Process Hacker Forums

OK, Thanks

Are you going to add process protection information in next version? It may be obtained with NtQueryInformationProcess. With Delphi i use this code and it works fine. const PS_PROTECTION_NONE = 0; PS_PROTECTION_AUDITED = 8; PS_PROTECTION_AUTHENTICODE_PROTECTED = $12; PS_PROTECTION_CODEGEN_LIGHT = $2...

Thanks

Is there source code for TrustedInstallerPlugin?

Loaded as maped file.., PH not verify mapped files?

PH 3.0.105, W7 X64 SP1

Bug in the signature verification?

Make a separate column to highlight the type of process, perhaps like this

Process Hacker 2.37 don't support PsTerminateProcess/PspTerminateProcess on Windows 10?

else if (majorVersion == 6 && minorVersion > 3 || majorVersion > 6)
{
    KphDynNtVersion = 0xffffffff;
    return STATUS_NOT_SUPPORTED;
}

...\phlib\basesup.c

Maybe should do this verifyResult = PhpVerifyFile(Information, fileHandle, WTD_CHOICE_FILE, &fileInfo, &WinTrustActionGenericVerifyV2, NULL, &signatures, &numberOfSignatures); if (verifyResult != VrTrusted) //if (verifyResult == VrNoSignature) { if (CryptCATAdminAcquireContext2 &...

On Windows 10 there is a process named browser_broker.exe that contains embedded certificate which is not trusted, 5-25-2015 6-52-32 PM.jpg 5-25-2015 6-53-12 PM.jpg but the same time there is Windows catalog exists with the file hash which is trusted, 5-25-2015 6-50-55 PM.jpg 5-25-2015 6-51-06 PM.jp...

PH can show cycle based DPC and Interrupts CPU separately?

You can disable cycle based CPU usage via Settings to show the separate DPC process:

But then it shows time based CPU usage, I'm talking about to show cycle based DPC and Interrupts separately

type NTSTATUS = System.LongInt; const STATUS_SUCCESS = NTSTATUS($00000000); STATUS_INFO_LENGTH_MISMATCH = NTSTATUS($C0000004); type _SYSTEM_PROCESSOR_PERFORMANCE_INFORMATION = record IdleTime, KernelTime, UserTime, DpcTime, InterruptTime: Int64; InterruptCount: ULONG; end; SYSTEM_PROCESSOR_PERFORMA...

Let's say you have DPC and Interrupts time based CPU // Calculate total DPC and Interrupts time based CPU Int64 TotalInterruptTime = InterruptsTime + DPCTime; // Get 1% TotalInterruptTime Int64 PercentInterrupt = TotalInterruptTime / 100; // 1% TotalInterrupt // Get % DPC time based CPU Int64 Percen...

#define IMAGE_DLLCHARACTERISTICS_GUARD_CF = 0x4000

ImageNtHeaders->ImageOptionalHeader->DllCharacteristics

if DllCharacteristics = DllCharacteristics or IMAGE_DLLCHARACTERISTICS_GUARD_CF then
   GuardCF := True

TETYYS wrote:
...the less operations are done in kernel - the better.

YES

Driver loading requires elevation only once when you install it service, write?

I'm just saying that PH can't set "Real Time(24)" base priority to a process without administrative privileges, with driver you don't need to elevate PH to do this

Process Hacker Forums

Search found 112 matches

Re: Process Protection Information

Process Protection Information

Re: TrustedInstaller

Re: TrustedInstaller

Re: Bug in the signature verification

Bug in the signature verification

Separate column to highlight the type of process

PsTerminateProcess/PspTerminateProcess

Re: etwmon.c I see

Re: Windows 10 browser_broker.exe

Re: Windows 10 browser_broker.exe

Windows 10 browser_broker.exe

Re: DPC and Interrupts cycle based CPU

Re: DPC and Interrupts cycle based CPU

Re: DPC and Interrupts cycle based CPU

DPC and Interrupts cycle based CPU

Re: Detect if process is compiled with "Control Flow Guard"

Re: Set process base priority from kernel

Re: Set process base priority from kernel

Re: Set process base priority from kernel