mirror of
https://github.com/mirror/processhacker
synced 2026-06-08 16:03:24 +00:00
wj32
53756b953e
* added confirmation for Terminator * improved changelog format git-svn-id: svn://svn.code.sf.net/p/processhacker/code@414 21ef857c-d57f-4fe0-8362-d861dc6d29cd
585 lines
22 KiB
C#
585 lines
22 KiB
C#
/*
|
|
* Process Hacker
|
|
*
|
|
* Copyright (C) 2008 Dean
|
|
* Copyright (C) 2008 wj32
|
|
*
|
|
* This program is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU General Public License as published by
|
|
* the Free Software Foundation, either version 3 of the License, or
|
|
* (at your option) any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
using System;
|
|
using System.Collections.Generic;
|
|
using System.ComponentModel;
|
|
using System.Data;
|
|
using System.Drawing;
|
|
using System.Text;
|
|
using System.Windows.Forms;
|
|
using System.Diagnostics;
|
|
|
|
namespace ProcessHacker
|
|
{
|
|
public partial class ProcessWindow : Form
|
|
{
|
|
private ProcessItem _processItem;
|
|
private int _pid;
|
|
private Process _process;
|
|
|
|
private ThreadProvider _threadP;
|
|
private ModuleProvider _moduleP;
|
|
private MemoryProvider _memoryP;
|
|
private HandleProvider _handleP;
|
|
|
|
private TokenProperties _tokenProps;
|
|
private ServiceProperties _serviceProps;
|
|
|
|
public ProcessWindow(ProcessItem process)
|
|
{
|
|
InitializeComponent();
|
|
|
|
_processItem = process;
|
|
_pid = process.PID;
|
|
_process = Process.GetProcessById(_pid);
|
|
|
|
this.Text = process.Name + " (PID " + _pid.ToString() + ")";
|
|
|
|
if (process.Icon != null)
|
|
this.Icon = process.Icon;
|
|
else
|
|
this.Icon = Program.HackerWindow.Icon;
|
|
|
|
Program.PWindows.Add(_pid, this);
|
|
}
|
|
|
|
private void ProcessWindow_Load(object sender, EventArgs e)
|
|
{
|
|
this.Size = Properties.Settings.Default.ProcessWindowSize;
|
|
buttonSearch.Text = Properties.Settings.Default.SearchType;
|
|
checkHideHandlesNoName.Checked = Properties.Settings.Default.HideHandlesNoName;
|
|
|
|
if (tabControl.TabPages[Properties.Settings.Default.ProcessWindowSelectedTab] != null)
|
|
tabControl.SelectedTab = tabControl.TabPages[Properties.Settings.Default.ProcessWindowSelectedTab];
|
|
|
|
Program.UpdateWindows();
|
|
|
|
_tokenProps = new TokenProperties(_processItem.ProcessQueryLimitedHandle);
|
|
_tokenProps.Dock = DockStyle.Fill;
|
|
tabToken.Controls.Add(_tokenProps);
|
|
|
|
listThreads.BeginUpdate();
|
|
listThreads.Highlight = false;
|
|
_threadP = new ThreadProvider(_pid);
|
|
_threadP.Interval = Properties.Settings.Default.RefreshInterval;
|
|
_threadP.Updated += new Provider<int, ThreadItem>.ProviderUpdateOnce(_threadP_Updated);
|
|
_threadP.RunOnceAsync();
|
|
listThreads.Provider = _threadP;
|
|
_threadP.Enabled = true;
|
|
|
|
listModules.BeginUpdate();
|
|
listModules.Highlight = false;
|
|
_moduleP = new ModuleProvider(_pid);
|
|
_moduleP.Interval = Properties.Settings.Default.RefreshInterval;
|
|
_moduleP.Updated += new Provider<int, ModuleItem>.ProviderUpdateOnce(_moduleP_Updated);
|
|
_moduleP.RunOnceAsync();
|
|
listModules.Provider = _moduleP;
|
|
_moduleP.Enabled = true;
|
|
|
|
listMemory.BeginUpdate();
|
|
listMemory.Highlight = false;
|
|
_memoryP = new MemoryProvider(_pid);
|
|
_memoryP.IgnoreFreeRegions = true;
|
|
_memoryP.Interval = Properties.Settings.Default.RefreshInterval;
|
|
_memoryP.Updated += new Provider<int, MemoryItem>.ProviderUpdateOnce(_memoryP_Updated);
|
|
_memoryP.RunOnceAsync();
|
|
listMemory.Provider = _memoryP;
|
|
_memoryP.Enabled = true;
|
|
|
|
listHandles.BeginUpdate();
|
|
listHandles.Highlight = false;
|
|
_handleP = new HandleProvider(_pid);
|
|
_handleP.Interval = Properties.Settings.Default.RefreshInterval;
|
|
_handleP.Updated += new Provider<short, HandleItem>.ProviderUpdateOnce(_handleP_Updated);
|
|
_handleP.RunOnceAsync();
|
|
listHandles.Provider = _handleP;
|
|
_handleP.Enabled = true;
|
|
|
|
_serviceProps = new ServiceProperties(
|
|
Program.HackerWindow.ProcessServices.ContainsKey(_pid) ?
|
|
Program.HackerWindow.ProcessServices[_pid].ToArray() :
|
|
new string[0]);
|
|
_serviceProps.Dock = DockStyle.Fill;
|
|
_serviceProps.PID = _pid;
|
|
tabServices.Controls.Add(_serviceProps);
|
|
|
|
try { pictureIcon.Image = Win32.GetProcessIcon(_process, true).ToBitmap(); }
|
|
catch { pictureIcon.Image = global::ProcessHacker.Properties.Resources.Process.ToBitmap(); }
|
|
try
|
|
{
|
|
string fileName;
|
|
|
|
if (_pid == 4)
|
|
fileName = Misc.GetKernelFileName();
|
|
else
|
|
fileName = Misc.GetRealPath(_process.MainModule.FileName);
|
|
|
|
FileVersionInfo info = FileVersionInfo.GetVersionInfo(fileName);
|
|
|
|
textFileDescription.Text = info.FileDescription;
|
|
textFileCompany.Text = info.CompanyName;
|
|
textFileVersion.Text = info.FileVersion;
|
|
textFileName.Text = info.FileName;
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
textFileDescription.Text = "(" + ex.Message + ")";
|
|
textFileCompany.Text = "";
|
|
}
|
|
|
|
textCmdLine.Text = _processItem.CmdLine;
|
|
|
|
try
|
|
{
|
|
using (Win32.ProcessHandle phandle
|
|
= new Win32.ProcessHandle(_pid, Program.MinProcessQueryRights | Win32.PROCESS_RIGHTS.PROCESS_VM_READ))
|
|
{
|
|
textCurrentDirectory.Text =
|
|
phandle.GetPEBString(Win32.ProcessHandle.PEBOffset.CurrentDirectoryPath);
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
textCurrentDirectory.Text = "(" + ex.Message + ")";
|
|
}
|
|
|
|
try
|
|
{
|
|
using (Win32.ProcessHandle phandle = new Win32.ProcessHandle(_pid, Program.MinProcessQueryRights))
|
|
{
|
|
textPEBAddress.Text = "0x" + phandle.GetBasicInformation().PebBaseAddress.ToString("x8");
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
textPEBAddress.Text = "(" + ex.Message + ")";
|
|
}
|
|
|
|
if (_processItem.ParentPID != -1)
|
|
{
|
|
if (Program.HackerWindow.ProcessProvider.Dictionary.ContainsKey(_processItem.ParentPID))
|
|
{
|
|
textParent.Text =
|
|
Program.HackerWindow.ProcessProvider.Dictionary[_processItem.ParentPID].Name +
|
|
" (" + _processItem.ParentPID.ToString() + ")";
|
|
}
|
|
else
|
|
{
|
|
textParent.Text = "Non-existent Process (" + _processItem.ParentPID.ToString() + ")";
|
|
buttonInspectParent.Enabled = false;
|
|
}
|
|
}
|
|
|
|
this.UpdateDEPStatus();
|
|
|
|
tabControl_SelectedIndexChanged(null, null);
|
|
}
|
|
|
|
public void UpdateDEPStatus()
|
|
{
|
|
try
|
|
{
|
|
using (Win32.ProcessHandle phandle
|
|
= new Win32.ProcessHandle(_pid, Win32.PROCESS_RIGHTS.PROCESS_QUERY_INFORMATION))
|
|
{
|
|
var depStatus = phandle.GetDEPStatus();
|
|
string str;
|
|
|
|
if ((depStatus & Win32.ProcessHandle.DEPStatus.Enabled) != 0)
|
|
{
|
|
str = "Enabled";
|
|
}
|
|
else
|
|
{
|
|
str = "Disabled";
|
|
}
|
|
|
|
if ((depStatus & Win32.ProcessHandle.DEPStatus.Permanent) != 0)
|
|
{
|
|
buttonEditDEP.Enabled = false;
|
|
str += ", Permanent";
|
|
}
|
|
|
|
if ((depStatus & Win32.ProcessHandle.DEPStatus.ATLThunkEmulationDisabled) != 0)
|
|
str += ", DEP-ATL thunk emulation disabled";
|
|
|
|
textDEP.Text = str;
|
|
}
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
textDEP.Text = "(" + ex.Message + ")";
|
|
}
|
|
|
|
if (_processItem.SessionId != Program.CurrentSessionId)
|
|
buttonEditDEP.Enabled = false;
|
|
}
|
|
|
|
private void _memoryP_Updated()
|
|
{
|
|
if (_memoryP.RunCount > 1)
|
|
{
|
|
this.BeginInvoke(new MethodInvoker(delegate
|
|
{
|
|
listMemory.EndUpdate();
|
|
listMemory.Highlight = true;
|
|
}));
|
|
_memoryP.Updated -= new Provider<int, MemoryItem>.ProviderUpdateOnce(_memoryP_Updated);
|
|
}
|
|
}
|
|
|
|
private void _handleP_Updated()
|
|
{
|
|
if (_handleP.RunCount > 1)
|
|
{
|
|
this.BeginInvoke(new MethodInvoker(delegate
|
|
{
|
|
listHandles.EndUpdate();
|
|
listHandles.Highlight = true;
|
|
}));
|
|
_handleP.Updated -= new Provider<short, HandleItem>.ProviderUpdateOnce(_handleP_Updated);
|
|
}
|
|
}
|
|
|
|
private void _moduleP_Updated()
|
|
{
|
|
if (_moduleP.RunCount > 1)
|
|
{
|
|
this.BeginInvoke(new MethodInvoker(delegate
|
|
{
|
|
listModules.EndUpdate();
|
|
listModules.Highlight = true;
|
|
}));
|
|
_moduleP.Updated -= new Provider<int, ModuleItem>.ProviderUpdateOnce(_moduleP_Updated);
|
|
}
|
|
}
|
|
|
|
private void _threadP_Updated()
|
|
{
|
|
if (_threadP.RunCount > 1)
|
|
{
|
|
this.BeginInvoke(new MethodInvoker(delegate
|
|
{
|
|
listThreads.EndUpdate();
|
|
listThreads.Highlight = true;
|
|
}));
|
|
_threadP.Updated -= new Provider<int, ThreadItem>.ProviderUpdateOnce(_threadP_Updated);
|
|
}
|
|
}
|
|
|
|
private void ProcessWindow_FormClosing(object sender, FormClosingEventArgs e)
|
|
{
|
|
_threadP.Kill();
|
|
_moduleP.Kill();
|
|
_memoryP.Kill();
|
|
_handleP.Kill();
|
|
|
|
listThreads.SaveSettings();
|
|
listModules.SaveSettings();
|
|
listMemory.SaveSettings();
|
|
listHandles.SaveSettings();
|
|
_tokenProps.SaveSettings();
|
|
|
|
Properties.Settings.Default.ProcessWindowSelectedTab = tabControl.SelectedTab.Name;
|
|
Properties.Settings.Default.SearchType = buttonSearch.Text;
|
|
Properties.Settings.Default.ProcessWindowSize = this.Size;
|
|
}
|
|
|
|
public MenuItem WindowMenuItem
|
|
{
|
|
get { return windowMenuItem; }
|
|
}
|
|
|
|
public wyDay.Controls.VistaMenu VistaMenu
|
|
{
|
|
get { return vistaMenu; }
|
|
}
|
|
|
|
private void tabControl_SelectedIndexChanged(object sender, EventArgs e)
|
|
{
|
|
if (_threadP != null)
|
|
_threadP.Enabled = tabControl.SelectedTab == tabThreads;
|
|
if (_moduleP != null)
|
|
_moduleP.Enabled = tabControl.SelectedTab == tabModules;
|
|
if (_memoryP != null)
|
|
_memoryP.Enabled = tabControl.SelectedTab == tabMemory;
|
|
if (_handleP != null)
|
|
_handleP.Enabled = tabControl.SelectedTab == tabHandles;
|
|
}
|
|
|
|
private void inspectImageFileMenuItem_Click(object sender, EventArgs e)
|
|
{
|
|
try
|
|
{
|
|
string path;
|
|
|
|
if (_pid == 4)
|
|
{
|
|
path = Misc.GetKernelFileName();
|
|
}
|
|
else
|
|
{
|
|
path = Misc.GetRealPath(_process.MainModule.FileName);
|
|
}
|
|
|
|
PEWindow pw = Program.GetPEWindow(path,
|
|
new Program.PEWindowInvokeAction(delegate(PEWindow f)
|
|
{
|
|
try
|
|
{
|
|
f.Show();
|
|
f.Activate();
|
|
}
|
|
catch
|
|
{ }
|
|
}));
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
MessageBox.Show("Error inspecting:\n\n" + ex.Message, "Process Hacker", MessageBoxButtons.OK,
|
|
MessageBoxIcon.Error);
|
|
}
|
|
}
|
|
|
|
private void buttonPEBStrings_Click(object sender, EventArgs e)
|
|
{
|
|
List<KeyValuePair<string, string>> list = new List<KeyValuePair<string, string>>();
|
|
|
|
try
|
|
{
|
|
using (Win32.ProcessHandle ph
|
|
= new Win32.ProcessHandle(_pid, Program.MinProcessQueryRights | Win32.PROCESS_RIGHTS.PROCESS_VM_READ))
|
|
{
|
|
list.Add(new KeyValuePair<string, string>("Command Line",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.CommandLine)));
|
|
list.Add(new KeyValuePair<string, string>("Current Directory Path",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.CurrentDirectoryPath)));
|
|
list.Add(new KeyValuePair<string, string>("Desktop Name",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.DesktopName)));
|
|
list.Add(new KeyValuePair<string, string>("Path",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.DllPath)));
|
|
list.Add(new KeyValuePair<string, string>("Image File Name",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.ImagePathName)));
|
|
list.Add(new KeyValuePair<string, string>("Runtime Data",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.RuntimeData)));
|
|
list.Add(new KeyValuePair<string, string>("Shell Info",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.ShellInfo)));
|
|
list.Add(new KeyValuePair<string, string>("Window Title",
|
|
ph.GetPEBString(Win32.ProcessHandle.PEBOffset.WindowTitle)));
|
|
}
|
|
|
|
ListWindow window = new ListWindow(list);
|
|
|
|
window.TopMost = this.TopMost;
|
|
window.ShowDialog();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
MessageBox.Show(ex.Message, "Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error);
|
|
}
|
|
}
|
|
|
|
private void buttonOpenFileNameFolder_Click(object sender, EventArgs e)
|
|
{
|
|
try
|
|
{
|
|
Process.Start("explorer.exe", "/select," + textFileName.Text);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
MessageBox.Show("Could not start process:\n\n" + ex.Message, "Process Hacker",
|
|
MessageBoxButtons.OK, MessageBoxIcon.Error);
|
|
}
|
|
}
|
|
|
|
private void buttonOpenCurDir_Click(object sender, EventArgs e)
|
|
{
|
|
try
|
|
{
|
|
Process.Start("explorer.exe", "/select," + textCurrentDirectory.Text);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
MessageBox.Show("Could not start process:\n\n" + ex.Message, "Process Hacker",
|
|
MessageBoxButtons.OK, MessageBoxIcon.Error);
|
|
}
|
|
}
|
|
|
|
private void buttonTerminate_Click(object sender, EventArgs e)
|
|
{
|
|
if (MessageBox.Show("Are you sure you want to terminate this process?", "Process Hacker",
|
|
MessageBoxButtons.YesNo, MessageBoxIcon.Exclamation) == DialogResult.Yes)
|
|
{
|
|
try
|
|
{
|
|
using (Win32.ProcessHandle phandle = new Win32.ProcessHandle(_pid, Win32.PROCESS_RIGHTS.PROCESS_TERMINATE))
|
|
phandle.Terminate();
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
MessageBox.Show(ex.Message, "Process Hacker",
|
|
MessageBoxButtons.OK, MessageBoxIcon.Error);
|
|
}
|
|
}
|
|
}
|
|
|
|
private void buttonEditDEP_Click(object sender, EventArgs e)
|
|
{
|
|
EditDEPWindow w = new EditDEPWindow(_pid);
|
|
|
|
w.TopMost = this.TopMost;
|
|
w.ShowDialog();
|
|
|
|
this.UpdateDEPStatus();
|
|
}
|
|
|
|
private void buttonInspectParent_Click(object sender, EventArgs e)
|
|
{
|
|
try
|
|
{
|
|
ProcessWindow pForm = Program.GetProcessWindow(
|
|
Program.HackerWindow.ProcessProvider.Dictionary[_processItem.ParentPID],
|
|
new Program.PWindowInvokeAction(delegate(ProcessWindow f)
|
|
{
|
|
f.Show();
|
|
f.Activate();
|
|
}));
|
|
}
|
|
catch (KeyNotFoundException)
|
|
{
|
|
MessageBox.Show("The process could not be found.", "Process Hacker",
|
|
MessageBoxButtons.OK, MessageBoxIcon.Error);
|
|
}
|
|
catch (Exception ex)
|
|
{
|
|
MessageBox.Show("Could not inspect the process:\n\n" + ex.Message,
|
|
"Process Hacker", MessageBoxButtons.OK, MessageBoxIcon.Error);
|
|
}
|
|
}
|
|
|
|
private void newWindowSearchMenuItem_Click(object sender, EventArgs e)
|
|
{
|
|
PerformSearch(newWindowSearchMenuItem.Text);
|
|
}
|
|
|
|
private void literalSearchMenuItem_Click(object sender, EventArgs e)
|
|
{
|
|
PerformSearch(literalSearchMenuItem.Text);
|
|
}
|
|
|
|
private void regexSearchMenuItem_Click(object sender, EventArgs e)
|
|
{
|
|
PerformSearch(regexSearchMenuItem.Text);
|
|
}
|
|
|
|
private void stringScanMenuItem_Click(object sender, EventArgs e)
|
|
{
|
|
PerformSearch(stringScanMenuItem.Text);
|
|
}
|
|
|
|
private void heapScanMenuItem_Click(object sender, EventArgs e)
|
|
{
|
|
PerformSearch(heapScanMenuItem.Text);
|
|
}
|
|
|
|
private void PerformSearch(string text)
|
|
{
|
|
Point location = this.Location;
|
|
System.Drawing.Size size = this.Size;
|
|
|
|
ResultsWindow rw = Program.GetResultsWindow(_pid,
|
|
new Program.ResultsWindowInvokeAction(delegate(ResultsWindow f)
|
|
{
|
|
if (text == "&New Results Window...")
|
|
{
|
|
f.Show();
|
|
}
|
|
else if (text == "&Literal Search...")
|
|
{
|
|
if (f.EditSearch(SearchType.Literal, location, size) == DialogResult.OK)
|
|
{
|
|
f.Show();
|
|
f.StartSearch();
|
|
}
|
|
else
|
|
{
|
|
f.Close();
|
|
}
|
|
}
|
|
else if (text == "&Regex Search...")
|
|
{
|
|
if (f.EditSearch(SearchType.Regex, location, size) == DialogResult.OK)
|
|
{
|
|
f.Show();
|
|
f.StartSearch();
|
|
}
|
|
else
|
|
{
|
|
f.Close();
|
|
}
|
|
}
|
|
else if (text == "&String Scan...")
|
|
{
|
|
f.SearchOptions.Type = SearchType.String;
|
|
f.Show();
|
|
f.StartSearch();
|
|
}
|
|
else if (text == "&Heap Scan...")
|
|
{
|
|
f.SearchOptions.Type = SearchType.Heap;
|
|
f.Show();
|
|
f.StartSearch();
|
|
}
|
|
}));
|
|
|
|
buttonSearch.Text = text;
|
|
}
|
|
|
|
private void buttonSearch_Click(object sender, EventArgs e)
|
|
{
|
|
PerformSearch(buttonSearch.Text);
|
|
}
|
|
|
|
private void checkHideFreeRegions_CheckedChanged(object sender, EventArgs e)
|
|
{
|
|
_memoryP.IgnoreFreeRegions = checkHideFreeRegions.Checked;
|
|
}
|
|
|
|
private void checkHideHandlesNoName_CheckedChanged(object sender, EventArgs e)
|
|
{
|
|
Properties.Settings.Default.HideHandlesNoName = checkHideHandlesNoName.Checked;
|
|
|
|
if (_handleP != null)
|
|
{
|
|
_handleP.Kill();
|
|
listHandles.BeginUpdate();
|
|
listHandles.Highlight = false;
|
|
_handleP = new HandleProvider(_pid);
|
|
_handleP.Interval = Properties.Settings.Default.RefreshInterval;
|
|
_handleP.Updated += new Provider<short, HandleItem>.ProviderUpdateOnce(_handleP_Updated);
|
|
_handleP.RunOnceAsync();
|
|
listHandles.Provider = _handleP;
|
|
_handleP.Enabled = true;
|
|
}
|
|
}
|
|
}
|
|
}
|