提交 c61de7b0 编写于 作者: A Alex Brainman

[proc] use syscall package to call NtQueryInformationThread

I was hoping this will fix the issue below.
But there is more code that break new cgo rules.

Fixes #409 (partial)
上级 e2c455dd
package proc
// #include "threads_windows.h"
// #include <windows.h>
import "C"
import (
"bytes"
"fmt"
"syscall"
"unsafe"
)
// Regs represents CPU registers on an AMD64 processor.
......@@ -121,12 +123,11 @@ func registers(thread *Thread) (Registers, error) {
return nil, fmt.Errorf("failed to read ThreadContext")
}
var threadInfo C.THREAD_BASIC_INFORMATION
res = C.thread_basic_information(C.HANDLE(thread.os.hThread), &threadInfo)
if res == C.FALSE {
var threadInfo _THREAD_BASIC_INFORMATION
status := _NtQueryInformationThread(syscall.Handle(thread.os.hThread), ThreadBasicInformation, uintptr(unsafe.Pointer(&threadInfo)), uint32(unsafe.Sizeof(threadInfo)), nil)
if !_NT_SUCCESS(status) {
return nil, fmt.Errorf("failed to get thread_basic_information")
}
tls := uintptr(threadInfo.TebBaseAddress)
regs := &Regs{
rax: uint64(context.Rax),
......@@ -150,7 +151,7 @@ func registers(thread *Thread) (Registers, error) {
cs: uint64(context.SegCs),
fs: uint64(context.SegFs),
gs: uint64(context.SegGs),
tls: uint64(tls),
tls: uint64(threadInfo.TebBaseAddress),
}
return regs, nil
}
......
//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsyscall_windows.go syscall_windows.go
package proc
import (
"syscall"
)
type _NTSTATUS int32
type _CLIENT_ID struct {
UniqueProcess syscall.Handle
UniqueThread syscall.Handle
}
type _THREAD_BASIC_INFORMATION struct {
ExitStatus _NTSTATUS
TebBaseAddress uintptr
ClientId _CLIENT_ID
AffinityMask uintptr
Priority int32
BasePriority int32
}
const (
ThreadBasicInformation = 0
)
func _NT_SUCCESS(x _NTSTATUS) bool {
return x >= 0
}
//sys _NtQueryInformationThread(threadHandle syscall.Handle, infoclass int32, info uintptr, infolen uint32, retlen *uint32) (status _NTSTATUS) = ntdll.NtQueryInformationThread
#include "threads_windows.h"
typedef NTSTATUS (WINAPI *pNtQIT)(HANDLE, LONG, PVOID, ULONG, PULONG);
WINBOOL thread_basic_information(HANDLE h, THREAD_BASIC_INFORMATION* addr) {
static pNtQIT NtQueryInformationThread = NULL;
if(NtQueryInformationThread == NULL) {
NtQueryInformationThread = (pNtQIT)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryInformationThread");
if(NtQueryInformationThread == NULL) {
return 0;
}
}
NTSTATUS status = NtQueryInformationThread(h, ThreadBasicInformation, addr, 48, 0);
return NT_SUCCESS(status);
}
#include <windows.h>
#include <Winternl.h>
typedef struct THREAD_BASIC_INFORMATION
{
NTSTATUS ExitStatus;
PVOID TebBaseAddress;
CLIENT_ID ClientId;
ULONG_PTR AffinityMask;
LONG Priority;
LONG BasePriority;
} THREAD_BASIC_INFORMATION,*PTHREAD_BASIC_INFORMATION;
WINBOOL thread_basic_information(HANDLE h, PTHREAD_BASIC_INFORMATION addr);
// MACHINE GENERATED BY 'go generate' COMMAND; DO NOT EDIT
package proc
import "unsafe"
import "syscall"
var _ unsafe.Pointer
var (
modntdll = syscall.NewLazyDLL("ntdll.dll")
procNtQueryInformationThread = modntdll.NewProc("NtQueryInformationThread")
)
func _NtQueryInformationThread(threadHandle syscall.Handle, infoclass int32, info uintptr, infolen uint32, retlen *uint32) (status _NTSTATUS) {
r0, _, _ := syscall.Syscall6(procNtQueryInformationThread.Addr(), 5, uintptr(threadHandle), uintptr(infoclass), uintptr(info), uintptr(infolen), uintptr(unsafe.Pointer(retlen)), 0)
status = _NTSTATUS(r0)
return
}
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册