windows-sudo/utils.cpp at master · ysmu/windows-sudo · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
#include <Windows.h>
#include <tlhelp32.h>
#include <tchar.h>
#include "windefs.h"

int GetParentProcessId()
{
	PROCESSENTRY32 stPe32;
	stPe32.dwSize = sizeof(PROCESSENTRY32);

	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (Process32First(hSnapshot, &stPe32))
	{
		do
		{
			if (stPe32.th32ProcessID == GetCurrentProcessId())
			{
				CloseHandle(hSnapshot);
				return stPe32.th32ParentProcessID;
			}
		} while (Process32Next(hSnapshot, &stPe32));
	}

	CloseHandle(hSnapshot);
	return -1;
}

bool GetProcessCurrentDirectory(wchar_t wszPath[MAX_PATH])
{
	ZeroMemory(wszPath, MAX_PATH * sizeof(wchar_t));

	//open parent process
	int ppid = GetParentProcessId();
	if (ppid < 0)
	{
		return false;
	}
	HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, ppid);
	if (hProcess == NULL)
	{
		return false;
	}

	BOOL isWow64;
	IsWow64Process(GetCurrentProcess(), &isWow64);
	if (isWow64)
	{
		PEB_WOW64 stPEB;
		PROCESS_BASIC_INFORMATION_WOW64 stPbi;

		//read PEB
		NtQueryInformationProcessFunc NtQueryInformationProcess = (NtQueryInformationProcessFunc)GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtWow64QueryInformationProcess64");
		if (NtQueryInformationProcess == NULL)
		{
			CloseHandle(hProcess);
			return false;
		}
		if (NtQueryInformationProcess(hProcess, ProcessBasicInformation, &stPbi, sizeof PROCESS_BASIC_INFORMATION_WOW64, NULL) != 0)
		{
			CloseHandle(hProcess);
			return false;
		}
		NtWow64ReadVirtualMemory64Func NtWow64ReadVirtualMemoryWow64 = (NtWow64ReadVirtualMemory64Func)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtWow64ReadVirtualMemory64");
		if (NtWow64ReadVirtualMemoryWow64(hProcess, stPbi.PebBaseAddress, &stPEB, sizeof PEB_WOW64, NULL) != 0)
		{
			CloseHandle(hProcess);
			return false;
		}

		RTL_USER_PROCESS_PARAMETERS_WOW64 stUPP;
		if (NtWow64ReadVirtualMemoryWow64(hProcess, stPEB.ProcessParameters, &stUPP, sizeof RTL_USER_PROCESS_PARAMETERS_WOW64, NULL) != 0)
		{
			CloseHandle(hProcess);
			return false;
		}
		if (NtWow64ReadVirtualMemoryWow64(hProcess, stUPP.CurrentDirectory.DosPath.Buffer, wszPath, stUPP.CurrentDirectory.DosPath.Length, NULL) != 0)
		{
			CloseHandle(hProcess);
			return false;
		}
	}
	else
	{
		PEB stPEB;
		PROCESS_BASIC_INFORMATION stPbi;

		//read PEB
		NtQueryInformationProcessFunc NtQueryInformationProcess = (NtQueryInformationProcessFunc)GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtQueryInformationProcess");
		if (NtQueryInformationProcess == NULL)
		{
			CloseHandle(hProcess);
			return false;
		}
		if (NtQueryInformationProcess(hProcess, ProcessBasicInformation, &stPbi, sizeof PROCESS_BASIC_INFORMATION, NULL) != 0)
		{
			CloseHandle(hProcess);
			return false;
		}
		if (ReadProcessMemory(hProcess, stPbi.PebBaseAddress, &stPEB, sizeof PEB, NULL) == 0)
		{
			CloseHandle(hProcess);
			return false;
		}

		RTL_USER_PROCESS_PARAMETERS stUPP;
		if (ReadProcessMemory(hProcess, stPEB.ProcessParameters, &stUPP, sizeof RTL_USER_PROCESS_PARAMETERS, NULL) == 0)
		{
			CloseHandle(hProcess);
			return false;
		}
		if (ReadProcessMemory(hProcess, stUPP.CurrentDirectory.DosPath.Buffer, wszPath, stUPP.CurrentDirectory.DosPath.Length, NULL) == 0)
		{
			CloseHandle(hProcess);
			return false;
		}
	}
	CloseHandle(hProcess);
	return true;
}