1
0
Форкнуть 0

alm: enable remote url sniffing on 32-bit Windows.

Due to struct size differences, the remote URL capture via command line sniffing failed.

Instead of relying on fixed size and offset value, the p/invoke layer should use the offset and size values which align with the bitness of the process.
This commit is contained in:
J Wyman ∞ 2018-06-08 11:21:01 -04:00
Родитель 19660c2398
Коммит 8b6bcfd4a5
2 изменённых файлов: 53 добавлений и 32 удалений

Просмотреть файл

@ -153,9 +153,11 @@ namespace Microsoft.Alm.Authentication.Git
// Gloves off...
unsafe
{
var basicInfo = new Win32.ProcessBasicInformation { };
int bytesRead = 0;
long outResult = 0;
var basicInfo = new Win32.ProcessBasicInformation { };
// Ask the OS for information about the process, this will include the address of the PEB or
// Process Environment Block, which contains useful information (like the offset of the process' parameters).
var hresult = Win32.Ntdll.QueryInformationProcess(processHandle: processHandle,
@ -173,7 +175,6 @@ namespace Microsoft.Alm.Authentication.Git
return false;
}
int bytesRead = 0;
var peb = new Win32.ProcessEnvironmentBlock { };
// Now that we know the offsets of the process' parameters, read it because
@ -187,7 +188,7 @@ namespace Microsoft.Alm.Authentication.Git
{
var error = Win32.Kernel32.GetLastError();
Trace.WriteLine($"failed to read process environment block [{error}].");
Trace.WriteLine($"failed to read process environment block [{error}] ({bytesRead:n0} bytes read).");
return false;
}
@ -201,11 +202,11 @@ namespace Microsoft.Alm.Authentication.Git
buffer: &processParameters,
bufferSize: sizeof(Win32.PebProcessParameters),
bytesRead: out bytesRead)
|| bytesRead != sizeof(Win32.PebProcessParameters))
|| bytesRead < sizeof(Win32.PebProcessParameters))
{
var error = Win32.Kernel32.GetLastError();
Trace.WriteLine($"failed to read process parameters [{error}].");
Trace.WriteLine($"failed to read process parameters [{error}] ({bytesRead:n0} bytes read).");
return false;
}
@ -223,7 +224,7 @@ namespace Microsoft.Alm.Authentication.Git
{
var error = Win32.Kernel32.GetLastError();
Trace.WriteLine($"failed to read process image path [{error}].");
Trace.WriteLine($"failed to read process image path [{error}] ({bytesRead:n0} bytes read).");
}
else
{
@ -241,7 +242,7 @@ namespace Microsoft.Alm.Authentication.Git
{
var error = Win32.Kernel32.GetLastError();
Trace.WriteLine($"failed to read process command line [{error}].");
Trace.WriteLine($"failed to read process command line [{error}] ({bytesRead:n0} bytes read).");
}
else
{

Просмотреть файл

@ -369,40 +369,57 @@ namespace Microsoft.Alm.Win32
public string ExeFileName;
}
[StructLayout(LayoutKind.Explicit, Size = 0x30)]
[StructLayout(LayoutKind.Sequential)]
internal unsafe struct ProcessEnvironmentBlock
{
[FieldOffset(0x02)]
private byte _offset_0x02;
[FieldOffset(0x20)]
private PebProcessParameters* _offset_0x20;
fixed byte _[256];
public bool IsBeingDebugged
{
get { return _offset_0x02 != 0; }
get { fixed (byte* p = _) { return p[2] != 0; } }
}
public PebProcessParameters* ProcessParameters
{
get { return _offset_0x20; }
get
{
fixed (byte* p = _)
{
return IntPtr.Size == 4
? *((PebProcessParameters**)(p + 0x10))
: *((PebProcessParameters**)(p + 0x20));
}
}
}
}
[StructLayout(LayoutKind.Explicit, Size = 104)]
[StructLayout(LayoutKind.Sequential, Size = 128)]
internal unsafe struct PebProcessParameters
{
[FieldOffset(0x60)]
private UnicodeString _offset_0x60;
[FieldOffset(0x70)]
private UnicodeString _offset_0x70;
fixed byte _[128];
public UnicodeString CommandLine
{
get { return _offset_0x70; }
get
{
fixed (byte* p = _)
{
return IntPtr.Size == 4
? *((UnicodeString*)(p + 0x40))
: *((UnicodeString*)(p + 0x70));
}
}
}
public UnicodeString ImagePathName
{
get { return _offset_0x60; }
get
{
fixed (byte* p = _)
{
return IntPtr.Size == 4
? *((UnicodeString*)(p + 0x38))
: *((UnicodeString*)(p + 0x60));
}
}
}
}
@ -504,22 +521,25 @@ namespace Microsoft.Alm.Win32
/// <summary>
/// Represents a Unicode encoded string.
/// </summary>
[StructLayout(LayoutKind.Explicit, Pack = 1)]
[StructLayout(LayoutKind.Sequential)]
internal unsafe struct UnicodeString
{
[FieldOffset(0x00)]
private ushort _field1;
[FieldOffset(0x02)]
private ushort _field2;
[FieldOffset(0x08)]
private IntPtr _field3;
fixed byte _[16];
/// <summary>
/// Gets the pointer to the character data buffer.
/// </summary>
public char* Buffer
{
get { return (char*)_field3.ToPointer(); }
get
{
fixed (byte* p = _)
{
return (IntPtr.Size == 4)
? *((char**)(p + 0x04))
: *((char**)(p + 0x08));
}
}
}
/// <summary>
@ -527,7 +547,7 @@ namespace Microsoft.Alm.Win32
/// </summary>
public int Length
{
get { return _field1 / sizeof(char); }
get { fixed (byte* p = _) { return *((ushort*)(p + 0x00)) / sizeof(char); } }
}
/// <summary>
@ -535,7 +555,7 @@ namespace Microsoft.Alm.Win32
/// </summary>
public int MaximumSize
{
get { return _field2; }
get { fixed (byte* p = _) { return *((ushort*)(p + 0x02)); } }
}
}
}