kbe/whitemagic
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix 32-bit thread context API selection in DllInjector

Browse Source 
Because DllInjector enforces matching host/target bitness, a 32-bit caller
always handles a 32-bit target. The correct API is native
GetThreadContext/SetThreadContext with Context32; the Wow64 APIs are only for
64-bit processes inspecting WOW64 targets, which never happens here.

- Collapse the 32-bit path to always use GetThreadContext/SetThreadContext.
- Remove the now-unused Wow64GetThreadContext/Wow64SetThreadContext
  declarations.
- Update Context32 doc comment to describe the x86 usage.
- ExternalReader access guard now also accepts QueryLimitedInformation.

Tests: 207 passing, 4 skipped.
This commit is contained in:
kbe
2026-07-22 02:31:32 +02:00
parent 286bb9cab1
commit eda467bc46
4 changed files with 14 additions and 39 deletions
Download Patch File Download Diff File Expand all files Collapse all files
WhiteMagic/Native/NativeStructures.cs
+2 -2
View File
@@ -29,8 +29,8 @@ public unsafe struct FloatingSaveArea32
}
/// <summary>
/// A 32-bit (x86/WOW64) thread context. Use it with
/// <c>Wow64GetThreadContext</c> and <c>Wow64SetThreadContext</c> to inspect a 32-bit thread.
/// A 32-bit x86 thread context. Use it with <c>GetThreadContext</c> and
/// <c>SetThreadContext</c> from a 32-bit process targeting a 32-bit thread.
/// The total size is 716 bytes.
/// </summary>
[StructLayout(LayoutKind.Sequential)]