kbe/whitemagic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix 32-bit thread context API selection in DllInjector

Browse Source 
Because DllInjector enforces matching host/target bitness, a 32-bit caller
always handles a 32-bit target. The correct API is native
GetThreadContext/SetThreadContext with Context32; the Wow64 APIs are only for
64-bit processes inspecting WOW64 targets, which never happens here.

- Collapse the 32-bit path to always use GetThreadContext/SetThreadContext.
- Remove the now-unused Wow64GetThreadContext/Wow64SetThreadContext
  declarations.
- Update Context32 doc comment to describe the x86 usage.
- ExternalReader access guard now also accepts QueryLimitedInformation.

Tests: 207 passing, 4 skipped.
This commit is contained in:
kbe
2026-07-22 02:31:32 +02:00
parent 286bb9cab1
commit eda467bc46
4 changed files with 14 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WhiteMagic/Injection/DllInjector.cs
+9 -22
View File
@@ -215,7 +215,7 @@ public sealed class DllInjector
{
IntPtr result;
if (Environment.Is64BitProcess)
if (_currentIs64Bit)
{
var originalContext = new Context64 { ContextFlags = ContextFlags.Amd64Full };
if (!NativeMethods.GetThreadContext(thread, ref originalContext))
@@ -264,32 +264,23 @@ public sealed class DllInjector
}
else
{
// 32-bit process on either a 32-bit or 64-bit (WOW64) host.
bool useWow64 = Environment.Is64BitOperatingSystem;
// 32-bit process targeting a 32-bit process. The target context is
// a native x86 CONTEXT; the WOW64 APIs are for 64-bit callers only.
var originalContext = new Context32 { ContextFlags = ContextFlags.X86Full };
bool gotContext = useWow64
? NativeMethods.Wow64GetThreadContext(thread, ref originalContext)
: NativeMethods.GetThreadContext(thread, ref originalContext);
if (!gotContext)
if (!NativeMethods.GetThreadContext(thread, ref originalContext))
{
int error = Marshal.GetLastPInvokeError();
string api = useWow64 ? "Wow64GetThreadContext" : "GetThreadContext";
throw new InvalidOperationException($"{api} failed (error {error}).");
throw new InvalidOperationException($"GetThreadContext failed (error {error}).");
}
var redirectContext = originalContext;
redirectContext.Eip = (uint)(nint)remoteBase;
redirectContext.Esp = (uint)(nint)stackTop;
bool setContext = useWow64
? NativeMethods.Wow64SetThreadContext(thread, ref redirectContext)
: NativeMethods.SetThreadContext(thread, ref redirectContext);
if (!setContext)
if (!NativeMethods.SetThreadContext(thread, ref redirectContext))
{
int error = Marshal.GetLastPInvokeError();
string api = useWow64 ? "Wow64SetThreadContext" : "SetThreadContext";
throw new InvalidOperationException($"{api} failed (error {error}).");
throw new InvalidOperationException($"SetThreadContext failed (error {error}).");
}
if (NativeMethods.ResumeThread(thread) == 0xFFFFFFFF)
@@ -306,14 +297,10 @@ public sealed class DllInjector
throw new InvalidOperationException($"SuspendThread failed while capturing result (error {error}).");
}
bool restoredContext = useWow64
? NativeMethods.Wow64SetThreadContext(thread, ref originalContext)
: NativeMethods.SetThreadContext(thread, ref originalContext);
if (!restoredContext)
if (!NativeMethods.SetThreadContext(thread, ref originalContext))
{
int error = Marshal.GetLastPInvokeError();
string api = useWow64 ? "Wow64SetThreadContext" : "SetThreadContext";
throw new InvalidOperationException($"{api} restore failed (error {error}).");
throw new InvalidOperationException($"SetThreadContext restore failed (error {error}).");
}
if (NativeMethods.ResumeThread(thread) == 0xFFFFFFFF)