BOOLEAN WordMatchStringZ( _In_ PWSTR Text ) { PH_STRINGREF text; PhInitializeStringRef(&text, Text); return WordMatchStringRef(&text); }
BOOLEAN ServiceTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_SERVICE_NODE serviceNode = (PPH_SERVICE_NODE)Node; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; if (WordMatchStringZ(PhGetServiceTypeString(serviceNode->ServiceItem->Type))) return TRUE; if (WordMatchStringZ(PhGetServiceStateString(serviceNode->ServiceItem->State))) return TRUE; if (WordMatchStringZ(PhGetServiceStartTypeString(serviceNode->ServiceItem->StartType))) return TRUE; if (WordMatchStringZ(PhGetServiceErrorControlString(serviceNode->ServiceItem->ErrorControl))) return TRUE; if (serviceNode->ServiceItem->Name) { if (WordMatchStringRef(&serviceNode->ServiceItem->Name->sr)) return TRUE; } if (serviceNode->ServiceItem->DisplayName) { if (WordMatchStringRef(&serviceNode->ServiceItem->DisplayName->sr)) return TRUE; } if (serviceNode->ServiceItem->ProcessIdString[0] != 0) { if (WordMatchStringZ(serviceNode->ServiceItem->ProcessIdString)) return TRUE; } return FALSE; }
BOOLEAN ProcessTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_PROCESS_NODE processNode = (PPH_PROCESS_NODE)Node; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; if (!PhIsNullOrEmptyString(processNode->ProcessItem->ProcessName)) { if (WordMatchStringRef(&processNode->ProcessItem->ProcessName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->FileName)) { if (WordMatchStringRef(&processNode->ProcessItem->FileName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->CommandLine)) { if (WordMatchStringRef(&processNode->ProcessItem->CommandLine->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->VersionInfo.CompanyName)) { if (WordMatchStringRef(&processNode->ProcessItem->VersionInfo.CompanyName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->VersionInfo.FileDescription)) { if (WordMatchStringRef(&processNode->ProcessItem->VersionInfo.FileDescription->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->VersionInfo.FileVersion)) { if (WordMatchStringRef(&processNode->ProcessItem->VersionInfo.FileVersion->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->VersionInfo.ProductName)) { if (WordMatchStringRef(&processNode->ProcessItem->VersionInfo.ProductName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->UserName)) { if (WordMatchStringRef(&processNode->ProcessItem->UserName->sr)) return TRUE; } if (processNode->ProcessItem->IntegrityString) { if (WordMatchStringZ(processNode->ProcessItem->IntegrityString)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->JobName)) { if (WordMatchStringRef(&processNode->ProcessItem->JobName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->VerifySignerName)) { if (WordMatchStringRef(&processNode->ProcessItem->VerifySignerName->sr)) return TRUE; } if (processNode->ProcessItem->ProcessIdString[0]) { if (WordMatchStringZ(processNode->ProcessItem->ProcessIdString)) return TRUE; } if (processNode->ProcessItem->ParentProcessIdString[0]) { if (WordMatchStringZ(processNode->ProcessItem->ParentProcessIdString)) return TRUE; } if (processNode->ProcessItem->SessionIdString[0]) { if (WordMatchStringZ(processNode->ProcessItem->SessionIdString)) return TRUE; } if (!PhIsNullOrEmptyString(processNode->ProcessItem->PackageFullName)) { if (WordMatchStringRef(&processNode->ProcessItem->PackageFullName->sr)) return TRUE; } if (WordMatchStringZ(PhGetProcessPriorityClassString(processNode->ProcessItem->PriorityClass))) { return TRUE; } if (processNode->ProcessItem->VerifyResult != VrUnknown) { switch (processNode->ProcessItem->VerifyResult) { case VrNoSignature: if (WordMatchStringZ(L"NoSignature")) return TRUE; break; case VrTrusted: if (WordMatchStringZ(L"Trusted")) return TRUE; break; case VrExpired: if (WordMatchStringZ(L"Expired")) return TRUE; break; case VrRevoked: if (WordMatchStringZ(L"Revoked")) return TRUE; break; case VrDistrust: if (WordMatchStringZ(L"Distrust")) return TRUE; break; case VrSecuritySettings: if (WordMatchStringZ(L"SecuritySettings")) return TRUE; break; case VrBadSignature: if (WordMatchStringZ(L"BadSignature")) return TRUE; break; default: if (WordMatchStringZ(L"Unknown")) return TRUE; break; } } if (processNode->ProcessItem->ElevationType != TokenElevationTypeDefault) { switch (processNode->ProcessItem->ElevationType) { case TokenElevationTypeLimited: if (WordMatchStringZ(L"Limited")) return TRUE; break; case TokenElevationTypeFull: if (WordMatchStringZ(L"Full")) return TRUE; break; default: if (WordMatchStringZ(L"Unknown")) return TRUE; break; } } if (WordMatchStringZ(L"IsBeingDebugged") && processNode->ProcessItem->IsBeingDebugged) { return TRUE; } if (WordMatchStringZ(L"IsDotNet") && processNode->ProcessItem->IsDotNet) { return TRUE; } if (WordMatchStringZ(L"IsElevated") && processNode->ProcessItem->IsElevated) { return TRUE; } if (WordMatchStringZ(L"IsInJob") && processNode->ProcessItem->IsInJob) { return TRUE; } if (WordMatchStringZ(L"IsInSignificantJob") && processNode->ProcessItem->IsInSignificantJob) { return TRUE; } if (WordMatchStringZ(L"IsPacked") && processNode->ProcessItem->IsPacked) { return TRUE; } if (WordMatchStringZ(L"IsSuspended") && processNode->ProcessItem->IsSuspended) { return TRUE; } if (WordMatchStringZ(L"IsWow64") && processNode->ProcessItem->IsWow64) { return TRUE; } if (WordMatchStringZ(L"IsImmersive") && processNode->ProcessItem->IsImmersive) { return TRUE; } if (WordMatchStringZ(L"IsProtectedProcess") && processNode->ProcessItem->IsProtectedProcess) { return TRUE; } if (WordMatchStringZ(L"IsSecureProcess") && processNode->ProcessItem->IsSecureProcess) { return TRUE; } if (WordMatchStringZ(L"IsPicoProcess") && processNode->ProcessItem->IsSubsystemProcess) { return TRUE; } if (processNode->ProcessItem->ServiceList && processNode->ProcessItem->ServiceList->Count) { ULONG enumerationKey = 0; PPH_SERVICE_ITEM serviceItem; PPH_LIST serviceList; ULONG i; BOOLEAN matched = FALSE; // Copy the service list so we can search it. serviceList = PhCreateList(processNode->ProcessItem->ServiceList->Count); PhAcquireQueuedLockShared(&processNode->ProcessItem->ServiceListLock); while (PhEnumPointerList( processNode->ProcessItem->ServiceList, &enumerationKey, &serviceItem )) { PhReferenceObject(serviceItem); PhAddItemList(serviceList, serviceItem); } PhReleaseQueuedLockShared(&processNode->ProcessItem->ServiceListLock); for (i = 0; i < serviceList->Count; i++) { PPH_STRING serviceFileName = NULL; PPH_STRING serviceBinaryPath = NULL; serviceItem = serviceList->Items[i]; if (!PhIsNullOrEmptyString(serviceItem->Name)) { if (WordMatchStringRef(&serviceItem->Name->sr)) { matched = TRUE; break; } } if (!PhIsNullOrEmptyString(serviceItem->DisplayName)) { if (WordMatchStringRef(&serviceItem->DisplayName->sr)) { matched = TRUE; break; } } if (serviceItem->ProcessId) { if (WordMatchStringZ(serviceItem->ProcessIdString)) { matched = TRUE; break; } } if (NT_SUCCESS(QueryServiceFileName( &serviceItem->Name->sr, &serviceFileName, &serviceBinaryPath ))) { if (serviceFileName) { if (WordMatchStringRef(&serviceFileName->sr)) { matched = TRUE; } PhDereferenceObject(serviceFileName); } if (serviceBinaryPath) { if (WordMatchStringRef(&serviceBinaryPath->sr)) { matched = TRUE; } PhDereferenceObject(serviceBinaryPath); } if (matched) break; } } PhDereferenceObjects(serviceList->Items, serviceList->Count); PhDereferenceObject(serviceList); if (matched) return TRUE; } return FALSE; }
BOOLEAN NetworkTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_NETWORK_NODE networkNode = (PPH_NETWORK_NODE)Node; PPH_STRING processNameText; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; // TODO: We need export the PPH_NETWORK_NODE->ProcessNameText field to search // waiting/unknown network connections... For now just replicate the data here. processNameText = PhpNetworkTreeGetNetworkItemProcessName(networkNode->NetworkItem); if (!PhIsNullOrEmptyString(processNameText)) { if (WordMatchStringRef(&processNameText->sr)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->ProcessName)) { if (WordMatchStringRef(&networkNode->NetworkItem->ProcessName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->OwnerName)) { if (WordMatchStringRef(&networkNode->NetworkItem->OwnerName->sr)) return TRUE; } if (networkNode->NetworkItem->LocalAddressString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->LocalAddressString)) return TRUE; } if (networkNode->NetworkItem->LocalPortString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->LocalPortString)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->LocalHostString)) { if (WordMatchStringRef(&networkNode->NetworkItem->LocalHostString->sr)) return TRUE; } if (networkNode->NetworkItem->RemoteAddressString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->RemoteAddressString)) return TRUE; } if (networkNode->NetworkItem->RemotePortString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->RemotePortString)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->RemoteHostString)) { if (WordMatchStringRef(&networkNode->NetworkItem->RemoteHostString->sr)) return TRUE; } if (WordMatchStringZ(PhGetProtocolTypeName(networkNode->NetworkItem->ProtocolType))) return TRUE; if ((networkNode->NetworkItem->ProtocolType & PH_TCP_PROTOCOL_TYPE) && WordMatchStringZ(PhGetTcpStateName(networkNode->NetworkItem->State))) return TRUE; if (networkNode->NetworkItem->ProcessId) { PPH_PROCESS_NODE processNode; WCHAR processIdString[PH_INT32_STR_LEN_1]; PhPrintUInt32(processIdString, HandleToUlong(networkNode->NetworkItem->ProcessId)); if (WordMatchStringZ(processIdString)) return TRUE; // Search the process node if (processNode = PhFindProcessNode(networkNode->NetworkItem->ProcessId)) { if (ProcessTreeFilterCallback(&processNode->Node, NULL)) return TRUE; } } return FALSE; }
BOOLEAN ServiceTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_SERVICE_NODE serviceNode = (PPH_SERVICE_NODE)Node; PPH_STRING serviceFileName = NULL; PPH_STRING serviceBinaryPath = NULL; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; if (WordMatchStringZ(PhGetServiceTypeString(serviceNode->ServiceItem->Type))) return TRUE; if (WordMatchStringZ(PhGetServiceStateString(serviceNode->ServiceItem->State))) return TRUE; if (WordMatchStringZ(PhGetServiceStartTypeString(serviceNode->ServiceItem->StartType))) return TRUE; if (WordMatchStringZ(PhGetServiceErrorControlString(serviceNode->ServiceItem->ErrorControl))) return TRUE; if (!PhIsNullOrEmptyString(serviceNode->ServiceItem->Name)) { if (WordMatchStringRef(&serviceNode->ServiceItem->Name->sr)) return TRUE; } if (!PhIsNullOrEmptyString(serviceNode->ServiceItem->DisplayName)) { if (WordMatchStringRef(&serviceNode->ServiceItem->DisplayName->sr)) return TRUE; } if (serviceNode->ServiceItem->ProcessId) { PPH_PROCESS_NODE processNode; if (WordMatchStringZ(serviceNode->ServiceItem->ProcessIdString)) return TRUE; // Search the process node if (processNode = PhFindProcessNode(serviceNode->ServiceItem->ProcessId)) { if (ProcessTreeFilterCallback(&processNode->Node, NULL)) return TRUE; } } if (!PhIsNullOrEmptyString(serviceNode->ServiceItem->VerifySignerName)) { if (WordMatchStringRef(&serviceNode->ServiceItem->VerifySignerName->sr)) return TRUE; } if (serviceNode->ServiceItem->VerifyResult != VrUnknown) { switch (serviceNode->ServiceItem->VerifyResult) { case VrNoSignature: if (WordMatchStringZ(L"NoSignature")) return TRUE; break; case VrTrusted: if (WordMatchStringZ(L"Trusted")) return TRUE; break; case VrExpired: if (WordMatchStringZ(L"Expired")) return TRUE; break; case VrRevoked: if (WordMatchStringZ(L"Revoked")) return TRUE; break; case VrDistrust: if (WordMatchStringZ(L"Distrust")) return TRUE; break; case VrSecuritySettings: if (WordMatchStringZ(L"SecuritySettings")) return TRUE; break; case VrBadSignature: if (WordMatchStringZ(L"BadSignature")) return TRUE; break; default: if (WordMatchStringZ(L"Unknown")) return TRUE; break; } } if (NT_SUCCESS(QueryServiceFileName( &serviceNode->ServiceItem->Name->sr, &serviceFileName, &serviceBinaryPath ))) { BOOLEAN matched = FALSE; if (serviceFileName) { if (WordMatchStringRef(&serviceFileName->sr)) { matched = TRUE; } PhDereferenceObject(serviceFileName); } if (serviceBinaryPath) { if (WordMatchStringRef(&serviceBinaryPath->sr)) { matched = TRUE; } PhDereferenceObject(serviceBinaryPath); } if (matched) return TRUE; } return FALSE; }
BOOLEAN NetworkTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_NETWORK_NODE networkNode = (PPH_NETWORK_NODE)Node; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; if (!PhIsNullOrEmptyString(networkNode->NetworkItem->ProcessName)) { if (WordMatchStringRef(&networkNode->NetworkItem->ProcessName->sr)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->OwnerName)) { if (WordMatchStringRef(&networkNode->NetworkItem->OwnerName->sr)) return TRUE; } if (networkNode->NetworkItem->LocalAddressString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->LocalAddressString)) return TRUE; } if (networkNode->NetworkItem->LocalPortString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->LocalPortString)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->LocalHostString)) { if (WordMatchStringRef(&networkNode->NetworkItem->LocalHostString->sr)) return TRUE; } if (networkNode->NetworkItem->RemoteAddressString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->RemoteAddressString)) return TRUE; } if (networkNode->NetworkItem->RemotePortString[0]) { if (WordMatchStringZ(networkNode->NetworkItem->RemotePortString)) return TRUE; } if (!PhIsNullOrEmptyString(networkNode->NetworkItem->RemoteHostString)) { if (WordMatchStringRef(&networkNode->NetworkItem->RemoteHostString->sr)) return TRUE; } if (WordMatchStringZ(PhGetProtocolTypeName(networkNode->NetworkItem->ProtocolType))) return TRUE; if ((networkNode->NetworkItem->ProtocolType & PH_TCP_PROTOCOL_TYPE) && WordMatchStringZ(PhGetTcpStateName(networkNode->NetworkItem->State))) return TRUE; if (networkNode->NetworkItem->ProcessId) { PPH_PROCESS_NODE processNode; WCHAR processIdString[PH_INT32_STR_LEN_1]; PhPrintUInt32(processIdString, HandleToUlong(networkNode->NetworkItem->ProcessId)); if (WordMatchStringZ(processIdString)) return TRUE; // Search the process node if (processNode = PhFindProcessNode(networkNode->NetworkItem->ProcessId)) { if (ProcessTreeFilterCallback(&processNode->Node, NULL)) return TRUE; } } return FALSE; }
BOOLEAN ServiceTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_SERVICE_NODE serviceNode = (PPH_SERVICE_NODE)Node; PPH_STRING serviceFileName = NULL; PPH_STRING serviceBinaryPath = NULL; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; if (WordMatchStringZ(PhGetServiceTypeString(serviceNode->ServiceItem->Type))) return TRUE; if (WordMatchStringZ(PhGetServiceStateString(serviceNode->ServiceItem->State))) return TRUE; if (WordMatchStringZ(PhGetServiceStartTypeString(serviceNode->ServiceItem->StartType))) return TRUE; if (WordMatchStringZ(PhGetServiceErrorControlString(serviceNode->ServiceItem->ErrorControl))) return TRUE; if (!PhIsNullOrEmptyString(serviceNode->ServiceItem->Name)) { if (WordMatchStringRef(&serviceNode->ServiceItem->Name->sr)) return TRUE; } if (!PhIsNullOrEmptyString(serviceNode->ServiceItem->DisplayName)) { if (WordMatchStringRef(&serviceNode->ServiceItem->DisplayName->sr)) return TRUE; } if (serviceNode->ServiceItem->ProcessId) { PPH_PROCESS_NODE processNode; WCHAR processIdString[PH_INT32_STR_LEN_1]; PhPrintUInt32(processIdString, HandleToUlong(serviceNode->ServiceItem->ProcessId)); if (WordMatchStringZ(processIdString)) return TRUE; // Search the process node if (processNode = PhFindProcessNode(serviceNode->ServiceItem->ProcessId)) { if (ProcessTreeFilterCallback(&processNode->Node, NULL)) return TRUE; } } if (NT_SUCCESS(QueryServiceFileName( &serviceNode->ServiceItem->Name->sr, &serviceFileName, &serviceBinaryPath ))) { BOOLEAN matched = FALSE; if (serviceFileName) { if (WordMatchStringRef(&serviceFileName->sr)) { matched = TRUE; } PhDereferenceObject(serviceFileName); } if (serviceBinaryPath) { if (WordMatchStringRef(&serviceBinaryPath->sr)) { matched = TRUE; } PhDereferenceObject(serviceBinaryPath); } if (matched) return TRUE; } return FALSE; }
BOOLEAN NetworkTreeFilterCallback( _In_ PPH_TREENEW_NODE Node, _In_opt_ PVOID Context ) { PPH_NETWORK_NODE networkNode = (PPH_NETWORK_NODE)Node; if (PhIsNullOrEmptyString(SearchboxText)) return TRUE; if (networkNode->NetworkItem->ProcessName) { if (WordMatchStringRef(&networkNode->NetworkItem->ProcessName->sr)) return TRUE; } if (networkNode->NetworkItem->OwnerName) { if (WordMatchStringRef(&networkNode->NetworkItem->OwnerName->sr)) return TRUE; } if (networkNode->NetworkItem->LocalAddressString[0] != 0) { if (WordMatchStringZ(networkNode->NetworkItem->LocalAddressString)) return TRUE; } if (networkNode->NetworkItem->LocalPortString[0] != 0) { if (WordMatchStringZ(networkNode->NetworkItem->LocalPortString)) return TRUE; } if (networkNode->NetworkItem->LocalHostString) { if (WordMatchStringRef(&networkNode->NetworkItem->LocalHostString->sr)) return TRUE; } if (networkNode->NetworkItem->RemoteAddressString[0] != 0) { if (WordMatchStringZ(networkNode->NetworkItem->RemoteAddressString)) return TRUE; } if (networkNode->NetworkItem->RemotePortString[0] != 0) { if (WordMatchStringZ(networkNode->NetworkItem->RemotePortString)) return TRUE; } if (networkNode->NetworkItem->RemoteHostString) { if (WordMatchStringRef(&networkNode->NetworkItem->RemoteHostString->sr)) return TRUE; } if (WordMatchStringZ(PhGetProtocolTypeName(networkNode->NetworkItem->ProtocolType))) return TRUE; if ((networkNode->NetworkItem->ProtocolType & PH_TCP_PROTOCOL_TYPE) && WordMatchStringZ(PhGetTcpStateName(networkNode->NetworkItem->State))) return TRUE; { WCHAR pidString[32]; PhPrintUInt32(pidString, HandleToUlong(networkNode->NetworkItem->ProcessId)); if (WordMatchStringZ(pidString)) return TRUE; } return FALSE; }