Merge pull request #449 from processhacker/master

[pull] master from processhacker:master
CeruleanSky · Apr 14, 2022 · 3874b61 · 3874b61
2 parents 75f15e0 + e4ef86c
commit 3874b61
Show file tree

Hide file tree

Showing 2 changed files with 46 additions and 2 deletions.
diff --git a/ProcessHacker/hndlprv.c b/ProcessHacker/hndlprv.c
@@ -405,6 +405,14 @@ NTSTATUS PhpCreateHandleItemFunction(
         NULL
         );
 
+    // HACK: Some security products block NtQueryObject with ObjectTypeInformation and return an invalid type
+    // so we need to lookup the TypeName using the TypeIndex. We should improve PhGetHandleInformationEx for this case
+    // but for now we'll preserve backwards compat by doing the lookup here. (dmex)
+    if (PhIsNullOrEmptyString(handleItem->TypeName))
+    {
+        PhMoveReference(&handleItem->TypeName, PhGetObjectTypeName(handleItem->TypeIndex));
+    }
+
     if (handleItem->TypeName)
     {
         // Add the handle item to the hashtable.

diff --git a/plugins/UserNotes/main.c b/plugins/UserNotes/main.c
@@ -24,6 +24,7 @@
 #include "usernotes.h"
 #include <toolstatusintf.h>
 #include <commdlg.h>
+#include <mapimg.h>
 
 VOID SearchChangedHandler(
     _In_opt_ PVOID Parameter,
@@ -417,7 +418,7 @@ VOID NTAPI MainMenuInitializingCallback(
 }
 
 PPH_STRING ShowFileDialog(
-    _In_ HWND ParentHandle
+    _In_ HWND ParentWindowHandle
     )
 {
     static PH_FILETYPE_FILTER filters[] =
@@ -430,12 +431,47 @@ PPH_STRING ShowFileDialog(
     fileDialog = PhCreateOpenFileDialog();
     PhSetFileDialogFilter(fileDialog, filters, RTL_NUMBER_OF(filters));
 
-    if (PhShowFileDialog(ParentHandle, fileDialog))
+    if (PhShowFileDialog(ParentWindowHandle, fileDialog))
     {
         fileName = PhGetFileDialogFileName(fileDialog);
     }
 
     PhFreeFileDialog(fileDialog);
+
+    if (fileName)
+    {
+        NTSTATUS status;
+        PH_MAPPED_IMAGE mappedImage;
+
+        status = PhLoadMappedImage(
+            PhGetString(fileName),
+            NULL,
+            &mappedImage
+            );
+
+        if (NT_SUCCESS(status))
+        {
+            if (mappedImage.Magic == IMAGE_NT_OPTIONAL_HDR32_MAGIC)
+            {
+                if (!(mappedImage.NtHeaders32->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE) || mappedImage.NtHeaders32->FileHeader.Characteristics & IMAGE_FILE_DLL)
+                    status = STATUS_INVALID_IMAGE_NOT_MZ;
+            }
+            else if (mappedImage.Magic == IMAGE_NT_OPTIONAL_HDR64_MAGIC)
+            {
+                if (!(mappedImage.NtHeaders32->FileHeader.Characteristics & IMAGE_FILE_EXECUTABLE_IMAGE) || mappedImage.NtHeaders32->FileHeader.Characteristics & IMAGE_FILE_DLL)
+                    status = STATUS_INVALID_IMAGE_NOT_MZ;
+            }
+
+            PhUnloadMappedImage(&mappedImage);
+        }
+
+        if (!NT_SUCCESS(status))
+        {
+            PhClearReference(&fileName);
+            PhShowStatus(ParentWindowHandle, L"Unable to configure IFEO priority for this image.", status, 0);
+        }
+    }
+
     return fileName;
 }