C++ IsWow64Process函数代码示例

NTSTATUS kuhl_m_standard_version(int argc, wchar_t * argv[])
{
	BOOL isWow64;
	#ifdef _M_X64
	isWow64 = TRUE;
	#else
	if(IsWow64Process(GetCurrentProcess(), &isWow64))
	#endif
	{
		kprintf(
			L"\n" MIMIKATZ L" " MIMIKATZ_VERSION L" (arch " MIMIKATZ_ARCH L")\n"
			L"NT     -  Windows NT %u.%u build %u (arch x%s)\n",
			MIMIKATZ_NT_MAJOR_VERSION, MIMIKATZ_NT_MINOR_VERSION, MIMIKATZ_NT_BUILD_NUMBER, isWow64 ? L"64" : L"86"
			);
	}
	return STATUS_SUCCESS;
}

/******************************************************************
 *      DllMain
 */
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        msi_hInstance = hinstDLL;
        DisableThreadLibraryCalls(hinstDLL);
        IsWow64Process( GetCurrentProcess(), &is_wow64 );
        break;
    case DLL_PROCESS_DETACH:
        msi_dialog_unregister_class();
        msi_free_handle_table();
        msi_free( gszLogFile );
        break;
    }
    return TRUE;
}

// convert process name to id
DWORD name2pid (char name[], int cpu_mode)
{
  HANDLE         hSnap, hProc;
  PROCESSENTRY32 pe32;
  DWORD          dwId=0;
  BOOL           bWow64;

  // get snapshot of all process running
  hSnap = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, 0);
  
  if (hSnap != INVALID_HANDLE_VALUE) {
    pe32.dwSize = sizeof (PROCESSENTRY32);

    if (Process32First (hSnap, &pe32)) {
      do {
        // is this what we're looking for?
        if (!lstrcmpi (pe32.szExeFile, name)) 
        {
          if (cpu_mode!=0)
          {
            hProc=OpenProcess (PROCESS_QUERY_INFORMATION, FALSE, pe32.th32ProcessID);
            if (hProc!=NULL) {
              bWow64=FALSE;
              IsWow64Process (hProc, &bWow64);
              CloseHandle (hProc);
              
              // if wow64 and excluding 32, continue
              if (bWow64 && cpu_mode==32) continue;
              // if wow64 and excluding 64, save it
              if (bWow64 && cpu_mode==64) continue;
              
              dwId = pe32.th32ProcessID;
              break;
            }
          } else {
            dwId = pe32.th32ProcessID;
            break;
          }
        }
      } while (Process32Next (hSnap, &pe32));
    }
    CloseHandle (hSnap);
  }
  return dwId;
}

std::string get_sysinfo()
{
#ifdef _WIN32

	std::ostringstream oss;
	LPSTR filePath = new char[MAX_PATH];
	UINT blockSize;
	VS_FIXEDFILEINFO *fixedFileInfo;

	GetSystemDirectoryA(filePath, MAX_PATH);
	PathAppendA(filePath, "kernel32.dll");

	DWORD dwVersionSize = GetFileVersionInfoSizeA(filePath, NULL);
	LPBYTE lpVersionInfo = new BYTE[dwVersionSize];

	GetFileVersionInfoA(filePath, 0, dwVersionSize, lpVersionInfo);
	VerQueryValueA(lpVersionInfo, "\\", (LPVOID *)&fixedFileInfo, &blockSize);

	oss << "Windows/"
		<< HIWORD(fixedFileInfo->dwProductVersionMS) << '.' // Major
		<< LOWORD(fixedFileInfo->dwProductVersionMS) << '.' // Minor
		<< HIWORD(fixedFileInfo->dwProductVersionLS) << ' '; // Build

	#ifdef _WIN64
	oss << "x86_64";
	#else
	BOOL is64 = FALSE;
	if (IsWow64Process(GetCurrentProcess(), &is64) && is64)
		oss << "x86_64"; // 32-bit app on 64-bit OS
	else
		oss << "x86";
	#endif

	delete[] lpVersionInfo;
	delete[] filePath;

	return oss.str();
#else
	struct utsname osinfo;
	uname(&osinfo);
	return std::string(osinfo.sysname) + "/"
		+ osinfo.release + " " + osinfo.machine;
#endif
}

void LoadDrivers()
{
    if (!gCAProfAPISharedMapFile)
    {
        InitializeProfAPISharedObj();
    }

    if (!gPwrProfSharedMapFile)
    {
        InitializePwrProfSharedObj();
    }

    if (!gDriverHandlePcore)
    {
        wchar_t drivername[nBufferSize + 1];
        wchar_t systemDir[MAX_PATH];
        systemDir[0] = '\0';
        GetSystemDirectory(systemDir, MAX_PATH);
        PVOID oldValue = nullptr;
        BOOL isSys64;
        IsWow64Process(GetCurrentProcess(), &isSys64);

        if (isSys64)
        {
            isSys64 = Wow64DisableWow64FsRedirection(&oldValue);
        }

        swprintf(drivername, nBufferSize, L"%s%s", systemDir, L"\\drivers\\PCORE");
        OpenAmdDriver((LPCTSTR)drivername, &gDriverHandlePcore);

        swprintf(drivername, nBufferSize, L"%s%s", systemDir, L"\\drivers\\CpuProf");
        OpenAmdDriver((LPCTSTR)drivername, &gDriverHandleCAProf);

        // Install the Power Profiler driver only on AMD supported platforms
        swprintf(drivername, nBufferSize, L"%s%s", systemDir, L"\\drivers\\AMDTPwrProf");
        OpenAmdDriver((LPCTSTR)drivername, &gDriverHandlePwrProf);

        if (isSys64)
        {
            Wow64RevertWow64FsRedirection(oldValue);
        }
    }
}

int main(int argc, char *argv[]) {
#ifndef __WIN64__
    if (library_loader loader = {L"kernel32.dll"})
	if (auto IsWow64Process = loader.symbol< BOOL WINAPI (HANDLE, BOOL*) >("IsWow64Process")) {
	    BOOL runningOn64 = false;
	    if (IsWow64Process(GetCurrentProcess(), &runningOn64) && runningOn64) {
		MessageBox(0, L"The 32-bit version of kiosh will not work on a 64-bit OS.  Please use the 64-bit version instead.", L"kiosh", MB_ICONERROR);
		return EXIT_FAILURE;
	    }
	}
#endif

    if (argc < 2) {
	MessageBox(0, L"Usage: kiosh <command to run>", L"kiosh", MB_ICONERROR);
	return EXIT_FAILURE;
    }

    runInstallUninstallStubs();

    event(os_version().major() >= 6 ? L"ShellDesktopSwitchEvent" : L"msgina: ShellReadyEvent").set();

    // FIXME: As Windows lacks anything that even remotely resembles sane quote handling wrt command line arguments,
    //        we don't pretend to really get it right.  We just remove what looks like being the first word (i.e. argv[0])
    //        and pass the rest untouched.
    std::wstring cmd = {GetCommandLine()};
    if (cmd.empty()) {
	MessageBox(0, L"Internal error", L"kiosh", MB_ICONERROR);
	return EXIT_FAILURE;
    }
    std::size_t p = cmd.find(cmd[0] == L'"' ? L'"' : L' ', 1);
    if (p == cmd.npos) {
	MessageBox(0, L"Invalid command line", L"kiosh", MB_ICONERROR);
	return EXIT_FAILURE;
    }
    cmd.erase(0, p + 1);

    // FIXME: Get this ugliness out of the main application code
    STARTUPINFO si = {cb: sizeof(si)};
    PROCESS_INFORMATION pi;
    CreateProcess(0, const_cast< wchar_t* >(cmd.c_str()), 0, 0, FALSE, 0, 0, 0, &si, &pi);

    return EXIT_SUCCESS;
}

    //
    // system warnings
    //
    void logCommonStartupWarnings() {
        // each message adds a leading and a trailing newline

        bool warned = false;
        {
            const char * foo = strchr(versionString , '.') + 1;
            int bar = atoi(foo);
            if ((2 * (bar / 2)) != bar) {
                log() << startupWarningsLog;
                log() << "** NOTE: This is a development version (" << versionString
                      << ") of MongoDB." << startupWarningsLog;
                log() << "**       Not recommended for production." << startupWarningsLog;
                warned = true;
            }
        }

#if defined(_WIN32) && !defined(_WIN64)
        // Warn user that they are running a 32-bit app on 64-bit Windows
        BOOL wow64Process;
        BOOL retWow64 = IsWow64Process(GetCurrentProcess(), &wow64Process);
        if (retWow64 && wow64Process) {
            log() << "** NOTE: This is a 32-bit MongoDB binary running on a 64-bit operating"
                    << startupWarningsLog;
            log() << "**      system. Switch to a 64-bit build of MongoDB to"
                    << startupWarningsLog;
            log() << "**      support larger databases." << startupWarningsLog;
            warned = true;
        }
#endif

#if !defined(_WIN32)
        if (getuid() == 0) {
            log() << "** WARNING: You are running this process as the root user, "
                  << "which is not recommended." << startupWarningsLog;
            warned = true;
        }
#endif

        if (warned) {
            log() << startupWarningsLog;
        }
    }

void ProcessInfo::getExtraInfo(BSONObjBuilder& info) {
    MEMORYSTATUSEX mse;
    mse.dwLength = sizeof(mse);
    PROCESS_MEMORY_COUNTERS pmc;
    if (GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc))) {
        info.append("page_faults", static_cast<int>(pmc.PageFaultCount));
        info.append("usagePageFileMB", static_cast<int>(pmc.PagefileUsage / 1024 / 1024));
    }
    if (GlobalMemoryStatusEx(&mse)) {
        info.append("totalPageFileMB", static_cast<int>(mse.ullTotalPageFile / 1024 / 1024));
        info.append("availPageFileMB", static_cast<int>(mse.ullAvailPageFile / 1024 / 1024));
        info.append("ramMB", static_cast<int>(mse.ullTotalPhys / 1024 / 1024));
    }

#ifndef _WIN64
    BOOL wow64Process;
    BOOL retWow64 = IsWow64Process(GetCurrentProcess(), &wow64Process);
    info.append("wow64Process", static_cast<bool>(retWow64 && wow64Process));
#endif
}

//------------------------------------------------------------------------------
// Returns TRUE if we are running on a 64-bit OS in WoW, FALSE otherwise.
BOOL RunningInWow64()
{
#ifdef PLATFORM_UNIX
    return FALSE;
#else
    static int s_Wow64Process;

    if (s_Wow64Process == 0)
    {
        BOOL fWow64Process = FALSE;

        if (!IsWow64Process(GetCurrentProcess(), &fWow64Process))
            fWow64Process = FALSE;

        s_Wow64Process = fWow64Process ? 1 : -1;
    }

    return (s_Wow64Process == 1) ? TRUE : FALSE;
#endif
}

DWORD64 WoW64dm::LoadLibrary64( const wchar_t* path )
{
    BOOL isWOW = FALSE;
    IsWow64Process(_hProcess, &isWOW);

    // Inject into x64
    if(isWOW == FALSE)
    {
        DWORD64 memptr = 0;

        VirtualAllocEx64(memptr, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

        if(memptr != 0)
        {
            DWORD size = 0;

            DWORD64 hKernel32 = GetModuleHandle64(L"Kernel32.dll", &size);
            DWORD64 pLoadLib  = GetProcAddress64(hKernel32, size, "LoadLibraryW");

            if(pLoadLib != 0 && WriteProcessMemory64(memptr, (LPVOID)path, (wcslen(path) + 1)*sizeof(wchar_t), 0) == STATUS_SUCCESS)
            {
                DWORD64 status = 0;

                if(CreateRemoteThread64(pLoadLib, memptr, status, true) != FALSE && status == STATUS_SUCCESS)
                {
                    VirtualFreeEx64(memptr, 0x1000, MEM_RELEASE);
                    return status;
                }
            }

            VirtualFreeEx64(memptr, 0x1000, MEM_FREE);
        }

        return FALSE;
    }
    // Inject into WOW64
    else
    {
        return LoadLibraryRemoteWOW64(path);
    }
}

BOOL CBiosDlg::OnInitDialog()
{
	CDialog::OnInitDialog();

	// TODO:  Add extra initialization here
	_tcscpy(m_szTempDir,_tgetenv(TEXT("SystemRoot")));
	_tcscat(m_szTempDir,TEXT("\\Temp"));
	GetCurrentDirectory(2048,m_curPath);
	typedef BOOL (WINAPI* ChangeWindowMessageFilterFn)( UINT, DWORD );
	HMODULE hUserMod = NULL;
	BOOL bResult = FALSE;
	hUserMod = LoadLibrary(TEXT("user32.dll"));
	if (hUserMod)
	{
		ChangeWindowMessageFilterFn pfnChangeWindowMessageFilter = (ChangeWindowMessageFilterFn)GetProcAddress( hUserMod, "ChangeWindowMessageFilter" );
		if (pfnChangeWindowMessageFilter)
		{
			pfnChangeWindowMessageFilter(WM_DROPFILES, 1); // 1-MSGFLT_ADD, 2-MSGFLT_REMOVE
			pfnChangeWindowMessageFilter(0x0049, 1); // 1-MSGFLT_ADD, 2-MSGFLT_REMOVE
		}

		FreeLibrary(hUserMod);
	}
	m_nBiosSize = 0;
	m_bExistKey = FALSE;
	m_strSSN = TEXT("");
	CCpuInfo ci;
	mbstowcs(m_wszCpuInfo,ci.GetBrand(),49);
	IsWow64Process(GetCurrentProcess(),&m_bIsx64);
	CBiosInfo* pInfo = ((CHWToolApp*)AfxGetApp())->m_BiosInfo;
	SetDlgItemText(IDC_IBV,pInfo->m_BiosInfoW.m_wszIVN);
	SetDlgItemText(IDC_BIOSVER,pInfo->m_BiosInfoW.m_wszIV);
	SetDlgItemText(IDC_BIOSDATE,pInfo->m_BiosInfoW.m_wszID);
	SetDlgItemText(IDC_BIOSHASH,pInfo->m_BiosInfoW.m_wszSK);
	SetDlgItemText(IDC_PID,pInfo->m_BiosInfoW.m_wszSM);
	SetDlgItemText(IDC_MODEL,pInfo->m_BiosInfoW.m_wszSP);
	SetDlgItemText(IDC_SERIALNUM,pInfo->m_BiosInfoW.m_wszSS);
	SetDlgItemText(IDC_MBPID,pInfo->m_BiosInfoW.m_wszBM);
	return TRUE;  // return TRUE unless you set the focus to a control
	// EXCEPTION: OCX Property Pages should return FALSE
}

int CSysInfo::GetKernelBitness(void)
{
  static int kernelBitness = -1;
  if (kernelBitness == -1)
  {
#ifdef TARGET_WINDOWS
    SYSTEM_INFO si;
    GetNativeSystemInfo(&si);
    if (si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL || si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_ARM)
      kernelBitness = 32;
    else if (si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64)
      kernelBitness = 64;
    else
    {
      BOOL isWow64 = FALSE;
      if (IsWow64Process(GetCurrentProcess(), &isWow64) && isWow64) // fallback
        kernelBitness = 64;
    }
#elif defined(TARGET_DARWIN_IOS)
    // Note: OS X return x86 CPU type without CPU_ARCH_ABI64 flag
    const NXArchInfo* archInfo = NXGetLocalArchInfo();
    if (archInfo)
      kernelBitness = ((archInfo->cputype & CPU_ARCH_ABI64) != 0) ? 64 : 32;
#elif defined(TARGET_POSIX)
    struct utsname un;
    if (uname(&un) == 0)
    {
      std::string machine(un.machine);
      if (machine == "x86_64" || machine == "amd64" || machine == "arm64" || machine == "aarch64" || machine == "ppc64" ||
          machine == "ia64" || machine == "mips64")
        kernelBitness = 64;
      else
        kernelBitness = 32;
    }
#endif
    if (kernelBitness == -1)
      kernelBitness = 0; // can't detect
  }

  return kernelBitness;
}

BOOL
unicorn::IPluginInfo::isWow64()
{
    BOOL bIsWow64 = FALSE;

    //IsWow64Process is not available on all supported versions of Windows.
    //Use GetModuleHandle to get a handle to the DLL that contains the function
    //and GetProcAddress to get a pointer to the function if available.

    void* fnIsWow64Process = GetProcAddress(
    GetModuleHandle(TEXT("kernel32")),"IsWow64Process");

    if(NULL != fnIsWow64Process)
    {
        if (!IsWow64Process(GetCurrentProcess(),&bIsWow64))
        {
            //handle error
        }
    }
    return bIsWow64;
}

/**
 * Makes sure a library named "Subversion" exists and has our template
 * set to it.
 * If the library already exists, the template is set.
 * If the library doesn't exist, it is created.
 */
void EnsureSVNLibrary(bool bCreate /* = true*/)
{
    // when running the 32-bit version of TortoiseProc on x64 OS,
    // we must not create the library! This would break
    // the library in the x64 explorer.
    BOOL bIsWow64 = FALSE;
    IsWow64Process(GetCurrentProcess(), &bIsWow64);
    if (bIsWow64)
        return;

    CComPtr<IShellLibrary> pLibrary = NULL;
    if (FAILED(OpenShellLibrary(L"Subversion", &pLibrary)))
    {
        if (!bCreate)
            return;
        if (FAILED(SHCreateLibrary(IID_PPV_ARGS(&pLibrary))))
            return;

        // Save the new library under the user's Libraries folder.
        CComPtr<IShellItem> pSavedTo = NULL;
        if (FAILED(pLibrary->SaveInKnownFolder(FOLDERID_UsersLibraries, L"Subversion", LSF_OVERRIDEEXISTING, &pSavedTo)))
            return;
    }

    if (SUCCEEDED(pLibrary->SetFolderType(IsWindows8OrGreater() ? FOLDERTYPEID_Documents : FOLDERTYPEID_SVNWC)))
    {
        // create the path for the icon
        CString path;
        CString appDir = CPathUtils::GetAppDirectory();
        if (appDir.GetLength() < MAX_PATH)
        {
            TCHAR buf[MAX_PATH] = {0};
            PathCanonicalize(buf, (LPCTSTR)appDir);
            appDir = buf;
        }
        path.Format(L"%s%s,-%d", (LPCTSTR)appDir, L"TortoiseProc.exe", IsWin10OrLater() ? IDI_LIBRARY_WIN10 : IDI_LIBRARY);
        pLibrary->SetIcon((LPCTSTR)path);
        pLibrary->Commit();
    }
}

/// <summary>
/// Initialize some internal data
/// </summary>
/// <returns>Status code</returns>
NTSTATUS ProcessCore::Init()
{
    // Detect x86 OS
    SYSTEM_INFO info = { { 0 } };
    GetNativeSystemInfo( &info );

    if (info.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
    {
        _native.reset( new x86Native( _hProcess ) );
    }
    else
    {
        // Detect wow64 barrier
        BOOL wowSrc = FALSE;
        IsWow64Process( GetCurrentProcess(), &wowSrc );

        if (wowSrc == TRUE)
            _native.reset( new NativeWow64( _hProcess ) );
        else
            _native.reset( new Native( _hProcess ) );
    }

    // Get DEP info
    // For native x64 processes DEP is always enabled
    if (_native->GetWow64Barrier().targetWow64 == false)
    {
        _dep = true;
    }
    else
    {
        DWORD flags = 0;
        BOOL perm = 0;

        if (SAFE_CALL( GetProcessDEPPolicy, _hProcess, &flags, &perm ))
            _dep = (flags & PROCESS_DEP_ENABLE) != 0;
    }

    return STATUS_SUCCESS;
}