From 18a463bc2fd6b67ff2e08ec4b4eabd92b3071dc1 Mon Sep 17 00:00:00 2001 From: Doug Coleman Date: Mon, 15 Jul 2013 15:19:07 -0700 Subject: [PATCH] tools.ps.windows: Fix offsets for win64. --- basis/tools/ps/windows/windows.factor | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/basis/tools/ps/windows/windows.factor b/basis/tools/ps/windows/windows.factor index eff6ce997f..6076b9fb56 100644 --- a/basis/tools/ps/windows/windows.factor +++ b/basis/tools/ps/windows/windows.factor @@ -53,17 +53,26 @@ IN: tools.ps.windows [ dup query-information-process PebBaseAddress>> read-peb ] bi ] with-destructors ; +: slot-offset-by-name ( struct-class name -- value/f ) + [ struct-slots ] dip '[ name>> _ = ] find swap [ offset>> ] when ; + :: read-args ( handle -- string/f ) handle &dispose drop handle query-information-process :> process-basic-information handle process-basic-information PebBaseAddress>> [ - 0x10 PVOID heap-size read-process-memory + PEB "ProcessParameters" slot-offset-by-name + PVOID heap-size + read-process-memory PVOID deref :> args-offset args-offset ALIEN: 0 = [ f ] [ - handle args-offset 0x40 UNICODE_STRING heap-size read-process-memory + handle + args-offset + RTL_USER_PROCESS_PARAMETERS "CommandLine" slot-offset-by-name + UNICODE_STRING heap-size + read-process-memory [ handle ] dip UNICODE_STRING deref [ Buffer>> 0 ] [ Length>> ] bi read-process-memory utf16n decode