Windows port follow-ups: real argv, single-call enumeration, real state, robustness - #76
Merged
Merged
Conversation
The Command Line column fell back to the image path. Read the target's RTL_USER_PROCESS_PARAMETERS.CommandLine (a documented member, reached via NtQueryInformationProcess + ReadProcessMemory, same as the env read) and use it for command_line; a best-effort PROCESS_VM_READ handle keeps a read failure from costing the basic details, and get_all_processes still falls back to the image path when it comes up empty. Closes #72 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xodto1bRjCSGEzLuz3JFbV
- get_username_for_pid cached the LookupAccountSid result even when it failed (empty string), permanently poisoning that SID's name after one transient failure. Only cache a non-empty result. - get_libraries used a fixed HMODULE[1024] and silently dropped modules from a process that loads more. Size the buffer from EnumProcessModulesEx's reported need and re-query if it exceeds the initial array. Closes #75 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xodto1bRjCSGEzLuz3JFbV
get_all_processes took a Toolhelp snapshot and then opened a handle per process for ~6 more calls (times/memory/IO/path/token/priority) every tick — the dominant CPU cost of the port. Replace it with a single NtQuerySystemInformation(SystemProcessInformation) call that returns every process's name/pid/ppid/threads/times/working-set/IO and per-thread state in one buffer; no per-process handle for those fields. - Per-process state is now derived from the threads' KTHREAD_STATE / KWAIT_REASON (Running / Suspended / Sleeping) instead of hardcoded 'R'. - The immutable strings (user, exe path, command line) are fetched once per process instance and cached, keyed by pid and validated by creation time, so steady state opens no per-process handle at all. - priority now reflects the base scheduling priority (comparable to the Unix priority column) rather than the Win32 priority class. Uses fully-specified SYSTEM_PROCESS_INFORMATION / SYSTEM_THREAD_INFORMATION structs (winternl's are reserved-padded); natural x64 alignment matches the kernel layout. Compile-verified via CI; needs runtime validation. Closes #73 Closes #74 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xodto1bRjCSGEzLuz3JFbV
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Windows follow-ups I flagged when closing #43. Needs runtime validation on a Windows host before merge — W2/W3 use a hand-specified kernel struct layout that CI only compiles, not verifies.
RTL_USER_PROCESS_PARAMETERS.CommandLinefrom the PEB instead of falling back to the image path. Closes Windows: show the real command line (argv) instead of the image path #72.NtQuerySystemInformation(SystemProcessInformation)for name/pid/ppid/threads/times/memory/IO; immutable strings (user/exe/cmdline) cached per (pid, creation-time) so steady state opens no per-process handle. This is the fix for the per-tick Windows CPU cost. Closes Windows: enumerate processes in one NtQuerySystemInformation call #73.KTHREAD_STATE/KWAIT_REASONinstead of hardcodingR. Closes Windows: report real per-process state instead of always 'Running' #74.LookupAccountSidfailure; don't silently truncate the library list at 1024 modules. Closes Windows: detail-provider robustness (username cache, library module cap) #75.What to validate on Windows
SYSTEM_PROCESS_INFORMATIONoffsets are off and I'll fix them).R); a suspended app (e.g. a minimized Store app) readsT.All CI jobs green on the branch (incl. Windows compile). Do not merge until the above is confirmed.
🤖 Generated with Claude Code
https://claude.ai/code/session_01Xodto1bRjCSGEzLuz3JFbV