Process Hacker Forums

PHAPPAPI
PPH_PLUGIN
NTAPI
PhRegisterPlugin(
    __in PWSTR Name,
    __in PVOID DllBase,
    __out_opt PPH_PLUGIN_INFORMATION *Information
    );

PHAPPAPI
PPH_PLUGIN
NTAPI
PhFindPlugin(
    __in PWSTR Name
    );

PHAPPAPI
PPH_CALLBACK
NTAPI
PhGetPluginCallback(
    __in PPH_PLUGIN Plugin,
    __in PH_PLUGIN_CALLBACK Callback
    );

PHAPPAPI
PPH_CALLBACK
NTAPI
PhGetGeneralCallback(
    __in PH_GENERAL_CALLBACK Callback
    );

PHAPPAPI
ULONG
NTAPI
PhPluginReserveIds(
    __in ULONG Count
    );

PHAPPAPI
ULONG_PTR
NTAPI
PhPluginAddMenuItem(
    __in PPH_PLUGIN Plugin,
    __in ULONG_PTR Location,
    __in_opt PWSTR InsertAfter,
    __in ULONG Id,
    __in PWSTR Text,
    __in_opt PVOID Context
    );

PHAPPAPI
PPH_EMENU_ITEM
NTAPI
PhPluginCreateEMenuItem(
    __in PPH_PLUGIN Plugin,
    __in ULONG Flags,
    __in ULONG Id,
    __in PWSTR Text,
    __in_opt PVOID Context
    );

static PH_SETTING_CREATE settings[] =
{
    // { type, name, default value }
    { IntegerSettingType, L"AcmeCompany.FooBarExplorer.FooCount", L"1" },
    { StringSettingType, L"AcmeCompany.FooBarExplorer.BarPath", L"C:\\Windows\\explorer.exe" }
};

// PhAddSettings(settings array, number of settings)
PhAddSettings(settings, sizeof(settings) / sizeof(PH_SETTING_CREATE));

ULONG fooCount;
PPH_STRING barPath;

fooCount = PhGetIntegerSetting(L"AcmeCompany.FooBarExplorer.FooCount");
// Use fooCount
PhSetIntegerSetting(L"AcmeCompany.FooBarExplorer.FooCount", 1234);

barPath = PhGetStringSetting(L"AcmeCompany.FooBarExplorer.BarPath");
// Use barPath
PhDereferenceObject(barPath); // Don't forget this or you will have a reference/memory leak!
PhSetStringSetting(L"AcmeCompany.FooBarExplorer.BarPath", L"C:\\Some\\New\\Path");

VOID NTAPI MainWindowShowingCallback(
    __in_opt PVOID Parameter,
    __in_opt PVOID Context
    )
{
    PhPluginAddMenuItem(
        PluginInstance, // your plugin instance
        PH_MENU_ITEM_LOCATION_VIEW, // location of the menu item
        L"System Information", // your menu item will be inserted after this menu item
        1234, // menu item identifier - any integer you want to use
        L"Foobar Information", // text of the menu item
        NULL // arbitrary PVOID value you can specify
        );
}

VOID NTAPI ProcessMenuInitializingCallback(
    __in_opt PVOID Parameter,
    __in_opt PVOID Context
    )
{
    PPH_PLUGIN_MENU_INFORMATION menuInfo = Parameter;
    PPH_PROCESS_ITEM processItem;
    PPH_EMENU_ITEM myMenuItem;

    // In this particular event (GeneralCallbackProcessMenuInitializing), you are given the 
    // processes which the user selected when they invoked the context menu.
    if (menuInfo->u.Process.NumberOfProcesses == 1)
    {
        processItem = menuInfo->u.Process.Processes[0];
        myMenuItem = PhPluginCreateEMenuItem(
            PluginInstance, // your plugin instance
            0, // flags
            1234, // menu item identifier - any integer you want to use
            L"Unloaded Modules", // text of the menu item
            processItem // arbitrary PVOID value you can specify - in this case, we specify the process the user selected so we can use it later
            );
        PhInsertEMenuItem(
            menuInfo->Menu, // the parent menu (provided by the callback)
            myMenuItem, // the new menu item
            -1 // index - 0 means the first position, and -1 means the last position
            );
    }
}

VOID NTAPI MenuItemCallback(
    __in_opt PVOID Parameter,
    __in_opt PVOID Context
    )
{
    PPH_PLUGIN_MENU_ITEM menuItem = Parameter;

    switch (menuItem->Id)
    {
    case 1234:
        {
            // Do stuff. The arbitrary PVOID is in menuItem->Context.
        }
        break;
    // More cases?
    }
}

PPH_PLUGIN PluginInstance;
PH_CALLBACK_REGISTRATION PluginLoadCallbackRegistration;
PH_CALLBACK_REGISTRATION MainWindowShowingCallbackRegistration;
// More callback registration objects?

LOGICAL DllMain(
    __in HINSTANCE Instance, // This is really the base address of your plugin DLL. Process Hacker needs to know this value, which is why you pass it to PhRegisterPlugin.
    __in ULONG Reason,
    __reserved PVOID Reserved
    )
{
    switch (Reason)
    {
    case DLL_PROCESS_ATTACH:
        {
            PPH_PLUGIN_INFORMATION info;

            // Registers your plugin with Process Hacker.
            PluginInstance = PhRegisterPlugin(L"AcmeCompany.FooBarExplorer", Instance, &info);

            if (!PluginInstance)
                return FALSE;

            // Set up some information for your plugin.
            info->DisplayName = L"Foobar Explorer";
            info->Author = L"Acme Company";
            info->Description = L"Allows you to explore foobar objects.";
            info->HasOptions = FALSE;

            // Process Hacker notifies your plugin of events. You must use PhRegisterCallback to set up handlers for these events.
            PhRegisterCallback(
                // PhGetPluginCallback gets a pointer to a PPH_CALLBACK object that describes the event you're interested in.
                PhGetPluginCallback(PluginInstance, PluginCallbackLoad),
                // The address of your handler function.
                LoadCallback,
                // An arbitrary PVOID value. This is passed to your handler function (in this case, LoadCallback) in the Context parameter. Most of the time you won't need this.
                NULL,
                // A pointer to a PH_CALLBACK_REGISTRATION structure. This structure must be available as long as your handler function is registered (i.e. until you call PhUnregisterCallback). For best results, declare this as a global variable (see the top of this code sample)
                &PluginLoadCallbackRegistration
                );
            PhRegisterCallback(
                PhGetGeneralCallback(GeneralCallbackMainWindowShowing),
                MainWindowShowingCallback,
                NULL,
                &MainWindowShowingCallbackRegistration
                );
            // ...
            // More PhRegisterCallback calls.
        }
        break;
    }

    return TRUE;
}

// This is the handler function for the PluginCallbackLoad event.
VOID NTAPI LoadCallback(
    __in_opt PVOID Parameter, // Most callbacks give you additional information. This event doesn't give you any.
    __in_opt PVOID Context // This is the arbitrary PVOID value you specified in PhRegisterCallback.
    )
{
    // Do stuff.
}

VOID NTAPI MainWindowShowingCallback(
    __in_opt PVOID Parameter,
    __in_opt PVOID Context
    )
{
    // Do stuff.
}