Fix saving kernel minidumps for processes when EnableMinidumpKernelMinidump enabled
@@ -124,10 +124,23 @@ VOID PhpProcessMiniDumpContextDeleteProcedure(
{
PPH_PROCESS_MINIDUMP_CONTEXT context = Object;
- if (context->FileHandle)
- NtClose(context->FileHandle);
if (context->KernelFileHandle)
+ {
+ LARGE_INTEGER fileSize;
+
+ if (NT_SUCCESS(PhGetFileSize(context->KernelFileHandle, &fileSize)))
+ {
+ if (fileSize.QuadPart == 0)
+ {
+ PhDeleteFile(context->KernelFileHandle);
+ }
+ }
+
NtClose(context->KernelFileHandle);
+ }
+
+ if (context->FileHandle)
+ NtClose(context->FileHandle);
if (context->ProcessHandle)
NtClose(context->ProcessHandle);
if (context->FileName)
@@ -358,15 +371,17 @@ static BOOL CALLBACK PhpProcessMiniDumpCallback(
break;
case WriteKernelMinidumpCallback:
{
- if (!PhGetIntegerSetting(L"EnableMinidumpKernelMinidump"))
- break;
-
+ static PH_STRINGREF kernelDumpFileExt = PH_STRINGREF_INIT(L".kernel.dmp");
HANDLE kernelDumpFileHandle;
PPH_STRING kernelDumpFileName;
- kernelDumpFileName = PhGetBaseName(context->FileName);
- PhMoveReference(&kernelDumpFileName, PhConcatStringRefZ(&kernelDumpFileName->sr, L"kernel.dmp"));
+ if (!PhGetIntegerSetting(L"EnableMinidumpKernelMinidump"))
+ break;
+ if (!PhGetOwnTokenAttributes().Elevated)
+ break;
+ if (kernelDumpFileName = PhGetBaseNamePathWithExtension(context->FileName, &kernelDumpFileExt))
+ {
if (NT_SUCCESS(PhCreateFileWin32(
&kernelDumpFileHandle,
PhGetString(kernelDumpFileName),
@@ -380,6 +395,9 @@ static BOOL CALLBACK PhpProcessMiniDumpCallback(
context->KernelFileHandle = kernelDumpFileHandle;
CallbackOutput->Handle = kernelDumpFileHandle;
}
+
+ PhDereferenceObject(kernelDumpFileName);
+ }
}
break;
case KernelMinidumpStatusCallback:
@@ -466,7 +484,20 @@ NTSTATUS PhpProcessMiniDumpThreadStart(
PhAppResolverBeginCrashDumpTaskByHandle(context->ProcessHandle, &packageTaskHandle);
}
- if (!PhGetIntegerSetting(L"EnableMinidumpKernelMinidump"))
+ if (PhGetIntegerSetting(L"EnableMinidumpKernelMinidump"))
+ {
+ if (!PhGetOwnTokenAttributes().Elevated)
+ {
+ PhShowWarning2(
+ context->WindowHandle,
+ L"Unable to create kernel minidump.",
+ L"%s",
+ L"Kernel minidump of processes require administrative privileges. "
+ L"Make sure System Informer is running with administrative privileges."
+ );
+ }
+ }
+ else
{
if (NT_SUCCESS(PhCreateProcessSnapshot(
&snapshotHandle,
