forked from DaxxTrias/Process.NET
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathRemoteThread.cs
More file actions
349 lines (318 loc) · 12.4 KB
/
RemoteThread.cs
File metadata and controls
349 lines (318 loc) · 12.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
using ProcessNET.Marshaling;
using ProcessNET.Native.Types;
using ProcessNET.Utilities;
using ThreadState = System.Diagnostics.ThreadState;
namespace ProcessNET.Threads
{
/// <summary>
/// Class representing a thread in the remote process.
/// </summary>
public class RemoteThread : IEquatable<RemoteThread>, IRemoteThread
{
private readonly IMarshalledValue _parameter;
private readonly Task _parameterCleaner;
protected readonly IProcess ProcessPlus;
/// <summary>
/// Initializes a new instance of the <see cref="RemoteThread" /> class.
/// </summary>
/// <param name="processPlus">The reference of the <see cref="IProcess" /> object.</param>
/// <param name="thread">The native <see cref="ProcessThread" /> object.</param>
public RemoteThread(IProcess processPlus, ProcessThread thread)
{
// Save the parameters
ProcessPlus = processPlus;
Native = thread;
// Save the thread id
Id = thread.Id;
// Open the thread
Handle = ThreadHelper.OpenThread(ThreadAccessFlags.AllAccess, Id);
}
/// <summary>
/// Initializes a new instance of the <see cref="RemoteThread" /> class.
/// </summary>
/// <param name="processPlus">The reference of the <see cref="MemoryManagement.MemorySharp" /> object.</param>
/// <param name="thread">The native <see cref="ProcessThread" /> object.</param>
/// <param name="parameter">The parameter passed to the thread when it was created.</param>
public RemoteThread(IProcess processPlus, ProcessThread thread, IMarshalledValue parameter = null)
: this(processPlus, thread)
{
// Save the parameter
_parameter = parameter;
// Create the task
_parameterCleaner = new Task(() =>
{
Join();
_parameter.Dispose();
});
}
/// <summary>
/// Returns a value indicating whether this instance is equal to a specified object.
/// </summary>
public bool Equals(RemoteThread other)
{
if (ReferenceEquals(null, other)) return false;
return ReferenceEquals(this, other) || (Id == other.Id && ProcessPlus.Equals(other.ProcessPlus));
}
/// <summary>
/// Gets or sets the full context of the thread.
/// If the thread is not already suspended, performs a <see cref="Suspend" /> and <see cref="Resume" /> call on the
/// thread.
/// </summary>
public ThreadContext Context
{
get
{
// Check if the thread is alive
if (!IsAlive)
throw new ThreadStateException(
$"Couldn't set the context of the thread #{Id} because it is terminated.");
// Check if the thread is already suspended
var isSuspended = IsSuspended;
try
{
// Suspend the thread if it wasn't
if (!isSuspended)
Suspend();
// Get the context
return ThreadHelper.GetThreadContext(Handle,
ThreadContextFlags.All | ThreadContextFlags.FloatingPoint |
ThreadContextFlags.DebugRegisters | ThreadContextFlags.ExtendedRegisters);
}
finally
{
// Resume the thread if it wasn't suspended
if (!isSuspended)
Resume();
}
// The thread is closed, cannot set the context
}
set
{
// Check if the thread is alive
if (!IsAlive) return;
// Check if the thread is already suspended
var isSuspended = IsSuspended;
try
{
// Suspend the thread if it wasn't
if (!isSuspended)
Suspend();
// Set the context
ThreadHelper.SetThreadContext(Handle, value);
}
finally
{
// Resume the thread if it wasn't suspended
if (!isSuspended)
Resume();
}
}
}
/// <summary>
/// The remote thread handle opened with all rights.
/// </summary>
public SafeMemoryHandle Handle { get; }
/// <summary>
/// Gets the unique identifier of the thread.
/// </summary>
public int Id { get; }
/// <summary>
/// Gets if the thread is alive.
/// </summary>
public bool IsAlive => !IsTerminated;
/// <summary>
/// Gets if the thread is the main one in the remote process.
/// </summary>
public bool IsMainThread => ProcessPlus.Native.Threads[0].Id == Id;
/// <summary>
/// Gets if the thread is suspended.
/// </summary>
public bool IsSuspended
{
get
{
// Refresh the thread info
Refresh();
// Return if the thread is suspended
return Native != null && Native.ThreadState == ThreadState.Wait &&
Native.WaitReason == ThreadWaitReason.Suspended;
}
}
/// <summary>
/// Gets if the thread is terminated.
/// </summary>
public bool IsTerminated
{
get
{
// Refresh the thread info
Refresh();
// Check if the thread is terminated
return Native == null;
}
}
/// <summary>
/// The native <see cref="ProcessThread" /> object corresponding to this thread.
/// </summary>
public ProcessThread Native { get; private set; }
/// <summary>
/// Releases all resources used by the <see cref="RemoteThread" /> object.
/// </summary>
public virtual void Dispose()
{
// Close the thread handle
Handle.Close();
// Avoid the finalizer
GC.SuppressFinalize(this);
}
/// <summary>
/// Gets the termination status of the thread.
/// </summary>
public T GetExitCode<T>()
{
// Get the exit code of the thread (can be nullable)
var ret = ThreadHelper.GetExitCodeThread(Handle);
// Return the exit code or the default value of T if there's no exit code
return ret.HasValue ? MarshalType<T>.PtrToObject(ProcessPlus, ret.Value) : default(T);
}
/// <summary>
/// Serves as a hash function for a particular type.
/// </summary>
public override int GetHashCode()
{
return Id.GetHashCode() ^ ProcessPlus.GetHashCode();
}
/// <summary>
/// Gets the linear address of a specified segment.
/// </summary>
/// <param name="segment">The segment to get.</param>
/// <returns>A <see cref="IntPtr" /> pointer corresponding to the linear address of the segment.</returns>
public IntPtr GetRealSegmentAddress(SegmentRegisters segment)
{
// Get a selector entry for the segment
LdtEntry entry;
switch (segment)
{
case SegmentRegisters.Cs:
entry = ThreadHelper.GetThreadSelectorEntry(Handle, Context.SegCs);
break;
case SegmentRegisters.Ds:
entry = ThreadHelper.GetThreadSelectorEntry(Handle, Context.SegDs);
break;
case SegmentRegisters.Es:
entry = ThreadHelper.GetThreadSelectorEntry(Handle, Context.SegEs);
break;
case SegmentRegisters.Fs:
entry = ThreadHelper.GetThreadSelectorEntry(Handle, Context.SegFs);
break;
case SegmentRegisters.Gs:
entry = ThreadHelper.GetThreadSelectorEntry(Handle, Context.SegGs);
break;
case SegmentRegisters.Ss:
entry = ThreadHelper.GetThreadSelectorEntry(Handle, Context.SegSs);
break;
default:
throw new InvalidEnumArgumentException("segment");
}
// Compute the linear address
return new IntPtr(entry.BaseLow | (entry.BaseMid << 16) | (entry.BaseHi << 24));
}
/// <summary>
/// Discards any information about this thread that has been cached inside the process component.
/// </summary>
public void Refresh()
{
if (Native == null)
return;
// Refresh the process info
ProcessPlus.Native.Refresh();
// Get new info about the thread
Native = ProcessPlus.Native.Threads.Cast<ProcessThread>().FirstOrDefault(t => t.Id == Native.Id);
}
/// <summary>
/// Blocks the calling thread until the thread terminates.
/// </summary>
public void Join()
{
ThreadHelper.WaitForSingleObject(Handle);
}
/// <summary>
/// Blocks the calling thread until a thread terminates or the specified time elapses.
/// </summary>
/// <param name="time">The timeout.</param>
/// <returns>The return value is a flag that indicates if the thread terminated or if the time elapsed.</returns>
public WaitValues Join(TimeSpan time)
{
return ThreadHelper.WaitForSingleObject(Handle, time);
}
/// <summary>
/// Resumes a thread that has been suspended.
/// </summary>
public void Resume()
{
// Check if the thread is still alive
if (!IsAlive) return;
// Start the thread
ThreadHelper.ResumeThread(Handle);
// Start a task to clean the memory used by the parameter if we created the thread
if (_parameter != null && !_parameterCleaner.IsCompleted)
_parameterCleaner.Start();
}
/// <summary>
/// Either suspends the thread, or if the thread is already suspended, has no effect.
/// </summary>
/// <returns>A new instance of the <see cref="FrozenThread" /> class. If this object is disposed, the thread is resumed.</returns>
public IFrozenThread Suspend()
{
if (!IsAlive) return null;
ThreadHelper.SuspendThread(Handle);
return new FrozenThread(this);
}
/// <summary>
/// Terminates the thread.
/// </summary>
/// <param name="exitCode">The exit code of the thread to close.</param>
public void Terminate(int exitCode = 0)
{
if (IsAlive)
ThreadHelper.TerminateThread(Handle, exitCode);
}
/// <summary>
/// Frees resources and perform other cleanup operations before it is reclaimed by garbage collection.
/// </summary>
~RemoteThread()
{
Dispose();
}
/// <summary>
/// Determines whether the specified object is equal to the current object.
/// </summary>
public override bool Equals(object obj)
{
if (ReferenceEquals(null, obj)) return false;
if (ReferenceEquals(this, obj)) return true;
return obj.GetType() == GetType() && Equals((RemoteThread) obj);
}
public static bool operator ==(RemoteThread left, RemoteThread right)
{
return Equals(left, right);
}
public static bool operator !=(RemoteThread left, RemoteThread right)
{
return !Equals(left, right);
}
/// <summary>
/// Returns a string that represents the current object.
/// </summary>
public override string ToString()
{
return $"Id = {Id} IsAlive = {IsAlive} IsMainThread = {IsMainThread}";
}
}
}