#ifndef PHAPP_H #define PHAPP_H #include #include #include #include "resource.h" #define KPH_ERROR_MESSAGE (L"KProcessHacker does not support your operating system " \ L"or could not be loaded. Make sure Process Hacker is running " \ L"on a 32-bit system and with administrative privileges.") #ifndef MAIN_PRIVATE extern PPH_STRING PhApplicationDirectory; extern PPH_STRING PhApplicationFileName; extern PPH_STRING PhSettingsFileName; extern PH_STARTUP_PARAMETERS PhStartupParameters; extern PWSTR PhWindowClassName; extern PH_PROVIDER_THREAD PhPrimaryProviderThread; extern PH_PROVIDER_THREAD PhSecondaryProviderThread; extern COLORREF PhSysWindowColor; #endif // main typedef struct _PH_STARTUP_PARAMETERS { BOOLEAN NoKph; BOOLEAN NoSettings; PPH_STRING SettingsFileName; BOOLEAN ShowHidden; BOOLEAN ShowVisible; BOOLEAN CommandMode; PPH_STRING CommandType; PPH_STRING CommandObject; PPH_STRING CommandAction; BOOLEAN RunAsServiceMode; } PH_STARTUP_PARAMETERS, *PPH_STARTUP_PARAMETERS; INT PhMainMessageLoop(); VOID PhRegisterDialog( __in HWND DialogWindowHandle ); VOID PhUnregisterDialog( __in HWND DialogWindowHandle ); VOID PhActivatePreviousInstance(); VOID PhInitializeCommonControls(); VOID PhInitializeFont( __in HWND hWnd ); VOID PhInitializeKph(); BOOLEAN PhInitializeAppSystem(); ATOM PhRegisterWindowClass(); // proctree // Columns #define PHTLC_NAME 0 #define PHTLC_PID 1 #define PHTLC_USERNAME 2 #define PHTLC_MAXIMUM 3 typedef struct _PH_PROCESS_NODE { PH_TREELIST_NODE Node; HANDLE ProcessId; PPH_PROCESS_ITEM ProcessItem; struct _PH_PROCESS_NODE *Parent; PPH_LIST Children; PH_STRINGREF TextCache[PHTLC_MAXIMUM]; } PH_PROCESS_NODE, *PPH_PROCESS_NODE; VOID PhProcessTreeListInitialization(); VOID PhInitializeProcessTreeList( __in HWND hwnd ); VOID PhCreateProcessNode( __in PPH_PROCESS_ITEM ProcessItem ); PPH_PROCESS_NODE PhFindProcessNode( __in HANDLE ProcessId ); VOID PhRemoveProcessNode( __in PPH_PROCESS_NODE ProcessNode ); VOID PhUpdateProcessNode( __in PPH_PROCESS_NODE ProcessNode ); // support typedef enum _PH_KNOWN_PROCESS_TYPE { UnknownProcessType, SystemProcessType, // ntoskrnl/ntkrnlpa/... SessionManagerProcessType, // smss WindowsSubsystemProcessType, // csrss WindowsStartupProcessType, // wininit ServiceControlManagerProcessType, // services LocalSecurityAuthorityProcessType, // lsass LocalSessionManagerProcessType, // lsm ServiceHostProcessType, // svchost RunDllAsAppProcessType, // rundll32 ComSurrogateProcessType // dllhost } PH_KNOWN_PROCESS_TYPE, *PPH_KNOWN_PROCESS_TYPE; NTSTATUS PhGetProcessKnownType( __in HANDLE ProcessHandle, __out PPH_KNOWN_PROCESS_TYPE KnownProcessType ); typedef union _PH_KNOWN_PROCESS_COMMAND_LINE { struct { PPH_STRING GroupName; } ServiceHost; struct { PPH_STRING FileName; PPH_STRING ProcedureName; } RunDllAsApp; struct { GUID Guid; PPH_STRING Name; PPH_STRING FileName; } ComSurrogate; } PH_KNOWN_PROCESS_COMMAND_LINE, *PPH_KNOWN_PROCESS_COMMAND_LINE; BOOLEAN PhaGetProcessKnownCommandLine( __in PPH_STRING CommandLine, __in PH_KNOWN_PROCESS_TYPE KnownProcessType, __out PPH_KNOWN_PROCESS_COMMAND_LINE KnownCommandLine ); PPH_STRING PhGetSessionInformationString( __in HANDLE ServerHandle, __in ULONG SessionId, __in ULONG InformationClass ); VOID PhSearchOnlineString( __in HWND hWnd, __in PWSTR String ); VOID PhShellExecuteUserString( __in HWND hWnd, __in PWSTR Setting, __in PWSTR String, __in BOOLEAN UseShellExecute ); #define PH_LOAD_SHARED_IMAGE(Name, Type) LoadImage(PhInstanceHandle, (Name), (Type), 0, 0, LR_SHARED) FORCEINLINE PVOID PhpGenericPropertyPageHeader( __in HWND hwndDlg, __in UINT uMsg, __in WPARAM wParam, __in LPARAM lParam, __in PWSTR ContextName ) { PVOID context; switch (uMsg) { case WM_INITDIALOG: { LPPROPSHEETPAGE propSheetPage = (LPPROPSHEETPAGE)lParam; context = (PVOID)propSheetPage->lParam; SetProp(hwndDlg, ContextName, (HANDLE)context); } break; case WM_DESTROY: { context = (PVOID)GetProp(hwndDlg, ContextName); RemoveProp(hwndDlg, ContextName); } break; default: { context = (PVOID)GetProp(hwndDlg, ContextName); } break; } return context; } // mainwnd #ifndef MAINWND_PRIVATE extern HWND PhMainWndHandle; extern BOOLEAN PhMainWndExiting; #endif #define WM_PH_ACTIVATE (WM_APP + 99) #define PH_ACTIVATE_REPLY 0x1119 #define WM_PH_SHOW_PROCESS_PROPERTIES (WM_APP + 120) #define WM_PH_DESTROY (WM_APP + 121) #define WM_PH_SAVE_ALL_SETTINGS (WM_APP + 122) #define WM_PH_PREPARE_FOR_EARLY_SHUTDOWN (WM_APP + 123) #define WM_PH_CANCEL_EARLY_SHUTDOWN (WM_APP + 124) #define WM_PH_PROCESS_ADDED (WM_APP + 101) #define WM_PH_PROCESS_MODIFIED (WM_APP + 102) #define WM_PH_PROCESS_REMOVED (WM_APP + 103) #define WM_PH_SERVICE_ADDED (WM_APP + 104) #define WM_PH_SERVICE_MODIFIED (WM_APP + 105) #define WM_PH_SERVICE_REMOVED (WM_APP + 106) #define WM_PH_SERVICES_UPDATED (WM_APP + 107) #define ProcessHacker_ShowProcessProperties(hWnd, ProcessItem) \ SendMessage(hWnd, WM_PH_SHOW_PROCESS_PROPERTIES, 0, (LPARAM)(ProcessItem)) #define ProcessHacker_Destroy(hWnd) \ SendMessage(hWnd, WM_PH_DESTROY, 0, 0) #define ProcessHacker_SaveAllSettings(hWnd) \ SendMessage(hWnd, WM_PH_SAVE_ALL_SETTINGS, 0, 0) #define ProcessHacker_PrepareForEarlyShutdown(hWnd) \ SendMessage(hWnd, WM_PH_PREPARE_FOR_EARLY_SHUTDOWN, 0, 0) #define ProcessHacker_CancelEarlyShutdown(hWnd) \ SendMessage(hWnd, WM_PH_CANCEL_EARLY_SHUTDOWN, 0, 0) BOOLEAN PhMainWndInitialization( __in INT ShowCommand ); LRESULT CALLBACK PhMainWndProc( __in HWND hWnd, __in UINT uMsg, __in WPARAM wParam, __in LPARAM lParam ); // procprp #define PH_PROCESS_PROPCONTEXT_MAXPAGES 20 typedef struct _DLGTEMPLATEEX { WORD dlgVer; WORD signature; DWORD helpID; DWORD exStyle; DWORD style; WORD cDlgItems; short x; short y; short cx; short cy; } DLGTEMPLATEEX, *PDLGTEMPLATEEX; typedef struct _PH_PROCESS_PROPCONTEXT { PPH_PROCESS_ITEM ProcessItem; HANDLE WindowHandle; PH_EVENT CreatedEvent; PPH_STRING Title; PROPSHEETHEADER PropSheetHeader; HPROPSHEETPAGE *PropSheetPages; } PH_PROCESS_PROPCONTEXT, *PPH_PROCESS_PROPCONTEXT; typedef struct _PH_PROCESS_PROPPAGECONTEXT { PPH_PROCESS_PROPCONTEXT PropContext; PVOID Context; PROPSHEETPAGE PropSheetPage; BOOLEAN LayoutInitialized; } PH_PROCESS_PROPPAGECONTEXT, *PPH_PROCESS_PROPPAGECONTEXT; BOOLEAN PhProcessPropInitialization(); PPH_PROCESS_PROPCONTEXT PhCreateProcessPropContext( __in HWND ParentWindowHandle, __in PPH_PROCESS_ITEM ProcessItem ); VOID PhRefreshProcessPropContext( __inout PPH_PROCESS_PROPCONTEXT PropContext ); BOOLEAN PhAddProcessPropPage( __inout PPH_PROCESS_PROPCONTEXT PropContext, __in __assumeRefs(1) PPH_PROCESS_PROPPAGECONTEXT PropPageContext ); BOOLEAN PhAddProcessPropPage2( __inout PPH_PROCESS_PROPCONTEXT PropContext, __in HPROPSHEETPAGE PropSheetPageHandle ); PPH_PROCESS_PROPPAGECONTEXT PhCreateProcessPropPageContext( __in LPCWSTR Template, __in DLGPROC DlgProc, __in PVOID Context ); BOOLEAN PhShowProcessProperties( __in PPH_PROCESS_PROPCONTEXT Context ); // dbgcon VOID PhShowDebugConsole(); // actions BOOLEAN PhUiTerminateProcesses( __in HWND hWnd, __in PPH_PROCESS_ITEM *Processes, __in ULONG NumberOfProcesses ); BOOLEAN PhUiSuspendProcesses( __in HWND hWnd, __in PPH_PROCESS_ITEM *Processes, __in ULONG NumberOfProcesses ); BOOLEAN PhUiResumeProcesses( __in HWND hWnd, __in PPH_PROCESS_ITEM *Processes, __in ULONG NumberOfProcesses ); BOOLEAN PhUiRestartProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process ); BOOLEAN PhUiReduceWorkingSetProcesses( __in HWND hWnd, __in PPH_PROCESS_ITEM *Processes, __in ULONG NumberOfProcesses ); BOOLEAN PhUiSetVirtualizationProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process, __in BOOLEAN Enable ); BOOLEAN PhUiDetachFromDebuggerProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process ); BOOLEAN PhUiInjectDllProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process ); BOOLEAN PhUiSetIoPriorityProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process, __in ULONG IoPriority ); BOOLEAN PhUiSetPriorityProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process, __in ULONG PriorityClassWin32 ); BOOLEAN PhUiSetDepStatusProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process ); BOOLEAN PhUiSetProtectionProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process ); BOOLEAN PhUiStartService( __in HWND hWnd, __in PPH_SERVICE_ITEM Service ); BOOLEAN PhUiContinueService( __in HWND hWnd, __in PPH_SERVICE_ITEM Service ); BOOLEAN PhUiPauseService( __in HWND hWnd, __in PPH_SERVICE_ITEM Service ); BOOLEAN PhUiStopService( __in HWND hWnd, __in PPH_SERVICE_ITEM Service ); BOOLEAN PhUiDeleteService( __in HWND hWnd, __in PPH_SERVICE_ITEM Service ); BOOLEAN PhUiTerminateThreads( __in HWND hWnd, __in PPH_THREAD_ITEM *Threads, __in ULONG NumberOfThreads ); BOOLEAN PhUiForceTerminateThreads( __in HWND hWnd, __in HANDLE ProcessId, __in PPH_THREAD_ITEM *Threads, __in ULONG NumberOfThreads ); BOOLEAN PhUiSuspendThreads( __in HWND hWnd, __in PPH_THREAD_ITEM *Threads, __in ULONG NumberOfThreads ); BOOLEAN PhUiResumeThreads( __in HWND hWnd, __in PPH_THREAD_ITEM *Threads, __in ULONG NumberOfThreads ); BOOLEAN PhUiSetPriorityThread( __in HWND hWnd, __in PPH_THREAD_ITEM Thread, __in ULONG ThreadPriorityWin32 ); BOOLEAN PhUiSetIoPriorityThread( __in HWND hWnd, __in PPH_THREAD_ITEM Thread, __in ULONG IoPriority ); BOOLEAN PhUiUnloadModule( __in HWND hWnd, __in HANDLE ProcessId, __in PPH_MODULE_ITEM Module ); BOOLEAN PhUiCloseHandles( __in HWND hWnd, __in HANDLE ProcessId, __in PPH_HANDLE_ITEM *Handles, __in ULONG NumberOfHandles, __in BOOLEAN Warn ); BOOLEAN PhUiSetAttributesHandle( __in HWND hWnd, __in HANDLE ProcessId, __in PPH_HANDLE_ITEM Handle, __in ULONG Attributes ); // cmdmode NTSTATUS PhCommandModeStart(); // anawait VOID PhUiAnalyzeWaitThread( __in HWND hWnd, __in HANDLE ProcessId, __in HANDLE ThreadId, __in PPH_SYMBOL_PROVIDER SymbolProvider ); // mdump BOOLEAN PhUiCreateDumpFileProcess( __in HWND hWnd, __in PPH_PROCESS_ITEM Process ); // about VOID PhShowAboutDialog( __in HWND ParentWindowHandle ); PPH_STRING PhGetDiagnosticsString(); // affinity VOID PhShowProcessAffinityDialog( __in HWND ParentWindowHandle, __in PPH_PROCESS_ITEM ProcessItem ); // chdlg #define PH_CHOICE_DIALOG_SAVED_CHOICES 10 #define PH_CHOICE_DIALOG_USER_CHOICE 0x1 BOOLEAN PhaChoiceDialog( __in HWND ParentWindowHandle, __in PWSTR Title, __in_opt PWSTR *Choices, __in_opt ULONG NumberOfChoices, __in_opt PWSTR Option, __in ULONG Flags, __inout PPH_STRING *SelectedChoice, __inout_opt PBOOLEAN SelectedOption, __in_opt PWSTR SavedChoicesSettingName ); // findobj VOID PhShowFindObjectsDialog(); // heapinfo VOID PhShowProcessHeapsDialog( __in HWND ParentWindowHandle, __in PPH_PROCESS_ITEM ProcessItem ); NTSTATUS PhGetProcessDefaultHeap( __in HANDLE ProcessHandle, __out PPVOID Heap ); // hidnproc VOID PhShowHiddenProcessesDialog(); // hndlprp VOID PhShowHandleProperties( __in HWND ParentWindowHandle, __in HANDLE ProcessId, __in PPH_HANDLE_ITEM HandleItem ); // infodlg VOID PhShowInformationDialog( __in HWND ParentWindowHandle, __in PWSTR String ); // jobprp VOID PhShowJobProperties( __in HWND ParentWindowHandle, __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context, __in_opt PWSTR Title ); HPROPSHEETPAGE PhCreateJobPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context, __in_opt DLGPROC HookProc ); // ntobjprp HPROPSHEETPAGE PhCreateEventPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context ); HPROPSHEETPAGE PhCreateEventPairPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context ); HPROPSHEETPAGE PhCreateMutantPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context ); HPROPSHEETPAGE PhCreateSectionPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context ); HPROPSHEETPAGE PhCreateSemaphorePage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context ); HPROPSHEETPAGE PhCreateTimerPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context ); // pagfiles VOID PhShowPagefilesDialog( __in HWND ParentWindowHandle ); // runas VOID PhShowRunAsDialog( __in HWND ParentWindowHandle, __in_opt HANDLE ProcessId ); NTSTATUS PhRunAsCommandStart( __in PWSTR ServiceCommandLine, __in PWSTR ServiceName ); NTSTATUS PhRunAsCommandStart2( __in HWND hWnd, __in PWSTR Program, __in_opt PWSTR UserName, __in_opt PWSTR Password, __in_opt ULONG LogonType, __in_opt HANDLE ProcessIdWithToken, __in ULONG SessionId ); VOID PhRunAsServiceStart(); NTSTATUS PhCreateProcessAsUser( __in_opt PWSTR ApplicationName, __in_opt PWSTR CommandLine, __in_opt PWSTR CurrentDirectory, __in_opt PVOID Environment, __in_opt PWSTR DomainName, __in_opt PWSTR UserName, __in_opt PWSTR Password, __in_opt ULONG LogonType, __in_opt HANDLE ProcessIdWithToken, __in ULONG SessionId, __out_opt PHANDLE ProcessHandle, __out_opt PHANDLE ThreadHandle ); // sessprp VOID PhShowSessionProperties( __in HWND ParentWindowHandle, __in ULONG SessionId ); // srvprp VOID PhShowServiceProperties( __in HWND ParentWindowHandle, __in PPH_SERVICE_ITEM ServiceItem ); // ssndmsg VOID PhShowSessionSendMessageDialog( __in HWND ParentWindowHandle, __in ULONG SessionId ); // termator VOID PhShowProcessTerminatorDialog( __in HWND ParentWindowHandle, __in PPH_PROCESS_ITEM ProcessItem ); // thrdstk VOID PhShowThreadStackDialog( __in HWND ParentWindowHandle, __in HANDLE ProcessId, __in HANDLE ThreadId, __in PPH_SYMBOL_PROVIDER SymbolProvider ); // tokprp PPH_STRING PhGetGroupAttributesString( __in ULONG Attributes ); PWSTR PhGetPrivilegeAttributesString( __in ULONG Attributes ); VOID PhShowTokenProperties( __in HWND ParentWindowHandle, __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context, __in_opt PWSTR Title ); HPROPSHEETPAGE PhCreateTokenPage( __in PPH_OPEN_OBJECT OpenObject, __in PVOID Context, __in_opt DLGPROC HookProc ); #endif