summaryrefslogtreecommitdiffhomepage
path: root/src/process/ntapi_tt_get_runtime_data.c
blob: 60cdf17fb19a97be093e207aeb748e0260256f4c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
/********************************************************/
/*  ntapi: Native API core library                      */
/*  Copyright (C) 2013--2016  Z. Gilboa                 */
/*  Released under GPLv2 and GPLv3; see COPYING.NTAPI.  */
/********************************************************/

#include <psxtypes/psxtypes.h>
#include <ntapi/nt_memory.h>
#include <ntapi/nt_process.h>
#include <ntapi/ntapi.h>
#include "ntapi_impl.h"

#if (__SIZEOF_POINTER__ == 4)
static wchar16_t runtime_arg[12] = {
	' ','-','r',' ',
	'i','n','t','e','g','r','a','l'};
#elif (__SIZEOF_POINTER__ == 8)
static wchar16_t runtime_arg[20] = {
	' ','-','r',' ',
	'i','n','t','e','g','r','a','l',
	'-','r','u','n','t','i','m','e'};
#endif

int32_t __stdcall __ntapi_tt_get_runtime_data(
	__out		nt_runtime_data **	rtdata,
	__in		wchar16_t **		wargv)
{
	int32_t				status;
	nt_process_parameters *		process_params;
	wchar16_t *			addrarg;
	nt_runtime_data			buffer;
	nt_runtime_data *		prtdata;
	ntapi_internals *		__internals;

	/* init */
	__internals = __ntapi_internals();

	/* once? */
	if (__internals->rtdata) {
		*rtdata = __internals->rtdata;
		return NT_STATUS_SUCCESS;
	}

	if (!(wargv = wargv ? wargv : __internals->ntapi_img_sec_bss->argv_envp_array))
		return NT_STATUS_INVALID_PARAMETER_2;

	if (!wargv[1] || !wargv[2])
		return NT_STATUS_MORE_PROCESSING_REQUIRED;

	/* integral process? */
	if ((wargv[1][0] == '-') && (wargv[1][1] == 'r') && (wargv[1][2] == 0))
		addrarg = wargv[2];
	else
		return NT_STATUS_INVALID_PARAMETER;

	if (!addrarg || wargv[3])
		status = NT_STATUS_INVALID_PARAMETER_MIX;

	/* obtain pointer to data block */
	if ((status = __ntapi->tt_hex_utf16_to_uintptr(
			addrarg,
			(uintptr_t *)&prtdata)))
		return status;

	if ((status = __ntapi->zw_read_virtual_memory(
			NT_CURRENT_PROCESS_HANDLE,
			prtdata,
			(char *)&buffer,
			sizeof(buffer),0)))
		return status;

	/* update state */
	prtdata->flags |= NT_RUNTIME_DATA_INTEGRAL_PROCESS;

	/* avoid confusion :-) */
	process_params = ((nt_peb *)pe_get_peb_address())->process_params;

	__ntapi->tt_memcpy_utf16(
		(wchar16_t *)pe_va_from_rva(
			process_params->command_line.buffer,
			process_params->command_line.strlen - sizeof(runtime_arg)),
		runtime_arg,
		sizeof(runtime_arg));

	*rtdata = prtdata;

	return NT_STATUS_SUCCESS;
}