Skip to content

[Windows] giveup with AD for all NtWow64 API calls (query 64-bit process from 32-bit) #1888

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 3 commits into from
Dec 14, 2020
Merged

[Windows] giveup with AD for all NtWow64 API calls (query 64-bit process from 32-bit) #1888

merged 3 commits into from
Dec 14, 2020
+46 −2

Conversation

giampaolo
Copy link
Owner

@giampaolo giampaolo commented Dec 14, 2020 •
edited
Loading

Resume

Description

On Windows, cmdline(), cwd() and environ() use some complex logic to query a 64 bit process from a 32 bit one by using NtWow64* APIs which may randomly fail with:

  • [Error 0] The operation completed successfully
  • [Error 998] Invalid access to memory location
  • possibly others

Since this happens randomly and it's unclear how to do this properly, this PR turns any error from NtWow64* APIs into AccessDenied.

@giampaolo
correct printf() parameter
dd24c64 
Signed-off-by: Giampaolo Rodola <[email protected]>
@giampaolo giampaolo merged commit a6e5e3c into master Dec 14, 2020
@delete-merged-branch delete-merged-branch bot deleted the NtWoW64 branch December 14, 2020 21:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
bug new-api windows
Projects
None yet
Milestone
No milestone
1 participant
@giampaolo