| 75 | } |
| 76 | |
| 77 | ComFlags WinSys::Thread::GetComFlags() const { |
| 78 | THREAD_BASIC_INFORMATION tbi; |
| 79 | auto status = ::NtQueryInformationThread(_handle, ThreadBasicInformation, &tbi, sizeof(tbi), nullptr); |
| 80 | if (!NT_SUCCESS(status)) |
| 81 | return ComFlags::Error; |
| 82 | |
| 83 | if (tbi.TebBaseAddress == 0) |
| 84 | return ComFlags::Error; |
| 85 | |
| 86 | bool is64Bit = SystemInformation::GetBasicSystemInfo().MaximumAppAddress > (void*)(1LL << 32); |
| 87 | auto pid = ::GetProcessIdOfThread(_handle); |
| 88 | auto process = Process::OpenById(pid, ProcessAccessMask::QueryLimitedInformation | ProcessAccessMask::VmRead); |
| 89 | if (!process) |
| 90 | return ComFlags::Error; |
| 91 | |
| 92 | void* ole = nullptr; |
| 93 | bool wow = false; |
| 94 | auto teb = tbi.TebBaseAddress; |
| 95 | if (!is64Bit || process->IsWow64Process()) { |
| 96 | wow = true; |
| 97 | auto offset = offsetof(TEB32, ReservedForOle); |
| 98 | ::ReadProcessMemory(process->GetHandle(), (BYTE*)teb + offset, &ole, sizeof(ULONG), nullptr); |
| 99 | } |
| 100 | else { |
| 101 | ::ReadProcessMemory(process->GetHandle(), (BYTE*)teb + offsetof(TEB, ReservedForOle), &ole, sizeof(ole), nullptr); |
| 102 | } |
| 103 | if (ole == nullptr) |
| 104 | return ComFlags::None; |
| 105 | |
| 106 | BYTE buffer[32]; |
| 107 | if (!::ReadProcessMemory(process->GetHandle(), ole, buffer, sizeof(buffer), nullptr)) |
| 108 | return ComFlags::Error; |
| 109 | |
| 110 | auto flags = wow ? (buffer + 12) : (buffer + 20); |
| 111 | return ComFlags(*(DWORD*)flags); |
| 112 | } |
| 113 | |
| 114 | bool WinSys::Thread::IsValid() const { |
| 115 | return _handle != nullptr; |
no test coverage detected