admin/mirror-processhacker
1
0
Fork 0
mirror of https://github.com/mirror/processhacker synced 2026-06-08 16:03:24 +00:00
Code Issues Packages Projects Releases Wiki Activity
1,521 Commits 1 Branch 0 Tags
9ef9db660fd7952d7aed48278d4cdf6b1deeebbd
Commit Graph

77 Commits

Author SHA1 Message Date
wj32 4f8aabf04f added paged code sections to KPH 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1508 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-07-03 07:36:49 +00:00
wj32 3d8e9894c2 Terminator test: TT4 (dangerous thread termination) 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1467 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-25 10:26:50 +00:00
wj32 fe52a61b6b * kernel-mode stack traces! 
* pool tag cleanup

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1439 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-20 23:41:17 +00:00
wj32 f98148bd1f * updated version information 
* updated NPH with new functions and argument attributes
* fixed some KPH argument attributes
* fixed optional buffer support in KphQueryProcessHandles
* fixed NPH NtOpenProcessTokenEx hook

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1438 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-20 08:26:23 +00:00
wj32 a17e10d425 * added KphQueryProcessHandles 
* added KphOpenThreadProcess
* hidden processes scanner can now detect FUTo
* KPH cleanup - added argument attributes
* improved auto-ForeColor

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1436 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-20 02:47:04 +00:00
wj32 a0ecb1c49d Ability to set DEP status of processes in other sessions 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1432 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-19 06:58:46 +00:00
wj32 10113a1831 added KphUnsafeReadVirtualMemory, fixed very rare BSOD 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1425 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-16 11:18:39 +00:00
wj32 2c3c8a402f added ability to detach processes from debuggers 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1376 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-06-06 00:53:45 +00:00
wj32 860d7b751d * dynamic PEB offsets 
* hooking/unhooking is now completely safe on multi-processor systems

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1303 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-21 06:13:09 +00:00
wj32 c3625ea5fc * changed error when terminating self to STATUS_CANT_TERMINATE_SELF 
* fixed some outdated comments
* added lots of defs to NProcessHacker KPH
* added test program

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1297 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-19 08:25:38 +00:00
wj32 5a25f7aeeb fixed "don't allow kernel-mode to bypass protection" by allowing rule creators to bypass the rules 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1296 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-18 09:11:21 +00:00
wj32 03db5a1fd2 * removes protection when the process is terminated 
* new ObOpenObjectByPointer now checks if the object is a process/thread
* calling ProtectRemove and ProtectQuery no longer initializes process protection if it hasn't been initialized

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1295 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-18 08:24:49 +00:00
wj32 fdab46f9b0 added option to protect from kernel-mode callers 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1292 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 10:55:05 +00:00
wj32 7f2f872b96 fixed BSOD when unloading KPH after ObOpenObjectByPointer has been hooked - forgot to delete the lookaside list 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1289 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 10:17:50 +00:00
wj32 0de2790f9c KPH code cleanup 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1288 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 04:40:24 +00:00
wj32 91d061b663 added experimental feature: protect processes 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1287 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-17 02:59:06 +00:00
wj32 6f9e57b10a all I had to do was to change UserMode to KernelMode when opening handles... handle granted access manipulation no longer needed! 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1263 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-11 08:08:45 +00:00
wj32 666df2e06f * added ObSetHandleAttributes 
* ability to set handle flags such as protect-from-close and inherit

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1256 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-10 01:57:45 +00:00
wj32 6eaaa3deb8 * added KphSetHandleGrantedAccess; KPH can finally bypass all protected process restrictions 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1254 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-09 11:57:47 +00:00
wj32 ac906ee65e more ULONG_PTR usage in KPH 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1247 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-08 08:46:00 +00:00
wj32 1384a506d1 * removed KPH ExpGetProcessInformation 
* fixed PsTerminateProcess and PspTerminateThreadByPointer scanning for Windows 7 ntoskrnl

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1245 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-08 07:46:54 +00:00
wj32 30114f9047 added more comments to KProcessHacker 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1231 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-04 10:16:27 +00:00
wj32 741af29084 * KProcessHacker can now perform process memory reading/writing by itself and does not require MmCopyVirtualMemory 
* added KphAssignImpersonationToken
* added KphAcquireProcessRundownProtection and KphReleaseProcessRundownProtection
* added some impersonation code

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1226 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-05-03 07:03:02 +00:00
wj32 06a8d1e9a5 added KPH call documentation 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1165 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-27 03:43:22 +00:00
wj32 1134c7820a * completely refactored argument code in KPH 
* fixed: random file-object-related BSODs
* removed GetObjectName - unsafe, not used
* added Terminate Process Tree

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1147 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-26 00:08:16 +00:00
wj32 4dba651028 added ExpGetProcessInformation (not used yet) 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1116 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-21 09:01:12 +00:00
wj32 69a6811b71 added KphTerminateThread -> PspTerminateThreadByPointer 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1102 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-19 22:36:44 +00:00
wj32 fd240faf2a fixed handle filter to use KPH properly 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1098 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-19 06:25:48 +00:00
wj32 2834affe18 * support for Windows 7 in KProcessHacker 
* new Windows version system for Process Hacker

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1092 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-19 00:24:27 +00:00
wj32 949417b506 * named KPH functions properly (according to MS) 
* added support for version-specific info for service packs

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1091 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-18 23:06:36 +00:00
wj32 2e1120a4a9 added version-dependent info for ProtectedProcess 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1089 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-18 09:26:08 +00:00
wj32 36d0d9299a * added new system for OS version-dependent data 
* fixed GenericMapping offset for Windows XP

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1087 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-18 08:02:21 +00:00
wj32 fd789a3cbf * KphAttachProcess* functions 
* improved handle viewing
* improved start addresses on Windows XP

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1085 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-18 02:52:10 +00:00
wj32 83ff30039b new KPH I/O control: ZwQueryObject 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1080 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-17 11:45:17 +00:00
wj32 08854be5dd After 8 hours of debugging and 5 BSODs, nothing has been achieved :( 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1079 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-17 09:01:10 +00:00
wj32 5eccb86895 * reorganized KProcessHacker 
* added KphDuplicateObject

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1078 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-17 02:29:25 +00:00
wj32 e29085b64a removed old KPH comments 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1037 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-09 09:16:15 +00:00
wj32 5c49f831b2 added an important safety guard to KPH 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1013 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-05 05:42:49 +00:00
wj32 932bbb0b28 added highlighting for GUI threads 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1009 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-05 00:28:15 +00:00
wj32 4692867d03 * fixed thread stacks on Windows Vista + KPH 
* added KphGetContextThread and KphSetContextThread

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@1001 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-03 07:39:36 +00:00
wj32 200b17c0b3 * fixed thread start addresses on Windows XP 
* fixed module information on Windows XP

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@999 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-02 22:36:43 +00:00
wj32 60b4ed9ed1 * KPH now loads on XP again; introduced the use of MmGetSystemRoutineAddress 
* brought back KphSuspendProcess and KphResumeProcess on Vista

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@995 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-02 08:16:43 +00:00
wj32 71ce9c03db * KPH now supports KphWriteVirtualMemory 
* revised process opening means that we can now get the command line of audiodg.exe

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@991 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-02 05:38:59 +00:00
wj32 a59eedfb65 implemented KphReadVirtualMemory! 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@987 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-01 10:27:41 +00:00
wj32 018928f184 * reversed the sealed attribute 
* fixed KPH for XP (for both jobs and thread start addresses)

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@984 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-04-01 04:49:57 +00:00
wj32 331d515717 job detection works (after 4 hours and 2 BSODs)! 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@977 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-03-31 10:09:37 +00:00
wj32 2e5b27161f KProcessHacker now retrieves thread start addresses 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@976 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-03-31 06:40:27 +00:00
wj32 5ba55035d0 cosmetic changes in KProcessHacker/kprocesshacker.c 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@927 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-03-26 09:09:54 +00:00
wj32 bc6f66615c KPH fixes, small struct def changes 
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@857 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-03-12 07:12:45 +00:00
wj32 2393410972 * fixed KPH BSOD 
* kprocesshacker.c now has 0 warnings

git-svn-id: svn://svn.code.sf.net/p/processhacker/code@856 21ef857c-d57f-4fe0-8362-d861dc6d29cd
 2009-03-12 06:25:37 +00:00