Fix 32-bit host context APIs and ExternalReader bitness detection

- Add GetThreadContext/SetThreadContext overloads accepting Context32 so a
  32-bit process on a native 32-bit OS can capture x86 thread context.
- DllInjector.InjectWithThreadHijack now selects the context API based on
  both process bitness and OS bitness:
  * 64-bit process -> native 64-bit context
  * 32-bit process on 64-bit OS -> WOW64 context
  * 32-bit process on 32-bit OS -> native x86 context
- ExternalReader now validates that the caller supplied
  ProcessAccess.QueryInformation, and surfaces any IsWow64Process failure
  instead of silently falling back to host bitness.

Tests: 207 passing, 4 skipped.
This commit is contained in:
kbe
2026-07-22 02:24:06 +02:00
parent 1911514120
commit a34389fbba
4 changed files with 56 additions and 10 deletions
+9
View File
@@ -151,6 +151,15 @@ public class MemoryHardeningTests
Assert.False(reader.Handle.IsInvalid);
}
[Fact]
public void ExternalReader_throws_when_query_information_access_missing()
{
var ex = Assert.Throws<ArgumentException>(() =>
new ExternalReader(Process.GetCurrentProcess(), ProcessAccess.VmRead));
Assert.Equal("desiredAccess", ex.ParamName);
}
/// <summary>
/// A <see cref="MemoryBase"/> that serves bytes from an in-memory buffer and
/// caps every read to <c>maxChunk</c> bytes, to exercise partial-read handling.