First try at WinProcess.architecture

This commit is contained in:
hakril
2025-01-18 23:31:30 +01:00
parent 8151292042
commit ce13bf08e3
+12 -5
View File
@@ -106,12 +106,19 @@ class Process(utils.AutoHandle):
# Syswow2 will exactly tell us the architecture
if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
process_machine, native_machine = self.is_wow_64_2
try:
return utils.image_file_machine_to_processor_architecture(process_machine)
except KeyError as e:
raise ValueError("Unknown IsWow64Process2(process_machine:#x) -> {0}".format(process_machine))
if process_machine != gdef.PROCESSOR_ARCHITECTURE_UNKNOWN:
try:
return utils.image_file_machine_to_processor_architecture(process_machine)
except KeyError as e:
raise ValueError("Unknown IsWow64Process2(process_machine:#x) -> {0}".format(process_machine))
# No IsWow64Process2 -> No ARM64
if windows.system.architecture == gdef.PROCESSOR_ARCHITECTURE_ARM64:
# May be ARM64 or AMD64 as X64TA64 is not considered WOW64
machine_archi = gdef.PROCESS_MACHINE_INFORMATION()
windows.winproxy.GetProcessInformation(self.handle, gdef.ProcessMachineTypeInfo, machine_archi)
return utils.image_file_machine_to_processor_architecture(machine_archi.ProcessMachine)
# No IsWow64Process2 -> No ARM
# So its up on x86 -> x64 based on process bitness
if self.bitness == 32:
return gdef.PROCESSOR_ARCHITECTURE_INTEL