Skip to content

Commit 284fddd

Browse files
DartVanyaDartVanya
committed
Merge branch 'master' into master-dm
2 parents c8d8ee2 + 8566b1e commit 284fddd

File tree

15 files changed

+442
-177
lines changed

15 files changed

+442
-177
lines changed

‎SystemInformer/include/thrdlist.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ typedef enum _PH_THREAD_TREELIST_COLUMN
2020
PH_THREAD_TREELIST_COLUMN_TID,
2121
PH_THREAD_TREELIST_COLUMN_CPU,
2222
PH_THREAD_TREELIST_COLUMN_CYCLESDELTA,
23-
PH_THREAD_TREELIST_COLUMN_STARTADDRESS,
23+
PH_THREAD_TREELIST_COLUMN_STARTADDRESSWIN32,
2424
PH_THREAD_TREELIST_COLUMN_PRIORITYSYMBOLIC,
2525
PH_THREAD_TREELIST_COLUMN_SERVICE,
2626
PH_THREAD_TREELIST_COLUMN_NAME,
@@ -61,6 +61,7 @@ typedef enum _PH_THREAD_TREELIST_COLUMN
6161
PH_THREAD_TREELIST_COLUMN_IOOTHERBYTES,
6262
PH_THREAD_TREELIST_COLUMN_LXSSTID,
6363
PH_THREAD_TREELIST_COLUMN_POWERTHROTTLING,
64+
PH_THREAD_TREELIST_COLUMN_STARTADDRESS,
6465
PH_THREAD_TREELIST_COLUMN_MAXIMUM,
6566
} PH_THREAD_TREELIST_COLUMN;
6667

‎SystemInformer/include/thrdprv.h‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,10 +54,14 @@ typedef struct _PH_THREAD_ITEM
5454
PPH_STRING ServiceName;
5555

5656
PVOID StartAddressWin32;
57-
PVOID StartAddressNative;
57+
PVOID StartAddress;
5858

59-
ULONG ThreadHandleStatus;
60-
ULONG StartAddressStatus;
59+
NTSTATUS ThreadHandleStatus;
60+
NTSTATUS StartAddressStatus;
61+
62+
PPH_STRING StartAddressWin32String;
63+
PPH_STRING StartAddressWin32FileName;
64+
enum _PH_SYMBOL_RESOLVE_LEVEL StartAddressWin32ResolveLevel;
6165

6266
PPH_STRING StartAddressString;
6367
PPH_STRING StartAddressFileName;

‎SystemInformer/main.c‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -454,7 +454,7 @@ static BOOLEAN NTAPI PhpPreviousInstancesCallback(
454454
_In_ PVOID Context
455455
)
456456
{
457-
static PH_STRINGREF objectNameSr = PH_STRINGREF_INIT(L"SiMutant_");
457+
static CONST PH_STRINGREF objectNameSr = PH_STRINGREF_INIT(L"SiMutant_");
458458
HANDLE objectHandle;
459459
UNICODE_STRING objectName;
460460
OBJECT_ATTRIBUTES objectAttributes;
@@ -506,8 +506,8 @@ static BOOLEAN NTAPI PhpPreviousInstancesCallback(
506506
if (!PhEqualSid(tokenUser.User.Sid, PhGetOwnTokenAttributes().TokenSid))
507507
goto CleanupExit;
508508

509-
AllowSetForegroundWindow(HandleToUlong(basicInfo.UniqueProcessId));
510-
PhConsoleSetForeground(processHandle, TRUE);
509+
//AllowSetForegroundWindow(HandleToUlong(basicInfo.UniqueProcessId));
510+
//PhConsoleSetForeground(processHandle, TRUE);
511511

512512
// Try to locate the window a few times because some users reported that it might not yet have been created. (dmex)
513513
do

‎SystemInformer/prpgthrd.c‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -448,15 +448,15 @@ BOOLEAN PhpThreadTreeFilterCallback(
448448
return TRUE;
449449
}
450450

451-
if (!PhIsNullOrEmptyString(threadNode->ThreadItem->StartAddressString))
451+
if (!PhIsNullOrEmptyString(threadNode->ThreadItem->StartAddressWin32String))
452452
{
453-
if (PhSearchControlMatch(Context->SearchMatchHandle, &threadNode->ThreadItem->StartAddressString->sr))
453+
if (PhSearchControlMatch(Context->SearchMatchHandle, &threadNode->ThreadItem->StartAddressWin32String->sr))
454454
return TRUE;
455455
}
456456

457-
if (!PhIsNullOrEmptyString(threadNode->ThreadItem->StartAddressFileName))
457+
if (!PhIsNullOrEmptyString(threadNode->ThreadItem->StartAddressWin32FileName))
458458
{
459-
if (PhSearchControlMatch(Context->SearchMatchHandle, &threadNode->ThreadItem->StartAddressFileName->sr))
459+
if (PhSearchControlMatch(Context->SearchMatchHandle, &threadNode->ThreadItem->StartAddressWin32FileName->sr))
460460
return TRUE;
461461
}
462462

@@ -1512,12 +1512,12 @@ INT_PTR CALLBACK PhpProcessThreadsDlgProc(
15121512
// {
15131513
// PPH_THREAD_ITEM threadItem = PhGetSelectedThreadItem(&threadsContext->ListContext);
15141514
//
1515-
// if (threadItem && threadItem->StartAddressFileName)
1515+
// if (threadItem && threadItem->StartAddressWin32FileName)
15161516
// {
15171517
// PhShellExecuteUserString(
15181518
// hwndDlg,
15191519
// L"FileBrowseExecutable",
1520-
// threadItem->StartAddressFileName->Buffer,
1520+
// threadItem->StartAddressWin32FileName->Buffer,
15211521
// FALSE,
15221522
// L"Make sure the Explorer executable file is present."
15231523
// );

‎SystemInformer/thrdlist.c‎

Lines changed: 84 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ VOID PhInitializeThreadList(
8888
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_TID, TRUE, L"TID", 50, PH_ALIGN_RIGHT, 0, DT_RIGHT);
8989
PhAddTreeNewColumnEx(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_CPU, TRUE, L"CPU", 45, PH_ALIGN_RIGHT, 1, DT_RIGHT, TRUE);
9090
PhAddTreeNewColumnEx(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_CYCLESDELTA, TRUE, L"Cycles delta", 80, PH_ALIGN_RIGHT, 2, DT_RIGHT, TRUE);
91-
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_STARTADDRESS, TRUE, L"Start address", 180, PH_ALIGN_LEFT, 3, 0);
91+
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_STARTADDRESSWIN32, TRUE, L"Start address (Win32)", 180, PH_ALIGN_LEFT, 3, 0);
9292
PhAddTreeNewColumnEx(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_PRIORITYSYMBOLIC, TRUE, L"Priority (symbolic)", 80, PH_ALIGN_LEFT, 4, 0, TRUE);
9393
// Available columns
9494
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_SERVICE, FALSE, L"Service", 100, PH_ALIGN_LEFT, ULONG_MAX, 0);
@@ -131,6 +131,7 @@ VOID PhInitializeThreadList(
131131
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_LXSSTID, FALSE, L"TID (LXSS)", 50, PH_ALIGN_LEFT, ULONG_MAX, 0);
132132
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_POWERTHROTTLING, FALSE, L"Power throttling", 50, PH_ALIGN_LEFT, ULONG_MAX, 0);
133133
//PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_CONTAINERID, FALSE, L"Container ID", 50, PH_ALIGN_LEFT, ULONG_MAX, 0);
134+
PhAddTreeNewColumn(TreeNewHandle, PH_THREAD_TREELIST_COLUMN_STARTADDRESS, TRUE, L"Start address (Native)", 180, PH_ALIGN_LEFT, 3, 0);
134135

135136
PhCmInitializeManager(&Context->Cm, TreeNewHandle, PH_THREAD_TREELIST_COLUMN_MAXIMUM, PhpThreadTreeNewPostSortFunction);
136137
PhInitializeTreeNewFilterSupport(&Context->TreeFilterSupport, Context->TreeNewHandle, Context->NodeList);
@@ -836,11 +837,11 @@ VOID PhpUpdateThreadNodeStackUsage(
836837
_In_ const void *_elem2 \
837838
) \
838839
{ \
840+
PPH_THREAD_LIST_CONTEXT context = (PPH_THREAD_LIST_CONTEXT)_context; \
839841
PPH_THREAD_NODE node1 = *(PPH_THREAD_NODE *)_elem1; \
840842
PPH_THREAD_NODE node2 = *(PPH_THREAD_NODE *)_elem2; \
841843
PPH_THREAD_ITEM threadItem1 = node1->ThreadItem; \
842844
PPH_THREAD_ITEM threadItem2 = node2->ThreadItem; \
843-
PPH_THREAD_LIST_CONTEXT context = (PPH_THREAD_LIST_CONTEXT)_context; \
844845
int sortResult = 0;
845846

846847
#define END_SORT_FUNCTION \
@@ -892,9 +893,9 @@ BEGIN_SORT_FUNCTION(CyclesDelta)
892893
}
893894
END_SORT_FUNCTION
894895

895-
BEGIN_SORT_FUNCTION(StartAddress)
896+
BEGIN_SORT_FUNCTION(StartAddressWin32)
896897
{
897-
sortResult = PhCompareStringWithNull(threadItem1->StartAddressString, threadItem2->StartAddressString, TRUE);
898+
sortResult = uint64cmp((ULONG_PTR)threadItem1->StartAddressWin32, (ULONG_PTR)threadItem2->StartAddressWin32);
898899
}
899900
END_SORT_FUNCTION
900901

@@ -906,7 +907,7 @@ END_SORT_FUNCTION
906907

907908
BEGIN_SORT_FUNCTION(Service)
908909
{
909-
sortResult = PhCompareStringWithNull(threadItem1->ServiceName, threadItem2->ServiceName, TRUE);
910+
sortResult = PhCompareStringWithNullSortOrder(threadItem1->ServiceName, threadItem2->ServiceName, context->TreeNewSortOrder, TRUE);
910911
}
911912
END_SORT_FUNCTION
912913

@@ -915,7 +916,7 @@ BEGIN_SORT_FUNCTION(Name)
915916
PhpUpdateThreadNodeNameText(node1);
916917
PhpUpdateThreadNodeNameText(node2);
917918

918-
sortResult = PhCompareStringWithNull(node1->NameText, node2->NameText, TRUE);
919+
sortResult = PhCompareStringWithNullSortOrder(node1->NameText, node2->NameText, context->TreeNewSortOrder, TRUE);
919920
}
920921
END_SORT_FUNCTION
921922

@@ -927,7 +928,7 @@ END_SORT_FUNCTION
927928

928929
BEGIN_SORT_FUNCTION(StartModule)
929930
{
930-
sortResult = PhCompareStringWithNull(threadItem1->StartAddressFileName, threadItem2->StartAddressFileName, TRUE);
931+
sortResult = PhCompareStringWithNullSortOrder(threadItem1->StartAddressWin32FileName, threadItem2->StartAddressWin32FileName, context->TreeNewSortOrder, TRUE);
931932
}
932933
END_SORT_FUNCTION
933934

@@ -1209,6 +1210,12 @@ BEGIN_SORT_FUNCTION(PowerThrottling)
12091210
}
12101211
END_SORT_FUNCTION
12111212

1213+
BEGIN_SORT_FUNCTION(StartAddressKernel)
1214+
{
1215+
sortResult = uint64cmp((ULONG_PTR)threadItem1->StartAddress, (ULONG_PTR)threadItem2->StartAddress);
1216+
}
1217+
END_SORT_FUNCTION
1218+
12121219
BOOLEAN NTAPI PhpThreadTreeNewCallback(
12131220
_In_ HWND hwnd,
12141221
_In_ PH_TREENEW_MESSAGE Message,
@@ -1236,7 +1243,7 @@ BOOLEAN NTAPI PhpThreadTreeNewCallback(
12361243
SORT_FUNCTION(Tid),
12371244
SORT_FUNCTION(Cpu),
12381245
SORT_FUNCTION(CyclesDelta),
1239-
SORT_FUNCTION(StartAddress),
1246+
SORT_FUNCTION(StartAddressWin32),
12401247
SORT_FUNCTION(PrioritySymbolic),
12411248
SORT_FUNCTION(Service),
12421249
SORT_FUNCTION(Name),
@@ -1276,6 +1283,7 @@ BOOLEAN NTAPI PhpThreadTreeNewCallback(
12761283
SORT_FUNCTION(IoOtherBytes),
12771284
SORT_FUNCTION(LxssTid),
12781285
SORT_FUNCTION(PowerThrottling),
1286+
SORT_FUNCTION(StartAddressKernel),
12791287
};
12801288
int (__cdecl *sortFunction)(void *, const void *, const void *);
12811289

@@ -1391,9 +1399,74 @@ BOOLEAN NTAPI PhpThreadTreeNewCallback(
13911399
}
13921400
}
13931401
break;
1402+
case PH_THREAD_TREELIST_COLUMN_STARTADDRESSWIN32:
1403+
{
1404+
if (NT_SUCCESS(threadItem->StartAddressStatus))
1405+
{
1406+
getCellText->Text = PhGetStringRef(threadItem->StartAddressWin32String);
1407+
}
1408+
else
1409+
{
1410+
PPH_STRING errorMessage;
1411+
PH_FORMAT format[5];
1412+
1413+
PhInitFormatS(&format[0], L"0x");
1414+
PhInitFormatX(&format[1], threadItem->StartAddressStatus);
1415+
1416+
if (errorMessage = PhGetStatusMessage(threadItem->StartAddressStatus, 0))
1417+
{
1418+
PhInitFormatS(&format[2], L" (");
1419+
PhInitFormatSR(&format[3], errorMessage->sr);
1420+
PhInitFormatC(&format[4], L')');
1421+
1422+
PhMoveReference(&threadItem->StartAddressWin32String, PhFormat(format, 5, 0));
1423+
PhDereferenceObject(errorMessage);
1424+
}
1425+
else
1426+
{
1427+
PhMoveReference(&threadItem->StartAddressWin32String, PhFormat(format, 2, 0));
1428+
}
1429+
1430+
getCellText->Text = PhGetStringRef(threadItem->StartAddressWin32String);
1431+
}
1432+
}
1433+
break;
13941434
case PH_THREAD_TREELIST_COLUMN_STARTADDRESS:
13951435
{
1396-
getCellText->Text = PhGetStringRef(threadItem->StartAddressString);
1436+
if (threadItem->StartAddress)
1437+
{
1438+
getCellText->Text = PhGetStringRef(threadItem->StartAddressString);
1439+
}
1440+
else
1441+
{
1442+
NTSTATUS status;
1443+
PPH_STRING errorMessage;
1444+
PH_FORMAT format[5];
1445+
1446+
if (WindowsVersion > WINDOWS_10_22H2)
1447+
status = STATUS_ACCESS_DENIED;
1448+
else
1449+
status = STATUS_BUFFER_ALL_ZEROS;
1450+
1451+
PhInitFormatS(&format[0], L"0x");
1452+
PhInitFormatX(&format[1], status);
1453+
1454+
if (errorMessage = PhGetStatusMessage(status, 0))
1455+
{
1456+
PhInitFormatS(&format[2], L" (");
1457+
PhInitFormatSR(&format[3], errorMessage->sr);
1458+
PhInitFormatC(&format[4], L')');
1459+
1460+
PhMoveReference(&threadItem->StartAddressString, PhFormat(format, 5, 0));
1461+
PhDereferenceObject(errorMessage);
1462+
}
1463+
else
1464+
{
1465+
PhMoveReference(&threadItem->StartAddressString, PhFormat(format, 2, 0));
1466+
}
1467+
1468+
getCellText->Text = PhGetStringRef(threadItem->StartAddressString);
1469+
}
13971470
}
13981471
break;
13991472
case PH_THREAD_TREELIST_COLUMN_PRIORITYSYMBOLIC:
@@ -1421,7 +1494,7 @@ BOOLEAN NTAPI PhpThreadTreeNewCallback(
14211494
break;
14221495
case PH_THREAD_TREELIST_COLUMN_STARTMODULE:
14231496
{
1424-
getCellText->Text = PhGetStringRef(threadItem->StartAddressFileName);
1497+
getCellText->Text = PhGetStringRef(threadItem->StartAddressWin32FileName);
14251498
}
14261499
break;
14271500
case PH_THREAD_TREELIST_COLUMN_CONTEXTSWITCHES:
@@ -2094,7 +2167,7 @@ BOOLEAN NTAPI PhpThreadTreeNewCallback(
20942167

20952168
if (!threadItem)
20962169
NOTHING;
2097-
//else if (context->HighlightUnknownStartAddress && threadItem->StartAddressResolveLevel == PhsrlAddress)
2170+
//else if (context->HighlightUnknownStartAddress && threadItem->StartAddressWin32ResolveLevel == PhsrlAddress)
20982171
// getNodeColor->BackColor = PhCsColorUnknown;
20992172
else if (context->HighlightSuspended && threadItem->WaitReason == Suspended)
21002173
getNodeColor->BackColor = PhCsColorSuspended;

0 commit comments

Comments
 (0)