Ejemplo n.º 1
0
        private void heapsProcessMenuItem_Click(object sender, EventArgs e)
        {
            try
            {
                HeapsWindow heapsWindow;

                using (DebugBuffer buffer = new DebugBuffer())
                {
                    this.Cursor = Cursors.WaitCursor;

                    try
                    {
                        buffer.Query(
                            processSelectedPid,
                            RtlQueryProcessDebugFlags.HeapSummary |
                            RtlQueryProcessDebugFlags.HeapEntries
                            );
                    }
                    finally
                    {
                        this.Cursor = Cursors.Default;
                    }

                    heapsWindow = new HeapsWindow(processSelectedPid, buffer.GetHeaps());
                }
                heapsWindow.ShowDialog();
            }
            catch (WindowsException ex)
            {
                PhUtils.ShowException("Unable to get heap information", ex);
            }
        }
Ejemplo n.º 2
0
        private void DoFilter()
        {
            // Stop if cancel
            if (!CancelRequested)
            {
                var handles = Windows.GetHandles();
                Dictionary<int, ProcessHandle> processHandles = new Dictionary<int, ProcessHandle>();

                // Find handles
                for (int i = 0; i < handles.Length; i++)
                {
                    // Check for cancellation here too,
                    // otherwise the user might have to wait for much time                    
                    if (CancelRequested) return;

                    if (i % 20 == 0)
                        OnMatchProgress(i, handles.Length);

                    var handle = handles[i];

                    CompareHandleBestNameWithFilter(processHandles, handle);
                    // test Exception 
                    //if (i > 2000) throw new Exception("test");
                }

                foreach (ProcessHandle phandle in processHandles.Values)
                    phandle.Dispose();

                // Find DLLs and mapped files
                Dictionary<int, SystemProcess> processes = Windows.GetProcesses();

                foreach (KeyValuePair<int, SystemProcess> process in processes)
                {
                    try
                    {
                        // Modules
                        using (ProcessHandle phandle = new ProcessHandle(process.Key, Program.MinProcessQueryRights | Program.MinProcessReadMemoryRights))
                        {
                            phandle.EnumModules(module =>
                            {
                                if (module.FileName.Contains(strFilterLower, StringComparison.OrdinalIgnoreCase))
                                    this.CallDllMatchListView(process.Key, module);
                                return true;
                            });
                        }

                        // Memory
                        using (ProcessHandle phandle = new ProcessHandle(process.Key, ProcessAccess.QueryInformation | Program.MinProcessReadMemoryRights))
                        {
                            phandle.EnumMemory(region =>
                            {
                                if (region.Type != MemoryType.Mapped)
                                    return true;

                                string name = phandle.GetMappedFileName(region.BaseAddress);

                                if (!string.IsNullOrEmpty(name) && name.Contains(strFilterLower, StringComparison.OrdinalIgnoreCase))
                                    this.CallMappedFileMatchListView(process.Key, region.BaseAddress, name);

                                return true;
                            });
                        }

                        // WOW64 Modules
                        if (OSVersion.Architecture == OSArch.Amd64)
                        {
                            using (DebugBuffer buffer = new DebugBuffer())
                            {
                                buffer.Query(
                                    process.Key,
                                    RtlQueryProcessDebugFlags.Modules32 |
                                    RtlQueryProcessDebugFlags.NonInvasive
                                    );

                                buffer.EnumModules(module =>
                                {
                                    if (module.FileName.Contains(strFilterLower, StringComparison.OrdinalIgnoreCase))
                                        this.CallDllMatchListView(process.Key, module);
                                    return true;
                                });
                            }
                        }
                    }
                    catch (Exception ex)
                    {
                        Logging.Log(ex);
                    }
                }

                OnMatchListView(null);
            }
        }