diff --git a/SystemInformer/heapinfo.c b/SystemInformer/heapinfo.c index 1cd9aaf2dd8c..f6b4f6c9282c 100644 --- a/SystemInformer/heapinfo.c +++ b/SystemInformer/heapinfo.c @@ -417,38 +417,38 @@ VOID PhpEnumerateProcessHeaps( status = PhOpenProcess( &processHandle, PROCESS_ALL_ACCESS, - Context->ProcessItem->ProcessId + clientProcessId ); } - else if (WindowsVersion >= WINDOWS_10) + else { // Windows 10 and above require SET_LIMITED for PLM execution requests. (dmex) status = PhOpenProcess( &processHandle, - PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION, - Context->ProcessItem->ProcessId + PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION | // PLM + PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE, // Reflection + clientProcessId ); } if (processHandle) { PhCreateExecutionRequiredRequest(processHandle, &powerRequestHandle); - } - if (PhGetIntegerSetting(L"EnableHeapReflection")) - { - // NOTE: RtlQueryProcessDebugInformation injects a thread into the process causing deadlocks and other issues in rare cases. - // We mitigate these problems by reflecting the process and querying heap information from the clone. (dmex) + if (PhGetIntegerSetting(L"EnableHeapReflection")) + { + // NOTE: RtlQueryProcessDebugInformation injects a thread into the process causing deadlocks and other issues in rare cases. + // We mitigate these problems by reflecting the process and querying heap information from the clone. (dmex) - status = PhCreateProcessReflection( - &reflectionInfo, - NULL, - clientProcessId - ); + status = PhCreateProcessReflection( + &reflectionInfo, + processHandle + ); - if (NT_SUCCESS(status)) - { - clientProcessId = reflectionInfo.ReflectionClientId.UniqueProcess; + if (NT_SUCCESS(status)) + { + clientProcessId = reflectionInfo.ReflectionClientId.UniqueProcess; + } } } @@ -637,6 +637,9 @@ VOID PhpEnumerateProcessHeaps( CleanupExit: PhFreeProcessReflection(&reflectionInfo); + if (processHandle) + NtClose(processHandle); + if (powerRequestHandle) PhDestroyExecutionRequiredRequest(powerRequestHandle); diff --git a/SystemInformer/memprv.c b/SystemInformer/memprv.c index 7c8f5fdd06e3..74b1cf7a9ade 100644 --- a/SystemInformer/memprv.c +++ b/SystemInformer/memprv.c @@ -391,7 +391,8 @@ VOID PhpUpdateHeapRegions( status = PhOpenProcess( &processHandle, - PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE | PROCESS_SET_LIMITED_INFORMATION, + PROCESS_QUERY_LIMITED_INFORMATION | PROCESS_SET_LIMITED_INFORMATION | + PROCESS_CREATE_THREAD | PROCESS_VM_OPERATION | PROCESS_DUP_HANDLE, List->ProcessId ); @@ -404,8 +405,7 @@ VOID PhpUpdateHeapRegions( { status = PhCreateProcessReflection( &reflectionInfo, - processHandle, - List->ProcessId + processHandle ); if (NT_SUCCESS(status))