#include <phapp.h>

#include <winsta.h>

#include <dbghelp.h>

#include <appmodel.h>

#include <shellapi.h>

#include <cpysave.h>

#include <emenu.h>

#include <svcsup.h>

#include <symprv.h>

#include <settings.h>

#include <actions.h>

#include <phappres.h>

#include <phsvccl.h>

#include <phsettings.h>

#include "pcre/pcre2.h"

typedef LONG (WINAPI *_GetPackageFullName)(

_In_ HANDLE hProcess,

_Inout_ UINT32 *packageFullNameLength,

_Out_opt_ PWSTR packageFullName

);

typedef LONG (WINAPI *_GetPackagePath)(

_In_ PACKAGE_ID *packageId,

_Reserved_ UINT32 reserved,

_Inout_ UINT32 *pathLength,

_Out_opt_ PWSTR path

);

typedef LONG (WINAPI *_PackageIdFromFullName)(

_In_ PCWSTR packageFullName,

_In_ UINT32 flags,

_Inout_ UINT32 *bufferLength,

_Out_opt_ BYTE *buffer

);

GUID XP_CONTEXT_GUID = { 0xbeb1b341, 0x6837, 0x4c83, { 0x83, 0x66, 0x2b, 0x45, 0x1e, 0x7c, 0xe6, 0x9b } };

GUID VISTA_CONTEXT_GUID = { 0xe2011457, 0x1546, 0x43c5, { 0xa5, 0xfe, 0x00, 0x8d, 0xee, 0xe3, 0xd3, 0xf0 } };

GUID WIN7_CONTEXT_GUID = { 0x35138b9a, 0x5d96, 0x4fbd, { 0x8e, 0x2d, 0xa2, 0x44, 0x02, 0x25, 0xf9, 0x3a } };

GUID WIN8_CONTEXT_GUID = { 0x4a2f28e3, 0x53b9, 0x4441, { 0xba, 0x9c, 0xd6, 0x9d, 0x4a, 0x4a, 0x6e, 0x38 } };

GUID WINBLUE_CONTEXT_GUID = { 0x1f676c76, 0x80e1, 0x4239, { 0x95, 0xbb, 0x83, 0xd0, 0xf6, 0xd0, 0xda, 0x78 } };

GUID WINTHRESHOLD_CONTEXT_GUID = { 0x8e0f7a12, 0xbfb3, 0x4fe8, { 0xb9, 0xa5, 0x48, 0xfd, 0x50, 0xa1, 0x5a, 0x9a } };

BOOLEAN PhGetProcessIsSuspended(

_In_ PSYSTEM_PROCESS_INFORMATION Process

)

{

ULONG i;

for (i = 0; i < Process->NumberOfThreads; i++)

{

if (

Process->Threads[i].ThreadState != Waiting ||

Process->Threads[i].WaitReason != Suspended

)

return FALSE;

}

return Process->NumberOfThreads != 0;

}

NTSTATUS PhGetProcessSwitchContext(

_In_ HANDLE ProcessHandle,

_Out_ PGUID Guid

)

{

NTSTATUS status;

PROCESS_BASIC_INFORMATION basicInfo;

#ifdef _WIN64

PVOID peb32;

ULONG data32;

PVOID data;

// Reverse-engineered from WdcGetProcessSwitchContext (wdc.dll).

// On Windows 8, the function is now SdbGetAppCompatData (apphelp.dll).

// On Windows 10, the function is again WdcGetProcessSwitchContext.

#ifdef _WIN64

if (NT_SUCCESS(PhGetProcessPeb32(ProcessHandle, &peb32)) && peb32)

{

if (WindowsVersion >= WINDOWS_8)

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(peb32, FIELD_OFFSET(PEB32, pShimData)),

&data32,

sizeof(ULONG),

NULL

)))

return status;

}

else

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(peb32, FIELD_OFFSET(PEB32, pContextData)),

&data32,

sizeof(ULONG),

NULL

)))

return status;

}

data = UlongToPtr(data32);

}

else

{

if (!NT_SUCCESS(status = PhGetProcessBasicInformation(ProcessHandle, &basicInfo)))

return status;

if (WindowsVersion >= WINDOWS_8)

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(basicInfo.PebBaseAddress, FIELD_OFFSET(PEB, pShimData)),

&data,

sizeof(PVOID),

NULL

)))

return status;

}

else

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(basicInfo.PebBaseAddress, FIELD_OFFSET(PEB, pContextData)),

&data,

sizeof(PVOID),

NULL

)))

return status;

}

#ifdef _WIN64

}

if (!data)

return STATUS_UNSUCCESSFUL; // no compatibility context data

if (WindowsVersion >= WINDOWS_10_RS2)

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(data, 1544),

Guid,

sizeof(GUID),

NULL

)))

return status;

}

else if (WindowsVersion >= WINDOWS_10)

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(data, 2040 + 24), // Magic value from SbReadProcContextByHandle

Guid,

sizeof(GUID),

NULL

)))

return status;

}

else if (WindowsVersion >= WINDOWS_8_1)

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(data, 2040 + 16), // Magic value from SbReadProcContextByHandle

Guid,

sizeof(GUID),

NULL

)))

return status;

}

else if (WindowsVersion >= WINDOWS_8)

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(data, 2040), // Magic value from SbReadProcContextByHandle

Guid,

sizeof(GUID),

NULL

)))

return status;

}

else

{

if (!NT_SUCCESS(status = NtReadVirtualMemory(

ProcessHandle,

PTR_ADD_OFFSET(data, 32), // Magic value from WdcGetProcessSwitchContext

Guid,

sizeof(GUID),

NULL

)))

return status;

}

return STATUS_SUCCESS;

}

PPH_STRING PhGetProcessPackageFullName(

_In_ HANDLE ProcessHandle

)

{

static _GetPackageFullName getPackageFullName = NULL;

LONG result;

PPH_STRING name;

ULONG nameLength;

if (!getPackageFullName)

getPackageFullName = PhGetModuleProcAddress(L"kernel32.dll", "GetPackageFullName");

if (!getPackageFullName)

return NULL;

nameLength = 101;

name = PhCreateStringEx(NULL, (nameLength - 1) * 2);

result = getPackageFullName(ProcessHandle, &nameLength, name->Buffer);

if (result == ERROR_INSUFFICIENT_BUFFER)

{

PhDereferenceObject(name);

name = PhCreateStringEx(NULL, (nameLength - 1) * 2);

result = getPackageFullName(ProcessHandle, &nameLength, name->Buffer);

}

if (result == ERROR_SUCCESS)

{

PhTrimToNullTerminatorString(name);

return name;

}

else

{

PhDereferenceObject(name);

return NULL;

}

}

PACKAGE_ID *PhPackageIdFromFullName(

_In_ PWSTR PackageFullName

)

{

static _PackageIdFromFullName packageIdFromFullName = NULL;

LONG result;

PVOID packageIdBuffer;

ULONG packageIdBufferSize;

if (!packageIdFromFullName)

packageIdFromFullName = PhGetModuleProcAddress(L"kernel32.dll", "PackageIdFromFullName");

if (!packageIdFromFullName)

return NULL;

packageIdBufferSize = 100;

packageIdBuffer = PhAllocate(packageIdBufferSize);

result = packageIdFromFullName(PackageFullName, PACKAGE_INFORMATION_BASIC, &packageIdBufferSize, (PBYTE)packageIdBuffer);

if (result == ERROR_INSUFFICIENT_BUFFER)

{

PhFree(packageIdBuffer);

packageIdBuffer = PhAllocate(packageIdBufferSize);

result = packageIdFromFullName(PackageFullName, PACKAGE_INFORMATION_BASIC, &packageIdBufferSize, (PBYTE)packageIdBuffer);

}

if (result == ERROR_SUCCESS)

{

return packageIdBuffer;

}

else

{

PhFree(packageIdBuffer);

return NULL;

}

}

PPH_STRING PhGetPackagePath(

_In_ PACKAGE_ID *PackageId

)

{

static _GetPackagePath getPackagePath = NULL;

LONG result;

PPH_STRING path;

ULONG pathLength;

if (!getPackagePath)

getPackagePath = PhGetModuleProcAddress(L"kernel32.dll", "GetPackagePath");

if (!getPackagePath)

return NULL;

pathLength = 101;

path = PhCreateStringEx(NULL, (pathLength - 1) * 2);

result = getPackagePath(PackageId, 0, &pathLength, path->Buffer);

if (result == ERROR_INSUFFICIENT_BUFFER)

{

PhDereferenceObject(path);

path = PhCreateStringEx(NULL, (pathLength - 1) * 2);

result = getPackagePath(PackageId, 0, &pathLength, path->Buffer);

}

if (result == ERROR_SUCCESS)

{

PhTrimToNullTerminatorString(path);

return path;

}

else

{

PhDereferenceObject(path);

return NULL;

}

}

NTSTATUS PhGetProcessKnownType(

_In_ HANDLE ProcessHandle,

_Out_ PH_KNOWN_PROCESS_TYPE *KnownProcessType

)

{

NTSTATUS status;

PH_KNOWN_PROCESS_TYPE knownProcessType;

PROCESS_BASIC_INFORMATION basicInfo;

PH_STRINGREF systemRootPrefix;

PPH_STRING fileName;

PPH_STRING newFileName;

PH_STRINGREF name;

#ifdef _WIN64

BOOLEAN isWow64 = FALSE;

if (!NT_SUCCESS(status = PhGetProcessBasicInformation(

ProcessHandle,

&basicInfo

)))

return status;

if (basicInfo.UniqueProcessId == SYSTEM_PROCESS_ID)

{

*KnownProcessType = SystemProcessType;

return STATUS_SUCCESS;

}

PhGetSystemRoot(&systemRootPrefix);

if (!NT_SUCCESS(status = PhGetProcessImageFileName(

ProcessHandle,

&fileName

)))

{

return status;

}

newFileName = PhGetFileName(fileName);

PhDereferenceObject(fileName);

name = newFileName->sr;

knownProcessType = UnknownProcessType;

if (PhStartsWithStringRef(&name, &systemRootPrefix, TRUE))

{

// Skip the system root, and we now have three cases:

// 1. \\xyz.exe - Windows executable.

// 2. \\System32\\xyz.exe - system32 executable.

// 3. \\SysWow64\\xyz.exe - system32 executable + WOW64.

PhSkipStringRef(&name, systemRootPrefix.Length);

if (PhEqualStringRef2(&name, L"\\explorer.exe", TRUE))

{

knownProcessType = ExplorerProcessType;

}

else if (

PhStartsWithStringRef2(&name, L"\\System32", TRUE)

#ifdef _WIN64

|| (PhStartsWithStringRef2(&name, L"\\SysWow64", TRUE) && (isWow64 = TRUE, TRUE)) // ugly but necessary

)

{

// SysTem32 and SysWow64 are both 8 characters long.

PhSkipStringRef(&name, 9 * sizeof(WCHAR));

if (FALSE)

; // Dummy

else if (PhEqualStringRef2(&name, L"\\smss.exe", TRUE))

knownProcessType = SessionManagerProcessType;

else if (PhEqualStringRef2(&name, L"\\csrss.exe", TRUE))

knownProcessType = WindowsSubsystemProcessType;

else if (PhEqualStringRef2(&name, L"\\wininit.exe", TRUE))

knownProcessType = WindowsStartupProcessType;

else if (PhEqualStringRef2(&name, L"\\services.exe", TRUE))

knownProcessType = ServiceControlManagerProcessType;

else if (PhEqualStringRef2(&name, L"\\lsass.exe", TRUE))

knownProcessType = LocalSecurityAuthorityProcessType;

else if (PhEqualStringRef2(&name, L"\\lsm.exe", TRUE))

knownProcessType = LocalSessionManagerProcessType;

else if (PhEqualStringRef2(&name, L"\\winlogon.exe", TRUE))

knownProcessType = WindowsLogonProcessType;

else if (PhEqualStringRef2(&name, L"\\svchost.exe", TRUE))

knownProcessType = ServiceHostProcessType;

else if (PhEqualStringRef2(&name, L"\\rundll32.exe", TRUE))

knownProcessType = RunDllAsAppProcessType;

else if (PhEqualStringRef2(&name, L"\\dllhost.exe", TRUE))

knownProcessType = ComSurrogateProcessType;

else if (PhEqualStringRef2(&name, L"\\taskeng.exe", TRUE))

knownProcessType = TaskHostProcessType;

else if (PhEqualStringRef2(&name, L"\\taskhost.exe", TRUE))

knownProcessType = TaskHostProcessType;

else if (PhEqualStringRef2(&name, L"\\taskhostex.exe", TRUE))

knownProcessType = TaskHostProcessType;

else if (PhEqualStringRef2(&name, L"\\taskhostw.exe", TRUE))

knownProcessType = TaskHostProcessType;

else if (PhEqualStringRef2(&name, L"\\wudfhost.exe", TRUE))

knownProcessType = UmdfHostProcessType;

}

}

PhDereferenceObject(newFileName);

#ifdef _WIN64

if (isWow64)

knownProcessType |= KnownProcessWow64;

*KnownProcessType = knownProcessType;

return status;

}

static BOOLEAN NTAPI PhpSvchostCommandLineCallback(

)

{

PPH_KNOWN_PROCESS_COMMAND_LINE knownCommandLine = Context;

if (Option && Option->Id == 1)

{

PhSwapReference(&knownCommandLine->ServiceHost.GroupName, Value);

}

return TRUE;

}

BOOLEAN PhaGetProcessKnownCommandLine(

)

{

switch (KnownProcessType & KnownProcessTypeMask)

{

case ServiceHostProcessType:

{

// svchost.exe -k <GroupName>

static PH_COMMAND_LINE_OPTION options[] =

{

{ 1, L"k", MandatoryArgumentType }

};

KnownCommandLine->ServiceHost.GroupName = NULL;

PhParseCommandLine(

&CommandLine->sr,

options,

sizeof(options) / sizeof(PH_COMMAND_LINE_OPTION),

PH_COMMAND_LINE_IGNORE_UNKNOWN_OPTIONS,

PhpSvchostCommandLineCallback,

KnownCommandLine

);

if (KnownCommandLine->ServiceHost.GroupName)

{

PH_AUTO(KnownCommandLine->ServiceHost.GroupName);

return TRUE;

}

else

{

return FALSE;

}

}

break;

case RunDllAsAppProcessType:

{

// rundll32.exe <DllName>,<ProcedureName> ...

SIZE_T i;

PH_STRINGREF dllNamePart;

PH_STRINGREF procedureNamePart;

PPH_STRING dllName;

PPH_STRING procedureName;

i = 0;

// Get the rundll32.exe part.

dllName = PhParseCommandLinePart(&CommandLine->sr, &i);

if (!dllName)

return FALSE;

PhDereferenceObject(dllName);

// Get the DLL name part.

while (i < CommandLine->Length / 2 && CommandLine->Buffer[i] == ' ')

i++;

dllName = PhParseCommandLinePart(&CommandLine->sr, &i);

if (!dllName)

return FALSE;

PH_AUTO(dllName);

// The procedure name begins after the last comma.

if (!PhSplitStringRefAtLastChar(&dllName->sr, ',', &dllNamePart, &procedureNamePart))

return FALSE;

dllName = PH_AUTO(PhCreateString2(&dllNamePart));

procedureName = PH_AUTO(PhCreateString2(&procedureNamePart));

// If the DLL name isn't an absolute path, assume it's in system32.

// TODO: Use a proper search function.

if (RtlDetermineDosPathNameType_U(dllName->Buffer) == RtlPathTypeRelative)

{

dllName = PhaConcatStrings(

3,

PH_AUTO_T(PH_STRING, PhGetSystemDirectory())->Buffer,

L"\\",

dllName->Buffer

);

}

KnownCommandLine->RunDllAsApp.FileName = dllName;

KnownCommandLine->RunDllAsApp.ProcedureName = procedureName;

}

break;

case ComSurrogateProcessType:

{

// dllhost.exe /processid:<Guid>

static PH_STRINGREF inprocServer32Name = PH_STRINGREF_INIT(L"InprocServer32");

SIZE_T i;

ULONG_PTR indexOfProcessId;

PPH_STRING argPart;

PPH_STRING guidString;

UNICODE_STRING guidStringUs;

GUID guid;

HANDLE rootKeyHandle;

HANDLE inprocServer32KeyHandle;

PPH_STRING fileName;

i = 0;

// Get the dllhost.exe part.

argPart = PhParseCommandLinePart(&CommandLine->sr, &i);

if (!argPart)

return FALSE;

PhDereferenceObject(argPart);

// Get the argument part.

while (i < (ULONG)CommandLine->Length / 2 && CommandLine->Buffer[i] == ' ')

i++;

argPart = PhParseCommandLinePart(&CommandLine->sr, &i);

if (!argPart)

return FALSE;

PH_AUTO(argPart);

// Find "/processid:"; the GUID is just after that.

_wcsupr(argPart->Buffer);

indexOfProcessId = PhFindStringInString(argPart, 0, L"/PROCESSID:");

if (indexOfProcessId == -1)

return FALSE;

guidString = PhaSubstring(

argPart,

indexOfProcessId + 11,

(ULONG)argPart->Length / 2 - indexOfProcessId - 11

);

PhStringRefToUnicodeString(&guidString->sr, &guidStringUs);

if (!NT_SUCCESS(RtlGUIDFromString(

&guidStringUs,

&guid

)))

return FALSE;

KnownCommandLine->ComSurrogate.Guid = guid;

KnownCommandLine->ComSurrogate.Name = NULL;

KnownCommandLine->ComSurrogate.FileName = NULL;

// Lookup the GUID in the registry to determine the name and file name.

if (NT_SUCCESS(PhOpenKey(

&rootKeyHandle,

KEY_READ,

PH_KEY_CLASSES_ROOT,

&PhaConcatStrings2(L"CLSID\\", guidString->Buffer)->sr,

0

)))

{

KnownCommandLine->ComSurrogate.Name =

PH_AUTO(PhQueryRegistryString(rootKeyHandle, NULL));

if (NT_SUCCESS(PhOpenKey(

&inprocServer32KeyHandle,

KEY_READ,

rootKeyHandle,

&inprocServer32Name,

0

)))

{

KnownCommandLine->ComSurrogate.FileName =

PH_AUTO(PhQueryRegistryString(inprocServer32KeyHandle, NULL));

if (fileName = PH_AUTO(PhExpandEnvironmentStrings(

&KnownCommandLine->ComSurrogate.FileName->sr

)))

{

KnownCommandLine->ComSurrogate.FileName = fileName;

}

NtClose(inprocServer32KeyHandle);

}

NtClose(rootKeyHandle);

}

else if (NT_SUCCESS(PhOpenKey(

&rootKeyHandle,

KEY_READ,

PH_KEY_CLASSES_ROOT,

&PhaConcatStrings2(L"AppID\\", guidString->Buffer)->sr,

0

)))

{

KnownCommandLine->ComSurrogate.Name =

PH_AUTO(PhQueryRegistryString(rootKeyHandle, NULL));

NtClose(rootKeyHandle);

}

}

break;

default:

return FALSE;

}

return TRUE;

}

VOID PhEnumChildWindows(

)

{

HWND childWindow = NULL;

ULONG i = 0;

while (i < Limit && (childWindow = FindWindowEx(WindowHandle, childWindow, NULL, NULL)))

{

if (!Callback(childWindow, Context))

return;

i++;

}

}

typedef struct _GET_PROCESS_MAIN_WINDOW_CONTEXT

} GET_PROCESS_MAIN_WINDOW_CONTEXT, *PGET_PROCESS_MAIN_WINDOW_CONTEXT;

BOOLEAN CALLBACK PhpGetProcessMainWindowEnumWindowsProc(

_In_ HWND WindowHandle,

_In_opt_ PVOID Context

)

{

PGET_PROCESS_MAIN_WINDOW_CONTEXT context = (PGET_PROCESS_MAIN_WINDOW_CONTEXT)Context;

ULONG processId;

HWND parentWindow;

WINDOWINFO windowInfo;

if (context->SkipInvisible && !IsWindowVisible(WindowHandle))

return TRUE;

GetWindowThreadProcessId(WindowHandle, &processId);

if (UlongToHandle(processId) == context->ProcessId && (context->SkipInvisible ?

!((parentWindow = GetParent(WindowHandle)) && IsWindowVisible(parentWindow)) && // skip windows with a visible parent

PhGetWindowTextEx(WindowHandle, PH_GET_WINDOW_TEXT_INTERNAL | PH_GET_WINDOW_TEXT_LENGTH_ONLY, NULL) != 0 : TRUE)) // skip windows with no title

{

if (!context->ImmersiveWindow && context->IsImmersive &&

GetProp(WindowHandle, L"Windows.ImmersiveShell.IdentifyAsMainCoreWindow"))

{

context->ImmersiveWindow = WindowHandle;

}

windowInfo.cbSize = sizeof(WINDOWINFO);

if (!context->Window && GetWindowInfo(WindowHandle, &windowInfo) && (windowInfo.dwStyle & WS_DLGFRAME))

{

context->Window = WindowHandle;

// If we're not looking at an immersive process, there's no need to search any more windows.

if (!context->IsImmersive)

return FALSE;

}

}

return TRUE;

}

HWND PhGetProcessMainWindow(

_In_ HANDLE ProcessId,

_In_opt_ HANDLE ProcessHandle

)

{

return PhGetProcessMainWindowEx(ProcessId, ProcessHandle, TRUE);

}

HWND PhGetProcessMainWindowEx(

)

{

GET_PROCESS_MAIN_WINDOW_CONTEXT context;

HANDLE processHandle = NULL;

memset(&context, 0, sizeof(GET_PROCESS_MAIN_WINDOW_CONTEXT));

context.ProcessId = ProcessId;

context.SkipInvisible = SkipInvisible;

if (ProcessHandle)

processHandle = ProcessHandle;

else

PhOpenProcess(&processHandle, ProcessQueryAccess, ProcessId);

if (processHandle && IsImmersiveProcess_I)

context.IsImmersive = IsImmersiveProcess_I(processHandle);

PhEnumChildWindows(NULL, 0x800, PhpGetProcessMainWindowEnumWindowsProc, &context);

if (!ProcessHandle && processHandle)

NtClose(processHandle);

return context.ImmersiveWindow ? context.ImmersiveWindow : context.Window;

}

PPH_STRING PhGetServiceRelevantFileName(

_In_ PPH_STRINGREF ServiceName,

_In_ SC_HANDLE ServiceHandle

)

{

PPH_STRING fileName = NULL;

LPQUERY_SERVICE_CONFIG config;

if (config = PhGetServiceConfig(ServiceHandle))

{

PhGetServiceDllParameter(ServiceName, &fileName);

if (!fileName)

{

PPH_STRING commandLine;

commandLine = PhCreateString(config->lpBinaryPathName);

if (config->dwServiceType & SERVICE_WIN32)

{

PH_STRINGREF dummyFileName;

PH_STRINGREF dummyArguments;

PhParseCommandLineFuzzy(&commandLine->sr, &dummyFileName, &dummyArguments, &fileName);

if (!fileName)

PhSwapReference(&fileName, commandLine);

}

else

{

fileName = PhGetFileName(commandLine);

}

PhDereferenceObject(commandLine);

}

PhFree(config);

}

return fileName;

}

PPH_STRING PhEscapeStringForDelimiter(

_In_ PPH_STRING String,

_In_ WCHAR Delimiter

)

{

PH_STRING_BUILDER stringBuilder;

SIZE_T length;

SIZE_T i;

WCHAR temp[2];

length = String->Length / 2;

PhInitializeStringBuilder(&stringBuilder, String->Length / 2 * 3);

temp[0] = '\\';

for (i = 0; i < length; i++)

{

if (String->Buffer[i] == '\\' || String->Buffer[i] == Delimiter)

{

temp[1] = String->Buffer[i];

PhAppendStringBuilderEx(&stringBuilder, temp, 4);

}

else

{

PhAppendCharStringBuilder(&stringBuilder, String->Buffer[i]);

}

}

return PhFinalStringBuilderString(&stringBuilder);

}

PPH_STRING PhUnescapeStringForDelimiter(

_In_ PPH_STRING String,

_In_ WCHAR Delimiter

)

{

PH_STRING_BUILDER stringBuilder;

SIZE_T length;

SIZE_T i;

length = String->Length / 2;

PhInitializeStringBuilder(&stringBuilder, String->Length / 2 * 3);

for (i = 0; i < length; i++)

{

if (String->Buffer[i] == '\\')

{

if (i != length - 1)

{

PhAppendCharStringBuilder(&stringBuilder, String->Buffer[i + 1]);

i++;

}

else

{

// Trailing backslash. Just ignore it.

break;

}

}

else

{

PhAppendCharStringBuilder(&stringBuilder, String->Buffer[i]);

}

}

return PhFinalStringBuilderString(&stringBuilder);

}

VOID PhSearchOnlineString(

_In_ HWND hWnd,

_In_ PWSTR String

)

{

PhShellExecuteUserString(hWnd, L"SearchEngine", String, TRUE, NULL);

}

VOID PhShellExecuteUserString(

)

{

static PH_STRINGREF replacementToken = PH_STRINGREF_INIT(L"%s");

PPH_STRING executeString;

PH_STRINGREF stringBefore;

PH_STRINGREF stringMiddle;

PH_STRINGREF stringAfter;

PPH_STRING ntMessage;

executeString = PhGetStringSetting(Setting);

// Expand environment strings.

PhMoveReference(&executeString, PhExpandEnvironmentStrings(&executeString->sr));

// Make sure the user executable string is absolute. We can't use RtlDetermineDosPathNameType_U

// here because the string may be a URL.

if (PhFindCharInString(executeString, 0, ':') == -1)

{

INT stringArgCount;

PWSTR* stringArgList;

// (dmex) HACK: Escape the individual executeString components.

if ((stringArgList = CommandLineToArgvW(executeString->Buffer, &stringArgCount)) && stringArgCount == 2)

{

PPH_STRING fileName = PhCreateString(stringArgList[0]);

PPH_STRING fileArgs = PhCreateString(stringArgList[1]);

// Make sure the string is absolute and escape the filename.

if (RtlDetermineDosPathNameType_U(fileName->Buffer) == RtlPathTypeRelative)

PhMoveReference(&fileName, PhConcatStrings(4, L"\"", PhApplicationDirectory->Buffer, fileName->Buffer, L"\""));

else

PhMoveReference(&fileName, PhConcatStrings(3, L"\"", fileName->Buffer, L"\""));

// Escape the parameters.

PhMoveReference(&fileArgs, PhConcatStrings(3, L"\"", fileArgs->Buffer, L"\""));

// Create the escaped execute string.

PhMoveReference(&executeString, PhConcatStrings(3, fileName->Buffer, L" ", fileArgs->Buffer));

PhDereferenceObject(fileArgs);

PhDereferenceObject(fileName);

LocalFree(stringArgList);

}

else

{

if (RtlDetermineDosPathNameType_U(executeString->Buffer) == RtlPathTypeRelative)

PhMoveReference(&executeString, PhConcatStrings(4, L"\"", PhApplicationDirectory->Buffer, executeString->Buffer, L"\""));

else

PhMoveReference(&executeString, PhConcatStrings(3, L"\"", executeString->Buffer, L"\""));

}

}

// Replace the token with the string, or use the original string if the token is not present.

if (PhSplitStringRefAtString(&executeString->sr, &replacementToken, FALSE, &stringBefore, &stringAfter))

{

PhInitializeStringRef(&stringMiddle, String);

PhMoveReference(&executeString, PhConcatStringRef3(&stringBefore, &stringMiddle, &stringAfter));

}