/// <summary>
/// Get current process exe file directory
/// </summary>
/// <returns>Exe directory</returns>
std::wstring Utils::GetExeDirectory()
{
wchar_t imgName[MAX_PATH] = { 0 };
DWORD len = ARRAYSIZE(imgName);
auto pFunc = reinterpret_cast<fnQueryFullProcessImageNameW>(LOAD_IMPORT( "QueryFullProcessImageNameW", L"kernel32.dll" ));
if (pFunc != nullptr)
pFunc( GetCurrentProcess(), 0, imgName, &len );
else
GetModuleFileNameW( NULL, imgName, len );
return GetParent( imgName );
}
ProcessCore::ProcessCore()
: _native( nullptr )
{
LOAD_IMPORT( "GetProcessDEPPolicy", L"kernel32.dll" );
}
Native::Native( HANDLE hProcess, bool x86OS /*= false*/ )
: _hProcess( hProcess )
{
SYSTEM_INFO info = { { 0 } };
GetNativeSystemInfo( &info );
_pageSize = info.dwPageSize;
// x86 OS, emulate WOW64 processes
if (x86OS)
{
_wowBarrier.sourceWow64 = true;
_wowBarrier.targetWow64 = true;
_wowBarrier.type = wow_32_32;
_wowBarrier.x86OS = true;
}
else
{
BOOL wowSrc = FALSE, wowTgt = FALSE;
IsWow64Process( GetCurrentProcess(), &wowSrc );
IsWow64Process( _hProcess, &wowTgt );
_wowBarrier.sourceWow64 = (wowSrc == TRUE);
_wowBarrier.targetWow64 = (wowTgt == TRUE);
if (wowSrc == TRUE && wowTgt == TRUE)
_wowBarrier.type = wow_32_32;
else if (wowSrc == FALSE && wowTgt == FALSE)
_wowBarrier.type = wow_64_64;
else if (wowSrc == TRUE)
_wowBarrier.type = wow_32_64;
else
_wowBarrier.type = wow_64_32;
}
HMODULE hNtdll = GetModuleHandleW( L"ntdll.dll" );
HMODULE hKernel32 = GetModuleHandleW( L"kernel32.dll" );
LOAD_IMPORT( "NtQueryInformationProcess", hNtdll );
LOAD_IMPORT( "NtSetInformationProcess", hNtdll );
LOAD_IMPORT( "NtQueryInformationThread", hNtdll );
LOAD_IMPORT( "NtDuplicateObject", hNtdll );
LOAD_IMPORT( "NtQueryObject", hNtdll );
LOAD_IMPORT( "NtQuerySection", hNtdll );
LOAD_IMPORT( "RtlCreateActivationContext", hNtdll );
LOAD_IMPORT( "NtQueryVirtualMemory", hNtdll );
LOAD_IMPORT( "NtCreateThreadEx", hNtdll );
LOAD_IMPORT( "NtLockVirtualMemory", hNtdll );
LOAD_IMPORT( "NtSuspendProcess", hNtdll );
LOAD_IMPORT( "NtResumeProcess", hNtdll );
LOAD_IMPORT( "Wow64GetThreadContext", hKernel32 );
LOAD_IMPORT( "Wow64SetThreadContext", hKernel32 );
LOAD_IMPORT( "Wow64SuspendThread", hKernel32 );
}
