Skip to content

Commit

Permalink
Merge pull request #448 from processhacker/master
Browse files Browse the repository at this point in the history 
[pull] master from processhacker:master
  • Loading branch information
@pull
pull[bot] authored Apr 11, 2022
2 parents 08b06a4 + 6c01715 commit 75f15e0
Show file tree
Hide file tree
Showing 17 changed files with 121 additions and 66 deletions.
3 changes: 0 additions & 3 deletions ProcessHacker/ProcessHacker.manifest
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,8 +39,5 @@
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2019/WindowsSettings">
<activeCodePage>UTF-8</activeCodePage>
</asmv3:windowsSettings>
<asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2020/WindowsSettings">
<heapType>SegmentHeap</heapType>
</asmv3:windowsSettings>
</asmv3:application>
</assembly>
4 changes: 2 additions & 2 deletions ProcessHacker/proctree.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -234,8 +234,8 @@ VOID PhInitializeProcessTreeList(
PhAddTreeNewColumnEx2(hwnd, PHPRTLC_TIMELINE, FALSE, L"Timeline", 100, PH_ALIGN_LEFT, ULONG_MAX, 0, TN_COLUMN_FLAG_CUSTOMDRAW | TN_COLUMN_FLAG_SORTDESCENDING);
PhAddTreeNewColumnEx(hwnd, PHPRTLC_POWERTHROTTLING, FALSE, L"Power throttling", 70, PH_ALIGN_LEFT, ULONG_MAX, 0, TRUE);
PhAddTreeNewColumnEx(hwnd, PHPRTLC_ARCHITECTURE, FALSE, L"Architecture", 70, PH_ALIGN_LEFT, ULONG_MAX, 0, TRUE);
PhAddTreeNewColumn(hwnd, PHPRTLC_PARENTPID, TRUE, L"Parent PID", 50, PH_ALIGN_RIGHT, 0, DT_RIGHT);
PhAddTreeNewColumn(hwnd, PHPRTLC_PARENTCONSOLEPID, TRUE, L"Parent console PID", 50, PH_ALIGN_RIGHT, 0, DT_RIGHT);
PhAddTreeNewColumn(hwnd, PHPRTLC_PARENTPID, FALSE, L"Parent PID", 50, PH_ALIGN_RIGHT, 0, DT_RIGHT);
PhAddTreeNewColumn(hwnd, PHPRTLC_PARENTCONSOLEPID, FALSE, L"Parent console PID", 50, PH_ALIGN_RIGHT, 0, DT_RIGHT);
PhAddTreeNewColumnEx(hwnd, PHPRTLC_COMMITSIZE, FALSE, L"Shared commit", 70, PH_ALIGN_RIGHT, ULONG_MAX, DT_RIGHT, TRUE);
PhAddTreeNewColumnEx(hwnd, PHPRTLC_PRIORITYBOOST, FALSE, L"Priority boost", 45, PH_ALIGN_LEFT, ULONG_MAX, 0, TRUE);

Expand Down
48 changes: 42 additions & 6 deletions phlib/appresolver.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -854,31 +854,67 @@ HRESULT PhAppResolverBeginCrashDumpTask(
)
{
HRESULT status;
IOSTaskCompletion* taskCompletionManager;
IOSTaskCompletion* taskCompletion;

status = PhGetClassObject(
L"twinapi.appcore.dll",
&CLSID_OSTaskCompletion_I,
&IID_IOSTaskCompletion_I,
&taskCompletionManager
&taskCompletion
);

if (SUCCEEDED(status))
{
status = IOSTaskCompletion_BeginTask(
taskCompletionManager,
taskCompletion,
HandleToUlong(ProcessId),
PT_TC_CRASHDUMP
);
}

if (SUCCEEDED(status))
{
*TaskHandle = taskCompletionManager;
*TaskHandle = taskCompletion;
}
else if (taskCompletionManager)
else if (taskCompletion)
{
IOSTaskCompletion_Release(taskCompletionManager);
IOSTaskCompletion_Release(taskCompletion);
}

return status;
}

HRESULT PhAppResolverBeginCrashDumpTaskByHandle(
_In_ HANDLE ProcessHandle,
_Out_ HANDLE *TaskHandle
)
{
HRESULT status;
IOSTaskCompletion* taskCompletion;

status = PhGetClassObject(
L"twinapi.appcore.dll",
&CLSID_OSTaskCompletion_I,
&IID_IOSTaskCompletion_I,
&taskCompletion
);

if (SUCCEEDED(status))
{
status = IOSTaskCompletion_BeginTaskByHandle(
taskCompletion,
ProcessHandle,
PT_TC_CRASHDUMP
);
}

if (SUCCEEDED(status))
{
*TaskHandle = taskCompletion;
}
else if (taskCompletion)
{
IOSTaskCompletion_Release(taskCompletion);
}

return status;
Expand Down
4 changes: 2 additions & 2 deletions phlib/basesup.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -264,7 +264,7 @@ NTSTATUS PhCreateUserThread(
0,
StackSize,
StackSize,
0 // attributeList
NULL // attributeList
);

if (NT_SUCCESS(status))
Expand Down Expand Up @@ -320,7 +320,7 @@ HANDLE PhCreateThread(
// for checking errors. We need to preserve this behavior for compatibility -dmex
// TODO: Migrate code over to PhCreateThreadEx and remove this function.
//RtlSetLastWin32ErrorAndNtStatusFromNtStatus(status);
SetLastError(RtlNtStatusToDosError(status));
SetLastError(PhNtStatusToDosError(status));

if (NT_SUCCESS(status))
{
Expand Down
43 changes: 21 additions & 22 deletions phlib/global.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -246,19 +246,19 @@ BOOLEAN PhHeapInitialization(
_In_opt_ SIZE_T HeapCommitSize
)
{
if (WindowsVersion >= WINDOWS_8)
{
PhHeapHandle = RtlCreateHeap(
HEAP_GROWABLE | HEAP_CREATE_SEGMENT_HEAP | HEAP_CLASS_1,
NULL,
0,
0,
NULL,
NULL
);
}

if (!PhHeapHandle)
//if (WindowsVersion >= WINDOWS_8)
//{
// PhHeapHandle = RtlCreateHeap(
// HEAP_GROWABLE | HEAP_CREATE_SEGMENT_HEAP | HEAP_CLASS_1,
// NULL,
// 0,
// 0,
// NULL,
// NULL
// );
//}
//
//if (!PhHeapHandle)
{
PhHeapHandle = RtlCreateHeap(
HEAP_GROWABLE | HEAP_CLASS_1,
Expand All @@ -272,15 +272,14 @@ BOOLEAN PhHeapInitialization(
if (!PhHeapHandle)
return FALSE;

if (WindowsVersion >= WINDOWS_VISTA)
{
RtlSetHeapInformation(
PhHeapHandle,
HeapCompatibilityInformation,
&(ULONG){ HEAP_COMPATIBILITY_LFH },
sizeof(ULONG)
);
}
#if (PHNT_VERSION >= PHNT_VISTA)
RtlSetHeapInformation(
PhHeapHandle,
HeapCompatibilityInformation,
&(ULONG){ HEAP_COMPATIBILITY_LFH },
sizeof(ULONG)
);
#endif
}

return TRUE;
Expand Down
5 changes: 5 additions & 0 deletions phlib/include/appresolver.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -99,6 +99,11 @@ HRESULT PhAppResolverBeginCrashDumpTask(
_Out_ HANDLE* TaskHandle
);

HRESULT PhAppResolverBeginCrashDumpTaskByHandle(
_In_ HANDLE ProcessHandle,
_Out_ HANDLE* TaskHandle
);

HRESULT PhAppResolverEndCrashDumpTask(
_In_ HANDLE TaskHandle
);
Expand Down
4 changes: 2 additions & 2 deletions phlib/native.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9463,7 +9463,7 @@ NTSTATUS PhCreateNamedPipe(

status = NtCreateNamedPipeFile(
&pipeHandle,
FILE_GENERIC_READ | FILE_GENERIC_WRITE,
FILE_GENERIC_READ | FILE_GENERIC_WRITE | SYNCHRONIZE,
&objectAttributes,
&isb,
FILE_SHARE_READ | FILE_SHARE_WRITE,
Expand Down Expand Up @@ -9523,7 +9523,7 @@ NTSTATUS PhConnectPipe(

status = NtCreateFile(
&pipeHandle,
FILE_GENERIC_READ | FILE_GENERIC_WRITE,
FILE_GENERIC_READ | FILE_GENERIC_WRITE | SYNCHRONIZE,
&objectAttributes,
&isb,
NULL,
Expand Down
2 changes: 1 addition & 1 deletion phlib/util.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -593,7 +593,7 @@ PPH_STRING PhGetStatusMessage(
Status == STATUS_ACCESS_VIOLATION
)
{
Win32Result = RtlNtStatusToDosError(Status);
Win32Result = RtlNtStatusToDosErrorNoTeb(Status);
}
// Process NTSTATUS values with the NT-Win32 facility.
else if (NT_NTWIN32(Status))
Expand Down
17 changes: 15 additions & 2 deletions plugins/ExtendedTools/etwmon.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -275,8 +275,16 @@ VOID NTAPI EtpEtwEventCallback(

if (PhWindowsVersion >= WINDOWS_8)
{
diskEvent.ClientId.UniqueThread = UlongToHandle(data->IssuingThreadId);
diskEvent.ClientId.UniqueProcess = EtThreadIdToProcessId(diskEvent.ClientId.UniqueThread);
if (data->IssuingThreadId != ULONG_MAX)
{
diskEvent.ClientId.UniqueThread = UlongToHandle(data->IssuingThreadId);
diskEvent.ClientId.UniqueProcess = EtThreadIdToProcessId(diskEvent.ClientId.UniqueThread);
}
else
{
diskEvent.ClientId.UniqueThread = 0;
diskEvent.ClientId.UniqueProcess = SYSTEM_PROCESS_ID;
}
}
else
{
Expand All @@ -285,6 +293,11 @@ VOID NTAPI EtpEtwEventCallback(
diskEvent.ClientId.UniqueProcess = UlongToHandle(EventRecord->EventHeader.ProcessId);
diskEvent.ClientId.UniqueThread = UlongToHandle(EventRecord->EventHeader.ThreadId);
}
else
{
diskEvent.ClientId.UniqueThread = 0;
diskEvent.ClientId.UniqueProcess = SYSTEM_PROCESS_ID;
}
}

diskEvent.IrpFlags = data->IrpFlags;
Expand Down
7 changes: 6 additions & 1 deletion plugins/ExtendedTools/etwstat.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -257,11 +257,16 @@ VOID NTAPI EtEtwProcessesUpdatedCallback(
PET_PROCESS_BLOCK maxNetworkBlock = NULL;
PLIST_ENTRY listEntry;

// Since Windows 8, we no longer get the correct process/thread IDs in the
// event headers for disk events. We need to update our process information since
// etwmon uses our EtThreadIdToProcessId function. (wj32)
if (PhWindowsVersion >= WINDOWS_8)
EtpUpdateProcessInformation();

// ETW is extremely lazy when it comes to flushing buffers, so we must do it manually. (wj32)
//EtFlushEtwSession();

// Update global statistics.

PhUpdateDelta(&EtDiskReadDelta, EtpDiskReadRaw);
PhUpdateDelta(&EtDiskWriteDelta, EtpDiskWriteRaw);
PhUpdateDelta(&EtNetworkReceiveDelta, EtpNetworkReceiveRaw);
Expand Down
2 changes: 1 addition & 1 deletion tools/peview/clrprp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,7 @@ VOID PvpPeClrEnumSections(
PPH_STRING message;

//message = PH_AUTO(PhGetNtMessage(GetExceptionCode()));
message = PH_AUTO(PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS
message = PH_AUTO(PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS

PhSetListViewSubItem(ListViewHandle, lvItemIndex, 5, PhGetStringOrEmpty(message));
}
Expand Down
2 changes: 1 addition & 1 deletion tools/peview/debugprp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -184,7 +184,7 @@ INT_PTR CALLBACK PvpPeDebugDlgProc(
PPH_STRING message;

//message = PH_AUTO(PhGetNtMessage(GetExceptionCode()));
message = PH_AUTO(PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS
message = PH_AUTO(PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode()))); // WIN32_FROM_NTSTATUS

PhSetListViewSubItem(context->ListViewHandle, lvItemIndex, 5, PhGetStringOrEmpty(message));
}
Expand Down
8 changes: 4 additions & 4 deletions tools/peview/pedirprp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -283,7 +283,7 @@ VOID PvpPeEnumerateImageDataDirectory(
__except (EXCEPTION_EXECUTE_HANDLER)
{
//directoryNode->HashString = PhGetNtMessage(GetExceptionCode());
directoryNode->HashString = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
directoryNode->HashString = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
}

__try
Expand All @@ -302,7 +302,7 @@ VOID PvpPeEnumerateImageDataDirectory(
__except (EXCEPTION_EXECUTE_HANDLER)
{
//directoryNode->EntropyString = PhGetNtMessage(GetExceptionCode());
directoryNode->EntropyString = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
directoryNode->EntropyString = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
}

__try
Expand All @@ -323,7 +323,7 @@ VOID PvpPeEnumerateImageDataDirectory(
__except (EXCEPTION_EXECUTE_HANDLER)
{
//directoryNode->SsdeepString = PhGetNtMessage(GetExceptionCode());
directoryNode->SsdeepString = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
directoryNode->SsdeepString = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
}

__try
Expand All @@ -348,7 +348,7 @@ VOID PvpPeEnumerateImageDataDirectory(
__except (EXCEPTION_EXECUTE_HANDLER)
{
//sectionNode->TlshString = PhGetNtMessage(GetExceptionCode());
directoryNode->TlshString = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
directoryNode->TlshString = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())); // WIN32_FROM_NTSTATUS
}
}

Expand Down
16 changes: 8 additions & 8 deletions tools/peview/peheaderprp.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -246,7 +246,7 @@ VOID PvSetPeImageDosStubHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_DOS_STUBENTROPY, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -275,7 +275,7 @@ VOID PvSetPeImageDosStubHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_DOS_STUBHASH, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -326,7 +326,7 @@ VOID PvSetPeImageDosStubHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_DOS_RICHENTROPY, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -355,7 +355,7 @@ VOID PvSetPeImageDosStubHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_DOS_RICHHASH, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -406,7 +406,7 @@ VOID PvSetPeImageDosStubHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_DOS_ENTROPY, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -435,7 +435,7 @@ VOID PvSetPeImageDosStubHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_DOS_HASH, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -755,7 +755,7 @@ VOID PvSetPeImageOverlayHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_PE_OVERLAY_ENTROPY, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down Expand Up @@ -784,7 +784,7 @@ VOID PvSetPeImageOverlayHeaderProperties(
{
PPH_STRING message;

if (message = PhGetWin32Message(RtlNtStatusToDosError(GetExceptionCode())))
if (message = PhGetWin32Message(PhNtStatusToDosError(GetExceptionCode())))
{
PhSetListViewSubItem(Context->ListViewHandle, PVP_IMAGE_HEADER_INDEX_PE_OVERLAY_HASH, 1, PhGetString(message));
PhDereferenceObject(message);
Expand Down
Loading

0 comments on commit 75f15e0

Please sign in to comment.