 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1292 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 10:55:05 +00:00
wj32 7f2f872b96 fixed BSOD when unloading KPH after ObOpenObjectByPointer has been hooked - forgot to delete the lookaside list 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1289 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 10:17:50 +00:00
wj32 0de2790f9c KPH code cleanup 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1288 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 04:40:24 +00:00
wj32 91d061b663 added experimental feature: protect processes 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1287 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 02:59:06 +00:00
wj32 6f9e57b10a all I had to do was to change UserMode to KernelMode when opening handles... handle granted access manipulation no longer needed! 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1263 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-11 08:08:45 +00:00
wj32 666df2e06f * added ObSetHandleAttributes 
* ability to set handle flags such as protect-from-close and inherit

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1256 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-10 01:57:45 +00:00
wj32 6eaaa3deb8 * added KphSetHandleGrantedAccess; KPH can finally bypass all protected process restrictions 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1254 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-09 11:57:47 +00:00
wj32 ac906ee65e more ULONG_PTR usage in KPH 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1247 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-08 08:46:00 +00:00
wj32 1384a506d1 * removed KPH ExpGetProcessInformation 
* fixed PsTerminateProcess and PspTerminateThreadByPointer scanning for Windows 7 ntoskrnl

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1245 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-08 07:46:54 +00:00
wj32 30114f9047 added more comments to KProcessHacker 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1231 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-04 10:16:27 +00:00
wj32 741af29084 * KProcessHacker can now perform process memory reading/writing by itself and does not require MmCopyVirtualMemory 
* added KphAssignImpersonationToken
* added KphAcquireProcessRundownProtection and KphReleaseProcessRundownProtection
* added some impersonation code

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1226 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-03 07:03:02 +00:00
wj32 06a8d1e9a5 added KPH call documentation 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1165 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-27 03:43:22 +00:00
wj32 1134c7820a * completely refactored argument code in KPH 
* fixed: random file-object-related BSODs
* removed GetObjectName - unsafe, not used
* added Terminate Process Tree

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1147 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-26 00:08:16 +00:00
wj32 4dba651028 added ExpGetProcessInformation (not used yet) 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1116 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-21 09:01:12 +00:00
wj32 69a6811b71 added KphTerminateThread -> PspTerminateThreadByPointer 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1102 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-19 22:36:44 +00:00
wj32 fd240faf2a fixed handle filter to use KPH properly 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1098 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-19 06:25:48 +00:00
wj32 2834affe18 * support for Windows 7 in KProcessHacker 
* new Windows version system for Process Hacker

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1092 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-19 00:24:27 +00:00