Move architecture query into stage2
@@ -124,6 +124,8 @@ typedef struct _PH_PROCESS_QUERY_S2_DATA
NTSTATUS ImageCoherencyStatus;
FLOAT ImageCoherency;
+
+ USHORT Architecture;
} PH_PROCESS_QUERY_S2_DATA, *PPH_PROCESS_QUERY_S2_DATA;
typedef struct _PH_SID_FULL_NAME_CACHE_ENTRY
@@ -904,7 +906,7 @@ VOID PhpProcessQueryStage1(
status = STATUS_NOT_FOUND;
//
- // First try to use the new API if it makes sense to.
+ // First try to use the new API if it makes sense to. (jxy-s)
//
if (WindowsVersion >= WINDOWS_11 && processItem->QueryHandle)
{
@@ -922,27 +924,12 @@ VOID PhpProcessQueryStage1(
}
//
- // Check if we succeeded above.
+ // Check if we succeeded above. (jxy-s)
//
if (!NT_SUCCESS(status))
{
- //
- // For backward compatibility we'll read the Machine from the file.
- // If we fail to access the file we could go read from the remote
- // process memory, but for now we only read from the file.
- //
- if (processItem->FileName && !processItem->IsSubsystemProcess)
- {
- PH_MAPPED_IMAGE mappedImage;
- status = PhLoadMappedImageEx(processItem->FileName,
- NULL,
- &mappedImage);
- if (NT_SUCCESS(status))
- {
- Data->Architecture = (USHORT)mappedImage.NtHeaders->FileHeader.Machine;
- PhUnloadMappedImage(&mappedImage);
- }
- }
+ // Set the special value for a delayed stage2 query. (dmex)
+ Data->Architecture = USHRT_MAX;
}
}
@@ -1033,6 +1020,21 @@ VOID PhpProcessQueryStage2(
&Data->ImageCoherency
);
}
+
+ if (processItem->Architecture == USHRT_MAX)
+ {
+ PH_MAPPED_IMAGE mappedImage;
+
+ // For backward compatibility we'll read the Machine from the file.
+ // If we fail to access the file we could go read from the remote
+ // process memory, but for now we only read from the file. (jxy-s)
+
+ if (NT_SUCCESS(PhLoadMappedImageEx(processItem->FileName, NULL, &mappedImage)))
+ {
+ Data->Architecture = (USHORT)mappedImage.NtHeaders->FileHeader.Machine;
+ PhUnloadMappedImage(&mappedImage);
+ }
+ }
}
if (PhEnableLinuxSubsystemSupport && processItem->FileNameWin32 && processItem->IsSubsystemProcess)
@@ -1130,7 +1132,7 @@ VOID PhpFillProcessItemStage1(
processItem->IsBeingDebugged = Data->IsBeingDebugged;
processItem->IsImmersive = Data->IsImmersive;
processItem->IsProtectedHandle = Data->IsFilteredHandle;
- processItem->Architecture = (WORD)Data->Architecture;
+ processItem->Architecture = (USHORT)Data->Architecture;
PhSwapReference(&processItem->Record->CommandLine, processItem->CommandLine);
@@ -1164,6 +1166,12 @@ VOID PhpFillProcessItemStage2(
{
memcpy(&processItem->VersionInfo, &Data->VersionInfo, sizeof(PH_IMAGE_VERSION_INFO));
}
+
+ // Note: We query the architecture in stage1 so don't overwrite the previous data. (dmex)
+ if (processItem->Architecture == USHRT_MAX)
+ {
+ processItem->Architecture = Data->Architecture;
+ }
}
VOID PhpFillProcessItemExtension(
