mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
dmex
b02427417c
git-svn-id: svn://svn.code.sf.net/p/processhacker/code@5614 21ef857c-d57f-4fe0-8362-d861dc6d29cd
253 lines
11 KiB
C#
253 lines
11 KiB
C#
/*
|
|
* Process Hacker -
|
|
* IToolTipProvider implementation for the process tree
|
|
*
|
|
* Copyright (C) 2008-2009 wj32
|
|
*
|
|
* This file is part of Process Hacker.
|
|
*
|
|
* Process Hacker is free software; you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* Process Hacker is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with Process Hacker. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.Diagnostics;
|
|
using Aga.Controls.Tree;
|
|
using ProcessHacker.Common;
|
|
using ProcessHacker.Native;
|
|
using ProcessHacker.Native.Api;
|
|
|
|
namespace ProcessHacker
|
|
{
|
|
public class ProcessToolTipProvider : IToolTipProvider
|
|
{
|
|
private ProcessTree _tree;
|
|
|
|
public ProcessToolTipProvider(ProcessTree owner)
|
|
{
|
|
_tree = owner;
|
|
}
|
|
|
|
public string GetToolTip(TreeNodeAdv node, Aga.Controls.Tree.NodeControls.NodeControl nodeControl)
|
|
{
|
|
var pNode = _tree.FindNode(node);
|
|
|
|
// Use the process node's tooltip mechanism to allow caching.
|
|
if (pNode != null)
|
|
return pNode.GetTooltipText(this);
|
|
else
|
|
return "";
|
|
}
|
|
|
|
public string GetToolTip(ProcessNode pNode)
|
|
{
|
|
try
|
|
{
|
|
string cmdText = (pNode.ProcessItem.CmdLine != null ?
|
|
(Utils.CreateEllipsis(pNode.ProcessItem.CmdLine.Replace("\0", ""), 100) + "\n") : "");
|
|
|
|
string fileText = "";
|
|
|
|
try
|
|
{
|
|
if (pNode.ProcessItem.VersionInfo != null)
|
|
{
|
|
var info = pNode.ProcessItem.VersionInfo;
|
|
|
|
fileText = "File:\n" + PhUtils.FormatFileInfo(
|
|
info.FileName, info.FileDescription, info.CompanyName, info.FileVersion, 4);
|
|
}
|
|
}
|
|
catch
|
|
{
|
|
if (pNode.ProcessItem.FileName != null)
|
|
fileText = "File:\n " + pNode.ProcessItem.FileName;
|
|
}
|
|
|
|
string runDllText = "";
|
|
|
|
if (pNode.ProcessItem.FileName != null &&
|
|
pNode.ProcessItem.FileName.EndsWith("\\rundll32.exe",
|
|
StringComparison.InvariantCultureIgnoreCase) &&
|
|
pNode.ProcessItem.CmdLine != null)
|
|
{
|
|
try
|
|
{
|
|
// TODO: fix crappy method
|
|
string targetFile = pNode.ProcessItem.CmdLine.Split(new char[] { ' ' }, 2)[1].Split(',')[0];
|
|
|
|
// if it doesn't specify an absolute path, assume it's in system32.
|
|
if (!targetFile.Contains(":"))
|
|
targetFile = Environment.SystemDirectory + "\\" + targetFile;
|
|
|
|
FileVersionInfo info = FileVersionInfo.GetVersionInfo(targetFile);
|
|
|
|
runDllText = "\nRunDLL target:\n " + info.FileName + "\n " +
|
|
info.FileDescription + " " + info.FileVersion + "\n " +
|
|
info.CompanyName;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Logging.Log(ex);
|
|
}
|
|
}
|
|
|
|
string dllhostText = "";
|
|
|
|
if (pNode.ProcessItem.FileName != null &&
|
|
pNode.ProcessItem.FileName.EndsWith("\\dllhost.exe",
|
|
StringComparison.InvariantCultureIgnoreCase) &&
|
|
pNode.ProcessItem.CmdLine != null)
|
|
{
|
|
try
|
|
{
|
|
string clsid = pNode.ProcessItem.CmdLine.ToLowerInvariant().Split(
|
|
new string[] { "/processid:" }, StringSplitOptions.None)[1].Split(' ')[0];
|
|
using (var key = Microsoft.Win32.Registry.ClassesRoot.OpenSubKey("CLSID\\" + clsid))
|
|
{
|
|
using (var inprocServer32 = key.OpenSubKey("InprocServer32"))
|
|
{
|
|
string name = key.GetValue("") as string;
|
|
string fileName = inprocServer32.GetValue("") as string;
|
|
|
|
FileVersionInfo info = FileVersionInfo.GetVersionInfo(Environment.ExpandEnvironmentVariables(fileName));
|
|
|
|
dllhostText = "\nCOM Target:\n " + name + " (" + clsid.ToUpper() + ")\n " +
|
|
info.FileName + "\n " +
|
|
info.FileDescription + " " + info.FileVersion + "\n " + info.CompanyName;
|
|
}
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Logging.Log(ex);
|
|
}
|
|
}
|
|
|
|
string servicesText = "";
|
|
|
|
try
|
|
{
|
|
IDictionary<int, List<string>> processServices;
|
|
IDictionary<string, ServiceItem> services;
|
|
|
|
if (!_tree.DumpMode)
|
|
{
|
|
processServices = Program.HackerWindow.ProcessServices;
|
|
services = Program.ServiceProvider.Dictionary;
|
|
}
|
|
else
|
|
{
|
|
processServices = _tree.DumpProcessServices;
|
|
services = _tree.DumpServices;
|
|
}
|
|
|
|
if (processServices.ContainsKey(pNode.Pid))
|
|
{
|
|
foreach (string service in processServices[pNode.Pid])
|
|
{
|
|
if (services.ContainsKey(service))
|
|
{
|
|
if (services[service].Status.DisplayName != "")
|
|
servicesText += " " + service + " (" +
|
|
services[service].Status.DisplayName + ")\n";
|
|
else
|
|
servicesText += " " + service + "\n";
|
|
}
|
|
else
|
|
{
|
|
servicesText += " " + service + "\n";
|
|
}
|
|
}
|
|
|
|
servicesText = "\nServices:\n" + servicesText.TrimEnd('\n');
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Logging.Log(ex);
|
|
}
|
|
|
|
string otherNotes = "";
|
|
|
|
try
|
|
{
|
|
if (pNode.ProcessItem.IsPacked && pNode.ProcessItem.ImportModules > 0)
|
|
otherNotes += "\n Image is probably packed - has " +
|
|
pNode.ProcessItem.ImportFunctions.ToString() + " imports over " +
|
|
pNode.ProcessItem.ImportModules.ToString() + " modules.";
|
|
else if (pNode.ProcessItem.IsPacked)
|
|
otherNotes += "\n Image is probably packed - error reading PE file.";
|
|
|
|
if (pNode.ProcessItem.FileName != null)
|
|
{
|
|
if (pNode.ProcessItem.VerifyResult == VerifyResult.Trusted)
|
|
{
|
|
if (!string.IsNullOrEmpty(pNode.ProcessItem.VerifySignerName))
|
|
otherNotes += "\n Signer: " + pNode.ProcessItem.VerifySignerName;
|
|
else
|
|
otherNotes += "\n Signed.";
|
|
}
|
|
else if (pNode.ProcessItem.VerifyResult == VerifyResult.Unknown &&
|
|
!Settings.Instance.VerifySignatures)
|
|
{
|
|
otherNotes += "";
|
|
}
|
|
else if (pNode.ProcessItem.VerifyResult == VerifyResult.Unknown &&
|
|
Settings.Instance.VerifySignatures && !_tree.DumpMode)
|
|
{
|
|
otherNotes += "\n File has not been processed yet. Please wait...";
|
|
}
|
|
else if (pNode.ProcessItem.VerifyResult != VerifyResult.NoSignature)
|
|
{
|
|
otherNotes += "\n Signature invalid.";
|
|
}
|
|
|
|
if (Program.ImposterNames.Contains(pNode.Name.ToLowerInvariant()) &&
|
|
pNode.ProcessItem.VerifyResult != VerifyResult.Trusted &&
|
|
pNode.ProcessItem.VerifyResult != VerifyResult.Unknown)
|
|
otherNotes += "\n Process is using the name of a known process but its signature could not be verified.";
|
|
}
|
|
|
|
if (pNode.ProcessItem.IsInJob)
|
|
otherNotes += "\n Process is in a job.";
|
|
if (pNode.ProcessItem.ElevationType == TokenElevationType.Full)
|
|
otherNotes += "\n Process is elevated.";
|
|
if (pNode.ProcessItem.IsDotNet)
|
|
otherNotes += "\n Process is managed (.NET).";
|
|
if (pNode.ProcessItem.IsPosix)
|
|
otherNotes += "\n Process is POSIX.";
|
|
if (pNode.ProcessItem.IsWow64)
|
|
otherNotes += "\n Process is 32-bit (running under WOW64).";
|
|
|
|
if (otherNotes != "")
|
|
otherNotes = "\nNotes:" + otherNotes;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Logging.Log(ex);
|
|
}
|
|
|
|
return (cmdText + fileText + otherNotes + runDllText + dllhostText + servicesText).Trim(' ', '\n', '\r');
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
Logging.Log(ex);
|
|
}
|
|
|
|
return string.Empty;
|
|
}
|
|
}
|
|
}
|