diff --git a/trunk/ProcessHacker.Native/Objects/ProcessHandle.cs b/trunk/ProcessHacker.Native/Objects/ProcessHandle.cs index 02cd22ce7..552d54e83 100644 --- a/trunk/ProcessHacker.Native/Objects/ProcessHandle.cs +++ b/trunk/ProcessHacker.Native/Objects/ProcessHandle.cs @@ -439,11 +439,6 @@ namespace ProcessHacker.Native.Objects /// Gets the process' DEP policy. /// /// A DEPStatus enum. - /// This function does not work on - /// Windows XP SP2 or lower, since they do not - /// have the GetProcessDEPPolicy function. It is possible - /// to use NtQueryInformationProcess with ProcessExecuteFlags, - /// but it doesn't seem to work. public DepStatus GetDepStatus() { int status; @@ -484,10 +479,10 @@ namespace ProcessHacker.Native.Objects public unsafe IDictionary GetEnvironmentVariables() { IntPtr pebBaseAddress = this.GetBasicInformation().PebBaseAddress; - byte* buffer = stackalloc byte[4]; + byte* buffer = stackalloc byte[IntPtr.Size]; - this.ReadMemory(pebBaseAddress.Increment(0x10), buffer, 4); - int processParameters = *(int*)buffer; + this.ReadMemory(pebBaseAddress.Increment(0x10), buffer, IntPtr.Size); + IntPtr processParameters = *(IntPtr*)buffer; /* * RTL_USER_PROCESS_PARAMETERS @@ -508,22 +503,22 @@ namespace ProcessHacker.Native.Objects * +40 UNICODE_STRING CommandLine * +48 PVOID Environment */ - this.ReadMemory(new IntPtr( processParameters + 0x48), buffer, 4); - int envBase = *(int*)buffer; + this.ReadMemory(processParameters.Increment(0x48), buffer, IntPtr.Size); + IntPtr envBase = *(IntPtr*)buffer; int length = 0; { - MemoryBasicInformation mbi = this.QueryMemory(new IntPtr(envBase)); + MemoryBasicInformation mbi = this.QueryMemory(envBase); if (mbi.Protect == MemoryProtection.NoAccess) throw new WindowsException(); - length = mbi.RegionSize - (envBase - mbi.BaseAddress.ToInt32()); + length = mbi.RegionSize - envBase.Decrement(mbi.BaseAddress).ToInt32(); } // Now we read in the entire region of memory // And yes, some memory is wasted. - byte[] memory = this.ReadMemory(new IntPtr(envBase), length); + byte[] memory = this.ReadMemory(envBase, length); /* The environment variables block is a series of Unicode strings separated by * two null bytes. The entire block is terminated by four null bytes. @@ -756,7 +751,7 @@ namespace ProcessHacker.Native.Objects /// A string. public unsafe string GetPebString(PebOffset offset) { - byte* buffer = stackalloc byte[4]; + byte* buffer = stackalloc byte[IntPtr.Size]; IntPtr pebBaseAddress = this.GetBasicInformation().PebBaseAddress; /* read address of parameter information block @@ -772,8 +767,8 @@ namespace ProcessHacker.Native.Objects * +0c PVOID LoaderData; * +10 PRTL_USER_PROCESS_PARAMETERS ProcessParameters; */ - this.ReadMemory(pebBaseAddress.Increment(0x10), buffer, 4); - int processParameters = *(int*)buffer; + this.ReadMemory(pebBaseAddress.Increment(0x10), buffer, IntPtr.Size); + IntPtr processParameters = *(IntPtr*)buffer; // Read length (in bytes) of string. The offset of the UNICODE_STRING structure is // specified in the enum. @@ -783,13 +778,13 @@ namespace ProcessHacker.Native.Objects // +00 USHORT Length; // +02 USHORT MaximumLength; // +04 PWSTR Buffer; - this.ReadMemory(new IntPtr(processParameters + (int)offset), buffer, 2); + this.ReadMemory(processParameters.Increment((int)offset), buffer, 2); ushort stringLength = *(ushort*)buffer; byte[] stringData = new byte[stringLength]; // read address of string - this.ReadMemory(new IntPtr(processParameters + (int)offset + 0x4), buffer, 4); - IntPtr stringAddr = new IntPtr(*(int*)buffer); + this.ReadMemory(processParameters.Increment((int)offset + 0x4), buffer, 4); + IntPtr stringAddr = *(IntPtr*)buffer; // read string and decode it return UnicodeEncoding.Unicode.GetString(