Add workaround for ProcessSequenceNumber bug when running under wow64
@@ -1317,7 +1317,7 @@ VOID PhpFillProcessItemExtension(
{
PSYSTEM_PROCESS_INFORMATION_EXTENSION processExtension;
- if (WindowsVersion < WINDOWS_10_RS3)
+ if (WindowsVersion < WINDOWS_10_RS3 || PhIsExecutingInWow64())
return;
processExtension = PH_PROCESS_EXTENSION(Process);
@@ -2059,7 +2059,7 @@ VOID PhProcessProviderUpdate(
{
PPH_PROCESS_ITEM processItem;
- if (WindowsVersion >= WINDOWS_10_RS3)
+ if (WindowsVersion >= WINDOWS_10_RS3 && !PhIsExecutingInWow64())
{
if ((processItem = PhpLookupProcessItem(process->UniqueProcessId)) && processItem->ProcessSequenceNumber == PH_PROCESS_EXTENSION(process)->ProcessSequenceNumber)
sysTotalCycleTime += process->CycleTime - processItem->CycleTimeDelta.Value; // existing process
@@ -2128,7 +2128,7 @@ VOID PhProcessProviderUpdate(
processEntry = (PSYSTEM_PROCESS_INFORMATION)processEntry->UniqueProcessKey;
}
- if (WindowsVersion >= WINDOWS_10_RS3)
+ if (WindowsVersion >= WINDOWS_10_RS3 && !PhIsExecutingInWow64())
{
if (!processEntry || PH_PROCESS_EXTENSION(processEntry)->ProcessSequenceNumber != processItem->ProcessSequenceNumber)
processRemoved = TRUE;
@@ -2936,7 +2936,7 @@ PPH_PROCESS_ITEM PhReferenceProcessItemForParent(
parentProcessItem = PhpLookupProcessItem(ProcessItem->ParentProcessId);
- if (WindowsVersion >= WINDOWS_10_RS3)
+ if (WindowsVersion >= WINDOWS_10_RS3 && !PhIsExecutingInWow64())
{
// We make sure that the process item we found is actually the parent process - its sequence number
// must not be higher than the supplied sequence.
@@ -2970,7 +2970,7 @@ PPH_PROCESS_ITEM PhReferenceProcessItemForRecord(
processItem = PhpLookupProcessItem(Record->ProcessId);
- if (WindowsVersion >= WINDOWS_10_RS3)
+ if (WindowsVersion >= WINDOWS_10_RS3 && !PhIsExecutingInWow64())
{
if (processItem && processItem->ProcessSequenceNumber == Record->ProcessSequenceNumber)
PhReferenceObject(processItem);
