PPH_STRING PhpaGetAlpcInformation(
_In_ HANDLE ThreadId
)
{
NTSTATUS status;
PPH_STRING string = NULL;
HANDLE threadHandle;
PALPC_SERVER_INFORMATION serverInfo;
ULONG bufferLength;
if (!NT_SUCCESS(PhOpenThread(&threadHandle, THREAD_QUERY_INFORMATION, ThreadId)))
return NULL;
bufferLength = 0x110;
serverInfo = PhAllocate(bufferLength);
serverInfo->In.ThreadHandle = threadHandle;
status = NtAlpcQueryInformation(NULL, AlpcServerInformation, serverInfo, bufferLength, &bufferLength);
if (status == STATUS_INFO_LENGTH_MISMATCH)
{
PhFree(serverInfo);
serverInfo = PhAllocate(bufferLength);
serverInfo->In.ThreadHandle = threadHandle;
status = NtAlpcQueryInformation(NULL, AlpcServerInformation, serverInfo, bufferLength, &bufferLength);
}
if (NT_SUCCESS(status) && serverInfo->Out.ThreadBlocked)
{
CLIENT_ID clientId;
PPH_STRING clientIdName;
clientId.UniqueProcess = serverInfo->Out.ConnectedProcessId;
clientId.UniqueThread = NULL;
clientIdName = PH_AUTO(PhGetClientIdName(&clientId));
string = PhaFormatString(L"ALPC Port: %.*s (%s)", serverInfo->Out.ConnectionPortName.Length / sizeof(WCHAR), serverInfo->Out.ConnectionPortName.Buffer, clientIdName->Buffer);
}
PhFree(serverInfo);
NtClose(threadHandle);
return string;
}
INT_PTR CALLBACK EtpAlpcPortPageDlgProc(
__in HWND hwndDlg,
__in UINT uMsg,
__in WPARAM wParam,
__in LPARAM lParam
)
{
switch (uMsg)
{
case WM_INITDIALOG:
{
LPPROPSHEETPAGE propSheetPage = (LPPROPSHEETPAGE)lParam;
PCOMMON_PAGE_CONTEXT context = (PCOMMON_PAGE_CONTEXT)propSheetPage->lParam;
HANDLE portHandle;
if (NT_SUCCESS(EtpDuplicateHandleFromProcess(&portHandle, READ_CONTROL, context)))
{
ALPC_BASIC_INFORMATION basicInfo;
if (NT_SUCCESS(NtAlpcQueryInformation(
portHandle,
AlpcBasicInformation,
&basicInfo,
sizeof(ALPC_BASIC_INFORMATION),
NULL
)))
{
PH_FORMAT format[2];
PPH_STRING string;
PhInitFormatS(&format[0], L"Sequence Number: ");
PhInitFormatD(&format[1], basicInfo.SequenceNo);
format[1].Type |= FormatGroupDigits;
string = PhFormat(format, 2, 128);
SetDlgItemText(hwndDlg, IDC_SEQUENCENUMBER, string->Buffer);
PhDereferenceObject(string);
SetDlgItemText(hwndDlg, IDC_PORTCONTEXT,
PhaFormatString(L"Port Context: 0x%Ix", basicInfo.PortContext)->Buffer);
}
NtClose(portHandle);
}
}
break;
}
return FALSE;
}
