#pragma once #include "../Include/NativeStructures.h" #include "../Include/HandleGuard.h" #include "../Subsystem/Wow64Subsystem.h" #include "../Subsystem/x86Subsystem.h" #include #include namespace blackbone { class ProcessCore { public: /// /// Check if target process is running in WOW64 mode /// /// true if process is WOW64 BLACKBONE_API inline bool isWow64() const { return _native->GetWow64Barrier().targetWow64; } /// /// Get process handle /// /// Process handle BLACKBONE_API inline HANDLE handle() const { return _hProcess; } /// /// Get process ID /// /// Process ID BLACKBONE_API inline DWORD pid() const { return _pid; } /// /// Get process data execution prevention state /// /// true if DEP is enabled for process BLACKBONE_API inline bool DEP() const { return _dep; }; /// /// Get system routines /// /// BLACKBONE_API inline Native* native() { return _native.get(); } /// /// Get WOW64 PEB /// /// Retrieved PEB32 /// PEB pointer BLACKBONE_API inline ptr_t peb32( _PEB32* ppeb = nullptr ) { return _native->getPEB( ppeb ); } /// /// Get native PEB /// /// Retrieved PEB64 /// PEB pointer BLACKBONE_API inline ptr_t peb64( _PEB64* ppeb = nullptr ) { return _native->getPEB( ppeb ); } /// /// Get PEB /// /// Retrieved PEB /// PEB pointer template BLACKBONE_API inline ptr_t peb( _PEB_T* ppeb = nullptr ) { return _native->getPEB( ppeb ); } /// /// Check if process is a protected process /// /// true if protected BLACKBONE_API bool isProtected(); private: friend class Process; using ptrNative = std::unique_ptr; private: ProcessCore(); ProcessCore( const ProcessCore& ) = delete; ~ProcessCore(); /// /// Attach to existing process /// /// Process ID /// Access mask /// Status NTSTATUS Open( DWORD pid, DWORD access ); /// /// Attach to existing process by handle /// /// Process handle /// Status NTSTATUS Open( HANDLE handle ); /// /// Initialize some internal data /// /// Status code NTSTATUS Init(); /// /// Close current process handle /// void Close(); private: Handle _hProcess; // Process handle DWORD _pid = 0; // Process ID ptrNative _native; // Api wrapper bool _dep = true; // DEP state for process }; }