PPH_LIST PhInitializeColumnSetList( _In_ PWSTR SettingName ) { PPH_LIST columnSetList; PPH_STRING settingsString; ULONG64 count; ULONG64 index; PH_STRINGREF remaining; PH_STRINGREF part; columnSetList = PhCreateList(10); settingsString = PhaGetStringSetting(SettingName); remaining = settingsString->sr; if (remaining.Length == 0) goto CleanupExit; if (!PhSplitStringRefAtChar(&remaining, '-', &part, &remaining)) goto CleanupExit; if (!PhStringToInteger64(&part, 10, &count)) goto CleanupExit; for (index = 0; index < count; index++) { PH_STRINGREF columnSetNamePart; PH_STRINGREF columnSetSettingPart; PH_STRINGREF columnSetSortPart; if (remaining.Length == 0) break; PhSplitStringRefAtChar(&remaining, '-', &columnSetNamePart, &remaining); PhSplitStringRefAtChar(&remaining, '-', &columnSetSettingPart, &remaining); PhSplitStringRefAtChar(&remaining, '-', &columnSetSortPart, &remaining); { PPH_COLUMN_SET_ENTRY entry; entry = PhAllocate(sizeof(PH_COLUMN_SET_ENTRY)); entry->Name = PhCreateString2(&columnSetNamePart); entry->Setting = PhCreateString2(&columnSetSettingPart); entry->Sorting = PhCreateString2(&columnSetSortPart); PhAddItemList(columnSetList, entry); } } CleanupExit: return columnSetList; }
_May_raise_ VOID PhSetStringSetting2( _In_ PWSTR Name, _In_ PPH_STRINGREF Value ) { PPH_SETTING setting; PH_STRINGREF name; PhInitializeStringRef(&name, Name); PhAcquireQueuedLockExclusive(&PhSettingsLock); setting = PhpLookupSetting(&name); if (setting && setting->Type == StringSettingType) { PhpFreeSettingValue(StringSettingType, setting); setting->u.Pointer = PhCreateString2(Value); } PhReleaseQueuedLockExclusive(&PhSettingsLock); if (!setting) PhRaiseStatus(STATUS_NOT_FOUND); }
VOID DiskDrivesLoadList( VOID ) { PPH_STRING settingsString; PH_STRINGREF remaining; settingsString = PhaGetStringSetting(SETTING_NAME_DISK_LIST); remaining = settingsString->sr; while (remaining.Length != 0) { PH_STRINGREF part; DV_DISK_ID id; PDV_DISK_ENTRY entry; if (remaining.Length == 0) break; PhSplitStringRefAtChar(&remaining, ',', &part, &remaining); InitializeDiskId(&id, PhCreateString2(&part)); entry = CreateDiskEntry(&id); DeleteDiskId(&id); entry->UserReference = TRUE; } }
VOID PhpAddDisabledPlugins( VOID ) { PPH_STRING disabled; PH_STRINGREF remainingPart; PH_STRINGREF part; PPH_PLUGIN disabledPlugin; PPH_STRING displayText; INT lvItemIndex; disabled = PhGetStringSetting(L"DisabledPlugins"); remainingPart = disabled->sr; while (remainingPart.Length != 0) { PhSplitStringRefAtChar(&remainingPart, '|', &part, &remainingPart); if (part.Length != 0) { if (!PhpIsPluginLoadedByBaseName(&part)) { disabledPlugin = PhpCreateDisabledPlugin(&part); PhAddItemList(DisabledPluginInstances, disabledPlugin); PhAddItemSimpleHashtable(DisabledPluginLookup, disabledPlugin, NULL); displayText = PhCreateString2(&part); lvItemIndex = PhAddListViewItem(PluginsLv, MAXINT, displayText->Buffer, disabledPlugin); PhDereferenceObject(displayText); } } } PhDereferenceObject(disabled); }
PPH_STRING TrimString( _In_ PPH_STRING String ) { static PH_STRINGREF whitespace = PH_STRINGREF_INIT(L" \t\r\n"); PH_STRINGREF sr = String->sr; PhTrimStringRef(&sr, &whitespace, 0); return PhCreateString2(&sr); }
PPH_STRING PhpGetX500Value( _In_ PPH_STRINGREF String, _In_ PPH_STRINGREF KeyName ) { WCHAR keyNamePlusEqualsBuffer[10]; PH_STRINGREF keyNamePlusEquals; SIZE_T keyNameLength; PH_STRINGREF firstPart; PH_STRINGREF remainingPart; keyNameLength = KeyName->Length / sizeof(WCHAR); assert(!(keyNameLength > sizeof(keyNamePlusEquals) / sizeof(WCHAR) - 1)); keyNamePlusEquals.Buffer = keyNamePlusEqualsBuffer; keyNamePlusEquals.Length = (keyNameLength + 1) * sizeof(WCHAR); memcpy(keyNamePlusEquals.Buffer, KeyName->Buffer, KeyName->Length); keyNamePlusEquals.Buffer[keyNameLength] = '='; // Find "Key=". if (!PhSplitStringRefAtString(String, &keyNamePlusEquals, FALSE, &firstPart, &remainingPart)) return NULL; if (remainingPart.Length == 0) return NULL; // Is the value quoted? If so, return the part inside the quotes. if (remainingPart.Buffer[0] == '"') { PhSkipStringRef(&remainingPart, sizeof(WCHAR)); if (!PhSplitStringRefAtChar(&remainingPart, '"', &firstPart, &remainingPart)) return NULL; return PhCreateString2(&firstPart); } else { PhSplitStringRefAtChar(&remainingPart, ',', &firstPart, &remainingPart); return PhCreateString2(&firstPart); } }
PPH_STRING PhGetUrlBaseName( _In_ PPH_STRING FileName ) { PH_STRINGREF pathPart; PH_STRINGREF baseNamePart; if (!PhSplitStringRefAtLastChar(&FileName->sr, '/', &pathPart, &baseNamePart)) return NULL; return PhCreateString2(&baseNamePart); }
VOID PhpExecuteCallbackForAllPlugins( _In_ PH_PLUGIN_CALLBACK Callback, _In_ BOOLEAN StartupParameters ) { PPH_AVL_LINKS links; links = PhMinimumElementAvlTree(&PhPluginsByName); while (links) { PPH_PLUGIN plugin = CONTAINING_RECORD(links, PH_PLUGIN, Links); PPH_LIST parameters = NULL; // Find relevant startup parameters for this plugin. if (StartupParameters && PhStartupParameters.PluginParameters) { ULONG i; for (i = 0; i < PhStartupParameters.PluginParameters->Count; i++) { PPH_STRING string = PhStartupParameters.PluginParameters->Items[i]; PH_STRINGREF pluginName; PH_STRINGREF parameter; if (PhSplitStringRefAtChar(&string->sr, ':', &pluginName, ¶meter) && PhEqualStringRef(&pluginName, &plugin->Name, FALSE) && parameter.Length != 0) { if (!parameters) parameters = PhCreateList(3); PhAddItemList(parameters, PhCreateString2(¶meter)); } } } PhInvokeCallback(PhGetPluginCallback(plugin, Callback), parameters); if (parameters) { ULONG i; for (i = 0; i < parameters->Count; i++) PhDereferenceObject(parameters->Items[i]); PhDereferenceObject(parameters); } links = PhSuccessorElementAvlTree(links); } }
static VOID PhpSplitUserName( _In_ PWSTR UserName, _Out_ PPH_STRING *DomainPart, _Out_ PPH_STRING *UserPart ) { PH_STRINGREF userName; PH_STRINGREF domainPart; PH_STRINGREF userPart; PhInitializeStringRefLongHint(&userName, UserName); if (PhSplitStringRefAtChar(&userName, '\\', &domainPart, &userPart)) { *DomainPart = PhCreateString2(&domainPart); *UserPart = PhCreateString2(&userPart); } else { *DomainPart = NULL; *UserPart = PhCreateString2(&userName); } }
BOOLEAN NTAPI EnumDirectoryObjectsCallback( __in PPH_STRINGREF Name, __in PPH_STRINGREF TypeName, __in_opt PVOID Context ) { INT result; PPH_STRING name; PPH_STRING typeName; name = PhCreateString2(Name); typeName = PhCreateString2(TypeName); result = PhShowMessage( PhMainWndHandle, MB_ICONINFORMATION | MB_OKCANCEL, L"%s: %s", name->Buffer, typeName->Buffer ); PhDereferenceObject(name); PhDereferenceObject(typeName); return result == IDOK; }
static PPH_STRING UpdaterParseDownloadFileName( _In_ PPH_STRING DownloadUrlPath ) { PH_STRINGREF pathPart; PH_STRINGREF baseNamePart; PPH_STRING filePath; PPH_STRING downloadFileName; if (!PhSplitStringRefAtLastChar(&DownloadUrlPath->sr, '/', &pathPart, &baseNamePart)) return NULL; downloadFileName = PhCreateString2(&baseNamePart); filePath = PhCreateCacheFile(downloadFileName); PhDereferenceObject(downloadFileName); return filePath; }
VOID NetAdaptersLoadList( VOID ) { PPH_STRING settingsString; PH_STRINGREF remaining; settingsString = PhaGetStringSetting(SETTING_NAME_INTERFACE_LIST); remaining = settingsString->sr; while (remaining.Length != 0) { ULONG64 ifindex; ULONG64 luid64; PH_STRINGREF part1; PH_STRINGREF part2; PH_STRINGREF part3; IF_LUID ifLuid; DV_NETADAPTER_ID id; PDV_NETADAPTER_ENTRY entry; if (remaining.Length == 0) break; PhSplitStringRefAtChar(&remaining, ',', &part1, &remaining); PhSplitStringRefAtChar(&remaining, ',', &part2, &remaining); PhSplitStringRefAtChar(&remaining, ',', &part3, &remaining); PhStringToInteger64(&part1, 10, &ifindex); PhStringToInteger64(&part2, 10, &luid64); ifLuid.Value = luid64; InitializeNetAdapterId(&id, (IF_INDEX)ifindex, ifLuid, PhCreateString2(&part3)); entry = CreateNetAdapterEntry(&id); DeleteNetAdapterId(&id); entry->UserReference = TRUE; } }
VOID EtDiskProcessFileEvent( _In_ PET_ETW_FILE_EVENT Event ) { PH_KEY_VALUE_PAIR pair; PPH_KEY_VALUE_PAIR realPair; if (!EtDiskEnabled) return; if (Event->Type == EtEtwFileCreateType || Event->Type == EtEtwFileRundownType) { pair.Key = Event->FileObject; pair.Value = NULL; PhAcquireQueuedLockExclusive(&EtFileNameHashtableLock); realPair = PhAddEntryHashtableEx(EtFileNameHashtable, &pair, NULL); PhMoveReference(&realPair->Value, PhCreateString2(&Event->FileName)); PhReleaseQueuedLockExclusive(&EtFileNameHashtableLock); } else if (Event->Type == EtEtwFileDeleteType) { pair.Key = Event->FileObject; PhAcquireQueuedLockExclusive(&EtFileNameHashtableLock); realPair = PhFindEntryHashtable(EtFileNameHashtable, &pair); if (realPair) { PhDereferenceObject(realPair->Value); PhRemoveEntryHashtable(EtFileNameHashtable, &pair); } PhReleaseQueuedLockExclusive(&EtFileNameHashtableLock); } }
static BOOLEAN PhpSettingFromString( _In_ PH_SETTING_TYPE Type, _In_ PPH_STRINGREF StringRef, _In_opt_ PPH_STRING String, _Inout_ PPH_SETTING Setting ) { switch (Type) { case StringSettingType: { if (String) { PhSetReference(&Setting->u.Pointer, String); } else { Setting->u.Pointer = PhCreateString2(StringRef); } return TRUE; } case IntegerSettingType: { ULONG64 integer; if (PhStringToInteger64(StringRef, 16, &integer)) { Setting->u.Integer = (ULONG)integer; return TRUE; } else { return FALSE; } } case IntegerPairSettingType: { LONG64 x; LONG64 y; PH_STRINGREF xString; PH_STRINGREF yString; if (!PhSplitStringRefAtChar(StringRef, ',', &xString, &yString)) return FALSE; if (PhStringToInteger64(&xString, 10, &x) && PhStringToInteger64(&yString, 10, &y)) { Setting->u.IntegerPair.X = (LONG)x; Setting->u.IntegerPair.Y = (LONG)y; return TRUE; } else { return FALSE; } } case ScalableIntegerPairSettingType: { ULONG64 scale; LONG64 x; LONG64 y; PH_STRINGREF stringRef; PH_STRINGREF firstPart; PH_STRINGREF secondPart; PPH_SCALABLE_INTEGER_PAIR scalableIntegerPair; stringRef = *StringRef; if (stringRef.Length != 0 && stringRef.Buffer[0] == '@') { PhSkipStringRef(&stringRef, sizeof(WCHAR)); if (!PhSplitStringRefAtChar(&stringRef, '|', &firstPart, &stringRef)) return FALSE; if (!PhStringToInteger64(&firstPart, 10, &scale)) return FALSE; } else { scale = PhpGetCurrentScale(); } if (!PhSplitStringRefAtChar(&stringRef, ',', &firstPart, &secondPart)) return FALSE; if (PhStringToInteger64(&firstPart, 10, &x) && PhStringToInteger64(&secondPart, 10, &y)) { scalableIntegerPair = PhAllocate(sizeof(PH_SCALABLE_INTEGER_PAIR)); scalableIntegerPair->X = (LONG)x; scalableIntegerPair->Y = (LONG)y; scalableIntegerPair->Scale = (ULONG)scale; Setting->u.Pointer = scalableIntegerPair; return TRUE; } else { return FALSE; } } } return FALSE; }
BOOLEAN PhLoadSettingsColumnSet( _In_ PWSTR SettingName, _In_ PPH_STRING ColumnSetName, _Out_ PPH_STRING *TreeListSettings, _Out_ PPH_STRING *TreeSortSettings ) { PPH_STRING treeSettings = NULL; PPH_STRING sortSettings = NULL; PPH_STRING settingsString; ULONG64 count; ULONG64 index; PH_STRINGREF remaining; PH_STRINGREF part; settingsString = PhaGetStringSetting(SettingName); remaining = settingsString->sr; if (remaining.Length == 0) return FALSE; if (!PhSplitStringRefAtChar(&remaining, '-', &part, &remaining)) return FALSE; if (!PhStringToInteger64(&part, 10, &count)) return FALSE; for (index = 0; index < count; index++) { PH_STRINGREF columnSetNamePart; PH_STRINGREF columnSetSettingPart; PH_STRINGREF columnSetSortPart; if (remaining.Length == 0) break; PhSplitStringRefAtChar(&remaining, '-', &columnSetNamePart, &remaining); PhSplitStringRefAtChar(&remaining, '-', &columnSetSettingPart, &remaining); PhSplitStringRefAtChar(&remaining, '-', &columnSetSortPart, &remaining); if (PhEqualStringRef(&columnSetNamePart, &ColumnSetName->sr, FALSE)) { treeSettings = PhCreateString2(&columnSetSettingPart); sortSettings = PhCreateString2(&columnSetSortPart); break; } } if (!PhIsNullOrEmptyString(treeSettings) && !PhIsNullOrEmptyString(sortSettings)) { *TreeListSettings = treeSettings; *TreeSortSettings = sortSettings; return TRUE; } else { if (treeSettings) PhDereferenceObject(treeSettings); if (sortSettings) PhDereferenceObject(sortSettings); return FALSE; } }
VOID FindNetworkAdapters( _In_ PDV_NETADAPTER_CONTEXT Context ) { if (Context->UseAlternateMethod) { ULONG flags = GAA_FLAG_SKIP_UNICAST | GAA_FLAG_SKIP_ANYCAST | GAA_FLAG_SKIP_MULTICAST | GAA_FLAG_SKIP_DNS_SERVER | GAA_FLAG_INCLUDE_ALL_INTERFACES; ULONG bufferLength = 0; PVOID buffer; if (GetAdaptersAddresses(AF_UNSPEC, flags, NULL, NULL, &bufferLength) != ERROR_BUFFER_OVERFLOW) return; buffer = PhAllocate(bufferLength); memset(buffer, 0, bufferLength); if (GetAdaptersAddresses(AF_UNSPEC, flags, NULL, buffer, &bufferLength) == ERROR_SUCCESS) { PhAcquireQueuedLockShared(&NetworkAdaptersListLock); for (PIP_ADAPTER_ADDRESSES i = buffer; i; i = i->Next) { PPH_STRING description; if (description = PhCreateString(i->Description)) { AddNetworkAdapterToListView( Context, TRUE, i->IfIndex, i->Luid, PhConvertMultiByteToUtf16(i->AdapterName), description ); PhDereferenceObject(description); } } PhReleaseQueuedLockShared(&NetworkAdaptersListLock); } PhFree(buffer); } else { static PH_STRINGREF devicePathSr = PH_STRINGREF_INIT(L"\\\\.\\"); PPH_LIST deviceList; PWSTR deviceInterfaceList; ULONG deviceInterfaceListLength = 0; PWSTR deviceInterface; if (CM_Get_Device_Interface_List_Size( &deviceInterfaceListLength, (PGUID)&GUID_DEVINTERFACE_NET, NULL, CM_GET_DEVICE_INTERFACE_LIST_ALL_DEVICES ) != CR_SUCCESS) { return; } deviceInterfaceList = PhAllocate(deviceInterfaceListLength * sizeof(WCHAR)); memset(deviceInterfaceList, 0, deviceInterfaceListLength * sizeof(WCHAR)); if (CM_Get_Device_Interface_List( (PGUID)&GUID_DEVINTERFACE_NET, NULL, deviceInterfaceList, deviceInterfaceListLength, CM_GET_DEVICE_INTERFACE_LIST_ALL_DEVICES ) != CR_SUCCESS) { PhFree(deviceInterfaceList); return; } deviceList = PH_AUTO(PhCreateList(1)); for (deviceInterface = deviceInterfaceList; *deviceInterface; deviceInterface += PhCountStringZ(deviceInterface) + 1) { HKEY keyHandle; DEVINST deviceInstanceHandle; PPH_STRING deviceDescription = NULL; if (!QueryNetworkDeviceInterfaceDescription(deviceInterface, &deviceInstanceHandle, &deviceDescription)) continue; if (CM_Open_DevInst_Key( deviceInstanceHandle, KEY_QUERY_VALUE, 0, RegDisposition_OpenExisting, &keyHandle, CM_REGISTRY_SOFTWARE ) == CR_SUCCESS) { PNET_ENUM_ENTRY adapterEntry; HANDLE deviceHandle; adapterEntry = PhAllocate(sizeof(NET_ENUM_ENTRY)); memset(adapterEntry, 0, sizeof(NET_ENUM_ENTRY)); adapterEntry->DeviceGuid = PhQueryRegistryString(keyHandle, L"NetCfgInstanceId"); adapterEntry->DeviceInterface = PhConcatStringRef2(&devicePathSr, &adapterEntry->DeviceGuid->sr); adapterEntry->DeviceLuid.Info.IfType = PhQueryRegistryUlong64(keyHandle, L"*IfType"); adapterEntry->DeviceLuid.Info.NetLuidIndex = PhQueryRegistryUlong64(keyHandle, L"NetLuidIndex"); if (NT_SUCCESS(PhCreateFileWin32( &deviceHandle, PhGetString(adapterEntry->DeviceInterface), FILE_GENERIC_READ, FILE_ATTRIBUTE_NORMAL, FILE_SHARE_READ | FILE_SHARE_WRITE, FILE_OPEN, FILE_NON_DIRECTORY_FILE | FILE_SYNCHRONOUS_IO_NONALERT ))) { PPH_STRING adapterName; // Try query the full adapter name adapterName = NetworkAdapterQueryName(deviceHandle, adapterEntry->DeviceGuid); if (adapterName) adapterEntry->DeviceName = adapterName; adapterEntry->DevicePresent = TRUE; NtClose(deviceHandle); } if (!adapterEntry->DeviceName) adapterEntry->DeviceName = PhCreateString2(&deviceDescription->sr); PhAddItemList(deviceList, adapterEntry); NtClose(keyHandle); } PhClearReference(&deviceDescription); } // Cleanup. PhFree(deviceInterfaceList); // Sort the entries qsort(deviceList->Items, deviceList->Count, sizeof(PVOID), AdapterEntryCompareFunction); PhAcquireQueuedLockShared(&NetworkAdaptersListLock); for (ULONG i = 0; i < deviceList->Count; i++) { PNET_ENUM_ENTRY entry = deviceList->Items[i]; AddNetworkAdapterToListView( Context, entry->DevicePresent, 0, entry->DeviceLuid, entry->DeviceGuid, entry->DeviceName ); if (entry->DeviceName) PhDereferenceObject(entry->DeviceName); if (entry->DeviceInterface) PhDereferenceObject(entry->DeviceInterface); // Note: DeviceGuid is disposed by WM_DESTROY. PhFree(entry); } PhReleaseQueuedLockShared(&NetworkAdaptersListLock); } // HACK: Show all unknown devices. PhAcquireQueuedLockShared(&NetworkAdaptersListLock); for (ULONG i = 0; i < NetworkAdaptersList->Count; i++) { ULONG index = ULONG_MAX; BOOLEAN found = FALSE; PDV_NETADAPTER_ENTRY entry = PhReferenceObjectSafe(NetworkAdaptersList->Items[i]); if (!entry) continue; while ((index = PhFindListViewItemByFlags( Context->ListViewHandle, index, LVNI_ALL )) != ULONG_MAX) { PDV_NETADAPTER_ID param; if (PhGetListViewItemParam(Context->ListViewHandle, index, ¶m)) { if (EquivalentNetAdapterId(param, &entry->AdapterId)) { found = TRUE; } } } if (!found) { PPH_STRING description; MIB_IF_ROW2 interfaceRow; memset(&interfaceRow, 0, sizeof(MIB_IF_ROW2)); interfaceRow.InterfaceLuid = entry->AdapterId.InterfaceLuid; interfaceRow.InterfaceIndex = entry->AdapterId.InterfaceIndex; // HACK: Try query the description from the interface entry (if it exists). if (GetIfEntry2(&interfaceRow) == NO_ERROR) description = PhCreateString(interfaceRow.Description); else description = PhCreateString(L"Unknown network adapter"); if (description) { AddNetworkAdapterToListView( Context, FALSE, entry->AdapterId.InterfaceIndex, entry->AdapterId.InterfaceLuid, entry->AdapterId.InterfaceGuid, description ); PhDereferenceObject(description); } } PhDereferenceObjectDeferDelete(entry); } PhReleaseQueuedLockShared(&NetworkAdaptersListLock); }