Fix missing ImageSubsystem for WSL processes, Remove extra handle for querying the window title
@@ -1031,9 +1031,15 @@ static VOID PhpUpdateProcessNodeImage(
PVOID imageBaseAddress;
PH_REMOTE_MAPPED_IMAGE mappedImage;
+ if (ProcessNode->ProcessItem->IsSubsystemProcess)
+ {
+ ProcessNode->ImageSubsystem = IMAGE_SUBSYSTEM_POSIX_CUI;
+ }
+ else
+ {
if (NT_SUCCESS(PhOpenProcess(&processHandle, ProcessQueryAccess | PROCESS_VM_READ, ProcessNode->ProcessId)))
{
- if (NT_SUCCESS(PhGetProcessBasicInformation(processHandle, &basicInfo)))
+ if (NT_SUCCESS(PhGetProcessBasicInformation(processHandle, &basicInfo)) && basicInfo.PebBaseAddress != 0)
{
if (NT_SUCCESS(NtReadVirtualMemory(
processHandle,
@@ -1066,6 +1072,7 @@ static VOID PhpUpdateProcessNodeImage(
NtClose(processHandle);
}
+ }
ProcessNode->ValidMask |= PHPN_IMAGE;
}
@@ -1077,20 +1084,13 @@ static VOID PhpUpdateProcessNodeAppId(
{
if (!(ProcessNode->ValidMask & PHPN_APPID))
{
- HANDLE processHandle;
ULONG windowFlags;
PPH_STRING windowTitle;
PhClearReference(&ProcessNode->AppIdText);
- if (!NT_SUCCESS(PhOpenProcess(&processHandle, ProcessQueryAccess | PROCESS_VM_READ, ProcessNode->ProcessId)))
- {
- if (!NT_SUCCESS(PhOpenProcess(&processHandle, ProcessQueryAccess, ProcessNode->ProcessId)))
- goto Done;
- }
-
- if (NT_SUCCESS(PhGetProcessWindowTitle(
- processHandle,
+ if (ProcessNode->ProcessItem->QueryHandle && NT_SUCCESS(PhGetProcessWindowTitle(
+ ProcessNode->ProcessItem->QueryHandle,
&windowFlags,
&windowTitle
)))
@@ -1101,9 +1101,6 @@ static VOID PhpUpdateProcessNodeAppId(
PhDereferenceObject(windowTitle);
}
- NtClose(processHandle);
-
-Done:
ProcessNode->ValidMask |= PHPN_APPID;
}
}
