kbe
eda467bc46
Because DllInjector enforces matching host/target bitness, a 32-bit caller always handles a 32-bit target. The correct API is native GetThreadContext/SetThreadContext with Context32; the Wow64 APIs are only for 64-bit processes inspecting WOW64 targets, which never happens here. - Collapse the 32-bit path to always use GetThreadContext/SetThreadContext. - Remove the now-unused Wow64GetThreadContext/Wow64SetThreadContext declarations. - Update Context32 doc comment to describe the x86 usage. - ExternalReader access guard now also accepts QueryLimitedInformation. Tests: 207 passing, 4 skipped.
177 lines
7.7 KiB
C#
177 lines
7.7 KiB
C#
using System.Runtime.InteropServices;
|
|
|
|
namespace WhiteMagic.Native;
|
|
|
|
/// <summary>
|
|
/// P/Invoke declarations for the Win32 process, memory, thread, and module
|
|
/// APIs that WhiteMagic uses. Every declaration uses <see cref="LibraryImportAttribute"/>
|
|
/// (source-generated interop). SetLastError is enabled on all calls that the
|
|
/// Win32 API documents as setting a thread-local last-error value.
|
|
/// </summary>
|
|
internal static partial class NativeMethods
|
|
{
|
|
// ── Process ──────────────────────────────────────────────────────────────
|
|
|
|
/// <summary>Opens an existing process and returns a handle to it.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial SafeMemoryHandle OpenProcess(
|
|
ProcessAccess desiredAccess,
|
|
[MarshalAs(UnmanagedType.Bool)] bool inheritHandle,
|
|
int processId);
|
|
|
|
/// <summary>Opens an existing thread and returns a handle to it.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial SafeMemoryHandle OpenThread(
|
|
ThreadAccess desiredAccess,
|
|
[MarshalAs(UnmanagedType.Bool)] bool inheritHandle,
|
|
int threadId);
|
|
|
|
/// <summary>Closes an open object handle.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool CloseHandle(IntPtr handle);
|
|
|
|
/// <summary>Determines whether the specified process is running under WOW64.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool IsWow64Process(
|
|
SafeMemoryHandle process,
|
|
[MarshalAs(UnmanagedType.Bool)] out bool wow64Process);
|
|
|
|
/// <summary>Retrieves the termination status of the specified thread.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool GetExitCodeThread(
|
|
SafeMemoryHandle thread,
|
|
out uint exitCode);
|
|
|
|
// ── Memory ───────────────────────────────────────────────────────────────
|
|
|
|
/// <summary>Reads memory from a process.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool ReadProcessMemory(
|
|
SafeMemoryHandle process,
|
|
IntPtr baseAddress,
|
|
Span<byte> buffer,
|
|
int size,
|
|
out nint bytesRead);
|
|
|
|
/// <summary>Writes memory to a process.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool WriteProcessMemory(
|
|
SafeMemoryHandle process,
|
|
IntPtr baseAddress,
|
|
ReadOnlySpan<byte> buffer,
|
|
int size,
|
|
out nint bytesWritten);
|
|
|
|
/// <summary>Reserves or commits a region of memory in a process.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial IntPtr VirtualAllocEx(
|
|
SafeMemoryHandle process,
|
|
IntPtr address,
|
|
nint size,
|
|
MemoryAllocationType allocationType,
|
|
MemoryProtectionType protect);
|
|
|
|
/// <summary>Changes the protection on a committed region of memory.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool VirtualProtectEx(
|
|
SafeMemoryHandle process,
|
|
IntPtr address,
|
|
nint size,
|
|
MemoryProtectionType newProtect,
|
|
out MemoryProtectionType oldProtect);
|
|
|
|
/// <summary>Releases or decommits a region of memory in a process.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool VirtualFreeEx(
|
|
SafeMemoryHandle process,
|
|
IntPtr address,
|
|
nint size,
|
|
MemoryFreeType freeType);
|
|
|
|
// ── Threading ────────────────────────────────────────────────────────────
|
|
|
|
/// <summary>Creates a thread that runs in the virtual address space of a process.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial SafeMemoryHandle CreateRemoteThread(
|
|
SafeMemoryHandle process,
|
|
IntPtr threadAttributes,
|
|
nint stackSize,
|
|
IntPtr startAddress,
|
|
IntPtr parameter,
|
|
ThreadCreationFlags creationFlags,
|
|
out uint threadId);
|
|
|
|
/// <summary>Suspends the specified thread.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial uint SuspendThread(SafeMemoryHandle thread);
|
|
|
|
/// <summary>Resumes the specified thread.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial uint ResumeThread(SafeMemoryHandle thread);
|
|
|
|
/// <summary>Returns the thread identifier of the specified thread.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial uint GetThreadId(SafeMemoryHandle thread);
|
|
|
|
/// <summary>Returns the identifier of the calling thread.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial uint GetCurrentThreadId();
|
|
|
|
/// <summary>Sets a 64-bit thread context (AMD64).</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool SetThreadContext(
|
|
SafeMemoryHandle thread,
|
|
ref Context64 context);
|
|
|
|
/// <summary>Gets a 64-bit thread context (AMD64).</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool GetThreadContext(
|
|
SafeMemoryHandle thread,
|
|
ref Context64 context);
|
|
|
|
/// <summary>Sets a 32-bit thread context (x86 or WOW64).</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool SetThreadContext(
|
|
SafeMemoryHandle thread,
|
|
ref Context32 context);
|
|
|
|
/// <summary>Gets a 32-bit thread context (x86 or WOW64).</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
[return: MarshalAs(UnmanagedType.Bool)]
|
|
internal static partial bool GetThreadContext(
|
|
SafeMemoryHandle thread,
|
|
ref Context32 context);
|
|
|
|
|
|
// ── Modules ──────────────────────────────────────────────────────────────
|
|
|
|
/// <summary>Loads a module into the calling process.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true, EntryPoint = "LoadLibraryW")]
|
|
internal static partial IntPtr LoadLibrary(
|
|
[MarshalAs(UnmanagedType.LPWStr)] string lpFileName);
|
|
|
|
/// <summary>Returns the address of a function or variable from a loaded module.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial IntPtr GetProcAddress(
|
|
IntPtr hModule,
|
|
[MarshalAs(UnmanagedType.LPStr)] string lpProcName);
|
|
|
|
/// <summary>Waits until an object is signaled or the timeout elapses. Returns a
|
|
/// <c>WAIT_*</c> status (DWORD); <c>WAIT_FAILED</c> is <c>0xFFFFFFFF</c>.</summary>
|
|
[LibraryImport("kernel32.dll", SetLastError = true)]
|
|
internal static partial uint WaitForSingleObject(
|
|
SafeMemoryHandle handle,
|
|
uint milliseconds);
|
|
|
|
}
|