diff --git a/proc/registers_windows_amd64.go b/proc/registers_windows_amd64.go index 7690d27dbb5e199685934f3a6d93788c02f8f6b2..75f0b19d34b101614bb4bdaeeb0f5e7a589b3a07 100644 --- a/proc/registers_windows_amd64.go +++ b/proc/registers_windows_amd64.go @@ -1,10 +1,12 @@ package proc -// #include "threads_windows.h" +// #include import "C" import ( "bytes" "fmt" + "syscall" + "unsafe" ) // Regs represents CPU registers on an AMD64 processor. @@ -121,12 +123,11 @@ func registers(thread *Thread) (Registers, error) { return nil, fmt.Errorf("failed to read ThreadContext") } - var threadInfo C.THREAD_BASIC_INFORMATION - res = C.thread_basic_information(C.HANDLE(thread.os.hThread), &threadInfo) - if res == C.FALSE { + var threadInfo _THREAD_BASIC_INFORMATION + status := _NtQueryInformationThread(syscall.Handle(thread.os.hThread), ThreadBasicInformation, uintptr(unsafe.Pointer(&threadInfo)), uint32(unsafe.Sizeof(threadInfo)), nil) + if !_NT_SUCCESS(status) { return nil, fmt.Errorf("failed to get thread_basic_information") } - tls := uintptr(threadInfo.TebBaseAddress) regs := &Regs{ rax: uint64(context.Rax), @@ -150,7 +151,7 @@ func registers(thread *Thread) (Registers, error) { cs: uint64(context.SegCs), fs: uint64(context.SegFs), gs: uint64(context.SegGs), - tls: uint64(tls), + tls: uint64(threadInfo.TebBaseAddress), } return regs, nil } diff --git a/proc/syscall_windows.go b/proc/syscall_windows.go new file mode 100644 index 0000000000000000000000000000000000000000..5fa59fe0bef20f8f873a664d462e11e7d65ccdc8 --- /dev/null +++ b/proc/syscall_windows.go @@ -0,0 +1,33 @@ +//go:generate go run $GOROOT/src/syscall/mksyscall_windows.go -output zsyscall_windows.go syscall_windows.go + +package proc + +import ( + "syscall" +) + +type _NTSTATUS int32 + +type _CLIENT_ID struct { + UniqueProcess syscall.Handle + UniqueThread syscall.Handle +} + +type _THREAD_BASIC_INFORMATION struct { + ExitStatus _NTSTATUS + TebBaseAddress uintptr + ClientId _CLIENT_ID + AffinityMask uintptr + Priority int32 + BasePriority int32 +} + +const ( + ThreadBasicInformation = 0 +) + +func _NT_SUCCESS(x _NTSTATUS) bool { + return x >= 0 +} + +//sys _NtQueryInformationThread(threadHandle syscall.Handle, infoclass int32, info uintptr, infolen uint32, retlen *uint32) (status _NTSTATUS) = ntdll.NtQueryInformationThread diff --git a/proc/threads_windows.c b/proc/threads_windows.c deleted file mode 100644 index 285e9b9012db996fb186652aa5ff86ea97af6f04..0000000000000000000000000000000000000000 --- a/proc/threads_windows.c +++ /dev/null @@ -1,16 +0,0 @@ -#include "threads_windows.h" - -typedef NTSTATUS (WINAPI *pNtQIT)(HANDLE, LONG, PVOID, ULONG, PULONG); - -WINBOOL thread_basic_information(HANDLE h, THREAD_BASIC_INFORMATION* addr) { - static pNtQIT NtQueryInformationThread = NULL; - if(NtQueryInformationThread == NULL) { - NtQueryInformationThread = (pNtQIT)GetProcAddress(GetModuleHandle("ntdll.dll"), "NtQueryInformationThread"); - if(NtQueryInformationThread == NULL) { - return 0; - } - } - - NTSTATUS status = NtQueryInformationThread(h, ThreadBasicInformation, addr, 48, 0); - return NT_SUCCESS(status); -} diff --git a/proc/threads_windows.h b/proc/threads_windows.h deleted file mode 100644 index 9a4d190eeed3c28de02acdd432ff78fd19565ed9..0000000000000000000000000000000000000000 --- a/proc/threads_windows.h +++ /dev/null @@ -1,15 +0,0 @@ -#include -#include - -typedef struct THREAD_BASIC_INFORMATION -{ - NTSTATUS ExitStatus; - PVOID TebBaseAddress; - CLIENT_ID ClientId; - ULONG_PTR AffinityMask; - LONG Priority; - LONG BasePriority; - -} THREAD_BASIC_INFORMATION,*PTHREAD_BASIC_INFORMATION; - -WINBOOL thread_basic_information(HANDLE h, PTHREAD_BASIC_INFORMATION addr); diff --git a/proc/zsyscall_windows.go b/proc/zsyscall_windows.go new file mode 100755 index 0000000000000000000000000000000000000000..35d044b3112ec9c8e85b91e82d979d33c1a2056d --- /dev/null +++ b/proc/zsyscall_windows.go @@ -0,0 +1,20 @@ +// MACHINE GENERATED BY 'go generate' COMMAND; DO NOT EDIT + +package proc + +import "unsafe" +import "syscall" + +var _ unsafe.Pointer + +var ( + modntdll = syscall.NewLazyDLL("ntdll.dll") + + procNtQueryInformationThread = modntdll.NewProc("NtQueryInformationThread") +) + +func _NtQueryInformationThread(threadHandle syscall.Handle, infoclass int32, info uintptr, infolen uint32, retlen *uint32) (status _NTSTATUS) { + r0, _, _ := syscall.Syscall6(procNtQueryInformationThread.Addr(), 5, uintptr(threadHandle), uintptr(infoclass), uintptr(info), uintptr(infolen), uintptr(unsafe.Pointer(retlen)), 0) + status = _NTSTATUS(r0) + return +}