The current process
| 593 | |
| 594 | |
| 595 | class CurrentProcess(Process): |
| 596 | """The current process""" |
| 597 | get_peb = None |
| 598 | |
| 599 | get_peb_32_code = x86.MultipleInstr() |
| 600 | get_peb_32_code += x86.Mov('EAX', x86.mem('fs:[0x30]')) |
| 601 | get_peb_32_code += x86.Ret() |
| 602 | get_peb_32_code = get_peb_32_code.get_code() |
| 603 | |
| 604 | get_peb_64_code = x64.MultipleInstr() |
| 605 | get_peb_64_code += x64.Mov('RAX', x64.mem('gs:[0x60]')) |
| 606 | get_peb_64_code += x64.Ret() |
| 607 | get_peb_64_code = get_peb_64_code.get_code() |
| 608 | |
| 609 | allocator = native_exec.native_function.allocator |
| 610 | |
| 611 | name = "CurrentProcess" # Used by Winthread for __repr__ |
| 612 | |
| 613 | # Use RtlGetCurrentPeb ? |
| 614 | def get_peb_builtin(self): |
| 615 | if self.get_peb is not None: |
| 616 | return self.get_peb |
| 617 | if self.bitness == 32: |
| 618 | get_peb = native_exec.create_function(self.get_peb_32_code, [PVOID]) |
| 619 | else: |
| 620 | get_peb = native_exec.create_function(self.get_peb_64_code, [PVOID]) |
| 621 | self.get_peb = get_peb |
| 622 | return get_peb |
| 623 | |
| 624 | def _get_handle(self): |
| 625 | return winproxy.GetCurrentProcess() |
| 626 | |
| 627 | @utils.fixedpropety |
| 628 | def limited_handle(self): |
| 629 | return winproxy.GetCurrentProcess() |
| 630 | |
| 631 | |
| 632 | def __del__(self): |
| 633 | pass |
| 634 | |
| 635 | @property |
| 636 | def pid(self): |
| 637 | """Process ID |
| 638 | |
| 639 | :type: :class:`int` |
| 640 | """ |
| 641 | return os.getpid() |
| 642 | |
| 643 | @utils.fixedpropety # leave it has fixed property as we don't care if CurrentProcess is never collected |
| 644 | def peb(self): |
| 645 | """The Process Environment Block of the current process |
| 646 | |
| 647 | :type: :class:`PEB` |
| 648 | """ |
| 649 | return PEB.from_address(self.get_peb_builtin()()) |
| 650 | |
| 651 | @utils.fixedpropety |
| 652 | def bitness(self): |
no test coverage detected