Skip to content

Commit 5c82999

Browse files
DartVanyaDartVanya
committed
memsrcht show memory editor on double click
1 parent f754e7b commit 5c82999

File tree

2 files changed

+95
-46
lines changed

2 files changed

+95
-46
lines changed

‎SystemInformer/memsrcht.c‎

Lines changed: 86 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -138,6 +138,11 @@ BOOLEAN PhpShowMemoryStringTreeDialog(
138138
_In_opt_ PPH_LIST PrevNodeList
139139
);
140140

141+
VOID PhpShowMemoryEditor(
142+
PPH_MEMSTRINGS_CONTEXT context,
143+
PPH_MEMSTRINGS_NODE node
144+
);
145+
141146
_Function_class_(PH_STRING_SEARCH_NEXT_BUFFER)
142147
_Must_inspect_result_
143148
NTSTATUS NTAPI PhpMemoryStringSearchTreeNextBuffer(
@@ -809,7 +814,14 @@ BOOLEAN NTAPI PhpMemoryStringsTreeNewCallback(
809814
}
810815
return TRUE;
811816
case TreeNewNodeExpanding:
817+
return TRUE;
812818
case TreeNewLeftDoubleClick:
819+
{
820+
PPH_TREENEW_MOUSE_EVENT mouseEvent = Parameter1;
821+
node = (PPH_MEMSTRINGS_NODE)mouseEvent->Node;
822+
823+
PhpShowMemoryEditor(context, node);
824+
}
813825
return TRUE;
814826
case TreeNewContextMenu:
815827
{
@@ -996,6 +1008,47 @@ VOID PhpMemoryStringsSetWindowTitle(
9961008
SetWindowTextW(Context->WindowHandle, title->Buffer);
9971009
}
9981010

1011+
VOID PhpShowMemoryEditor(
1012+
PPH_MEMSTRINGS_CONTEXT context,
1013+
PPH_MEMSTRINGS_NODE node
1014+
)
1015+
{
1016+
NTSTATUS status;
1017+
MEMORY_BASIC_INFORMATION basicInfo;
1018+
PPH_SHOW_MEMORY_EDITOR showMemoryEditor;
1019+
PVOID address;
1020+
SIZE_T length;
1021+
1022+
address = node->Address;
1023+
if (node->Unicode)
1024+
length = node->String->Length;
1025+
else
1026+
length = node->String->Length / 2;
1027+
1028+
if (NT_SUCCESS(status = NtQueryVirtualMemory(
1029+
context->ProcessHandle,
1030+
address,
1031+
MemoryBasicInformation,
1032+
&basicInfo,
1033+
sizeof(basicInfo),
1034+
NULL
1035+
)))
1036+
{
1037+
showMemoryEditor = PhAllocateZero(sizeof(PH_SHOW_MEMORY_EDITOR));
1038+
showMemoryEditor->ProcessId = context->ProcessItem->ProcessId;
1039+
showMemoryEditor->BaseAddress = basicInfo.BaseAddress;
1040+
showMemoryEditor->RegionSize = basicInfo.RegionSize;
1041+
showMemoryEditor->SelectOffset = (ULONG)((ULONG_PTR)address - (ULONG_PTR)basicInfo.BaseAddress);
1042+
showMemoryEditor->SelectLength = (ULONG)length;
1043+
1044+
SystemInformer_ShowMemoryEditor(showMemoryEditor);
1045+
}
1046+
else
1047+
{
1048+
PhShowStatus(context->WindowHandle, L"Unable to edit memory", status, 0);
1049+
}
1050+
}
1051+
9991052
INT_PTR CALLBACK PhpMemoryStringsDlgProc(
10001053
_In_ HWND hwndDlg,
10011054
_In_ UINT uMsg,
@@ -1193,12 +1246,12 @@ INT_PTR CALLBACK PhpMemoryStringsDlgProc(
11931246

11941247
menu = PhCreateEMenu();
11951248

1196-
readWrite = PhCreateEMenuItem(0, 1, L"Read/Write memory", NULL, NULL);
1197-
1249+
readWrite = PhCreateEMenuItem(0, IDC_SHOW, L"Read/Write memory", NULL, NULL);
1250+
readWrite->Flags |= PH_EMENU_DEFAULT;
11981251
PhInsertEMenuItem(menu, readWrite, ULONG_MAX);
11991252
PhInsertEMenuItem(menu, PhCreateEMenuSeparator(), ULONG_MAX);
1200-
PhInsertEMenuItem(menu, PhCreateEMenuItem(0, 100, L"Copy", NULL, NULL), ULONG_MAX);
1201-
PhInsertCopyCellEMenuItem(menu, 100, context->TreeNewHandle, contextMenuEvent->Column);
1253+
PhInsertEMenuItem(menu, PhCreateEMenuItem(0, IDC_COPY, L"Copy", NULL, NULL), ULONG_MAX);
1254+
PhInsertCopyCellEMenuItem(menu, IDC_COPY, context->TreeNewHandle, contextMenuEvent->Column);
12021255

12031256
if (numberOfNodes != 1)
12041257
readWrite->Flags |= PH_EMENU_DISABLED;
@@ -1214,52 +1267,24 @@ INT_PTR CALLBACK PhpMemoryStringsDlgProc(
12141267

12151268
if (selectedItem && selectedItem->Id != ULONG_MAX && !PhHandleCopyCellEMenuItem(selectedItem))
12161269
{
1217-
if (selectedItem->Id == 1)
1270+
switch (selectedItem->Id)
12181271
{
1219-
NTSTATUS status;
1220-
MEMORY_BASIC_INFORMATION basicInfo;
1221-
PPH_SHOW_MEMORY_EDITOR showMemoryEditor;
1222-
PVOID address;
1223-
SIZE_T length;
1224-
1225-
assert(numberOfNodes == 1);
1226-
1227-
address = stringsNodes[0]->Address;
1228-
if (stringsNodes[0]->Unicode)
1229-
length = stringsNodes[0]->String->Length;
1230-
else
1231-
length = stringsNodes[0]->String->Length / 2;
1232-
1233-
if (NT_SUCCESS(status = NtQueryVirtualMemory(
1234-
context->ProcessHandle,
1235-
address,
1236-
MemoryBasicInformation,
1237-
&basicInfo,
1238-
sizeof(basicInfo),
1239-
NULL
1240-
)))
1272+
case IDC_SHOW:
12411273
{
1242-
showMemoryEditor = PhAllocateZero(sizeof(PH_SHOW_MEMORY_EDITOR));
1243-
showMemoryEditor->ProcessId = context->ProcessItem->ProcessId;
1244-
showMemoryEditor->BaseAddress = basicInfo.BaseAddress;
1245-
showMemoryEditor->RegionSize = basicInfo.RegionSize;
1246-
showMemoryEditor->SelectOffset = (ULONG)((ULONG_PTR)address - (ULONG_PTR)basicInfo.BaseAddress);
1247-
showMemoryEditor->SelectLength = (ULONG)length;
1248-
1249-
SystemInformer_ShowMemoryEditor(showMemoryEditor);
1274+
assert(numberOfNodes == 1);
1275+
1276+
PhpShowMemoryEditor(context, stringsNodes[0]);
12501277
}
1251-
else
1278+
break;
1279+
case IDC_COPY:
12521280
{
1253-
PhShowStatus(hwndDlg, L"Unable to edit memory", status, 0);
1254-
}
1255-
}
1256-
else if (selectedItem->Id == 100)
1257-
{
1258-
PPH_STRING text;
1281+
PPH_STRING text;
12591282

1260-
text = PhGetTreeNewText(context->TreeNewHandle, 0);
1261-
PhSetClipboardString(context->TreeNewHandle, &text->sr);
1262-
PhDereferenceObject(text);
1283+
text = PhGetTreeNewText(context->TreeNewHandle, 0);
1284+
PhSetClipboardString(context->TreeNewHandle, &text->sr);
1285+
PhDereferenceObject(text);
1286+
}
1287+
break;
12631288
}
12641289
}
12651290

@@ -1300,7 +1325,7 @@ INT_PTR CALLBACK PhpMemoryStringsDlgProc(
13001325
mapped = PhCreateEMenuItem(0, 6, L"Mapped", NULL, NULL);
13011326
minimumLength = PhCreateEMenuItem(0, 7, L"Minimum length...", NULL, NULL);
13021327
zeroPad = PhCreateEMenuItem(0, 8, L"Zero pad addresses", NULL, NULL);
1303-
refresh = PhCreateEMenuItem(0, 9, L"Refresh", NULL, NULL);
1328+
refresh = PhCreateEMenuItem(0, 9, L"Refresh\bF5", NULL, NULL);
13041329

13051330
menu = PhCreateEMenu();
13061331
PhInsertEMenuItem(menu, ansi, ULONG_MAX);
@@ -1418,6 +1443,16 @@ INT_PTR CALLBACK PhpMemoryStringsDlgProc(
14181443
break;
14191444
}
14201445
}
1446+
case WM_KEYDOWN:
1447+
{
1448+
switch (wParam)
1449+
{
1450+
case VK_F5:
1451+
PhpSearchMemoryStrings(context);
1452+
return TRUE;
1453+
}
1454+
}
1455+
break;
14211456
case WM_CTLCOLORBTN:
14221457
case WM_CTLCOLORDLG:
14231458
case WM_CTLCOLORSTATIC:
@@ -1461,6 +1496,11 @@ NTSTATUS NTAPI PhpShowMemoryStringDialogThreadStart(
14611496
if (result == INT_ERROR)
14621497
break;
14631498

1499+
if (message.message == WM_KEYDOWN)
1500+
{
1501+
CallWindowProc(PhpMemoryStringsDlgProc, windowHandle, message.message, message.wParam, message.lParam);
1502+
}
1503+
14641504
if (!IsDialogMessage(windowHandle, &message))
14651505
{
14661506
TranslateMessage(&message);

‎plugins/ExtendedTools/objprp.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1369,6 +1369,8 @@ VOID EtpCloseObjectHandles(
13691369
{
13701370
HANDLE oldHandle;
13711371
NTSTATUS status;
1372+
ULONG64 count;
1373+
WCHAR string[PH_INT64_STR_LEN_1];
13721374

13731375
for (ULONG i = 0; i < NumberOfItems; i++)
13741376
{
@@ -1380,6 +1382,13 @@ VOID EtpCloseObjectHandles(
13801382
ListviewItems[i]->ProcessId,
13811383
ListviewItems[i]->HandleItem->Handle)) == STATUS_INVALID_HANDLE)
13821384
{
1385+
PhStringToUInt64(&PhaGetDlgItemText(Context->WindowHandle, IDC_OBJ_HANDLESTOTAL)->sr, 0, &count);
1386+
PhPrintUInt32(string, (ULONG)count - 1);
1387+
PhSetDialogItemText(Context->WindowHandle, IDC_OBJ_HANDLESTOTAL, string);
1388+
PhStringToUInt64(&PhaGetDlgItemText(Context->WindowHandle, ListviewItems[i]->OwnHandle ? IDC_OBJ_HANDLESBYOBJECT : IDC_OBJ_HANDLESBYNAME)->sr, 0, &count);
1389+
PhPrintUInt32(string, (ULONG)count - 1);
1390+
PhSetDialogItemText(Context->WindowHandle, ListviewItems[i]->OwnHandle ? IDC_OBJ_HANDLESBYOBJECT : IDC_OBJ_HANDLESBYNAME, string);
1391+
13831392
PhRemoveListViewItem(Context->ListViewHandle, PhFindListViewItemByParam(Context->ListViewHandle, INT_ERROR, ListviewItems[i]));
13841393
PhClearReference(&ListviewItems[i]->HandleItem);
13851394
PhFree(ListviewItems[i]);

0 commit comments

Comments
 (0)