Update PhCreateProcessReflection

winsiderss · Oct 17, 2024 · 1462d72 · 1462d72
1 parent a14429a
commit 1462d72
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 20 deletions.
diff --git a/SystemInformer/heapinfo.c b/SystemInformer/heapinfo.c
@@ -417,38 +417,38 @@ VOID PhpEnumerateProcessHeaps(
  status = PhOpenProcess(
  &processHandle,
  PROCESS_ALL_ACCESS,
- Context->ProcessItem->ProcessId
+ clientProcessId
  );
  }
- else if (WindowsVersion >= WINDOWS_10)
+ else
  {
  // Windows 10 and above require SET_LIMITED for PLM execution requests. (dmex)
  status = PhOpenProcess(
  &processHandle,
- PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION,
- Context->ProcessItem->ProcessId
+ PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION | // PLM
+ PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE, // Reflection
+ clientProcessId
  );
  }
 
  if (processHandle)
  {
  PhCreateExecutionRequiredRequest(processHandle, &powerRequestHandle);
- }
 
- if (PhGetIntegerSetting(L"EnableHeapReflection"))
- {
- // NOTE: RtlQueryProcessDebugInformation injects a thread into the process causing deadlocks and other issues in rare cases.
- // We mitigate these problems by reflecting the process and querying heap information from the clone. (dmex)
+  if (PhGetIntegerSetting(L"EnableHeapReflection"))
+  {
+  // NOTE: RtlQueryProcessDebugInformation injects a thread into the process causing deadlocks and other issues in rare cases.
+  // We mitigate these problems by reflecting the process and querying heap information from the clone. (dmex)
 
- status = PhCreateProcessReflection(
- &reflectionInfo,
- NULL,
- clientProcessId
- );
+ status = PhCreateProcessReflection(
+ &reflectionInfo,
+ processHandle
+ );
 
- if (NT_SUCCESS(status))
- {
- clientProcessId = reflectionInfo.ReflectionClientId.UniqueProcess;
+ if (NT_SUCCESS(status))
+ {
+ clientProcessId = reflectionInfo.ReflectionClientId.UniqueProcess;
+ }
  }
  }
 
@@ -637,6 +637,9 @@ VOID PhpEnumerateProcessHeaps(
 CleanupExit:
  PhFreeProcessReflection(&reflectionInfo);
 
+ if (processHandle)
+ NtClose(processHandle);
+
  if (powerRequestHandle)
  PhDestroyExecutionRequiredRequest(powerRequestHandle);
 

diff --git a/SystemInformer/memprv.c b/SystemInformer/memprv.c
@@ -391,7 +391,8 @@ VOID PhpUpdateHeapRegions(
 
  status = PhOpenProcess(
  &processHandle,
- PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE | PROCESS_SET_LIMITED_INFORMATION,
+ PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION |
+ PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE,
  List->ProcessId
  );
 
@@ -404,8 +405,7 @@ VOID PhpUpdateHeapRegions(
  {
  status = PhCreateProcessReflection(
  &reflectionInfo,
- processHandle,
- List->ProcessId
+ processHandle
  );
 
  if (NT_SUCCESS(status))