From 90f133f202bc45708f7be48ff92428abd780cbcf Mon Sep 17 00:00:00 2001 From: YeDemirkiran Date: Mon, 22 Jun 2026 21:31:27 +0300 Subject: [PATCH 1/5] Add new column type "Short user name" --- SystemInformer/include/procprv.h | 1 + SystemInformer/include/proctree.h | 3 ++- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/SystemInformer/include/procprv.h b/SystemInformer/include/procprv.h index 572cedc4554a..5c70138aa33c 100644 --- a/SystemInformer/include/procprv.h +++ b/SystemInformer/include/procprv.h @@ -293,6 +293,7 @@ typedef struct _PH_PROCESS_ITEM PH_UINTPTR_DELTA PrivateBytesDelta; PPH_STRING PackageFullName; PPH_STRING UserName; + PPH_STRING ShortUserName; PROCESS_DISK_COUNTERS DiskCounters; PROCESS_NETWORK_COUNTERS NetworkCounters; diff --git a/SystemInformer/include/proctree.h b/SystemInformer/include/proctree.h index 963df2df529e..8da419183c8b 100644 --- a/SystemInformer/include/proctree.h +++ b/SystemInformer/include/proctree.h @@ -129,8 +129,9 @@ #define PHPRTLC_START_KEY 104 #define PHPRTLC_MITIGATION_POLICIES 105 #define PHPRTLC_SERVICES 106 +#define PHPRTLC_SHORT_USERNAME 107 -#define PHPRTLC_MAXIMUM 107 +#define PHPRTLC_MAXIMUM 108 #define PHPRTLC_IOGROUP_COUNT 9 #define PHPN_WSCOUNTERS 0x1 From 27093ccf4673e9f9614d0a4dc1a27e516f05c16d Mon Sep 17 00:00:00 2001 From: YeDemirkiran Date: Mon, 22 Jun 2026 21:31:58 +0300 Subject: [PATCH 2/5] Implement the new Short user name column --- SystemInformer/procprv.c | 1 + SystemInformer/proctree.c | 33 +++++++++++++++++++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/SystemInformer/procprv.c b/SystemInformer/procprv.c index 8c02225e8994..e41236cb1e20 100644 --- a/SystemInformer/procprv.c +++ b/SystemInformer/procprv.c @@ -448,6 +448,7 @@ VOID PhpProcessItemDeleteProcedure( if (processItem->VerifySignerName) PhDereferenceObject(processItem->VerifySignerName); if (processItem->PackageFullName) PhDereferenceObject(processItem->PackageFullName); if (processItem->UserName) PhDereferenceObject(processItem->UserName); + if (processItem->ShortUserName) PhDereferenceObject(processItem->ShortUserName); if (!PhSystemProcessorInformation.SingleProcessorGroup) { diff --git a/SystemInformer/proctree.c b/SystemInformer/proctree.c index 7d48bf4be8c0..1c0dea165d8e 100644 --- a/SystemInformer/proctree.c +++ b/SystemInformer/proctree.c @@ -233,6 +233,7 @@ VOID PhInitializeProcessTreeList( PhAddTreeNewColumn(hwnd, PHPRTLC_START_KEY, FALSE, L"Start key", 120, PH_ALIGN_LEFT, ULONG_MAX, 0); PhAddTreeNewColumn(hwnd, PHPRTLC_MITIGATION_POLICIES, FALSE, L"Mitigation policies", 180, PH_ALIGN_LEFT, ULONG_MAX, 0); PhAddTreeNewColumn(hwnd, PHPRTLC_SERVICES, FALSE, L"Services", 180, PH_ALIGN_LEFT, ULONG_MAX, 0); + PhAddTreeNewColumn(hwnd, PHPRTLC_SHORT_USERNAME, FALSE, L"Short user name", 140, PH_ALIGN_LEFT, ULONG_MAX, 0); PhCmInitializeManager(&ProcessTreeListCm, hwnd, PHPRTLC_MAXIMUM, PhpProcessTreeNewPostSortFunction); PhInitializeTreeNewFilterSupport(&FilterSupport, hwnd, ProcessNodeList); @@ -2976,6 +2977,17 @@ BEGIN_SORT_FUNCTION(Services) } END_SORT_FUNCTION +BEGIN_SORT_FUNCTION(ShortUserName) +{ + sortResult = PhCompareStringWithNullSortOrder( + processItem1->ShortUserName, + processItem2->ShortUserName, + ProcessTreeListSortOrder, + TRUE + ); +} +END_SORT_FUNCTION + BOOLEAN NTAPI PhpProcessTreeNewCallback( _In_ HWND hwnd, _In_ PH_TREENEW_MESSAGE Message, @@ -3163,6 +3175,7 @@ BOOLEAN NTAPI PhpProcessTreeNewCallback( SORT_FUNCTION(StartKey), SORT_FUNCTION(MitigationPolicies), SORT_FUNCTION(Services), + SORT_FUNCTION(ShortUserName), }; _CoreCrtNonSecureSearchSortCompareFunction sortFunction; @@ -4698,6 +4711,26 @@ BOOLEAN NTAPI PhpProcessTreeNewCallback( } } break; + case PHPRTLC_SHORT_USERNAME: + { + if (processItem->ShortUserName) + { + PhDereferenceObject(processItem->ShortUserName); + } + if (processItem->UserName) + { + wchar_t* backslash = wcsrchr(processItem->UserName->Buffer, L'\\'); + if (backslash) + processItem->ShortUserName = PhCreateString(backslash + 1); + else + processItem->ShortUserName = PhCreateString(processItem->UserName->Buffer); + } + if (processItem->ShortUserName) + { + getCellText->Text = PhGetStringRef(processItem->ShortUserName); + } + } + break; default: return FALSE; } From f2213c1060a92d076f40eb7f0e7319b1c70494ad Mon Sep 17 00:00:00 2001 From: YeDemirkiran Date: Mon, 22 Jun 2026 21:41:00 +0300 Subject: [PATCH 3/5] Allocate ShortUserName only once --- SystemInformer/proctree.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/SystemInformer/proctree.c b/SystemInformer/proctree.c index 1c0dea165d8e..eab2315ac9cb 100644 --- a/SystemInformer/proctree.c +++ b/SystemInformer/proctree.c @@ -4713,11 +4713,7 @@ BOOLEAN NTAPI PhpProcessTreeNewCallback( break; case PHPRTLC_SHORT_USERNAME: { - if (processItem->ShortUserName) - { - PhDereferenceObject(processItem->ShortUserName); - } - if (processItem->UserName) + if (!processItem->ShortUserName && processItem->UserName) { wchar_t* backslash = wcsrchr(processItem->UserName->Buffer, L'\\'); if (backslash) From 4737b546b70412f083af4a90a1d44dc0130de7f3 Mon Sep 17 00:00:00 2001 From: YeDemirkiran Date: Tue, 23 Jun 2026 15:19:41 +0300 Subject: [PATCH 4/5] Add Short username column update function - Move ShortUsername from PH_PROCESS_ITEM to PH_PROCESS_NODE - Add the PHPN_SHORTUSERNAME flag and PhpUpdateProcessNodeShortUsername function to update the short username text properly - Call the new update function from the sort function and render function --- SystemInformer/include/procprv.h | 1 - SystemInformer/include/proctree.h | 2 ++ SystemInformer/procprv.c | 1 - SystemInformer/proctree.c | 41 ++++++++++++++++++++++--------- 4 files changed, 31 insertions(+), 14 deletions(-) diff --git a/SystemInformer/include/procprv.h b/SystemInformer/include/procprv.h index 5c70138aa33c..572cedc4554a 100644 --- a/SystemInformer/include/procprv.h +++ b/SystemInformer/include/procprv.h @@ -293,7 +293,6 @@ typedef struct _PH_PROCESS_ITEM PH_UINTPTR_DELTA PrivateBytesDelta; PPH_STRING PackageFullName; PPH_STRING UserName; - PPH_STRING ShortUserName; PROCESS_DISK_COUNTERS DiskCounters; PROCESS_NETWORK_COUNTERS NetworkCounters; diff --git a/SystemInformer/include/proctree.h b/SystemInformer/include/proctree.h index 8da419183c8b..6fba93925e2f 100644 --- a/SystemInformer/include/proctree.h +++ b/SystemInformer/include/proctree.h @@ -160,6 +160,7 @@ #define PHPN_STARTKEY 0x800000 #define PHPN_SERVICES 0x1000000 #define PHPN_USERHANDLES 0x2000000 +#define PHPN_SHORTUSERNAME 0x4000000 // begin_phapppub typedef struct _PH_PROCESS_NODE @@ -310,6 +311,7 @@ typedef struct _PH_PROCESS_NODE PPH_STRING MitigationPoliciesText; PPH_STRING ServicesText; PPH_STRING ServerSiloText; + PPH_STRING ShortUsernameText; // Graph buffers PH_GRAPH_BUFFERS CpuGraphBuffers; diff --git a/SystemInformer/procprv.c b/SystemInformer/procprv.c index e41236cb1e20..8c02225e8994 100644 --- a/SystemInformer/procprv.c +++ b/SystemInformer/procprv.c @@ -448,7 +448,6 @@ VOID PhpProcessItemDeleteProcedure( if (processItem->VerifySignerName) PhDereferenceObject(processItem->VerifySignerName); if (processItem->PackageFullName) PhDereferenceObject(processItem->PackageFullName); if (processItem->UserName) PhDereferenceObject(processItem->UserName); - if (processItem->ShortUserName) PhDereferenceObject(processItem->ShortUserName); if (!PhSystemProcessorInformation.SingleProcessorGroup) { diff --git a/SystemInformer/proctree.c b/SystemInformer/proctree.c index eab2315ac9cb..497b6b930c12 100644 --- a/SystemInformer/proctree.c +++ b/SystemInformer/proctree.c @@ -1911,6 +1911,27 @@ static VOID PhpUpdateProcessNodeServices( } } +static VOID PhpUpdateProcessNodeShortUsername( + _Inout_ PPH_PROCESS_NODE ProcessNode +) +{ + if (!FlagOn(ProcessNode->ValidMask, PHPN_SHORTUSERNAME)) + { + PhClearReference(&ProcessNode->ShortUsernameText); + + if (ProcessNode->ProcessItem->UserName) + { + wchar_t* backslash = wcsrchr(ProcessNode->ProcessItem->UserName->Buffer, L'\\'); + if (backslash) + ProcessNode->ShortUsernameText = PhCreateString(backslash + 1); + else + ProcessNode->ShortUsernameText = PhCreateString(ProcessNode->ProcessItem->UserName->Buffer); + } + + SetFlag(ProcessNode->ValidMask, PHPN_SHORTUSERNAME); + } +} + #define SORT_FUNCTION(Column) PhpProcessTreeNewCompare##Column #define BEGIN_SORT_FUNCTION(Column) static int __cdecl PhpProcessTreeNewCompare##Column( \ _In_ const void *_elem1, \ @@ -2979,9 +3000,11 @@ END_SORT_FUNCTION BEGIN_SORT_FUNCTION(ShortUserName) { + PhpUpdateProcessNodeShortUsername(node1); + PhpUpdateProcessNodeShortUsername(node2); sortResult = PhCompareStringWithNullSortOrder( - processItem1->ShortUserName, - processItem2->ShortUserName, + node1->ShortUsernameText, + node2->ShortUsernameText, ProcessTreeListSortOrder, TRUE ); @@ -4713,17 +4736,11 @@ BOOLEAN NTAPI PhpProcessTreeNewCallback( break; case PHPRTLC_SHORT_USERNAME: { - if (!processItem->ShortUserName && processItem->UserName) - { - wchar_t* backslash = wcsrchr(processItem->UserName->Buffer, L'\\'); - if (backslash) - processItem->ShortUserName = PhCreateString(backslash + 1); - else - processItem->ShortUserName = PhCreateString(processItem->UserName->Buffer); - } - if (processItem->ShortUserName) + PhpUpdateProcessNodeShortUsername(node); + + if (node->ShortUsernameText) { - getCellText->Text = PhGetStringRef(processItem->ShortUserName); + getCellText->Text = PhGetStringRef(node->ShortUsernameText); } } break; From 1a9cbab337a147dd141dd06277b7d9fa22527d0a Mon Sep 17 00:00:00 2001 From: YeDemirkiran Date: Thu, 25 Jun 2026 15:23:17 +0300 Subject: [PATCH 5/5] Free ShortUsernameText upon node removal --- SystemInformer/proctree.c | 1 + 1 file changed, 1 insertion(+) diff --git a/SystemInformer/proctree.c b/SystemInformer/proctree.c index 497b6b930c12..02137c0a3bb4 100644 --- a/SystemInformer/proctree.c +++ b/SystemInformer/proctree.c @@ -694,6 +694,7 @@ VOID PhpRemoveProcessNode( PhClearReference(&ProcessNode->ProcessStartKeyText); PhClearReference(&ProcessNode->MitigationPoliciesText); PhClearReference(&ProcessNode->ServicesText); + PhClearReference(&ProcessNode->ShortUsernameText); PhDeleteGraphBuffers(&ProcessNode->CpuGraphBuffers); PhDeleteGraphBuffers(&ProcessNode->PrivateGraphBuffers);