@@ -1125,7 +1125,7 @@ VOID PhpFillProcessItem(
1125
1125
// Process information
1126
1126
{
1127
1127
// If we're dealing with System (PID 4), we need to get the
1128
- // kernel file name. Otherwise, get the image file name.
1128
+ // kernel file name. Otherwise, get the image file name. (wj32)
1129
1129
1130
1130
if (ProcessItem -> ProcessId != SYSTEM_PROCESS_ID )
1131
1131
{
@@ -1201,7 +1201,7 @@ VOID PhpFillProcessItem(
1201
1201
else
1202
1202
{
1203
1203
if (ProcessItem -> ProcessId == SYSTEM_IDLE_PROCESS_ID ||
1204
- ProcessItem -> ProcessId == SYSTEM_PROCESS_ID ) // System token can't be opened on XP
1204
+ ProcessItem -> ProcessId == SYSTEM_PROCESS_ID ) // System token can't be opened on XP (wj32)
1205
1205
{
1206
1206
ProcessItem -> Sid = PhAllocateCopy (& PhSeLocalSystemSid , RtlLengthSid (& PhSeLocalSystemSid ));
1207
1207
}
@@ -1229,15 +1229,15 @@ VOID PhpFillProcessItem(
1229
1229
}
1230
1230
else
1231
1231
{
1232
- // HACK: 'emulate' the PS_PROTECTION info for older OSes.
1232
+ // HACK: 'emulate' the PS_PROTECTION info for older OSes. (ge0rdi)
1233
1233
if (ProcessItem -> IsProtectedProcess )
1234
1234
ProcessItem -> Protection .Type = PsProtectedTypeProtected ;
1235
1235
}
1236
1236
}
1237
1237
else
1238
1238
{
1239
1239
// Signalize that we weren't able to get protection info with a special value.
1240
- // Note: We use this value to determine if we should show protection information.
1240
+ // Note: We use this value to determine if we should show protection information. (ge0rdi)
1241
1241
ProcessItem -> Protection .Level = UCHAR_MAX ;
1242
1242
}
1243
1243
@@ -1253,7 +1253,7 @@ VOID PhpFillProcessItem(
1253
1253
}
1254
1254
1255
1255
// On Windows 8.1 and above, processes without threads are reflected processes
1256
- // which will not terminate if we have a handle open.
1256
+ // which will not terminate if we have a handle open. (wj32)
1257
1257
if (Process -> NumberOfThreads == 0 && ProcessItem -> QueryHandle )
1258
1258
{
1259
1259
NtClose (ProcessItem -> QueryHandle );
0 commit comments