Windows: rewrite process enumeration around NtQuerySystemInformation

Cargo.toml

@@ -78,7 +78,7 @@ which         = "8"
 mach2         = "0.6.0"
 
 [target.'cfg(target_os = "windows")'.dependencies]
-windows-sys   = { version = "0.61", features = ["Win32_Foundation", "Win32_Networking_WinSock", "Win32_NetworkManagement_IpHelper", "Win32_Security", "Win32_System_Diagnostics_ToolHelp", "Win32_System_ProcessStatus", "Win32_System_Threading"] }
+windows-sys   = { version = "0.61", features = ["Win32_Foundation", "Win32_Networking_WinSock", "Win32_NetworkManagement_IpHelper", "Win32_Security", "Win32_System_Diagnostics_Debug", "Win32_System_LibraryLoader", "Win32_System_Threading"] }
 
 [target.'cfg(target_os = "freebsd")'.dependencies]
 bsd-kvm       = "0.1.5"

src/columns/gid.rs

@@ -1,6 +1,4 @@
 use crate::process::ProcessInfo;
-#[cfg(target_os = "windows")]
-use crate::util::format_sid;
 use crate::{column_default, Column};
 use std::cmp;
 use std::collections::HashMap;
@@ -64,17 +62,30 @@ impl Column for Gid {
 #[cfg(target_os = "windows")]
 impl Column for Gid {
     fn add(&mut self, proc: &ProcessInfo) {
-        let mut sid = &proc.groups[0].sid;
+        // A process whose token could not be opened - a protected process, or
+        // any process when procs is not elevated - has no group list. Render
+        // nothing rather than indexing a non-existent primary group.
+        let Some(primary) = proc.groups.first() else {
+            self.fmt_contents.insert(proc.pid, String::new());
+            self.raw_contents.insert(proc.pid, 0);
+            return;
+        };
+
+        let mut sid = primary;
         let mut kind = u64::MAX;
         for g in &proc.groups {
-            if g.sid.len() > 3 && g.sid[1] == 5 && g.sid[2] == 32 && kind > g.sid[3] {
-                sid = &g.sid;
-                kind = g.sid[3];
+            let subs = g.sub_authorities();
+            if g.authority() == 5
+                && subs.first() == Some(&32)
+                && u64::from(subs.get(1).copied().unwrap_or(u32::MAX)) < kind
+            {
+                sid = g;
+                kind = u64::from(subs[1]);
             }
         }
 
-        let fmt_content = format_sid(sid, self.abbr_sid);
-        let raw_content = sid[sid.len() - 1] as u32;
+        let fmt_content = sid.format(self.abbr_sid);
+        let raw_content = sid.sub_authorities().last().copied().unwrap_or(0);
 
         self.fmt_contents.insert(proc.pid, fmt_content);
         self.raw_contents.insert(proc.pid, raw_content);

src/columns/group.rs

@@ -1,6 +1,4 @@
 use crate::process::ProcessInfo;
-#[cfg(target_os = "windows")]
-use crate::util::format_sid;
 #[cfg(not(target_os = "windows"))]
 use crate::util::USERS_CACHE;
 use crate::{column_default, Column};
@@ -78,20 +76,31 @@ impl Column for Group {
 #[cfg(target_os = "windows")]
 impl Column for Group {
     fn add(&mut self, proc: &ProcessInfo) {
-        let mut sid_name = &proc.groups[0];
+        // A process whose token could not be opened - a protected process, or
+        // any process when procs is not elevated - has no group list. Render
+        // nothing rather than indexing a non-existent primary group.
+        let Some(primary) = proc.groups.first() else {
+            self.fmt_contents.insert(proc.pid, String::new());
+            self.raw_contents.insert(proc.pid, String::new());
+            return;
+        };
+
+        let mut sid = primary;
         let mut kind = u64::MAX;
         for g in &proc.groups {
-            if g.sid.len() > 3 && g.sid[1] == 5 && g.sid[2] == 32 && kind > g.sid[3] {
-                sid_name = g;
-                kind = g.sid[3];
+            let subs = g.sub_authorities();
+            if g.authority() == 5
+                && subs.first() == Some(&32)
+                && u64::from(subs.get(1).copied().unwrap_or(u32::MAX)) < kind
+            {
+                sid = g;
+                kind = u64::from(subs[1]);
             }
         }
 
-        let fmt_content = if let Some(name) = &sid_name.name {
-            name.clone()
-        } else {
-            format_sid(&sid_name.sid, self.abbr_sid)
-        };
+        let fmt_content = sid
+            .display_name()
+            .unwrap_or_else(|| sid.format(self.abbr_sid));
         let raw_content = fmt_content.clone();
 
         self.fmt_contents.insert(proc.pid, fmt_content);

src/columns/priority.rs

@@ -54,16 +54,11 @@ impl Column for Priority {
 #[cfg(target_os = "windows")]
 impl Column for Priority {
     fn add(&mut self, proc: &ProcessInfo) {
-        let raw_content = i64::from(proc.priority);
-        let fmt_content = match raw_content {
-            0x0020 => String::from("Normal"),
-            0x0040 => String::from("Idle"),
-            0x0080 => String::from("High"),
-            0x0100 => String::from("Realtime"),
-            0x4000 => String::from("BelowNormal"),
-            0x8000 => String::from("AboveNormal"),
-            _ => String::from("Unknown"),
-        };
+        // This is the kernel Base Priority, which is not the same as the user-mode priority class.
+        // To get the user-mode priority class, we would need GetPriorityClass / NtQueryInformationProcess syscall
+        // on the process handle, but that would require additional permissions and is not always available.
+        let raw_content = proc.priority as i64;
+        let fmt_content = format!("{raw_content}");
 
         self.fmt_contents.insert(proc.pid, fmt_content);
         self.raw_contents.insert(proc.pid, raw_content);

src/columns/uid.rs

@@ -1,6 +1,4 @@
 use crate::process::ProcessInfo;
-#[cfg(target_os = "windows")]
-use crate::util::format_sid;
 use crate::{column_default, Column};
 use std::cmp;
 use std::collections::HashMap;
@@ -64,8 +62,15 @@ impl Column for Uid {
 #[cfg(target_os = "windows")]
 impl Column for Uid {
     fn add(&mut self, proc: &ProcessInfo) {
-        let fmt_content = format_sid(&proc.user.sid, self.abbr_sid);
-        let raw_content = proc.user.sid[proc.user.sid.len() - 1] as u32;
+        let (fmt_content, raw_content) = if let Some(sid) = &proc.user {
+            let subs = sid.sub_authorities();
+            (
+                sid.format(self.abbr_sid),
+                subs.last().copied().unwrap_or(0),
+            )
+        } else {
+            (String::new(), 0)
+        };
 
         self.fmt_contents.insert(proc.pid, fmt_content);
         self.raw_contents.insert(proc.pid, raw_content);

src/columns/usage_mem.rs

@@ -5,9 +5,7 @@ use procfs::{Current, Meminfo, WithCurrentSystemInfo};
 use std::cmp;
 use std::collections::HashMap;
 #[cfg(target_os = "windows")]
-use std::mem::{size_of, zeroed};
-#[cfg(target_os = "windows")]
-use windows_sys::Win32::System::ProcessStatus::{GetPerformanceInfo, PERFORMANCE_INFORMATION};
+use windows_sys::Win32::System::SystemInformation::{GlobalMemoryStatusEx, MEMORYSTATUSEX};
 
 pub struct UsageMem {
     header: String,
@@ -64,11 +62,12 @@ fn get_mem_total() -> u64 {
 
 #[cfg(target_os = "windows")]
 fn get_mem_total() -> u64 {
-    let mut info: PERFORMANCE_INFORMATION = unsafe { zeroed() };
-    let ret = unsafe { GetPerformanceInfo(&mut info, size_of::<PERFORMANCE_INFORMATION>() as u32) };
+    let mut info: MEMORYSTATUSEX = Default::default();
+    info.dwLength = std::mem::size_of::<MEMORYSTATUSEX>() as u32;
+    let ret = unsafe { GlobalMemoryStatusEx(&mut info) };
 
     if ret != 0 {
-        info.PhysicalTotal as u64 * info.PageSize as u64
+        info.ullTotalPhys
     } else {
         0
     }

src/columns/user.rs

@@ -1,6 +1,4 @@
 use crate::process::ProcessInfo;
-#[cfg(target_os = "windows")]
-use crate::util::format_sid;
 #[cfg(not(target_os = "windows"))]
 use crate::util::USERS_CACHE;
 use crate::{column_default, Column};
@@ -74,10 +72,11 @@ impl Column for User {
 #[cfg(target_os = "windows")]
 impl Column for User {
     fn add(&mut self, proc: &ProcessInfo) {
-        let fmt_content = if let Some(name) = &proc.user.name {
-            name.clone()
+        let fmt_content = if let Some(sid) = &proc.user {
+            sid.display_name()
+                .unwrap_or_else(|| sid.format(self.abbr_sid))
         } else {
-            format_sid(&proc.user.sid, self.abbr_sid)
+            String::new()
         };
         let raw_content = fmt_content.clone();
 

src/process.rs

@@ -5,6 +5,8 @@ pub mod linux;
 #[cfg(target_os = "macos")]
 pub mod macos;
 #[cfg(target_os = "windows")]
+mod ntapi;
+#[cfg(target_os = "windows")]
 pub mod windows;
 
 #[cfg(target_os = "freebsd")]