x86 support

[chico-depressive]

hi, thank you for this nice project, do you have plans to port to x86 and wow?

I have tried some things:

	/* Get the pointer to the CLIENTINFO struct. &TEB.Win32ClientInfo */
#ifdef _M_IX86 
	d->pvWin32ClientInfo = (void *)((char *)d->pvTeb + 0x6cc);
#else
	//else
	d->pvWin32ClientInfo = (void *)((char *)d->pvTeb + 0x800);
#endif
	
	/* offsetof( struct CLIENTINFO, pDeskInfo ) */
	if( ( G->prog->dwOSMajorVersion == 5 ) && ( G->prog->dwOSMinorVersion == 0 ) ) // win2k
		offsetof_pDeskInfo = 20;
	else // XP+
#ifdef _M_IX86 
		offsetof_pDeskInfo = 24;
#else
		offsetof_pDeskInfo = 32;
#endif

but it is crashing, any idea how to solve the issue?

[chico-depressive]

wow64 support would be a good idea too

[tigros]

Hi,

Which OS are you using? so i'll start with that one. did you run it within debugger? should tell you where it's crashing usually.

[chico-depressive]

@tigros I think it is crashing because I compiled as x86 and my OS is windows 7 x64, so it is running as WOW64, TEB is empty at 0x6cc and 0x800 offsets, I am going to debug it better and post results

[tigros]

i've just found out compiling as x86 isn't straight forward at all, did you make a bunch of changes to compile it?

started off with
1>snapshot.c(587): error C2440: 'function': cannot convert from 'int (__stdcall *)(const void *const ,const void *const )' to 'int (__cdecl *)(const void *,const void *)'

type errors so fixed those but now bunch unresolved external linker errors. just wondering if you went through all that?

thanks.

[chico-depressive]

@tigros I am using Visual Studio 2015, it compiled just fine, this problem might be related to calling convention:
right click .sln -> Configuration Properties -> C/C++ -> Advanced
Change Calling convention to cdecl

[tigros]

ok that was v3, v2 doesn't get linker errors but still had to add a few __cdecl.

[chico-depressive]

@tigros v3 = hooktools for PH3 right? where I can download PH3?

[tigros]

it's a branch https://github.com/tigros/HookTools/tree/for_PH_v3

[tigros]

also git clone https://github.com/processhacker2/processhacker2.git would get you PH v3.

[tigros]

well it looks hopeless i have questions of my own like here https://social.msdn.microsoft.com/Forums/en-US/2b807d1b-fb7a-4863-807e-2e62277a8d10/changes-to-win32clientinfo?forum=windowsgeneraldevelopmentissues

if the OS was 32 bit should be straight forward.

good luck but might need a miracle :)

[chico-depressive]

@tigros v15063.138 is windows 10 right? We can inspect changed undocumented structures using windbg, I am going to try to port it to x86

[chico-depressive]

@tigros do you think we can solve it using symbol loading?

this code shows how to get not exported apis:
https://bitbucket.org/NtQuery/pdb-getprocaddress/src/eebe9737d6de34261f6bec5b7b57ae973978c9e2/PDBReader/Source.cpp?at=master

[tigros]

yes if you can find another way of getting DeskInfo and ulClientDelta.

what about IntGetCurrentThreadDesktopWindow function in https://github.com/mirror/reactos/blob/master/reactos/win32ss/user/ntuser/desktop.c i wonder?

[chico-depressive]

@tigros that was a great idea, but I think PsGetCurrentThreadWin32Thread is a kernel mode api isn't it?

we can use windbg to debug any process and get the offsets pvWin32ClientInfo of windows 10 redstone 2, the problem is, I don't have it installed

or we can try to download symbols from the program itself(using SymFromName())

I am going to try to code it, you are welcome to help 👍

[tigros]

ya i tried something like that couple weeks ago could get TEB struct but not pvWin32ClientInfo.