Process Hacker
|
Go to the source code of this file.
Macros | |
#define | PHP_USE_IFILEDIALOG (WINDOWS_HAS_IFILEDIALOG) |
Typedefs | |
typedef BOOLEAN(NTAPI * | _WinStationQueryInformationW )(_In_opt_ HANDLE ServerHandle, _In_ ULONG LogonId, _In_ WINSTATIONINFOCLASS WinStationInformationClass, _Out_writes_bytes_(WinStationInformationLength) PVOID WinStationInformation, _In_ ULONG WinStationInformationLength, _Out_ PULONG ReturnLength) |
typedef BOOL(WINAPI * | _CreateEnvironmentBlock )(_Out_ LPVOID *lpEnvironment, _In_opt_ HANDLE hToken, _In_ BOOL bInherit) |
typedef BOOL(WINAPI * | _DestroyEnvironmentBlock )(_In_ LPVOID lpEnvironment) |
typedef struct _PHP_FILE_DIALOG | PHP_FILE_DIALOG |
typedef struct _PHP_FILE_DIALOG * | PPHP_FILE_DIALOG |
Functions | |
VOID | PhAdjustRectangleToBounds (_Inout_ PPH_RECTANGLE Rectangle, _In_ PPH_RECTANGLE Bounds) |
Ensures a rectangle is positioned within the specified bounds. | |
VOID | PhCenterRectangle (_Inout_ PPH_RECTANGLE Rectangle, _In_ PPH_RECTANGLE Bounds) |
Positions a rectangle in the center of the specified bounds. | |
VOID | PhAdjustRectangleToWorkingArea (_In_ HWND hWnd, _Inout_ PPH_RECTANGLE Rectangle) |
Ensures a rectangle is positioned within the working area of the specified window's monitor. | |
VOID | PhCenterWindow (_In_ HWND WindowHandle, _In_opt_ HWND ParentWindowHandle) |
Centers a window. | |
VOID | PhReferenceObjects (_In_reads_(NumberOfObjects) PVOID *Objects, _In_ ULONG NumberOfObjects) |
References an array of objects. | |
VOID | PhDereferenceObjects (_In_reads_(NumberOfObjects) PVOID *Objects, _In_ ULONG NumberOfObjects) |
Dereferences an array of objects. | |
PPH_STRING | PhGetMessage (_In_ PVOID DllHandle, _In_ ULONG MessageTableId, _In_ ULONG MessageLanguageId, _In_ ULONG MessageId) |
Gets a string stored in a DLL's message table. | |
PPH_STRING | PhGetNtMessage (_In_ NTSTATUS Status) |
Gets a message describing a NT status value. | |
PPH_STRING | PhGetWin32Message (_In_ ULONG Result) |
Gets a message describing a Win32 error code. | |
INT | PhShowMessage (_In_ HWND hWnd, _In_ ULONG Type, _In_ PWSTR Format,...) |
Displays a message box. | |
INT | PhShowMessage_V (_In_ HWND hWnd, _In_ ULONG Type, _In_ PWSTR Format, _In_ va_list ArgPtr) |
PPH_STRING | PhGetStatusMessage (_In_ NTSTATUS Status, _In_opt_ ULONG Win32Result) |
VOID | PhShowStatus (_In_ HWND hWnd, _In_opt_ PWSTR Message, _In_ NTSTATUS Status, _In_opt_ ULONG Win32Result) |
Displays an error message for a NTSTATUS value or Win32 error code. | |
BOOLEAN | PhShowContinueStatus (_In_ HWND hWnd, _In_opt_ PWSTR Message, _In_ NTSTATUS Status, _In_opt_ ULONG Win32Result) |
Displays an error message for a NTSTATUS value or Win32 error code, and allows the user to cancel the current operation. | |
BOOLEAN | PhShowConfirmMessage (_In_ HWND hWnd, _In_ PWSTR Verb, _In_ PWSTR Object, _In_opt_ PWSTR Message, _In_ BOOLEAN Warning) |
Displays a confirmation message. | |
BOOLEAN | PhFindIntegerSiKeyValuePairs (_In_ PPH_KEY_VALUE_PAIR KeyValuePairs, _In_ ULONG SizeOfKeyValuePairs, _In_ PWSTR String, _Out_ PULONG Integer) |
Finds an integer in an array of string-integer pairs. | |
BOOLEAN | PhFindStringSiKeyValuePairs (_In_ PPH_KEY_VALUE_PAIR KeyValuePairs, _In_ ULONG SizeOfKeyValuePairs, _In_ ULONG Integer, _Out_ PWSTR *String) |
Finds a string in an array of string-integer pairs. | |
VOID | PhGenerateGuid (_Out_ PGUID Guid) |
Creates a random (type 4) UUID. | |
FORCEINLINE VOID | PhpReverseGuid (_Inout_ PGUID Guid) |
VOID | PhGenerateGuidFromName (_Out_ PGUID Guid, _In_ PGUID Namespace, _In_ PCHAR Name, _In_ ULONG NameLength, _In_ UCHAR Version) |
Creates a name-based (type 3 or 5) UUID. | |
VOID | PhGenerateRandomAlphaString (_Out_writes_z_(Count) PWSTR Buffer, _In_ ULONG Count) |
Fills a buffer with random uppercase alphabetical characters. | |
PPH_STRING | PhEllipsisString (_In_ PPH_STRING String, _In_ ULONG DesiredCount) |
Modifies a string to ensure it is within the specified length. | |
PPH_STRING | PhEllipsisStringPath (_In_ PPH_STRING String, _In_ ULONG DesiredCount) |
Modifies a string to ensure it is within the specified length, parsing the string as a path. | |
FORCEINLINE BOOLEAN | PhpMatchWildcards (_In_ PWSTR Pattern, _In_ PWSTR String, _In_ BOOLEAN IgnoreCase) |
BOOLEAN | PhMatchWildcards (_In_ PWSTR Pattern, _In_ PWSTR String, _In_ BOOLEAN IgnoreCase) |
Matches a pattern against a string. | |
PPH_STRING | PhEscapeStringForMenuPrefix (_In_ PPH_STRINGREF String) |
Escapes a string for prefix characters (ampersands). | |
LONG | PhCompareUnicodeStringZIgnoreMenuPrefix (_In_ PWSTR A, _In_ PWSTR B, _In_ BOOLEAN IgnoreCase, _In_ BOOLEAN MatchIfPrefix) |
Compares two strings, ignoring prefix characters (ampersands). | |
PPH_STRING | PhFormatDate (_In_opt_ PSYSTEMTIME Date, _In_opt_ PWSTR Format) |
Formats a date using the user's default locale. | |
PPH_STRING | PhFormatTime (_In_opt_ PSYSTEMTIME Time, _In_opt_ PWSTR Format) |
Formats a time using the user's default locale. | |
PPH_STRING | PhFormatDateTime (_In_opt_ PSYSTEMTIME DateTime) |
Formats a date and time using the user's default locale. | |
PPH_STRING | PhFormatTimeSpanRelative (_In_ ULONG64 TimeSpan) |
Formats a relative time span. | |
PPH_STRING | PhFormatUInt64 (_In_ ULONG64 Value, _In_ BOOLEAN GroupDigits) |
Formats a 64-bit unsigned integer. | |
PPH_STRING | PhFormatDecimal (_In_ PWSTR Value, _In_ ULONG FractionalDigits, _In_ BOOLEAN GroupDigits) |
PPH_STRING | PhFormatSize (_In_ ULONG64 Size, _In_ ULONG MaxSizeUnit) |
Gets a string representing a size. | |
PPH_STRING | PhFormatGuid (_In_ PGUID Guid) |
Converts a UUID to its string representation. | |
PVOID | PhGetFileVersionInfo (_In_ PWSTR FileName) |
Retrieves image version information for a file. | |
ULONG | PhGetFileVersionInfoLangCodePage (_In_ PVOID VersionInfo) |
Retrieves the language ID and code page used by a version information block. | |
PPH_STRING | PhGetFileVersionInfoString (_In_ PVOID VersionInfo, _In_ PWSTR SubBlock) |
Retrieves a string in a version information block. | |
PPH_STRING | PhGetFileVersionInfoString2 (_In_ PVOID VersionInfo, _In_ ULONG LangCodePage, _In_ PWSTR StringName) |
Retrieves a string in a version information block. | |
VOID | PhpGetImageVersionInfoFields (_Out_ PPH_IMAGE_VERSION_INFO ImageVersionInfo, _In_ PVOID VersionInfo, _In_ ULONG LangCodePage) |
BOOLEAN | PhInitializeImageVersionInfo (_Out_ PPH_IMAGE_VERSION_INFO ImageVersionInfo, _In_ PWSTR FileName) |
Initializes a structure with version information. | |
VOID | PhDeleteImageVersionInfo (_Inout_ PPH_IMAGE_VERSION_INFO ImageVersionInfo) |
Frees a version information structure initialized by PhInitializeImageVersionInfo(). | |
PPH_STRING | PhFormatImageVersionInfo (_In_opt_ PPH_STRING FileName, _In_ PPH_IMAGE_VERSION_INFO ImageVersionInfo, _In_opt_ PPH_STRINGREF Indent, _In_opt_ ULONG LineLimit) |
PPH_STRING | PhGetFullPath (_In_ PWSTR FileName, _Out_opt_ PULONG IndexOfFileName) |
Gets an absolute file name. | |
PPH_STRING | PhExpandEnvironmentStrings (_In_ PPH_STRINGREF String) |
Expands environment variables in a string. | |
PPH_STRING | PhGetBaseName (_In_ PPH_STRING FileName) |
Gets the base name from a file name. | |
PPH_STRING | PhGetSystemDirectory (VOID) |
Retrieves the system directory path. | |
VOID | PhGetSystemRoot (_Out_ PPH_STRINGREF SystemRoot) |
Retrieves the Windows directory path. | |
PLDR_DATA_TABLE_ENTRY | PhFindLoaderEntry (_In_opt_ PVOID DllBase, _In_opt_ PPH_STRINGREF FullDllName, _In_opt_ PPH_STRINGREF BaseDllName) |
Locates a loader entry in the current process. | |
PPH_STRING | PhGetDllFileName (_In_ PVOID DllHandle, _Out_opt_ PULONG IndexOfFileName) |
Retrieves the file name of a DLL loaded by the current process. | |
PPH_STRING | PhGetApplicationFileName (VOID) |
Retrieves the file name of the current process image. | |
PPH_STRING | PhGetApplicationDirectory (VOID) |
Retrieves the directory of the current process image. | |
PPH_STRING | PhGetKnownLocation (_In_ ULONG Folder, _In_opt_ PWSTR AppendPath) |
Gets a known location as a file name. | |
NTSTATUS | PhWaitForMultipleObjectsAndPump (_In_opt_ HWND hWnd, _In_ ULONG NumberOfHandles, _In_ PHANDLE Handles, _In_ ULONG Timeout) |
Waits on multiple objects while processing window messages. | |
NTSTATUS | PhCreateProcess (_In_ PWSTR FileName, _In_opt_ PPH_STRINGREF CommandLine, _In_opt_ PVOID Environment, _In_opt_ PPH_STRINGREF CurrentDirectory, _In_opt_ PPH_CREATE_PROCESS_INFO Information, _In_ ULONG Flags, _In_opt_ HANDLE ParentProcessHandle, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle) |
Creates a native process and an initial thread. | |
NTSTATUS | PhCreateProcessWin32 (_In_opt_ PWSTR FileName, _In_opt_ PWSTR CommandLine, _In_opt_ PVOID Environment, _In_opt_ PWSTR CurrentDirectory, _In_ ULONG Flags, _In_opt_ HANDLE TokenHandle, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle) |
Creates a Win32 process and an initial thread. | |
FORCEINLINE VOID | PhpConvertProcessInformation (_In_ PPROCESS_INFORMATION ProcessInfo, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle) |
NTSTATUS | PhCreateProcessWin32Ex (_In_opt_ PWSTR FileName, _In_opt_ PWSTR CommandLine, _In_opt_ PVOID Environment, _In_opt_ PWSTR CurrentDirectory, _In_opt_ STARTUPINFO *StartupInfo, _In_ ULONG Flags, _In_opt_ HANDLE TokenHandle, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle) |
Creates a Win32 process and an initial thread. | |
NTSTATUS | PhCreateProcessAsUser (_In_ PPH_CREATE_PROCESS_AS_USER_INFO Information, _In_ ULONG Flags, _Out_opt_ PCLIENT_ID ClientId, _Out_opt_ PHANDLE ProcessHandle, _Out_opt_ PHANDLE ThreadHandle) |
Creates a Win32 process and an initial thread under the specified user. | |
NTSTATUS | PhpGetAccountPrivileges (_In_ PSID AccountSid, _Out_ PTOKEN_PRIVILEGES *Privileges) |
NTSTATUS | PhFilterTokenForLimitedUser (_In_ HANDLE TokenHandle, _Out_ PHANDLE NewTokenHandle) |
Filters a token to create a limited user security context. | |
VOID | PhShellExecute (_In_ HWND hWnd, _In_ PWSTR FileName, _In_opt_ PWSTR Parameters) |
Opens a file or location through the shell. | |
BOOLEAN | PhShellExecuteEx (_In_opt_ HWND hWnd, _In_ PWSTR FileName, _In_opt_ PWSTR Parameters, _In_ ULONG ShowWindowType, _In_ ULONG Flags, _In_opt_ ULONG Timeout, _Out_opt_ PHANDLE ProcessHandle) |
Opens a file or location through the shell. | |
VOID | PhShellExploreFile (_In_ HWND hWnd, _In_ PWSTR FileName) |
Opens Windows Explorer with a file selected. | |
VOID | PhShellProperties (_In_ HWND hWnd, _In_ PWSTR FileName) |
Shows properties for a file. | |
PPH_STRING | PhExpandKeyName (_In_ PPH_STRING KeyName, _In_ BOOLEAN Computer) |
Expands registry name abbreviations. | |
VOID | PhShellOpenKey (_In_ HWND hWnd, _In_ PPH_STRING KeyName) |
Opens a key in the Registry Editor. | |
PKEY_VALUE_PARTIAL_INFORMATION | PhQueryRegistryValue (_In_ HANDLE KeyHandle, _In_opt_ PWSTR ValueName) |
Gets a registry value of any type. | |
PPH_STRING | PhQueryRegistryString (_In_ HANDLE KeyHandle, _In_opt_ PWSTR ValueName) |
Gets a registry string value. | |
VOID | PhMapFlags1 (_Inout_ PULONG Value2, _In_ ULONG Value1, _In_ const PH_FLAG_MAPPING *Mappings, _In_ ULONG NumberOfMappings) |
VOID | PhMapFlags2 (_Inout_ PULONG Value1, _In_ ULONG Value2, _In_ const PH_FLAG_MAPPING *Mappings, _In_ ULONG NumberOfMappings) |
UINT_PTR CALLBACK | PhpOpenFileNameHookProc (_In_ HWND hdlg, _In_ UINT uiMsg, _In_ WPARAM wParam, _In_ LPARAM lParam) |
OPENFILENAME * | PhpCreateOpenFileName (VOID) |
VOID | PhpFreeOpenFileName (_In_ OPENFILENAME *OpenFileName) |
PPHP_FILE_DIALOG | PhpCreateFileDialog (_In_ BOOLEAN Save, _In_opt_ OPENFILENAME *OpenFileName, _In_opt_ IFileDialog *FileDialog) |
PVOID | PhCreateOpenFileDialog (VOID) |
Creates a file dialog for the user to select a file to open. | |
PVOID | PhCreateSaveFileDialog (VOID) |
Creates a file dialog for the user to select a file to save to. | |
VOID | PhFreeFileDialog (_In_ PVOID FileDialog) |
Frees a file dialog. | |
BOOLEAN | PhShowFileDialog (_In_ HWND hWnd, _In_ PVOID FileDialog) |
Shows a file dialog to the user. | |
ULONG | PhGetFileDialogOptions (_In_ PVOID FileDialog) |
Gets the options for a file dialog. | |
VOID | PhSetFileDialogOptions (_In_ PVOID FileDialog, _In_ ULONG Options) |
Sets the options for a file dialog. | |
ULONG | PhGetFileDialogFilterIndex (_In_ PVOID FileDialog) |
Gets the index of the currently selected file type filter for a file dialog. | |
VOID | PhSetFileDialogFilter (_In_ PVOID FileDialog, _In_ PPH_FILETYPE_FILTER Filters, _In_ ULONG NumberOfFilters) |
Sets the file type filter for a file dialog. | |
PPH_STRING | PhGetFileDialogFileName (_In_ PVOID FileDialog) |
Gets the file name selected in a file dialog. | |
VOID | PhSetFileDialogFileName (_In_ PVOID FileDialog, _In_ PWSTR FileName) |
Sets the file name of a file dialog. | |
NTSTATUS | PhIsExecutablePacked (_In_ PWSTR FileName, _Out_ PBOOLEAN IsPacked, _Out_opt_ PULONG NumberOfModules, _Out_opt_ PULONG NumberOfFunctions) |
Determines if an executable image is packed. | |
ULONG | PhCrc32 (_In_ ULONG Crc, _In_reads_(Length) PCHAR Buffer, _In_ SIZE_T Length) |
C_ASSERT (RTL_FIELD_SIZE(PH_HASH_CONTEXT, Context) >=sizeof(MD5_CTX)) | |
C_ASSERT (RTL_FIELD_SIZE(PH_HASH_CONTEXT, Context) >=sizeof(A_SHA_CTX)) | |
VOID | PhInitializeHash (_Out_ PPH_HASH_CONTEXT Context, _In_ PH_HASH_ALGORITHM Algorithm) |
Initializes hashing. | |
VOID | PhUpdateHash (_Inout_ PPH_HASH_CONTEXT Context, _In_reads_bytes_(Length) PVOID Buffer, _In_ ULONG Length) |
Hashes a block of data. | |
BOOLEAN | PhFinalHash (_Inout_ PPH_HASH_CONTEXT Context, _Out_writes_bytes_(HashLength) PVOID Hash, _In_ ULONG HashLength, _Out_opt_ PULONG ReturnLength) |
Computes the final hash value. | |
PPH_STRING | PhParseCommandLinePart (_In_ PPH_STRINGREF CommandLine, _Inout_ PULONG_PTR Index) |
Parses one part of a command line string. | |
BOOLEAN | PhParseCommandLine (_In_ PPH_STRINGREF CommandLine, _In_opt_ PPH_COMMAND_LINE_OPTION Options, _In_ ULONG NumberOfOptions, _In_ ULONG Flags, _In_ PPH_COMMAND_LINE_CALLBACK Callback, _In_opt_ PVOID Context) |
Parses a command line string. | |
PPH_STRING | PhEscapeCommandLinePart (_In_ PPH_STRINGREF String) |
Escapes a string for use in a command line. | |
BOOLEAN | PhpSearchFilePath (_In_ PWSTR FileName, _In_opt_ PWSTR Extension, _Out_writes_(MAX_PATH) PWSTR Buffer) |
BOOLEAN | PhParseCommandLineFuzzy (_In_ PPH_STRINGREF CommandLine, _Out_ PPH_STRINGREF FileName, _Out_ PPH_STRINGREF Arguments, _Out_opt_ PPH_STRING *FullFileName) |
Parses a command line string. | |
Variables | |
DECLSPEC_SELECTANY WCHAR * | PhSizeUnitNames [7] = { L"B", L"kB", L"MB", L"GB", L"TB", L"PB", L"EB" } |
DECLSPEC_SELECTANY ULONG | PhMaxSizeUnit = MAXULONG32 |
#define PHP_USE_IFILEDIALOG (WINDOWS_HAS_IFILEDIALOG) |
typedef BOOL(WINAPI * _DestroyEnvironmentBlock)(_In_ LPVOID lpEnvironment) |
typedef BOOLEAN(NTAPI * _WinStationQueryInformationW)(_In_opt_ HANDLE ServerHandle, _In_ ULONG LogonId, _In_ WINSTATIONINFOCLASS WinStationInformationClass, _Out_writes_bytes_(WinStationInformationLength) PVOID WinStationInformation, _In_ ULONG WinStationInformationLength, _Out_ PULONG ReturnLength) |
typedef struct _PHP_FILE_DIALOG PHP_FILE_DIALOG |
typedef struct _PHP_FILE_DIALOG * PPHP_FILE_DIALOG |
C_ASSERT | ( | RTL_FIELD_SIZE(PH_HASH_CONTEXT, Context) >=sizeof(MD5_CTX) | ) |
C_ASSERT | ( | RTL_FIELD_SIZE(PH_HASH_CONTEXT, Context) >=sizeof(A_SHA_CTX) | ) |
VOID PhAdjustRectangleToBounds | ( | _Inout_ PPH_RECTANGLE | Rectangle, |
_In_ PPH_RECTANGLE | Bounds | ||
) |
VOID PhAdjustRectangleToWorkingArea | ( | _In_ HWND | hWnd, |
_Inout_ PPH_RECTANGLE | Rectangle | ||
) |
VOID PhCenterRectangle | ( | _Inout_ PPH_RECTANGLE | Rectangle, |
_In_ PPH_RECTANGLE | Bounds | ||
) |
VOID PhCenterWindow | ( | _In_ HWND | WindowHandle, |
_In_opt_ HWND | ParentWindowHandle | ||
) |
LONG PhCompareUnicodeStringZIgnoreMenuPrefix | ( | _In_ PWSTR | A, |
_In_ PWSTR | B, | ||
_In_ BOOLEAN | IgnoreCase, | ||
_In_ BOOLEAN | MatchIfPrefix | ||
) |
ULONG PhCrc32 | ( | _In_ ULONG | Crc, |
_In_reads_(Length) PCHAR | Buffer, | ||
_In_ SIZE_T | Length | ||
) |
PVOID PhCreateOpenFileDialog | ( | VOID | ) |
Creates a file dialog for the user to select a file to open.
NTSTATUS PhCreateProcess | ( | _In_ PWSTR | FileName, |
_In_opt_ PPH_STRINGREF | CommandLine, | ||
_In_opt_ PVOID | Environment, | ||
_In_opt_ PPH_STRINGREF | CurrentDirectory, | ||
_In_opt_ PPH_CREATE_PROCESS_INFO | Information, | ||
_In_ ULONG | Flags, | ||
_In_opt_ HANDLE | ParentProcessHandle, | ||
_Out_opt_ PCLIENT_ID | ClientId, | ||
_Out_opt_ PHANDLE | ProcessHandle, | ||
_Out_opt_ PHANDLE | ThreadHandle | ||
) |
Creates a native process and an initial thread.
FileName | The Win32 file name of the image. |
CommandLine | The command line string to pass to the process. This string cannot be used to specify the image to execute. |
Environment | The environment block for the process. Specify NULL to use the environment of the current process. |
CurrentDirectory | The current directory string to pass to the process. |
Information | Additional parameters to pass to the process. |
Flags | A combination of the following:
|
ParentProcessHandle | The process from which the new process will inherit attributes. Specify NULL for the current process. |
ClientId | A variable which recieves the identifier of the initial thread. |
ProcessHandle | A variable which receives a handle to the process. |
ThreadHandle | A variable which receives a handle to the initial thread. |
NTSTATUS PhCreateProcessAsUser | ( | _In_ PPH_CREATE_PROCESS_AS_USER_INFO | Information, |
_In_ ULONG | Flags, | ||
_Out_opt_ PCLIENT_ID | ClientId, | ||
_Out_opt_ PHANDLE | ProcessHandle, | ||
_Out_opt_ PHANDLE | ThreadHandle | ||
) |
Creates a Win32 process and an initial thread under the specified user.
Information | Parameters specifying how to create the process. |
Flags | See PhCreateProcess(). Additional flags may be used:
|
ClientId | A variable which recieves the identifier of the initial thread. |
ProcessHandle | A variable which receives a handle to the process. |
ThreadHandle | A variable which receives a handle to the initial thread. |
NTSTATUS PhCreateProcessWin32 | ( | _In_opt_ PWSTR | FileName, |
_In_opt_ PWSTR | CommandLine, | ||
_In_opt_ PVOID | Environment, | ||
_In_opt_ PWSTR | CurrentDirectory, | ||
_In_ ULONG | Flags, | ||
_In_opt_ HANDLE | TokenHandle, | ||
_Out_opt_ PHANDLE | ProcessHandle, | ||
_Out_opt_ PHANDLE | ThreadHandle | ||
) |
Creates a Win32 process and an initial thread.
FileName | The Win32 file name of the image. |
CommandLine | The command line to execute. This can be specified instead of FileName to indicate the image to execute. |
Environment | The environment block for the process. Specify NULL to use the environment of the current process. |
CurrentDirectory | The current directory string to pass to the process. |
Flags | See PhCreateProcess(). |
TokenHandle | The token of the process. Specify NULL for the token of the parent process. |
ProcessHandle | A variable which receives a handle to the process. |
ThreadHandle | A variable which receives a handle to the initial thread. |
NTSTATUS PhCreateProcessWin32Ex | ( | _In_opt_ PWSTR | FileName, |
_In_opt_ PWSTR | CommandLine, | ||
_In_opt_ PVOID | Environment, | ||
_In_opt_ PWSTR | CurrentDirectory, | ||
_In_opt_ STARTUPINFO * | StartupInfo, | ||
_In_ ULONG | Flags, | ||
_In_opt_ HANDLE | TokenHandle, | ||
_Out_opt_ PCLIENT_ID | ClientId, | ||
_Out_opt_ PHANDLE | ProcessHandle, | ||
_Out_opt_ PHANDLE | ThreadHandle | ||
) |
Creates a Win32 process and an initial thread.
FileName | The Win32 file name of the image. |
CommandLine | The command line to execute. This can be specified instead of FileName to indicate the image to execute. |
Environment | The environment block for the process. Specify NULL to use the environment of the current process. |
CurrentDirectory | The current directory string to pass to the process. |
StartupInfo | A STARTUPINFO structure containing additional parameters for the process. |
Flags | See PhCreateProcess(). |
TokenHandle | The token of the process. Specify NULL for the token of the parent process. |
ClientId | A variable which recieves the identifier of the initial thread. |
ProcessHandle | A variable which receives a handle to the process. |
ThreadHandle | A variable which receives a handle to the initial thread. |
PVOID PhCreateSaveFileDialog | ( | VOID | ) |
Creates a file dialog for the user to select a file to save to.
VOID PhDeleteImageVersionInfo | ( | _Inout_ PPH_IMAGE_VERSION_INFO | ImageVersionInfo | ) |
Frees a version information structure initialized by PhInitializeImageVersionInfo().
ImageVersionInfo | The version information structure. |
VOID PhDereferenceObjects | ( | _In_reads_(NumberOfObjects) PVOID * | Objects, |
_In_ ULONG | NumberOfObjects | ||
) |
PPH_STRING PhEllipsisString | ( | _In_ PPH_STRING | String, |
_In_ ULONG | DesiredCount | ||
) |
Modifies a string to ensure it is within the specified length.
String | The input string. |
DesiredCount | The desired number of characters in the new string. If necessary, parts of the string are replaced with an ellipsis to indicate characters have been omitted. |
PPH_STRING PhEllipsisStringPath | ( | _In_ PPH_STRING | String, |
_In_ ULONG | DesiredCount | ||
) |
Modifies a string to ensure it is within the specified length, parsing the string as a path.
String | The input string. |
DesiredCount | The desired number of characters in the new string. If necessary, parts of the string are replaced with an ellipsis to indicate characters have been omitted. |
PPH_STRING PhEscapeCommandLinePart | ( | _In_ PPH_STRINGREF | String | ) |
PPH_STRING PhEscapeStringForMenuPrefix | ( | _In_ PPH_STRINGREF | String | ) |
PPH_STRING PhExpandEnvironmentStrings | ( | _In_ PPH_STRINGREF | String | ) |
PPH_STRING PhExpandKeyName | ( | _In_ PPH_STRING | KeyName, |
_In_ BOOLEAN | Computer | ||
) |
NTSTATUS PhFilterTokenForLimitedUser | ( | _In_ HANDLE | TokenHandle, |
_Out_ PHANDLE | NewTokenHandle | ||
) |
Filters a token to create a limited user security context.
TokenHandle | A handle to an existing token. The handle must have TOKEN_DUPLICATE, TOKEN_QUERY, TOKEN_ADJUST_GROUPS, TOKEN_ADJUST_DEFAULT, READ_CONTROL and WRITE_DAC access. |
NewTokenHandle | A variable which receives a handle to the filtered token. The handle will have the same granted access as TokenHandle. |
BOOLEAN PhFinalHash | ( | _Inout_ PPH_HASH_CONTEXT | Context, |
_Out_writes_bytes_(HashLength) PVOID | Hash, | ||
_In_ ULONG | HashLength, | ||
_Out_opt_ PULONG | ReturnLength | ||
) |
BOOLEAN PhFindIntegerSiKeyValuePairs | ( | _In_ PPH_KEY_VALUE_PAIR | KeyValuePairs, |
_In_ ULONG | SizeOfKeyValuePairs, | ||
_In_ PWSTR | String, | ||
_Out_ PULONG | Integer | ||
) |
Finds an integer in an array of string-integer pairs.
KeyValuePairs | The array. |
SizeOfKeyValuePairs | The size of the array, in bytes. |
String | The string to search for. |
Integer | A variable which receives the found integer. |
PLDR_DATA_TABLE_ENTRY PhFindLoaderEntry | ( | _In_opt_ PVOID | DllBase, |
_In_opt_ PPH_STRINGREF | FullDllName, | ||
_In_opt_ PPH_STRINGREF | BaseDllName | ||
) |
Locates a loader entry in the current process.
DllBase | The base address of the DLL. Specify NULL if this is not a search criteria. |
FullDllName | The full name of the DLL. Specify NULL if this is not a search criteria. |
BaseDllName | The base name of the DLL. Specify NULL if this is not a search criteria. |
BOOLEAN PhFindStringSiKeyValuePairs | ( | _In_ PPH_KEY_VALUE_PAIR | KeyValuePairs, |
_In_ ULONG | SizeOfKeyValuePairs, | ||
_In_ ULONG | Integer, | ||
_Out_ PWSTR * | String | ||
) |
Finds a string in an array of string-integer pairs.
KeyValuePairs | The array. |
SizeOfKeyValuePairs | The size of the array, in bytes. |
Integer | The integer to search for. |
String | A variable which receives the found string. |
PPH_STRING PhFormatDate | ( | _In_opt_ PSYSTEMTIME | Date, |
_In_opt_ PWSTR | Format | ||
) |
PPH_STRING PhFormatDateTime | ( | _In_opt_ PSYSTEMTIME | DateTime | ) |
PPH_STRING PhFormatDecimal | ( | _In_ PWSTR | Value, |
_In_ ULONG | FractionalDigits, | ||
_In_ BOOLEAN | GroupDigits | ||
) |
PPH_STRING PhFormatGuid | ( | _In_ PGUID | Guid | ) |
PPH_STRING PhFormatImageVersionInfo | ( | _In_opt_ PPH_STRING | FileName, |
_In_ PPH_IMAGE_VERSION_INFO | ImageVersionInfo, | ||
_In_opt_ PPH_STRINGREF | Indent, | ||
_In_opt_ ULONG | LineLimit | ||
) |
PPH_STRING PhFormatSize | ( | _In_ ULONG64 | Size, |
_In_ ULONG | MaxSizeUnit | ||
) |
PPH_STRING PhFormatTime | ( | _In_opt_ PSYSTEMTIME | Time, |
_In_opt_ PWSTR | Format | ||
) |
PPH_STRING PhFormatTimeSpanRelative | ( | _In_ ULONG64 | TimeSpan | ) |
PPH_STRING PhFormatUInt64 | ( | _In_ ULONG64 | Value, |
_In_ BOOLEAN | GroupDigits | ||
) |
VOID PhFreeFileDialog | ( | _In_ PVOID | FileDialog | ) |
VOID PhGenerateGuidFromName | ( | _Out_ PGUID | Guid, |
_In_ PGUID | Namespace, | ||
_In_ PCHAR | Name, | ||
_In_ ULONG | NameLength, | ||
_In_ UCHAR | Version | ||
) |
Creates a name-based (type 3 or 5) UUID.
Guid | The destination UUID. |
Namespace | The UUID of the namespace. |
Name | The input name. |
NameLength | The length of the input name, not including the null terminator if present. |
Version | The type of UUID.
|
VOID PhGenerateRandomAlphaString | ( | _Out_writes_z_(Count) PWSTR | Buffer, |
_In_ ULONG | Count | ||
) |
PPH_STRING PhGetApplicationDirectory | ( | VOID | ) |
PPH_STRING PhGetApplicationFileName | ( | VOID | ) |
PPH_STRING PhGetBaseName | ( | _In_ PPH_STRING | FileName | ) |
PPH_STRING PhGetDllFileName | ( | _In_ PVOID | DllHandle, |
_Out_opt_ PULONG | IndexOfFileName | ||
) |
Retrieves the file name of a DLL loaded by the current process.
DllHandle | The base address of the DLL. |
IndexOfFileName | A variable which receives the index of the base name of the DLL in the returned string. |
PPH_STRING PhGetFileDialogFileName | ( | _In_ PVOID | FileDialog | ) |
Gets the file name selected in a file dialog.
FileDialog | The file dialog. |
ULONG PhGetFileDialogFilterIndex | ( | _In_ PVOID | FileDialog | ) |
ULONG PhGetFileDialogOptions | ( | _In_ PVOID | FileDialog | ) |
Gets the options for a file dialog.
FileDialog | The file dialog. |
PVOID PhGetFileVersionInfo | ( | _In_ PWSTR | FileName | ) |
ULONG PhGetFileVersionInfoLangCodePage | ( | _In_ PVOID | VersionInfo | ) |
PPH_STRING PhGetFileVersionInfoString | ( | _In_ PVOID | VersionInfo, |
_In_ PWSTR | SubBlock | ||
) |
PPH_STRING PhGetFileVersionInfoString2 | ( | _In_ PVOID | VersionInfo, |
_In_ ULONG | LangCodePage, | ||
_In_ PWSTR | StringName | ||
) |
PPH_STRING PhGetFullPath | ( | _In_ PWSTR | FileName, |
_Out_opt_ PULONG | IndexOfFileName | ||
) |
PPH_STRING PhGetKnownLocation | ( | _In_ ULONG | Folder, |
_In_opt_ PWSTR | AppendPath | ||
) |
PPH_STRING PhGetMessage | ( | _In_ PVOID | DllHandle, |
_In_ ULONG | MessageTableId, | ||
_In_ ULONG | MessageLanguageId, | ||
_In_ ULONG | MessageId | ||
) |
Gets a string stored in a DLL's message table.
DllHandle | The base address of the DLL. |
MessageTableId | The identifier of the message table. |
MessageLanguageId | The language ID of the message. |
MessageId | The identifier of the message. |
PPH_STRING PhGetNtMessage | ( | _In_ NTSTATUS | Status | ) |
PPH_STRING PhGetStatusMessage | ( | _In_ NTSTATUS | Status, |
_In_opt_ ULONG | Win32Result | ||
) |
PPH_STRING PhGetSystemDirectory | ( | VOID | ) |
VOID PhGetSystemRoot | ( | _Out_ PPH_STRINGREF | SystemRoot | ) |
PPH_STRING PhGetWin32Message | ( | _In_ ULONG | Result | ) |
VOID PhInitializeHash | ( | _Out_ PPH_HASH_CONTEXT | Context, |
_In_ PH_HASH_ALGORITHM | Algorithm | ||
) |
BOOLEAN PhInitializeImageVersionInfo | ( | _Out_ PPH_IMAGE_VERSION_INFO | ImageVersionInfo, |
_In_ PWSTR | FileName | ||
) |
NTSTATUS PhIsExecutablePacked | ( | _In_ PWSTR | FileName, |
_Out_ PBOOLEAN | IsPacked, | ||
_Out_opt_ PULONG | NumberOfModules, | ||
_Out_opt_ PULONG | NumberOfFunctions | ||
) |
Determines if an executable image is packed.
FileName | The file name of the image. |
IsPacked | A variable that receives TRUE if the image is packed, otherwise FALSE. |
NumberOfModules | A variable that receives the number of DLLs that the image imports functions from. |
NumberOfFunctions | A variable that receives the number of functions that the image imports. |
VOID PhMapFlags1 | ( | _Inout_ PULONG | Value2, |
_In_ ULONG | Value1, | ||
_In_ const PH_FLAG_MAPPING * | Mappings, | ||
_In_ ULONG | NumberOfMappings | ||
) |
VOID PhMapFlags2 | ( | _Inout_ PULONG | Value1, |
_In_ ULONG | Value2, | ||
_In_ const PH_FLAG_MAPPING * | Mappings, | ||
_In_ ULONG | NumberOfMappings | ||
) |
BOOLEAN PhMatchWildcards | ( | _In_ PWSTR | Pattern, |
_In_ PWSTR | String, | ||
_In_ BOOLEAN | IgnoreCase | ||
) |
BOOLEAN PhParseCommandLine | ( | _In_ PPH_STRINGREF | CommandLine, |
_In_opt_ PPH_COMMAND_LINE_OPTION | Options, | ||
_In_ ULONG | NumberOfOptions, | ||
_In_ ULONG | Flags, | ||
_In_ PPH_COMMAND_LINE_CALLBACK | Callback, | ||
_In_opt_ PVOID | Context | ||
) |
Parses a command line string.
CommandLine | The command line string. |
Options | An array of supported command line options. |
NumberOfOptions | The number of elements in Options. |
Flags | A combination of flags.
|
Callback | A callback function to execute for each command line option found. |
Context | A user-defined value to pass to Callback. |
BOOLEAN PhParseCommandLineFuzzy | ( | _In_ PPH_STRINGREF | CommandLine, |
_Out_ PPH_STRINGREF | FileName, | ||
_Out_ PPH_STRINGREF | Arguments, | ||
_Out_opt_ PPH_STRING * | FullFileName | ||
) |
Parses a command line string.
If the string does not contain quotation marks around the file name part, the function determines the file name to use.
CommandLine | The command line string. |
FileName | A variable which receives the part of CommandLine that contains the file name. |
Arguments | A variable which receives the part of CommandLine that contains the arguments. |
FullFileName | A variable which receives the full path and file name. This may be NULL if the file was not found. |
PPH_STRING PhParseCommandLinePart | ( | _In_ PPH_STRINGREF | CommandLine, |
_Inout_ PULONG_PTR | Index | ||
) |
Parses one part of a command line string.
Quotation marks and backslashes are handled appropriately.
CommandLine | The entire command line string. |
Index | The starting index of the command line part to be parsed. There should be no leading whitespace at this index. The index is updated to point to the end of the command line part. |
FORCEINLINE VOID PhpConvertProcessInformation | ( | _In_ PPROCESS_INFORMATION | ProcessInfo, |
_Out_opt_ PCLIENT_ID | ClientId, | ||
_Out_opt_ PHANDLE | ProcessHandle, | ||
_Out_opt_ PHANDLE | ThreadHandle | ||
) |
PPHP_FILE_DIALOG PhpCreateFileDialog | ( | _In_ BOOLEAN | Save, |
_In_opt_ OPENFILENAME * | OpenFileName, | ||
_In_opt_ IFileDialog * | FileDialog | ||
) |
VOID PhpFreeOpenFileName | ( | _In_ OPENFILENAME * | OpenFileName | ) |
NTSTATUS PhpGetAccountPrivileges | ( | _In_ PSID | AccountSid, |
_Out_ PTOKEN_PRIVILEGES * | Privileges | ||
) |
VOID PhpGetImageVersionInfoFields | ( | _Out_ PPH_IMAGE_VERSION_INFO | ImageVersionInfo, |
_In_ PVOID | VersionInfo, | ||
_In_ ULONG | LangCodePage | ||
) |
FORCEINLINE BOOLEAN PhpMatchWildcards | ( | _In_ PWSTR | Pattern, |
_In_ PWSTR | String, | ||
_In_ BOOLEAN | IgnoreCase | ||
) |
UINT_PTR CALLBACK PhpOpenFileNameHookProc | ( | _In_ HWND | hdlg, |
_In_ UINT | uiMsg, | ||
_In_ WPARAM | wParam, | ||
_In_ LPARAM | lParam | ||
) |
BOOLEAN PhpSearchFilePath | ( | _In_ PWSTR | FileName, |
_In_opt_ PWSTR | Extension, | ||
_Out_writes_(MAX_PATH) PWSTR | Buffer | ||
) |
PPH_STRING PhQueryRegistryString | ( | _In_ HANDLE | KeyHandle, |
_In_opt_ PWSTR | ValueName | ||
) |
Gets a registry string value.
KeyHandle | A handle to the key. |
ValueName | The name of the value. |
PKEY_VALUE_PARTIAL_INFORMATION PhQueryRegistryValue | ( | _In_ HANDLE | KeyHandle, |
_In_opt_ PWSTR | ValueName | ||
) |
Gets a registry value of any type.
KeyHandle | A handle to the key. |
ValueName | The name of the value. |
VOID PhReferenceObjects | ( | _In_reads_(NumberOfObjects) PVOID * | Objects, |
_In_ ULONG | NumberOfObjects | ||
) |
VOID PhSetFileDialogFileName | ( | _In_ PVOID | FileDialog, |
_In_ PWSTR | FileName | ||
) |
VOID PhSetFileDialogFilter | ( | _In_ PVOID | FileDialog, |
_In_ PPH_FILETYPE_FILTER | Filters, | ||
_In_ ULONG | NumberOfFilters | ||
) |
VOID PhSetFileDialogOptions | ( | _In_ PVOID | FileDialog, |
_In_ ULONG | Options | ||
) |
Sets the options for a file dialog.
FileDialog | The file dialog. |
Options | A combination of flags specifying the options.
|
VOID PhShellExecute | ( | _In_ HWND | hWnd, |
_In_ PWSTR | FileName, | ||
_In_opt_ PWSTR | Parameters | ||
) |
BOOLEAN PhShellExecuteEx | ( | _In_opt_ HWND | hWnd, |
_In_ PWSTR | FileName, | ||
_In_opt_ PWSTR | Parameters, | ||
_In_ ULONG | ShowWindowType, | ||
_In_ ULONG | Flags, | ||
_In_opt_ ULONG | Timeout, | ||
_Out_opt_ PHANDLE | ProcessHandle | ||
) |
Opens a file or location through the shell.
hWnd | The window to display user interface components on. |
FileName | A file name or location. |
Parameters | The parameters to pass to the executed application. |
ShowWindowType | A value specifying how to show the application. |
Flags | A combination of the following:
|
Timeout | The number of milliseconds to wait on the application, or 0 to return immediately after the application is started. |
ProcessHandle | A variable which receives a handle to the new process. |
VOID PhShellExploreFile | ( | _In_ HWND | hWnd, |
_In_ PWSTR | FileName | ||
) |
VOID PhShellOpenKey | ( | _In_ HWND | hWnd, |
_In_ PPH_STRING | KeyName | ||
) |
VOID PhShellProperties | ( | _In_ HWND | hWnd, |
_In_ PWSTR | FileName | ||
) |
BOOLEAN PhShowConfirmMessage | ( | _In_ HWND | hWnd, |
_In_ PWSTR | Verb, | ||
_In_ PWSTR | Object, | ||
_In_opt_ PWSTR | Message, | ||
_In_ BOOLEAN | Warning | ||
) |
Displays a confirmation message.
hWnd | The owner window of the message box. |
Verb | A verb describing the operation, e.g. "terminate". |
Object | The object of the operation, e.g. "the process". |
Message | A message describing the operation. |
Warning | TRUE to display the confirmation message as a warning, otherwise FALSE. |
BOOLEAN PhShowContinueStatus | ( | _In_ HWND | hWnd, |
_In_opt_ PWSTR | Message, | ||
_In_ NTSTATUS | Status, | ||
_In_opt_ ULONG | Win32Result | ||
) |
Displays an error message for a NTSTATUS value or Win32 error code, and allows the user to cancel the current operation.
hWnd | The owner window of the message box. |
Message | A message describing the operation that failed. |
Status | A NTSTATUS value, or 0 if there is none. |
Win32Result | A Win32 error code, or 0 if there is none. |
BOOLEAN PhShowFileDialog | ( | _In_ HWND | hWnd, |
_In_ PVOID | FileDialog | ||
) |
INT PhShowMessage | ( | _In_ HWND | hWnd, |
_In_ ULONG | Type, | ||
_In_ PWSTR | Format, | ||
... | |||
) |
INT PhShowMessage_V | ( | _In_ HWND | hWnd, |
_In_ ULONG | Type, | ||
_In_ PWSTR | Format, | ||
_In_ va_list | ArgPtr | ||
) |
VOID PhShowStatus | ( | _In_ HWND | hWnd, |
_In_opt_ PWSTR | Message, | ||
_In_ NTSTATUS | Status, | ||
_In_opt_ ULONG | Win32Result | ||
) |
Displays an error message for a NTSTATUS value or Win32 error code.
hWnd | The owner window of the message box. |
Message | A message describing the operation that failed. |
Status | A NTSTATUS value, or 0 if there is none. |
Win32Result | A Win32 error code, or 0 if there is none. |
VOID PhUpdateHash | ( | _Inout_ PPH_HASH_CONTEXT | Context, |
_In_reads_bytes_(Length) PVOID | Buffer, | ||
_In_ ULONG | Length | ||
) |
NTSTATUS PhWaitForMultipleObjectsAndPump | ( | _In_opt_ HWND | hWnd, |
_In_ ULONG | NumberOfHandles, | ||
_In_ PHANDLE | Handles, | ||
_In_ ULONG | Timeout | ||
) |
Waits on multiple objects while processing window messages.
hWnd | The window to process messages for, or NULL to process all messages for the current thread. |
NumberOfHandles | The number of handles specified in Handles. This must not be greater than MAXIMUM_WAIT_OBJECTS - 1. |
Handles | An array of handles. |
Timeout | The number of milliseconds to wait on the objects, or INFINITE for no timeout. |