This commit is contained in:
Mino 2020-04-08 00:23:31 +09:00
parent b5f1084f73
commit 9965dc313a
14 changed files with 381 additions and 406 deletions

View file

@ -0,0 +1,51 @@
using System;
namespace Dalamud.Bootstrap.OS.Windows.Raw
{
// https://github.com/processhacker/processhacker/blob/c1a8c103f8afa1561dbac416f87523ea8f70b15e/phnt/include/ntpsapi.h#L96-L199
internal enum PROCESSINFOCLASS : uint
{
ProcessBasicInformation = 0,
}
// https://github.com/processhacker/processhacker/blob/0e9cf471e06a59cdb3a7c89f0b92b253a6a93999/phnt/include/ntpsapi.h#L5-L17
[Flags]
internal enum PROCESS_ACCESS_RIGHTS : uint
{
PROCESS_TERMINATE = 0x1,
PROCESS_CREATE_THREAD = 0x2,
PROCESS_VM_OPERATION = 0x8,
PROCESS_VM_READ = 0x10,
PROCESS_VM_WRITE = 0x20,
PROCESS_DUP_HANDLE = 0x40,
PROCESS_CREATE_PROCESS = 0x80,
PROCESS_SET_QUOTA = 0x100,
PROCESS_SET_INFORMATION = 0x200,
PROCESS_QUERY_INFORMATION = 0x400,
PROCESS_SUSPEND_RESUME = 0x800,
PROCESS_QUERY_LIMITED_INFORMATION = 0x1000,
SYNCHRONIZE = 0x100000,
}
[Flags]
internal enum PROCESS_CREATION_FLAGS : uint
{
CREATE_BREAKAWAY_FROM_JOB = 0x01000000,
CREATE_DEFAULT_ERROR_MODE = 0x04000000,
CREATE_NEW_CONSOLE = 0x00000010,
CREATE_NEW_PROCESS_GROUP = 0x00000200,
CREATE_NO_WINDOW = 0x08000000,
CREATE_PROTECTED_PROCESS = 0x00040000,
CREATE_PRESERVE_CODE_AUTHZ_LEVEL = 0x02000000,
CREATE_SECURE_PROCESS = 0x00400000,
CREATE_SEPARATE_WOW_VDM = 0x00000800,
CREATE_SHARED_WOW_VDM = 0x00001000,
CREATE_SUSPENDED = 0x00000004,
CREATE_UNICODE_ENVIRONMENT = 0x00000400,
DEBUG_ONLY_THIS_PROCESS = 0x00000002,
DEBUG_PROCESS = 0x00000001,
DETACHED_PROCESS = 0x00000008,
EXTENDED_STARTUPINFO_PRESENT = 0x00080000,
INHERIT_PARENT_AFFINITY = 0x00010000,
}
}

View file

@ -0,0 +1,49 @@
using Microsoft.Win32.SafeHandles;
using System;
using System.Runtime.InteropServices;
using System.Text;
namespace Dalamud.Bootstrap.OS.Windows.Raw
{
internal static unsafe class Kernel32
{
private const string Name = "kernel32";
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
public static extern SafeProcessHandle OpenProcess(uint dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, uint dwProcessId);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool TerminateProcess(SafeProcessHandle hProcess, int uExitCode);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool ReadProcessMemory(SafeProcessHandle hProcess, IntPtr lpBaseAddress, void* lpBuffer, IntPtr nSize, out IntPtr lpNumberOfBytesRead);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool WriteProcessMemory(SafeProcessHandle hProcess, IntPtr lpBaseAddress, void* lpBuffer, IntPtr nSize, out IntPtr lpNumberOfBytesWritten);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
public static extern void* LocalFree(void* hMem);
[DllImport(Name, CallingConvention = CallingConvention.Winapi)]
public static extern uint GetProcessId(SafeProcessHandle hProcess);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool GetProcessTimes(SafeProcessHandle hProcess, out FILETIME lpCreationTime, out FILETIME lpExitTime, out FILETIME lpKernelTime, out FILETIME lpUserTime);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Unicode)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool QueryFullProcessImageNameW(SafeProcessHandle hProcess, uint dwFlags, [MarshalAs(UnmanagedType.LPWStr)] StringBuilder lpExeName, ref int lpdwSize);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true, ExactSpelling = true, CharSet = CharSet.Unicode)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool CreateProcessW(void* lpApplicationName, void* lpCommandLine, SECURITY_ATTRIBUTES* lpProcessAttributes, SECURITY_ATTRIBUTES* lpThreadAttributes, uint bInheritHandles, uint dwCreationFlags, void* lpEnvironment, void* lpCurrentDirectory, void* lpStartupInfo, void* lpProcessInformation);
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool CloseHandle(IntPtr hObject);
}
}

View file

@ -0,0 +1,14 @@
using Microsoft.Win32.SafeHandles;
using System;
using System.Runtime.InteropServices;
namespace Dalamud.Bootstrap.OS.Windows.Raw
{
internal static unsafe class Ntdll
{
private const string Name = "ntdll";
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true)]
public static extern NTSTATUS NtQueryInformationProcess(SafeProcessHandle processHandle, PROCESSINFOCLASS processInfoClass, void* processInformation, int processInformationLength, IntPtr* returnLength);
}
}

View file

@ -0,0 +1,12 @@
using System.Runtime.InteropServices;
namespace Dalamud.Bootstrap.OS.Windows.Raw
{
internal static unsafe class Shell32
{
private const string Name = "shell32";
[DllImport(Name, CallingConvention = CallingConvention.Winapi, SetLastError = true, ExactSpelling = true)]
public static extern char** CommandLineToArgvW(void* lpCmdLine, out int pNumArgs);
}
}

View file

@ -0,0 +1,127 @@
using System;
using System.Runtime.InteropServices;
namespace Dalamud.Bootstrap.OS.Windows.Raw
{
[StructLayout(LayoutKind.Sequential)]
internal struct NTSTATUS
{
public uint Code;
public NTSTATUS(uint value)
{
Code = value;
}
/// <summary>
/// Equivalent to NT_SUCCESS
/// </summary>
public bool Success => Code <= 0x7FFFFFFF;
/// <summary>
/// Equivalent to NT_INFORMATION
/// </summary>
public bool Information => 0x40000000 <= Code && Code <= 0x7FFFFFFF;
/// <summary>
/// Equivalent to NT_WARNING
/// </summary>
public bool Warning => 0x80000000 <= Code && Code <= 0xBFFFFFFF;
/// <summary>
/// Equivalent to NT_ERROR
/// </summary>
public bool Error => 0xC0000000 <= Code;
public override string ToString() => $"{Code:X8}";
public static implicit operator uint(NTSTATUS status) => status.Code;
public static implicit operator NTSTATUS(uint code) => new NTSTATUS(code);
}
[StructLayout(LayoutKind.Sequential)]
internal struct FILETIME
{
public uint LowDateTime;
public uint HighDateTime;
public long FileTime => ((long)HighDateTime << 32) | LowDateTime;
public DateTime ToDateTime() => DateTime.FromFileTime(FileTime);
}
[StructLayout(LayoutKind.Sequential)]
internal unsafe struct UNICODE_STRING
{
public ushort Length;
public ushort MaximumLength;
public IntPtr Buffer;
}
// https://github.com/processhacker/processhacker/blob/e43d7c0513ec5368c3309a58c9f2c2a3ca5de367/phnt/include/ntpsapi.h#L272
[StructLayout(LayoutKind.Sequential)]
internal struct PROCESS_BASIC_INFORMATION
{
public NTSTATUS ExitStatus;
public IntPtr PebBaseAddress;
public IntPtr AffinityMask;
public IntPtr BasePriority;
public IntPtr UniqueProcessId;
public IntPtr InheritedFromUniqueProcessId;
}
[StructLayout(LayoutKind.Sequential)]
internal struct PEB
{
// https://github.com/processhacker/processhacker/blob/238287786b80abad647b988e60f69090cab4c8fe/phnt/include/ntpebteb.h#L57-L218
public byte InheritedAddressSpace;
public byte ReadImageFileExecOptions;
public byte BeingDebugged;
public byte BitField;
public IntPtr Mutant;
public IntPtr ImageBaseAddress;
public IntPtr Ldr;
public IntPtr ProcessParameters;
// ..snip.. we don't care about others
}
[StructLayout(LayoutKind.Sequential)]
internal struct RTL_USER_PROCESS_PARAMETERS
{
public uint MaximumLength;
public uint LengthInitialized;
public uint Flags;
public uint DebugFlags;
public IntPtr ConsoleHandle;
public uint ConsoleFlags;
public IntPtr StandardInput;
public IntPtr StandardOutput;
public IntPtr StandardError;
public UNICODE_STRING CurrentDirectory_DosPath;
public IntPtr CurrentDirectory_Handle;
public UNICODE_STRING DllPath;
public UNICODE_STRING ImagePathName;
public UNICODE_STRING CommandLine;
// ..snip.. don't care
}
[StructLayout(LayoutKind.Sequential)]
internal unsafe struct SECURITY_ATTRIBUTES
{
public uint Length;
public SECURITY_DESCRIPTOR* SecurityDescriptor;
[MarshalAs(UnmanagedType.Bool)]
public bool InheritHandle;
}
[StructLayout(LayoutKind.Sequential)]
internal struct SECURITY_DESCRIPTOR
{
}
}