winsiderss / systeminformer Goto Github PK

If I use new SDK tool I have many problem's:

1. can't build SDK - PS genarated error if PATH==SDK or PATH == ../../SDK or PATH == over path:

Действие, которое следует предпринять в связи с данным исключением:
Не удается обработать аргумент, так как значением аргумента "path" является NULL. Укажите для аргумента "path" значение, отличное от NULL.
[C] Продолжить - C  [I] Продолжить без уведомления - I  [B] Прервать - B  [S] Приостановить - S  [?] Справка (значением по умолчанию является "C"):c
Set-Location : Не удается обработать аргумент, так как значением аргумента "path" является NULL. Укажите для аргумента "path" значение,
отличное от NULL.
G:\dev\ProcessHacker\trunk\build\sdk\makesdk.ps1:44 знак:21
+         Set-Location <<<<  $PSScriptRoot;
    + CategoryInfo          : InvalidArgument: (:) [Set-Location], PSArgumentNullException
    + FullyQualifiedErrorId : ArgumentNull,Microsoft.PowerShell.Commands.SetLocationCommand

Building SDK headers            [SUCCESS]
Building public headers         [SUCCESS]
Setting up public headers       [SUCCESS]
Setting up resource headers
Действие, которое следует предпринять в связи с данным исключением:
Произошла ошибка при вызове метода, так как [System.Object[]] не содержит метод с именем "Replace".
[C] Продолжить - C  [I] Продолжить без уведомления - I  [B] Прервать - B  [S] Приостановить - S  [?] Справка (значением по умолчанию является "C"):c
Произошла ошибка при вызове метода, так как [System.Object[]] не содержит метод с именем "Replace".
G:\dev\ProcessHacker\trunk\build\sdk\makesdk.ps1:291 знак:27
+     $phappresource.Replace <<<< ("#define ID", "#define PHAPP_ID") | Set-Content "sdk\include\phappresource.h"
    + CategoryInfo          : InvalidOperation: (Replace:String) [], RuntimeException
    + FullyQualifiedErrorId : MethodNotFound

        [SUCCESS]
Setting up plugin lib files     [SUCCESS]

Build Time: 0 min, 11 sec, 327 ms

2. plug-ins can't build.

If I use old scripts all plug-ins is build success.

Question:

How to set the parameters of the call script make cdk.cmd? With old scripts is no problem, but with PowerShell I had never encountered and that it is necessary to transfer not understand ...

Hello,

As a long-time user of process hacker, I would like you to add this feature.
For multi-screen users it can be sometimes annoying to retrieve a Window.

An option such as "Bring Window to screen > screen list 1 , 2" would be welcomed !!

Thanks,
Georges

Hi, I have verifier enabled in some virtual machines and KProcessHacker driver triggers bugcheck C4 because ZwQueryObject is called with a usermode handle, in my case, when querying for ObjectTypeInformation.

Because ObQueryTypeInfo is not exported, the fix can be to use ObReferenceObjectByHandle and ObOpenObjectByPointer to convert the user-mode handle to kernel-mode.

BTW: Two suggestions:

a) Replace IsKernelHandle with a call to ObIsKernelHandle.
b) Include .pdb files in binary distributions.

Regards,
Mauro.

All items with more than two labels of information chops off

The handle tab will show zero handles for all processes if you're using the nightly build (or your own builds) and after using the -installkph parameter.

The bug seems to be caused by PhGetHandleInformationEx failing to call NtDuplicateObject when PhKphVerified is FALSE and thus returning STATUS_ACCESS_DENIED and bailing with an empty handleItem->TypeName which then causes the handle tab to show zero handles for all processes.

If PhKphVerified is FALSE then should PH disconnect from KPH so it's able to call the correct APIs (since KPH is unavailable anyway)?

The tooltip on the thread stack window that shows parameter and line number information should be visible when hovering over any row on the stack window and not just the first column as it currently does.

It's a great feature but it's not intuitive since it only displays the tooltip when the mouse is over the first column, most users do not realize those tooltips even exist.

The GPU graph shows incorrect processes as having the highest utilization in the Tooltips and other text boxes under some specific conditions:

1: If Process Hacker is prevented from opening a process by ObRegisterCallbacks (DayZ, Arma3, Rust).
2: If that process is utilizing high amounts of GPU.

Instead of showing the protected process or 'unknown', Process Hacker instead shows completely different processes has having that other process' utilization which is incorrect.

a draggable target button window finder like in the closed source Process Explorer.

Having a geo ip listing on the network port listing along with a flag indicating the country of orgin, would be helpful when looking at the network ports.

The problem arises in the files \trunk\tools\preview\ libprp.c \trunk\tools\peview\peprp.c - when assembling getting error messages cl and in this process stops:

libprp.c (170): error C2065: EnableThemeDialogTexture_I: undeclared identifier
libprp.c (171): warning C4013: EnableThemeDialogTexture_I: no definition; supposed to "extern" with the return type "int"
peprp.c (700): error C2065: EnableThemeDialogTexture_I: undeclared identifier
peprp.c (701): warning C4013: EnableThemeDialogTexture_I: no definition; supposed to "extern" with the return type "int"

These files have a line #include <uxtheme.h>, the file itself is available in Windows Platphorm SDK 7.0 and later, but as I understand the assembly may include a library should uxtheme.lib missing now, is starting with a revision of 79 ends with a message of error.

I can try to comment out the file \trunk\tools\peview\libprp.c lines 170 and 171 and in the \ trunk \trunk\tools\peview\peprp.c lines 700 and 701 containing the code:

if (EnableThemeDialogTexture_I) 
       EnableThemeDialogTexture_I (hwndDlg, ETDT_ENABLETAB);

but whether my action is correct in its consequences, or a reasonable start from the changes in ProcessHacker / procprp.c :: 4196 and repeat your logic and rename EnableThemeDialogTexture_I up to EnableThemeDialogTexture

  - If (EnableThemeDialogTexture_I)
- EnableThemeDialogTexture_I (hwndDlg, ETDT_ENABLETAB);
+ EnableThemeDialogTexture (hwndDlg, ETDT_ENABLETAB);

perhaps venture to test assembly and if they leave the option to roll back to version 2.39.0.77

Closing the handle to a worker factory via the process' Handles tab doesn't shutdown the worker factory.

We should probably add a context-menu entry to call NtShutdownWorkerFactory on the handle to aid debugging scenarios.

FR: Would it be possible to have the option of switching from linear charts/histograms to log base n (adjustable n) on the timewise/x axis?

In the System Information nonmodal popup window only.

The purpose would be to see at a glance if there was a swell in resource usage last hour/day/week/etc. while to the right side still observe a near-linear progression of mem/cpu/io usage.

Problem file is phlib/lsa.c strings 148 and 180 found in commit 921dbc9:

strings 148:

-    PhStringRefToUnicodeString(PrivilegeName, &privilegeName);  /* old version this string - no problem */
+    if (!PhStringRefToUnicodeString(PrivilegeName, &privilegeName)) /* added if ... and have problem */
+        return STATUS_NAME_TOO_LONG;

and VS2015 write to log:

1> lsa.c (149): error C2220: warning treated as error - "object" file is created
1> lsa.c (149): warning C4305: return: truncated from "NTSTATUS" to "BOOLEAN"
1> lsa.c (181): warning C4305: return: truncated from "NTSTATUS" to "BOOLEAN"
2> .. \ phlib\lsa.c (149): error C2220: warning treated as error - "object" file is created
2> .. \ phlib\lsa.c (149): warning C4305: return: truncated from "NTSTATUS" to "BOOLEAN"
2> .. \ phlib\lsa.c (181): warning C4305: return: truncated from "NTSTATUS" to "BOOLEAN"

========== Build: successfully: 0, with errors: 4, without changes: 0, conceded: 1 ==========

P.S.

Lines in phlib/lsa.c 148 and 180 caused the build fails before the compiler began processing phlib/native.c where there is a similar syntax in the line 6002, and therefore it is in theory should lead to the generation error C2220 and warning C4305 with followed by the failure of assembly...

After updating to 2.38 after some time it happens to act really strange before just not responding.

• Tray icons crash, just displays transparent square
• Scrolling the process list doesn't display processes, it just duplicates existing rendered graphics
• Displays scaled / distorted current rendered object artifacts on monitor (not only on PH window, also affects second monitor), here's part of bambalooza I've managed to snap http://i.imgur.com/7IO23cv.png
• ??????

Due to the way GPUs are utilized, it doesn't make sense to try and combine their usage into a single value like it does with CPU cores. In fact, combining their values into a single number renders that number almost useless.

I very often want to filter the disk activity down to a specific directory/file, but that filter is also applied to the rest of the tabs. Can we perhaps have the current search/filter box be a global one, but also add tab-specific ones? That way one for example could filter the disk activity down to a specific folder while still being able to view the main "Processes" tab.

Thanx for considering.

I ask to add a list of users like in the system task manager or System Explorer.
With the following features:

• Sign Out;
• Disable;
• Send a message;
• Display the status, session number, session type and other information.

Example:
[http://s011.radikal.ru/i315/1409/d6/c3521b1221c9.png]

The x64 build of peview shows an incorrect 64 bit Image Base when viewing 32bit files.

I always have to maximize it each time I start it.

first time NtQueryInformationProcess may return code other than 0xc0000004, returnLength will be an unexpected value, like -1, -2.
before PhAlloc, should assert return value from NtQuery, if return value is not 0xc0000004, should interrupt next alloc and NtQuery. otherwise program will alloc failed and crash.

Can we have a sector for display of decimal and hexadecimal process ID's in the Process Hackers - Find Handles or DLL's. And similar section in the main window. via selection on the column header.

The Process Hacker setup is not correctly installing/uninstalling KPH due to using the service name KProcessHacker2 after it was renamed KProcessHacker3 about two releases ago :P

EDIT: This won't happen anytime soon.

The phnt headers have the wrong definitions for the following APIs and use LONG values instead of the correct ULONG values:

RtlGetLastWin32Error
RtlSetLastWin32Error
RtlRestoreLastWin32Error

The check that disables ExtendedTools on XP doesn't work on Srv2k3 and XP-X64.

if (WindowsVersion <= WINDOWS_XP)

Should be:

if (WindowsVersion < WINDOWS_VISTA)

Right now MicrosoftEdgeCP.exe processes are not grouped properly in the mini info window (when you hover over a tray icon).

Found KLASS at forum.ru-board.com:

I checked out at - yes, there is a strange element, including in the Nightly Builds specially downloaded to test the hypothesis of a possible error of my build:

Therefore, the question arose what is it?

Ticket for tracking reported compatibility issues with "Multi Theft Auto".

Versions affected: 2.39

Versions affected:
2.29
2.28
2.27
2.26

I thought this was useful for the general audience using Process Hacker, so I thought of something like this:

Thanks in advance for looking forward into this!

Missing structure SE_SIGNING_LEVEL as seen in ntzwapi.h and ntseapi.h

NTSYSCALLAPI
NTSTATUS
NTAPI
ZwSetCachedSigningLevel(
    _In_ ULONG Flags, 
    _In_ SE_SIGNING_LEVEL InputSigningLevel,
    _In_reads_(SourceFileCount) PHANDLE SourceFiles,
    _In_ ULONG SourceFileCount,
    _In_opt_ HANDLE TargetFile
    );

and missing structures PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY, PROCESS_MITIGATION_FONT_DISABLE_POLICY and PROCESS_MITIGATION_IMAGE_LOAD_POLICY as seen in ntpsapi.h

typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
{
    PROCESS_MITIGATION_POLICY Policy;
    union
    {
        PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy;
        PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy;
        PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy;
        PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy;
        PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy;
        PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy;
        PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy;
        PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy;
        PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy;
    };
} PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION;

Would it be possible to add a new command line option that would print out info about a specific thread? Something like:

processhacker -c -ctype thread -cobject 180 -caction info

Or alternatively, a command line option that would allow searching for specific threads (something like the search option in the GUI already does, but instead of displaying the results in the GUI, it should print out results back into the command line).

Treenew is using an incorrect GDI context handle while drawing the selection rectangle.

In the call to CreateDIBSection, it's incorrectly using the HDC returned by CreateCompatibleDC instead of the HDC handle of the window.

Treenew.c, PhTnpDrawSelectionRectangle function, line 5620:
bitmap = CreateDIBSection(tempDc, (BITMAPINFO *)&header, DIB_RGB_COLORS, &bits, NULL, 0);

Should be:
bitmap = CreateDIBSection(hdc, (BITMAPINFO *)&header, DIB_RGB_COLORS, &bits, NULL, 0);

I write small update for prevent loss messages

/build/Installer/Custom_Messages.iss Thu Feb 18 05:39:54 +0300 2016
/build/Installer/Custom_Messages.iss commit 97880ce

en.comp_ExtendedServices =Extended Services
en.comp_ExtendedTools =Extended Tools
---en.comp_NetAdapters =Network Adapters
+++en.comp_hardwaredevices =Hardware Devices
en.comp_NetworkTools =Network Tools

Thanks!

Hi,

when I want to create a service on Windows Server 2012 R2 I get an error:
Unable to create the service: wrong parameter
Started as admin.

What could be the issue?

Thanks,
Hyper

For example, as it is now, I have the following graphs in this order:

CPU
Memory
I/O
GPU
Disk
Network
Disk 0
Disk 1
Disk 2
WiFi adapter
LAN adapter

I would like to list GPU under CPU, but that's just a matter of preference. What really annoys me is that a) disk and network adapters are not grouped together and b) disk 0 and disk 2 in my case are two software RAID disks that I'd like to have listed together (while disk 1 is a separate, independent disk)

So I'd like to have the option to manually reorder these. If you think this is to much for the UI, then can you please at least have it so that by default network adapters are listed/grouped together and disks too.

Thanx.

Test

When the UI is set to aggregate CPU, memory etc, for the processes in the sub-tree, it would be very helpful it shows a count of the number of processes in the sub-tree when it is collapsed (and only when its collapsed).

Example case 1: When there are no subprocesses to the subprocesses in the tree:

Instead of just a collapsed chrome.exe, it would display chrome.exe (10), if it has a total of 10 processes, including its sub-processes.

Example case 2: When there are subprocesses to the subprocesses:

Instead of just a collapsed explorer.exe, it would display explorer.exe (10, 25), if it has a total of 10 direct subprocesses, but a total of 25 including the subprocesses of every subprocess tree (recursively).

Thoughts?

PH v2.38.03: HardwareDevices: Re-enable disk details button d675524

I looked like some interpreted S.M.A.R.T. attributes in the plug-in window and I saw the error plugin algorithm: it randomly selects the critical attributes, although they may not be such, but for some attributes used decremental counter that the current alggoritm ignores.

For example, I made a couple of screenshots - windows plug Hardware Device:

windows and diagnostic tools HWiNFO64:

for the same drive (a server-side model Seagate Constellation ES.2).

Possible solutions:

-- I would put attributes polling interval S.M.A.R.T. equal to ten minutes because this interval corresponds approximately to device self-control cycle, and if We submit read command S.M.A.R.T. to complete self-test cycle, the device will display the last stored value attributes, and at sufficiently frequent queries S.M.A.R.T. its capacity will be significantly reduced due to the fact that most (all mass models) drives have only one I/O queue (except for server drives for database and video monitoring and recording systems with several parallel I/O queues) ...

An exception are hermetic zone temperature sensors (C2), shock - G-Sense (B7) and errors on the interface (C7) which are monitored continuously.

Attributes B7, C7 necessarily be controlled, because C7 value greater than zero indicate a defect in the electronics or connection cable, the B7 is positive sign exceeding the allowable shock load, and temperature (C2), it is desirable to control, but it is difficult because field recording format of this attribute depends on the model, and the other attributes of the problems are a sign of the change in time value of 05 attributes and C5 talking about HDD working surface degradation or SSD array and allow to see problems with the mechanics of the attributes 07, 08, 0A. 0B - but if they change for the worse is necessary to sound the alarm.

Other attributes more information, and for their correct interpretation must take into account the specific features of the drive model. And when you commit event "derating" I'd just brought a recommendation that should be diagnosed by a test device manufacturer, and then let the user itself on its result decides.

Sorry for providing little information, but all I have is call stack:

000000006aefb00c()
user32.dll!UserCallWinProcCheckWow()
user32.dll!DispatchMessageWorker()
ProcessHacker.exe!PhFormatLogEntry() + 5841 bytes
ProcessHacker.exe!PhFormatLogEntry() + 5507 bytes
Processhacker.exe!PhVerifyFile() + 9742 bytes
kernel32.dll!BaseThreadInitThunk()
ntdll.dll!RtlUserThreadStart()

I was fiddling around with UltraMon (actually it crashed at the moment I disabled smart task bar while PH was at second monitor), and last call memory was deallocated at the time debugger started so I guess it could be some kind of UltraMon injected dll. Only interesting thing is that PH was only application that crashed.

When changing Windows 10 scale, toolbar buttons disappear

Is this coming?

When I run Windows 10 in Tabletmode, start ProcessHacker, no graphs are shown in systeminformation window and at closing the Window, PH crashes at VOID PhSipOnNcDestroy (sysinfo.c line 334)

for (i = 0; i < SectionList->Count; i++)

I'm using -c -ctype process -cobject Process.exe -caction terminate
it would be very useful to add the ability to terminate process tree from the command line

This is on a Win8.1 x64 machine where the taskbar buttons for applications are set to "Combine when taskbar is full" (the default is "Always combine, hide labels").

After some time (could be days or weeks actually because I have my laptop set to hibernate when I close the lid), the taskbar button loses its icon and it is replaced by a generic one. I just upgraded to the newly-released 2.39 and restarted PR, so it is fine for now. Soon as this happens again, I'll post a screenshot.

Does anyone else notice this? It is not a big thing for me, because the program functionality doesn't change. It is simply a minor annoyance.

Additional notes:

• The main window icon does not display this issue.
• Restarting PR fixes the issue.
• Next time it happens, I will also check to see if closing the System Info window and opening it again fixes the issue.

I always have to go and start it manually and that's a couple of clicks that it would save me.

Alternatively, can we have it so that it loads as a tab of the main application window + have it auto-focus on start up?

Russian (original):

Проблема впервые замечена на forum.ru-board.com и проявляется если мы настроили вывод статистики HDD/SSD в окне System Information на одной машине, а после не отключив его в настройках плагина вышли из Process Hacker и запустили его с тем же processhacker.settings.xml на другой машине.

Для такого диска в окне Systerm Information будет выведено имя секции Unknown disk и исправить ошибку без ручной правки строки processhacker.settings.xml::184 - настройки ProcessHacker.HardwareDevices.DiskList невозможно.

Я вижу такое решение - при старте получить список зарегистрированных в ОС устройств (HDD/SSD/NIC) и если записанного в настройках ProcessHacker.HardwareDevices.NetworkList и ProcessHacker.HardwareDevices.DiskList устройства нет, то автоматически его скрывать как из списка выбора (это уже есть), так и из списка отображаемых секций в окне System Information (это пока не делается). А там пусть пользователь сам разбирается со своими настройками.

English (translation)

The problem first noticed on forum.ru-board.com manifested if we set the output HDD/SSD statistics in the System Information window on the same machine, and then turn it off in the plugin settings out of Process Hacker and run it with the same processhacker.settings .xml on another machine.

For such a disc Systerm Information window will display the name of the section Unknown disk and fix the problem without manual editing processhacker.settings.xml line::184 - ProcessHacker.HardwareDevices.DiskList impossible to configure.

I see this decision - when you start to get a list of registered OS devices (HDD/SSD/NIC) and if the recorded settings and ProcessHacker.HardwareDevices.NetworkList ProcessHacker.HardwareDevices.DiskList device does not automatically hide it from a selection list (this is there), and from the list displayed in the window sections System Information (this is not yet done). And then let the user himself to deal with its own settings.

Illustration:

KLASS (original reporter)

my test:

Unknown disk is Seagate ST32000645NS installed only on first workstation, but included on ProcessHacker.HardwareDevices.DiskList.

v2.38.0.3 (Git- d675524)

On same HDD ES.2 (see #15) I have four logical volume (one logical volume is hidded), and DVD-RAM device. On plug-in config and System Information section I see that DVD-RAM visualy mapped as HDD volume - HDD volume is C,D,E , DVD-RAM drive letter is J , but I see label ST32000645NS (C,D,E,J) :) Bug.:)

Sorry, I loss version number then found this problem. Added...

can we have search feature on
properties modules and threads tabs/