ExtendedTools: Improve EtFwFileNameToProcess caching
@@ -850,51 +850,38 @@ VOID PhpQueryHostnameForEntry(
}
PPH_PROCESS_ITEM EtFwFileNameToProcess(
- _In_ PPH_STRING ProcessBaseString
+ _In_ PPH_STRING ProcessFileName
)
{
- static PVOID processInfo = NULL;
- static ULONG64 lastTickTotal = 0;
- PSYSTEM_PROCESS_INFORMATION process;
- ULONG64 tickCount = NtGetTickCount64();
-
- if (tickCount - lastTickTotal >= 120 * 1000)
- {
- lastTickTotal = tickCount;
+ PPH_PROCESS_ITEM* processItems;
+ ULONG numberOfProcessItems;
- if (processInfo)
+ if (
+ ProcessFileName->Length == 12 &&
+ PhEqualString2(ProcessFileName, L"System", TRUE)
+ )
{
- PhFree(processInfo);
- processInfo = NULL;
+ return PhReferenceProcessItem(SYSTEM_PROCESS_ID);
}
- PhEnumProcesses(&processInfo);
- }
+ PhEnumProcessItems(&processItems, &numberOfProcessItems);
- if (!processInfo)
+ for (ULONG i = 0; i < numberOfProcessItems; i++)
{
- PhEnumProcesses(&processInfo);
- }
-
- if (process = PhFindProcessInformationByImageName(processInfo, &ProcessBaseString->sr))
+ if (
+ processItems[i]->FileName &&
+ PhEqualString(processItems[i]->FileName, ProcessFileName, TRUE)
+ )
{
- return PhReferenceProcessItem(process->UniqueProcessId);
+ PVOID object = PhReferenceObject(processItems[i]);
+ PhDereferenceObjects(processItems, numberOfProcessItems);
+ PhFree(processItems);
+ return object;
}
-
- lastTickTotal = tickCount;
-
- if (processInfo)
- {
- PhFree(processInfo);
- processInfo = NULL;
}
- PhEnumProcesses(&processInfo);
-
- if (process = PhFindProcessInformationByImageName(processInfo, &ProcessBaseString->sr))
- {
- return PhReferenceProcessItem(process->UniqueProcessId);
- }
+ PhDereferenceObjects(processItems, numberOfProcessItems);
+ PhFree(processItems);
return NULL;
}
