Implement core diagnostic memory layer, execution helpers, and high-level facade slices
Implemented: - Core: UTF-16 ReadString boundary/alignment fix, target bitness and process id on MemoryBase - function interception: PatchManager, DetourManager, InstructionAnalyzer, MainThreadDispatcher - Execution: BackgroundTaskExecutor, InProcessInvoker - High-level: Magic facade, RemotePointer, async wrappers - Discovery/external code loading/Window groundwork (PEB/TEB, pattern scanning, raw allocations, DLL external code loading, window/input) Tests: 180 passing, 4 integration/interactive tests skipped.
This commit is contained in:
@@ -33,6 +33,28 @@ public enum ProcessAccess : uint
|
||||
AllAccess = 0x001F0000 | Synchronize | 0xFFFF,
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Access rights that open a thread object.
|
||||
/// </summary>
|
||||
[Flags]
|
||||
public enum ThreadAccess : uint
|
||||
{
|
||||
/// <summary>The right to terminate the thread with TerminateThread.</summary>
|
||||
Terminate = 0x0001,
|
||||
/// <summary>The right to suspend and resume the thread.</summary>
|
||||
SuspendResume = 0x0002,
|
||||
/// <summary>The right to read the thread context with GetThreadContext.</summary>
|
||||
GetContext = 0x0008,
|
||||
/// <summary>The right to set the thread context with SetThreadContext.</summary>
|
||||
SetContext = 0x0010,
|
||||
/// <summary>The right to query information from the thread.</summary>
|
||||
QueryInformation = 0x0040,
|
||||
/// <summary>The right to set information on the thread.</summary>
|
||||
SetInformation = 0x0020,
|
||||
/// <summary>All access rights for a thread object.</summary>
|
||||
AllAccess = 0x001F0FFF,
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Values that control how VirtualAllocEx allocates memory.
|
||||
/// </summary>
|
||||
|
||||
@@ -19,11 +19,32 @@ internal static partial class NativeMethods
|
||||
[MarshalAs(UnmanagedType.Bool)] bool inheritHandle,
|
||||
int processId);
|
||||
|
||||
/// <summary>Opens an existing thread and returns a handle to it.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
internal static partial SafeMemoryHandle OpenThread(
|
||||
ThreadAccess desiredAccess,
|
||||
[MarshalAs(UnmanagedType.Bool)] bool inheritHandle,
|
||||
int threadId);
|
||||
|
||||
/// <summary>Closes an open object handle.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool CloseHandle(IntPtr handle);
|
||||
|
||||
/// <summary>Determines whether the specified process is running under WOW64.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool IsWow64Process(
|
||||
SafeMemoryHandle process,
|
||||
[MarshalAs(UnmanagedType.Bool)] out bool wow64Process);
|
||||
|
||||
/// <summary>Retrieves the termination status of the specified thread.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool GetExitCodeThread(
|
||||
SafeMemoryHandle thread,
|
||||
out uint exitCode);
|
||||
|
||||
// ── Memory ───────────────────────────────────────────────────────────────
|
||||
|
||||
/// <summary>Reads memory from a process.</summary>
|
||||
@@ -87,6 +108,22 @@ internal static partial class NativeMethods
|
||||
ThreadCreationFlags creationFlags,
|
||||
out uint threadId);
|
||||
|
||||
/// <summary>Suspends the specified thread.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
internal static partial uint SuspendThread(SafeMemoryHandle thread);
|
||||
|
||||
/// <summary>Resumes the specified thread.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
internal static partial uint ResumeThread(SafeMemoryHandle thread);
|
||||
|
||||
/// <summary>Returns the thread identifier of the specified thread.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
internal static partial uint GetThreadId(SafeMemoryHandle thread);
|
||||
|
||||
/// <summary>Returns the identifier of the calling thread.</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
internal static partial uint GetCurrentThreadId();
|
||||
|
||||
/// <summary>Sets a 64-bit thread context (AMD64).</summary>
|
||||
[LibraryImport("kernel32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
@@ -134,4 +171,5 @@ internal static partial class NativeMethods
|
||||
internal static partial uint WaitForSingleObject(
|
||||
SafeMemoryHandle handle,
|
||||
uint milliseconds);
|
||||
|
||||
}
|
||||
|
||||
@@ -0,0 +1,178 @@
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace WhiteMagic.Native;
|
||||
|
||||
/// <summary>
|
||||
/// P/Invoke declarations for kernel32/ntdll/user32 APIs used by the high-level
|
||||
/// PEB, TEB, windowing, and input helpers. These live in a separate partial file so
|
||||
/// they can evolve independently of <see cref="NativeMethods"/>.
|
||||
/// </summary>
|
||||
internal static partial class NativeMethods
|
||||
{
|
||||
// ── Natives used directly by public helpers ──────────────────────────────
|
||||
|
||||
/// <summary>Queries information about the specified process.</summary>
|
||||
[LibraryImport("ntdll.dll")]
|
||||
internal static partial int NtQueryInformationProcess(
|
||||
SafeMemoryHandle processHandle,
|
||||
int processInformationClass,
|
||||
ref ProcessBasicInformation processInformation,
|
||||
uint processInformationLength,
|
||||
out uint returnLength);
|
||||
|
||||
/// <summary>Queries information about the specified thread.</summary>
|
||||
[LibraryImport("ntdll.dll")]
|
||||
internal static partial int NtQueryInformationThread(
|
||||
SafeMemoryHandle threadHandle,
|
||||
int threadInformationClass,
|
||||
ref ThreadBasicInformation threadInformation,
|
||||
uint threadInformationLength,
|
||||
out uint returnLength);
|
||||
|
||||
/// <summary>Enumerates all top-level windows on the screen.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
internal static partial int EnumWindows(
|
||||
nint lpEnumFunc,
|
||||
IntPtr lParam);
|
||||
|
||||
/// <summary>Retrieves the identifier of the thread that created the window and the process id of the window.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
internal static partial uint GetWindowThreadProcessId(
|
||||
IntPtr hWnd,
|
||||
out uint lpdwProcessId);
|
||||
|
||||
/// <summary>Retrieves the name of the class to which the specified window belongs.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
|
||||
internal static partial int GetClassNameW(
|
||||
IntPtr hWnd,
|
||||
[Out] char[] lpClassName,
|
||||
int nMaxCount);
|
||||
|
||||
/// <summary>Copies the text of the specified window's title bar into a buffer.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
|
||||
internal static partial int GetWindowTextW(
|
||||
IntPtr hWnd,
|
||||
[Out] char[] lpString,
|
||||
int nMaxCount);
|
||||
|
||||
/// <summary>Changes the text of the specified window's title bar.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true, StringMarshalling = StringMarshalling.Utf16)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool SetWindowTextW(
|
||||
IntPtr hWnd,
|
||||
string lpString);
|
||||
|
||||
/// <summary>Changes the size, position, and Z order of a child, pop-up, or top-level window.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool SetWindowPos(
|
||||
IntPtr hWnd,
|
||||
IntPtr hWndInsertAfter,
|
||||
int x,
|
||||
int y,
|
||||
int cx,
|
||||
int cy,
|
||||
uint uFlags);
|
||||
|
||||
/// <summary>Retrieves a handle to the foreground window.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
internal static partial IntPtr GetForegroundWindow();
|
||||
|
||||
/// <summary>Brings the thread that created the specified window into the foreground and activates the window.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool SetForegroundWindow(IntPtr hWnd);
|
||||
|
||||
/// <summary>Flashes the specified window.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool FlashWindowEx(ref FlashWindowInfo pwfi);
|
||||
|
||||
/// <summary>Attaches or detaches the input processing mechanism of one thread to that of another thread.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool AttachThreadInput(
|
||||
uint idAttach,
|
||||
uint idAttachTo,
|
||||
[MarshalAs(UnmanagedType.Bool)] bool fAttach);
|
||||
|
||||
/// <summary>Places a message in the message queue associated with the thread that created the specified window.</summary>
|
||||
[LibraryImport("user32.dll", SetLastError = true)]
|
||||
[return: MarshalAs(UnmanagedType.Bool)]
|
||||
internal static partial bool PostMessageW(
|
||||
IntPtr hWnd,
|
||||
uint msg,
|
||||
nuint wParam,
|
||||
nint lParam);
|
||||
|
||||
// ── Window / input constants ───────────────────────────────────────────────
|
||||
|
||||
internal const uint WmChar = 0x0102;
|
||||
internal const uint WmLButtonDown = 0x0201;
|
||||
internal const uint WmLButtonUp = 0x0202;
|
||||
internal const uint WmRButtonDown = 0x0204;
|
||||
internal const uint WmRButtonUp = 0x0205;
|
||||
|
||||
internal static readonly IntPtr HwndTop = IntPtr.Zero;
|
||||
|
||||
internal const uint SwpShowWindow = 0x0040;
|
||||
internal const uint SwpNoActivate = 0x0010;
|
||||
|
||||
internal const uint FlashwAll = 0x00000003;
|
||||
internal const uint FlashwCaption = 0x00000001;
|
||||
internal const uint FlashwTray = 0x00000002;
|
||||
internal const uint FlashwTimer = 0x00000004;
|
||||
internal const uint FlashwTimerNoFg = 0x0000000C;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Layout matches <c>PROCESS_BASIC_INFORMATION</c> (ProcessBasicInformation = 0).
|
||||
/// </summary>
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
internal struct ProcessBasicInformation
|
||||
{
|
||||
public int ExitStatus;
|
||||
public IntPtr PebBaseAddress;
|
||||
public UIntPtr AffinityMask;
|
||||
public int BasePriority;
|
||||
public UIntPtr UniqueProcessId;
|
||||
public UIntPtr InheritedFromUniqueProcessId;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Layout matches <c>THREAD_BASIC_INFORMATION</c> (ThreadBasicInformation = 0).
|
||||
/// </summary>
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
internal struct ThreadBasicInformation
|
||||
{
|
||||
public int ExitStatus;
|
||||
public IntPtr TebBaseAddress;
|
||||
public ClientId ClientId;
|
||||
public UIntPtr AffinityMask;
|
||||
public int Priority;
|
||||
public int BasePriority;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Layout matches <c>CLIENT_ID</c>.
|
||||
/// </summary>
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
internal struct ClientId
|
||||
{
|
||||
public IntPtr UniqueProcess;
|
||||
public IntPtr UniqueThread;
|
||||
}
|
||||
|
||||
/// <summary>
|
||||
/// Layout matches <c>FLASHWINFO</c> used by <see cref="NativeMethods.FlashWindowEx"/>.
|
||||
/// </summary>
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
internal struct FlashWindowInfo
|
||||
{
|
||||
public uint cbSize;
|
||||
public IntPtr hwnd;
|
||||
public uint dwFlags;
|
||||
public uint uCount;
|
||||
public uint dwTimeout;
|
||||
}
|
||||
Reference in New Issue
Block a user