steve
/
factor
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

tools.ps.windows: Fix offsets for win64.

db4
Doug Coleman 2013-07-15 15:19:07 -07:00
parent b5484d33ba
commit 18a463bc2f
1 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
basis/tools/ps/windows/windows.factor
View File

@ -53,17 +53,26 @@ IN: tools.ps.windows
[ dup query-information-process PebBaseAddress>> read-peb ] bi [ dup query-information-process PebBaseAddress>> read-peb ] bi
] with-destructors ; ] with-destructors ;
: slot-offset-by-name ( struct-class name -- value/f )
[ struct-slots ] dip '[ name>> _ = ] find swap [ offset>> ] when ;
:: read-args ( handle -- string/f ) :: read-args ( handle -- string/f )
handle <win32-handle> &dispose drop handle <win32-handle> &dispose drop
handle query-information-process :> process-basic-information handle query-information-process :> process-basic-information
handle process-basic-information PebBaseAddress>> handle process-basic-information PebBaseAddress>>
[ [
0x10 PVOID heap-size read-process-memory PEB "ProcessParameters" slot-offset-by-name
PVOID heap-size
read-process-memory
PVOID deref :> args-offset PVOID deref :> args-offset
args-offset ALIEN: 0 = [ args-offset ALIEN: 0 = [
f f
] [ ] [
handle args-offset 0x40 UNICODE_STRING heap-size read-process-memory handle
args-offset
RTL_USER_PROCESS_PARAMETERS "CommandLine" slot-offset-by-name
UNICODE_STRING heap-size
read-process-memory
[ handle ] dip [ handle ] dip
UNICODE_STRING deref [ Buffer>> 0 ] [ Length>> ] bi read-process-memory UNICODE_STRING deref [ Buffer>> 0 ] [ Length>> ] bi read-process-memory
utf16n decode utf16n decode