tools.ps.windows: use offset-of instead.
parent
18a463bc2f
commit
787cc89370
|
@ -33,7 +33,7 @@ IN: tools.ps.windows
|
||||||
f
|
f
|
||||||
NtQueryInformationProcess drop
|
NtQueryInformationProcess drop
|
||||||
] keep ;
|
] keep ;
|
||||||
|
|
||||||
:: read-process-memory ( HANDLE alien offset len -- byte-array )
|
:: read-process-memory ( HANDLE alien offset len -- byte-array )
|
||||||
HANDLE
|
HANDLE
|
||||||
offset alien <displaced-alien>
|
offset alien <displaced-alien>
|
||||||
|
@ -53,15 +53,12 @@ IN: tools.ps.windows
|
||||||
[ dup query-information-process PebBaseAddress>> read-peb ] bi
|
[ dup query-information-process PebBaseAddress>> read-peb ] bi
|
||||||
] with-destructors ;
|
] with-destructors ;
|
||||||
|
|
||||||
: slot-offset-by-name ( struct-class name -- value/f )
|
|
||||||
[ struct-slots ] dip '[ name>> _ = ] find swap [ offset>> ] when ;
|
|
||||||
|
|
||||||
:: read-args ( handle -- string/f )
|
:: read-args ( handle -- string/f )
|
||||||
handle <win32-handle> &dispose drop
|
handle <win32-handle> &dispose drop
|
||||||
handle query-information-process :> process-basic-information
|
handle query-information-process :> process-basic-information
|
||||||
handle process-basic-information PebBaseAddress>>
|
handle process-basic-information PebBaseAddress>>
|
||||||
[
|
[
|
||||||
PEB "ProcessParameters" slot-offset-by-name
|
"ProcessParameters" PEB offset-of
|
||||||
PVOID heap-size
|
PVOID heap-size
|
||||||
read-process-memory
|
read-process-memory
|
||||||
PVOID deref :> args-offset
|
PVOID deref :> args-offset
|
||||||
|
@ -70,7 +67,7 @@ IN: tools.ps.windows
|
||||||
] [
|
] [
|
||||||
handle
|
handle
|
||||||
args-offset
|
args-offset
|
||||||
RTL_USER_PROCESS_PARAMETERS "CommandLine" slot-offset-by-name
|
"CommandLine" RTL_USER_PROCESS_PARAMETERS offset-of
|
||||||
UNICODE_STRING heap-size
|
UNICODE_STRING heap-size
|
||||||
read-process-memory
|
read-process-memory
|
||||||
[ handle ] dip
|
[ handle ] dip
|
||||||
|
@ -78,7 +75,7 @@ IN: tools.ps.windows
|
||||||
utf16n decode
|
utf16n decode
|
||||||
] if
|
] if
|
||||||
] [ drop f ] if* ;
|
] [ drop f ] if* ;
|
||||||
|
|
||||||
: process-list ( -- assoc )
|
: process-list ( -- assoc )
|
||||||
[
|
[
|
||||||
TH32CS_SNAPALL do-snapshot
|
TH32CS_SNAPALL do-snapshot
|
||||||
|
|
Loading…
Reference in New Issue