mirror of https://github.com/dahall/Vanara.git
Minor tweaks to PR #386
David Hall
parent
a9ff5e3c8f
commit
44d9c2a3b2
|
|
@ -300,169 +300,169 @@ namespace Vanara.PInvoke
|
||||||
[In] HPROCESS ParentProcess, [In] PROCESS_CREATE_FLAGS Flags, [In, Optional] IntPtr SectionHandle,
|
[In] HPROCESS ParentProcess, [In] PROCESS_CREATE_FLAGS Flags, [In, Optional] IntPtr SectionHandle,
|
||||||
[In, Optional] IntPtr DebugPort, [In, Optional] IntPtr ExceptionPort, uint JobMemberLevel);
|
[In, Optional] IntPtr DebugPort, [In, Optional] IntPtr ExceptionPort, uint JobMemberLevel);
|
||||||
|
|
||||||
/// <summary>Set the debug object handle in the TEB. This function is UNDOCUMENTED.</summary>
|
/// <summary>Set the debug object handle in the TEB. This function is UNDOCUMENTED.</summary>
|
||||||
/// <param name="DebugObjectHandle">Debug object handle. Retrieve from NtQueryInformationProcess</param>
|
/// <param name="DebugObjectHandle">Debug object handle. Retrieve from NtQueryInformationProcess</param>
|
||||||
/// <returns>
|
/// <returns>
|
||||||
/// <para>The function returns an NTSTATUS success or error code.</para>
|
/// <para>The function returns an NTSTATUS success or error code.</para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the DDK, and are
|
/// The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the DDK, and are
|
||||||
/// described in the DDK documentation under Kernel-Mode Driver Architecture / Design Guide / Driver Programming Techniques /
|
/// described in the DDK documentation under Kernel-Mode Driver Architecture / Design Guide / Driver Programming Techniques /
|
||||||
/// Logging Errors.
|
/// Logging Errors.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// </returns>
|
/// </returns>
|
||||||
[DllImport(Lib.NtDll, SetLastError = false, ExactSpelling = true)]
|
[DllImport(Lib.NtDll, SetLastError = false, ExactSpelling = true)]
|
||||||
public static extern NTStatus DbgUiSetThreadDebugObject(IntPtr DebugObjectHandle);
|
public static extern NTStatus DbgUiSetThreadDebugObject(IntPtr DebugObjectHandle);
|
||||||
|
|
||||||
/// <summary>Call the kernel to remove the debug object. This function is UNDOCUMENTED.</summary>
|
/// <summary>Call the kernel to remove the debug object. This function is UNDOCUMENTED.</summary>
|
||||||
/// <param name="ProcessHandle">The process handle.</param>
|
/// <param name="ProcessHandle">The process handle.</param>
|
||||||
/// <param name="DebugObjectHandle">Debug object handle. Retrieve from NtQueryInformationProcess</param>
|
/// <param name="DebugObjectHandle">Debug object handle. Retrieve from NtQueryInformationProcess</param>
|
||||||
/// <returns>
|
/// <returns>
|
||||||
/// <para>The function returns an NTSTATUS success or error code.</para>
|
/// <para>The function returns an NTSTATUS success or error code.</para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the DDK, and are
|
/// The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the DDK, and are
|
||||||
/// described in the DDK documentation under Kernel-Mode Driver Architecture / Design Guide / Driver Programming Techniques /
|
/// described in the DDK documentation under Kernel-Mode Driver Architecture / Design Guide / Driver Programming Techniques /
|
||||||
/// Logging Errors.
|
/// Logging Errors.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// </returns>
|
/// </returns>
|
||||||
[DllImport(Lib.NtDll, SetLastError = false, ExactSpelling = true)]
|
[DllImport(Lib.NtDll, SetLastError = false, ExactSpelling = true)]
|
||||||
public static extern NTStatus NtRemoveProcessDebug(HPROCESS ProcessHandle, IntPtr DebugObjectHandle);
|
public static extern NTStatus NtRemoveProcessDebug(HPROCESS ProcessHandle, IntPtr DebugObjectHandle);
|
||||||
|
|
||||||
/// <summary>
|
/// <summary>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// [ <c>NtQueryInformationProcess</c> may be altered or unavailable in future versions of Windows. Applications should use the
|
/// [ <c>NtQueryInformationProcess</c> may be altered or unavailable in future versions of Windows. Applications should use the
|
||||||
/// alternate functions listed in this topic.]
|
/// alternate functions listed in this topic.]
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>Retrieves information about the specified process.</para>
|
/// <para>Retrieves information about the specified process.</para>
|
||||||
/// </summary>
|
/// </summary>
|
||||||
/// <param name="ProcessHandle">A handle to the process for which information is to be retrieved.</param>
|
/// <param name="ProcessHandle">A handle to the process for which information is to be retrieved.</param>
|
||||||
/// <param name="ProcessInformationClass">
|
/// <param name="ProcessInformationClass">
|
||||||
/// <para>
|
/// <para>
|
||||||
/// The type of process information to be retrieved. This parameter can be one of the following values from the
|
/// The type of process information to be retrieved. This parameter can be one of the following values from the
|
||||||
/// <c>PROCESSINFOCLASS</c> enumeration.
|
/// <c>PROCESSINFOCLASS</c> enumeration.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <list type="table">
|
/// <list type="table">
|
||||||
/// <listheader>
|
/// <listheader>
|
||||||
/// <term>Value</term>
|
/// <term>Value</term>
|
||||||
/// <term>Meaning</term>
|
/// <term>Meaning</term>
|
||||||
/// </listheader>
|
/// </listheader>
|
||||||
/// <item>
|
/// <item>
|
||||||
/// <term>ProcessBasicInformation<br/>0</term>
|
/// <term>ProcessBasicInformation<br/>0</term>
|
||||||
/// <term>
|
/// <term>
|
||||||
/// Retrieves a pointer to a PEB structure that can be used to determine whether the specified process is being debugged, and a
|
/// Retrieves a pointer to a PEB structure that can be used to determine whether the specified process is being debugged, and a
|
||||||
/// unique value used by the system to identify the specified process. Use the CheckRemoteDebuggerPresent and GetProcessId functions
|
/// unique value used by the system to identify the specified process. Use the CheckRemoteDebuggerPresent and GetProcessId functions
|
||||||
/// to obtain this information.
|
/// to obtain this information.
|
||||||
/// </term>
|
/// </term>
|
||||||
/// </item>
|
/// </item>
|
||||||
/// <item>
|
/// <item>
|
||||||
/// <term>ProcessDebugPort<br/>7</term>
|
/// <term>ProcessDebugPort<br/>7</term>
|
||||||
/// <term>
|
/// <term>
|
||||||
/// Retrieves a DWORD_PTR value that is the port number of the debugger for the process. A nonzero value indicates that the process
|
/// Retrieves a DWORD_PTR value that is the port number of the debugger for the process. A nonzero value indicates that the process
|
||||||
/// is being run under the control of a ring 3 debugger. Use the CheckRemoteDebuggerPresent or IsDebuggerPresent function.
|
/// is being run under the control of a ring 3 debugger. Use the CheckRemoteDebuggerPresent or IsDebuggerPresent function.
|
||||||
/// </term>
|
/// </term>
|
||||||
/// </item>
|
/// </item>
|
||||||
/// <item>
|
/// <item>
|
||||||
/// <term>ProcessWow64Information<br/>26</term>
|
/// <term>ProcessWow64Information<br/>26</term>
|
||||||
/// <term>
|
/// <term>
|
||||||
/// Determines whether the process is running in the WOW64 environment (WOW64 is the x86 emulator that allows Win32-based
|
/// Determines whether the process is running in the WOW64 environment (WOW64 is the x86 emulator that allows Win32-based
|
||||||
/// applications to run on 64-bit Windows). Use the IsWow64Process2 function to obtain this information.
|
/// applications to run on 64-bit Windows). Use the IsWow64Process2 function to obtain this information.
|
||||||
/// </term>
|
/// </term>
|
||||||
/// </item>
|
/// </item>
|
||||||
/// <item>
|
/// <item>
|
||||||
/// <term>ProcessImageFileName<br/>27</term>
|
/// <term>ProcessImageFileName<br/>27</term>
|
||||||
/// <term>
|
/// <term>
|
||||||
/// Retrieves a UNICODE_STRING value containing the name of the image file for the process. Use the QueryFullProcessImageName or
|
/// Retrieves a UNICODE_STRING value containing the name of the image file for the process. Use the QueryFullProcessImageName or
|
||||||
/// GetProcessImageFileName function to obtain this information.
|
/// GetProcessImageFileName function to obtain this information.
|
||||||
/// </term>
|
/// </term>
|
||||||
/// </item>
|
/// </item>
|
||||||
/// <item>
|
/// <item>
|
||||||
/// <term>ProcessBreakOnTermination<br/>29</term>
|
/// <term>ProcessBreakOnTermination<br/>29</term>
|
||||||
/// <term>Retrieves a ULONG value indicating whether the process is considered critical.</term>
|
/// <term>Retrieves a ULONG value indicating whether the process is considered critical.</term>
|
||||||
/// </item>
|
/// </item>
|
||||||
/// <item>
|
/// <item>
|
||||||
/// <term>ProcessSubsystemInformation<br/>75</term>
|
/// <term>ProcessSubsystemInformation<br/>75</term>
|
||||||
/// <term>
|
/// <term>
|
||||||
/// Retrieves a SUBSYSTEM_INFORMATION_TYPE value indicating the subsystem type of the process. The buffer pointed to by the
|
/// Retrieves a SUBSYSTEM_INFORMATION_TYPE value indicating the subsystem type of the process. The buffer pointed to by the
|
||||||
/// ProcessInformation parameter should be large enough to hold a single SUBSYSTEM_INFORMATION_TYPE enumeration.
|
/// ProcessInformation parameter should be large enough to hold a single SUBSYSTEM_INFORMATION_TYPE enumeration.
|
||||||
/// </term>
|
/// </term>
|
||||||
/// </item>
|
/// </item>
|
||||||
/// </list>
|
/// </list>
|
||||||
/// </param>
|
/// </param>
|
||||||
/// <param name="ProcessInformation">
|
/// <param name="ProcessInformation">
|
||||||
/// <para>
|
/// <para>
|
||||||
/// A pointer to a buffer supplied by the calling application into which the function writes the requested information. The size of
|
/// A pointer to a buffer supplied by the calling application into which the function writes the requested information. The size of
|
||||||
/// the information written varies depending on the data type of the ProcessInformationClass parameter:
|
/// the information written varies depending on the data type of the ProcessInformationClass parameter:
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>PROCESS_BASIC_INFORMATION</para>
|
/// <para>PROCESS_BASIC_INFORMATION</para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// When the ProcessInformationClass parameter is <c>ProcessBasicInformation</c>, the buffer pointed to by the ProcessInformation
|
/// When the ProcessInformationClass parameter is <c>ProcessBasicInformation</c>, the buffer pointed to by the ProcessInformation
|
||||||
/// parameter should be large enough to hold a single <c>PROCESS_BASIC_INFORMATION</c> structure having the following layout:
|
/// parameter should be large enough to hold a single <c>PROCESS_BASIC_INFORMATION</c> structure having the following layout:
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <code><![CDATA[
|
/// <code><![CDATA[
|
||||||
///typedef struct _PROCESS_BASIC_INFORMATION {
|
///typedef struct _PROCESS_BASIC_INFORMATION {
|
||||||
/// PVOID Reserved1;
|
/// PVOID Reserved1;
|
||||||
/// PPEB PebBaseAddress;
|
/// PPEB PebBaseAddress;
|
||||||
/// PVOID Reserved2[2];
|
/// PVOID Reserved2[2];
|
||||||
/// ULONG_PTR UniqueProcessId;
|
/// ULONG_PTR UniqueProcessId;
|
||||||
/// PVOID Reserved3;
|
/// PVOID Reserved3;
|
||||||
///} PROCESS_BASIC_INFORMATION;
|
///} PROCESS_BASIC_INFORMATION;
|
||||||
/// ]]></code>
|
/// ]]></code>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// The <c>UniqueProcessId</c> member points to the system's unique identifier for this process. Use the GetProcessId function to
|
/// The <c>UniqueProcessId</c> member points to the system's unique identifier for this process. Use the GetProcessId function to
|
||||||
/// retrieve this information.
|
/// retrieve this information.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>The <c>PebBaseAddress</c> member points to a PEB structure.</para>
|
/// <para>The <c>PebBaseAddress</c> member points to a PEB structure.</para>
|
||||||
/// <para>The other members of this structure are reserved for internal use by the operating system.</para>
|
/// <para>The other members of this structure are reserved for internal use by the operating system.</para>
|
||||||
/// <para>ULONG_PTR</para>
|
/// <para>ULONG_PTR</para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// When the ProcessInformationClass parameter is <c>ProcessWow64Information</c>, the buffer pointed to by the ProcessInformation
|
/// When the ProcessInformationClass parameter is <c>ProcessWow64Information</c>, the buffer pointed to by the ProcessInformation
|
||||||
/// parameter should be large enough to hold a <c>ULONG_PTR</c>. If this value is nonzero, the process is running in a WOW64
|
/// parameter should be large enough to hold a <c>ULONG_PTR</c>. If this value is nonzero, the process is running in a WOW64
|
||||||
/// environment; otherwise, if the value is equal to zero, the process is not running in a WOW64 environment.
|
/// environment; otherwise, if the value is equal to zero, the process is not running in a WOW64 environment.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>Use the IsWow64Process2 function to determine whether a process is running in the WOW64 environment.</para>
|
/// <para>Use the IsWow64Process2 function to determine whether a process is running in the WOW64 environment.</para>
|
||||||
/// <para>UNICODE_STRING</para>
|
/// <para>UNICODE_STRING</para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// When the ProcessInformationClass parameter is <c>ProcessImageFileName</c>, the buffer pointed to by the ProcessInformation
|
/// When the ProcessInformationClass parameter is <c>ProcessImageFileName</c>, the buffer pointed to by the ProcessInformation
|
||||||
/// parameter should be large enough to hold a <c>UNICODE_STRING</c> structure as well as the string itself. The string stored in
|
/// parameter should be large enough to hold a <c>UNICODE_STRING</c> structure as well as the string itself. The string stored in
|
||||||
/// the <c>Buffer</c> member is the name of the image file.
|
/// the <c>Buffer</c> member is the name of the image file.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// If the buffer is too small, the function fails with the STATUS_INFO_LENGTH_MISMATCH error code and the ReturnLength parameter is
|
/// If the buffer is too small, the function fails with the STATUS_INFO_LENGTH_MISMATCH error code and the ReturnLength parameter is
|
||||||
/// set to the required buffer size.
|
/// set to the required buffer size.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// </param>
|
/// </param>
|
||||||
/// <param name="ProcessInformationLength">The size of the buffer pointed to by the ProcessInformation parameter, in bytes.</param>
|
/// <param name="ProcessInformationLength">The size of the buffer pointed to by the ProcessInformation parameter, in bytes.</param>
|
||||||
/// <param name="ReturnLength">
|
/// <param name="ReturnLength">
|
||||||
/// A pointer to a variable in which the function returns the size of the requested information. If the function was successful,
|
/// A pointer to a variable in which the function returns the size of the requested information. If the function was successful,
|
||||||
/// this is the size of the information written to the buffer pointed to by the ProcessInformation parameter, but if the buffer was
|
/// this is the size of the information written to the buffer pointed to by the ProcessInformation parameter, but if the buffer was
|
||||||
/// too small, this is the minimum size of buffer needed to receive the information successfully.
|
/// too small, this is the minimum size of buffer needed to receive the information successfully.
|
||||||
/// </param>
|
/// </param>
|
||||||
/// <returns>
|
/// <returns>
|
||||||
/// <para>The function returns an NTSTATUS success or error code.</para>
|
/// <para>The function returns an NTSTATUS success or error code.</para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the DDK, and are
|
/// The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the DDK, and are
|
||||||
/// described in the DDK documentation under Kernel-Mode Driver Architecture / Design Guide / Driver Programming Techniques /
|
/// described in the DDK documentation under Kernel-Mode Driver Architecture / Design Guide / Driver Programming Techniques /
|
||||||
/// Logging Errors.
|
/// Logging Errors.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// </returns>
|
/// </returns>
|
||||||
/// <remarks>
|
/// <remarks>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// The <c>NtQueryInformationProcess</c> function and the structures that it returns are internal to the operating system and
|
/// The <c>NtQueryInformationProcess</c> function and the structures that it returns are internal to the operating system and
|
||||||
/// subject to change from one release of Windows to another. To maintain the compatibility of your application, it is better to use
|
/// subject to change from one release of Windows to another. To maintain the compatibility of your application, it is better to use
|
||||||
/// public functions mentioned in the description of the ProcessInformationClass parameter instead.
|
/// public functions mentioned in the description of the ProcessInformationClass parameter instead.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// If you do use <c>NtQueryInformationProcess</c>, access the function through run-time dynamic linking. This gives your code an
|
/// If you do use <c>NtQueryInformationProcess</c>, access the function through run-time dynamic linking. This gives your code an
|
||||||
/// opportunity to respond gracefully if the function has been changed or removed from the operating system. Signature changes,
|
/// opportunity to respond gracefully if the function has been changed or removed from the operating system. Signature changes,
|
||||||
/// however, may not be detectable.
|
/// however, may not be detectable.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// <para>
|
/// <para>
|
||||||
/// This function has no associated import library. You must use the LoadLibrary and GetProcAddress functions to dynamically link to Ntdll.dll.
|
/// This function has no associated import library. You must use the LoadLibrary and GetProcAddress functions to dynamically link to Ntdll.dll.
|
||||||
/// </para>
|
/// </para>
|
||||||
/// </remarks>
|
/// </remarks>
|
||||||
// https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess __kernel_entry NTSTATUS
|
// https://docs.microsoft.com/en-us/windows/win32/api/winternl/nf-winternl-ntqueryinformationprocess __kernel_entry NTSTATUS
|
||||||
// NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN
|
// NtQueryInformationProcess( IN HANDLE ProcessHandle, IN PROCESSINFOCLASS ProcessInformationClass, OUT PVOID ProcessInformation, IN
|
||||||
// ULONG ProcessInformationLength, OUT PULONG ReturnLength );
|
// ULONG ProcessInformationLength, OUT PULONG ReturnLength );
|
||||||
[DllImport(Lib.NtDll, SetLastError = false, ExactSpelling = true)]
|
[DllImport(Lib.NtDll, SetLastError = false, ExactSpelling = true)]
|
||||||
[PInvokeData("winternl.h", MSDNShortId = "0eae7899-c40b-4a5f-9e9c-adae021885e7")]
|
[PInvokeData("winternl.h", MSDNShortId = "0eae7899-c40b-4a5f-9e9c-adae021885e7")]
|
||||||
public static extern NTStatus NtQueryInformationProcess([In] HPROCESS ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, [Out] IntPtr ProcessInformation, uint ProcessInformationLength, out uint ReturnLength);
|
public static extern NTStatus NtQueryInformationProcess([In] HPROCESS ProcessHandle, PROCESSINFOCLASS ProcessInformationClass, [Out] IntPtr ProcessInformation, uint ProcessInformationLength, out uint ReturnLength);
|
||||||
|
|
||||||
|
|
|
||||||
|
|
@ -5,124 +5,124 @@ using static Vanara.PInvoke.NtDll;
|
||||||
|
|
||||||
namespace Vanara.PInvoke.Tests
|
namespace Vanara.PInvoke.Tests
|
||||||
{
|
{
|
||||||
[TestFixture]
|
[TestFixture]
|
||||||
public partial class WinternlTests
|
public partial class WinternlTests
|
||||||
{
|
{
|
||||||
[Test]
|
[Test]
|
||||||
public void NtQueryInformationProcessTest()
|
public void NtQueryInformationProcessTest()
|
||||||
{
|
{
|
||||||
HPROCESS hProc = Kernel32.GetCurrentProcess();
|
HPROCESS hProc = Kernel32.GetCurrentProcess();
|
||||||
var procIsWow64 = hProc.IsWow64();
|
var procIsWow64 = hProc.IsWow64();
|
||||||
var procIs64 = Environment.Is64BitProcess;
|
var procIs64 = Environment.Is64BitProcess;
|
||||||
var osIs64 = Environment.Is64BitOperatingSystem;
|
var osIs64 = Environment.Is64BitOperatingSystem;
|
||||||
|
|
||||||
using var pbi = NtQueryInformationProcess<PROCESS_BASIC_INFORMATION>(hProc, PROCESSINFOCLASS.ProcessBasicInformation);
|
using var pbi = NtQueryInformationProcess<PROCESS_BASIC_INFORMATION>(hProc, PROCESSINFOCLASS.ProcessBasicInformation);
|
||||||
Assert.That(pbi, ResultIs.ValidHandle);
|
Assert.That(pbi, ResultIs.ValidHandle);
|
||||||
// Can get pointer here since PROCESS_BASIC_INFORMATION has no managed types
|
// Can get pointer here since PROCESS_BASIC_INFORMATION has no managed types
|
||||||
unsafe
|
unsafe
|
||||||
{
|
{
|
||||||
var rpbi = (PROCESS_BASIC_INFORMATION*)pbi;
|
var rpbi = (PROCESS_BASIC_INFORMATION*)pbi;
|
||||||
Assert.That(rpbi->UniqueProcessId.ToInt32(), Is.EqualTo(Kernel32.GetCurrentProcessId()));
|
Assert.That(rpbi->UniqueProcessId.ToInt32(), Is.EqualTo(Kernel32.GetCurrentProcessId()));
|
||||||
Assert.That(rpbi->PebBaseAddress, Is.Not.EqualTo(IntPtr.Zero));
|
Assert.That(rpbi->PebBaseAddress, Is.Not.EqualTo(IntPtr.Zero));
|
||||||
// Have to use ToStructure here since PEB has managed types
|
// Have to use ToStructure here since PEB has managed types
|
||||||
var peb = rpbi->PebBaseAddress.ToStructure<PEB>();
|
var peb = rpbi->PebBaseAddress.ToStructure<PEB>();
|
||||||
// Have to use ToStructure here since RTL_USER_PROCESS_PARAMETERS has managed types
|
// Have to use ToStructure here since RTL_USER_PROCESS_PARAMETERS has managed types
|
||||||
var upp = peb.ProcessParameters.ToStructure<RTL_USER_PROCESS_PARAMETERS>();
|
var upp = peb.ProcessParameters.ToStructure<RTL_USER_PROCESS_PARAMETERS>();
|
||||||
Assert.That(upp.CommandLine.ToString(hProc), Is.Not.Empty);
|
Assert.That(upp.CommandLine.ToString(hProc), Is.Not.Empty);
|
||||||
TestContext.WriteLine($"Img: {upp.ImagePathName.ToString(hProc)}; CmdLine: {upp.CommandLine.ToString(hProc)}");
|
TestContext.WriteLine($"Img: {upp.ImagePathName.ToString(hProc)}; CmdLine: {upp.CommandLine.ToString(hProc)}");
|
||||||
}
|
}
|
||||||
|
|
||||||
NtQueryResult<IntPtr> pdp = null;
|
NtQueryResult<IntPtr> pdp = null;
|
||||||
Assert.That(() => pdp = NtQueryInformationProcess<IntPtr>(hProc, PROCESSINFOCLASS.ProcessDebugPort), Throws.Nothing);
|
Assert.That(() => pdp = NtQueryInformationProcess<IntPtr>(hProc, PROCESSINFOCLASS.ProcessDebugPort), Throws.Nothing);
|
||||||
Assert.That(pdp, ResultIs.ValidHandle);
|
Assert.That(pdp, ResultIs.ValidHandle);
|
||||||
TestContext.WriteLine($"DbgPort: {pdp.Value.ToInt64()}");
|
TestContext.WriteLine($"DbgPort: {pdp.Value.ToInt64()}");
|
||||||
|
|
||||||
NtQueryResult<BOOL> pwi = null;
|
NtQueryResult<BOOL> pwi = null;
|
||||||
Assert.That(() => pwi = NtQueryInformationProcess<BOOL>(hProc, PROCESSINFOCLASS.ProcessWow64Information), Throws.Nothing);
|
Assert.That(() => pwi = NtQueryInformationProcess<BOOL>(hProc, PROCESSINFOCLASS.ProcessWow64Information), Throws.Nothing);
|
||||||
Assert.That(pwi, ResultIs.ValidHandle);
|
Assert.That(pwi, ResultIs.ValidHandle);
|
||||||
Assert.That(pwi.Value.Value, Is.True);
|
Assert.That(pwi.Value.Value, Is.True);
|
||||||
|
|
||||||
NtQueryResult<UNICODE_STRING> pfn = null;
|
NtQueryResult<UNICODE_STRING> pfn = null;
|
||||||
Assert.That(() => pfn = NtQueryInformationProcess<UNICODE_STRING>(hProc, PROCESSINFOCLASS.ProcessImageFileName), Throws.Nothing);
|
Assert.That(() => pfn = NtQueryInformationProcess<UNICODE_STRING>(hProc, PROCESSINFOCLASS.ProcessImageFileName), Throws.Nothing);
|
||||||
Assert.That(pfn, ResultIs.ValidHandle);
|
Assert.That(pfn, ResultIs.ValidHandle);
|
||||||
TestContext.WriteLine($"Fn: {pfn.Value.ToString(hProc)}");
|
TestContext.WriteLine($"Fn: {pfn.Value.ToString(hProc)}");
|
||||||
|
|
||||||
NtQueryResult<BOOL> pbt = null;
|
NtQueryResult<BOOL> pbt = null;
|
||||||
Assert.That(() => pbt = NtQueryInformationProcess<BOOL>(hProc, PROCESSINFOCLASS.ProcessBreakOnTermination), Throws.Nothing);
|
Assert.That(() => pbt = NtQueryInformationProcess<BOOL>(hProc, PROCESSINFOCLASS.ProcessBreakOnTermination), Throws.Nothing);
|
||||||
Assert.That(pbt, ResultIs.ValidHandle);
|
Assert.That(pbt, ResultIs.ValidHandle);
|
||||||
Assert.That(pbt.Value.Value, Is.False);
|
Assert.That(pbt.Value.Value, Is.False);
|
||||||
|
|
||||||
NtQueryResult<SUBSYSTEM_INFORMATION_TYPE> psi = null;
|
NtQueryResult<SUBSYSTEM_INFORMATION_TYPE> psi = null;
|
||||||
// This is documented, but fails on Win10
|
// This is documented, but fails on Win10
|
||||||
Assert.That(() => psi = NtQueryInformationProcess<SUBSYSTEM_INFORMATION_TYPE>(hProc, PROCESSINFOCLASS.ProcessSubsystemInformation), Throws.ArgumentException);
|
Assert.That(() => psi = NtQueryInformationProcess<SUBSYSTEM_INFORMATION_TYPE>(hProc, PROCESSINFOCLASS.ProcessSubsystemInformation), Throws.ArgumentException);
|
||||||
//Assert.That(psi, ResultIs.ValidHandle);
|
//Assert.That(psi, ResultIs.ValidHandle);
|
||||||
//Assert.That(Enum.IsDefined(typeof(SUBSYSTEM_INFORMATION_TYPE), psi.Value), Is.True);
|
//Assert.That(Enum.IsDefined(typeof(SUBSYSTEM_INFORMATION_TYPE), psi.Value), Is.True);
|
||||||
//TestContext.WriteLine($"SubSys: {psi.Value}");
|
//TestContext.WriteLine($"SubSys: {psi.Value}");
|
||||||
|
|
||||||
// Try undocumented fetch
|
// Try undocumented fetch
|
||||||
NtQueryResult<uint> ppb = null;
|
NtQueryResult<uint> ppb = null;
|
||||||
Assert.That(() => ppb = NtQueryInformationProcess<uint>(hProc, PROCESSINFOCLASS.ProcessPriorityBoost), Throws.Nothing);
|
Assert.That(() => ppb = NtQueryInformationProcess<uint>(hProc, PROCESSINFOCLASS.ProcessPriorityBoost), Throws.Nothing);
|
||||||
TestContext.WriteLine($"Priority boost: {ppb.Value}");
|
TestContext.WriteLine($"Priority boost: {ppb.Value}");
|
||||||
}
|
}
|
||||||
|
|
||||||
[Test]
|
[Test]
|
||||||
public void DbgUiSetThreadDebugObjectAndNtRemoveProcessDebugTest()
|
public void DbgUiSetThreadDebugObjectAndNtRemoveProcessDebugTest()
|
||||||
{
|
{
|
||||||
Kernel32.STARTUPINFO StartInfo = new Kernel32.STARTUPINFO
|
Kernel32.STARTUPINFO StartInfo = new()
|
||||||
{
|
{
|
||||||
dwFlags = Kernel32.STARTF.STARTF_USESHOWWINDOW,
|
dwFlags = Kernel32.STARTF.STARTF_USESHOWWINDOW,
|
||||||
wShowWindow = (ushort)ShowWindowCommand.SW_HIDE
|
wShowWindow = (ushort)ShowWindowCommand.SW_HIDE
|
||||||
};
|
};
|
||||||
|
|
||||||
Assert.IsTrue(Kernel32.CreateProcess("notepad.exe", dwCreationFlags: Kernel32.CREATE_PROCESS.DEBUG_PROCESS | Kernel32.CREATE_PROCESS.CREATE_UNICODE_ENVIRONMENT, lpStartupInfo: StartInfo, lpProcessInformation: out Kernel32.SafePROCESS_INFORMATION Information));
|
Assert.That(Kernel32.CreateProcess(@"C:\Program Files\Notepad++\notepad++.exe", dwCreationFlags: Kernel32.CREATE_PROCESS.DEBUG_PROCESS | Kernel32.CREATE_PROCESS.CREATE_UNICODE_ENVIRONMENT, lpStartupInfo: StartInfo, lpProcessInformation: out Kernel32.SafePROCESS_INFORMATION Information), ResultIs.Successful);
|
||||||
|
|
||||||
using (Information)
|
using (Information)
|
||||||
using (NtQueryResult<IntPtr> DebugObjectHandleQueryResult = NtQueryInformationProcess<IntPtr>(Information.hProcess, PROCESSINFOCLASS.ProcessDebugObjectHandle))
|
using (NtQueryResult<IntPtr> DebugObjectHandleQueryResult = NtQueryInformationProcess<IntPtr>(Information.hProcess, PROCESSINFOCLASS.ProcessDebugObjectHandle))
|
||||||
{
|
{
|
||||||
Assert.That(DebugObjectHandleQueryResult, ResultIs.ValidHandle);
|
Assert.That(DebugObjectHandleQueryResult, ResultIs.ValidHandle);
|
||||||
Assert.That(DebugObjectHandleQueryResult.Value, ResultIs.ValidHandle);
|
Assert.That(DebugObjectHandleQueryResult.Value, ResultIs.ValidHandle);
|
||||||
|
|
||||||
try
|
try
|
||||||
{
|
{
|
||||||
Assert.DoesNotThrow(() => DbgUiSetThreadDebugObject(DebugObjectHandleQueryResult.Value).ThrowIfFailed());
|
Assert.That(DbgUiSetThreadDebugObject(DebugObjectHandleQueryResult.Value), ResultIs.Successful);
|
||||||
|
|
||||||
try
|
try
|
||||||
{
|
{
|
||||||
Kernel32.SafeHPROCESS DebugProcessHandle = Kernel32.SafeHPROCESS.Null;
|
Kernel32.SafeHPROCESS DebugProcessHandle = Kernel32.SafeHPROCESS.Null;
|
||||||
|
|
||||||
try
|
try
|
||||||
{
|
{
|
||||||
while (true)
|
while (true)
|
||||||
{
|
{
|
||||||
Assert.IsTrue(Kernel32.WaitForDebugEvent(out Kernel32.DEBUG_EVENT Event, Kernel32.INFINITE));
|
Assert.That(Kernel32.WaitForDebugEvent(out Kernel32.DEBUG_EVENT Event, Kernel32.INFINITE), ResultIs.Successful);
|
||||||
|
|
||||||
if (Event.dwDebugEventCode == Kernel32.DEBUG_EVENT_CODE.CREATE_PROCESS_DEBUG_EVENT)
|
if (Event.dwDebugEventCode == Kernel32.DEBUG_EVENT_CODE.CREATE_PROCESS_DEBUG_EVENT)
|
||||||
{
|
{
|
||||||
DebugProcessHandle = new Kernel32.SafeHPROCESS(Event.u.CreateProcessInfo.hProcess);
|
DebugProcessHandle = new Kernel32.SafeHPROCESS(Event.u.CreateProcessInfo.hProcess);
|
||||||
break;
|
break;
|
||||||
}
|
}
|
||||||
|
|
||||||
Assert.IsTrue(Kernel32.ContinueDebugEvent(Event.dwProcessId, Event.dwThreadId, Kernel32.DEBUG_CONTINUE.DBG_CONTINUE));
|
Assert.That(Kernel32.ContinueDebugEvent(Event.dwProcessId, Event.dwThreadId, Kernel32.DEBUG_CONTINUE.DBG_CONTINUE), ResultIs.Successful);
|
||||||
}
|
}
|
||||||
|
|
||||||
Assert.AreNotEqual(Kernel32.SafeHPROCESS.Null, DebugProcessHandle);
|
Assert.False(DebugProcessHandle.IsNull);
|
||||||
}
|
}
|
||||||
finally
|
finally
|
||||||
{
|
{
|
||||||
DebugProcessHandle.Dispose();
|
DebugProcessHandle.Dispose();
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
finally
|
finally
|
||||||
{
|
{
|
||||||
Assert.DoesNotThrow(() => DbgUiSetThreadDebugObject(IntPtr.Zero).ThrowIfFailed());
|
Assert.That(DbgUiSetThreadDebugObject(IntPtr.Zero), ResultIs.Successful);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
finally
|
finally
|
||||||
{
|
{
|
||||||
Assert.IsTrue(Kernel32.TerminateProcess(Information.hProcess, 0));
|
Assert.That(Kernel32.TerminateProcess(Information.hProcess, 0), ResultIs.Successful);
|
||||||
Assert.DoesNotThrow(() => NtRemoveProcessDebug(Information.hProcess, DebugObjectHandleQueryResult.Value).ThrowIfFailed());
|
Assert.That(NtRemoveProcessDebug(Information.hProcess, DebugObjectHandleQueryResult.Value), ResultIs.Successful);
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
Loading…
Reference in New Issue