Global (Windows): adds full TEB/PEB definitions

This commit is contained in:
李通洲
2026-03-19 15:16:50 +08:00
parent 6ec59f8654
commit bab1e4ff82
3 changed files with 156 additions and 10 deletions
+7 -5
View File
@@ -19,7 +19,7 @@ static void getExePath(FFPlatform* platform)
wchar_t exePathW[MAX_PATH];
FF_AUTO_CLOSE_FD HANDLE hPath = CreateFileW(
ffGetProcessParams()->ImagePathName.Buffer,
ffGetPeb()->ProcessParameters->ImagePathName.Buffer,
GENERIC_READ,
FILE_SHARE_READ,
NULL,
@@ -38,7 +38,10 @@ static void getExePath(FFPlatform* platform)
}
if (platform->exePath.length == 0)
ffStrbufSetNWS(&platform->exePath, ffGetProcessParams()->ImagePathName.Length / 2, ffGetProcessParams()->ImagePathName.Buffer);
{
PCUNICODE_STRING imagePathName = &ffGetPeb()->ProcessParameters->ImagePathName;
ffStrbufSetNWS(&platform->exePath, imagePathName->Length / sizeof(wchar_t), imagePathName->Buffer);
}
ffStrbufReplaceAllC(&platform->exePath, '\\', '/');
}
@@ -296,7 +299,7 @@ static void getSystemArchitecture(FFPlatformSysinfo* info)
static void getCwd(FFPlatform* platform)
{
PCURDIR cwd = &ffGetProcessParams()->CurrentDirectory;
PCURDIR cwd = &ffGetPeb()->ProcessParameters->CurrentDirectory;
ffStrbufSetNWS(&platform->cwd, cwd->DosPath.Length / sizeof(WCHAR), cwd->DosPath.Buffer);
ffStrbufReplaceAllC(&platform->cwd, '\\', '/');
ffStrbufEnsureEndsWithC(&platform->cwd, '/');
@@ -304,8 +307,7 @@ static void getCwd(FFPlatform* platform)
void ffPlatformInitImpl(FFPlatform* platform)
{
static_assert(offsetof(TEB, Reserved1[8]) == sizeof(NT_TIB) + sizeof(PVOID) /*EnvironmentPointer*/, "Structure layout mismatch detected.");
platform->pid = (uint32_t) (uintptr_t) ((CLIENT_ID*) &NtCurrentTeb()->Reserved1[8])->UniqueProcess;
platform->pid = (uint32_t) (uintptr_t) ffGetTeb()->ClientId.UniqueProcess;
getExePath(platform);
getCwd(platform);
getHomeDir(platform);
+2 -2
View File
@@ -8,7 +8,7 @@
static bool createSubfolders(wchar_t* fileName)
{
HANDLE hRoot = ffGetProcessParams()->CurrentDirectory.Handle;
HANDLE hRoot = ffGetPeb()->ProcessParameters->CurrentDirectory.Handle;
bool closeRoot = false;
wchar_t* ptr = fileName;
@@ -69,7 +69,7 @@ static bool createSubfolders(wchar_t* fileName)
// Rooted path on current drive: \foo\bar
else if (ptr[0] == L'\\')
{
UNICODE_STRING* dosPath = &ffGetProcessParams()->CurrentDirectory.DosPath;
UNICODE_STRING* dosPath = &ffGetPeb()->ProcessParameters->CurrentDirectory.DosPath;
wchar_t driveRoot[] = { dosPath->Buffer[0], L':', L'\\', L'\0' };
hRoot = CreateFileW(
driveRoot,
+147 -3
View File
@@ -990,11 +990,155 @@ typedef struct _RTL_USER_PROCESS_PARAMETERS_FULL
ULONG ProcessGroupId;
// ...
} RTL_USER_PROCESS_PARAMETERS_FULL;
} RTL_USER_PROCESS_PARAMETERS_FULL, *PRTL_USER_PROCESS_PARAMETERS_FULL;
static inline RTL_USER_PROCESS_PARAMETERS_FULL* ffGetProcessParams()
typedef struct _PEB_FULL
{
return (RTL_USER_PROCESS_PARAMETERS_FULL*) NtCurrentTeb()->ProcessEnvironmentBlock->ProcessParameters;
//
// The process was cloned with an inherited address space.
//
BOOLEAN InheritedAddressSpace;
//
// The process has image file execution options (IFEO).
//
BOOLEAN ReadImageFileExecOptions;
//
// The process has a debugger attached.
//
BOOLEAN BeingDebugged;
union
{
BOOLEAN BitField;
struct
{
BOOLEAN ImageUsesLargePages : 1; // The process uses large image regions (4 MB).
BOOLEAN IsProtectedProcess : 1; // The process is a protected process.
BOOLEAN IsImageDynamicallyRelocated : 1; // The process image base address was relocated.
BOOLEAN SkipPatchingUser32Forwarders : 1; // The process skipped forwarders for User32.dll functions. 1 for 64-bit, 0 for 32-bit.
BOOLEAN IsPackagedProcess : 1; // The process is a packaged store process (APPX/MSIX).
BOOLEAN IsAppContainerProcess : 1; // The process has an AppContainer token.
BOOLEAN IsProtectedProcessLight : 1; // The process is a protected process (light).
BOOLEAN IsLongPathAwareProcess : 1; // The process is long path aware.
};
};
//
// Handle to a mutex for synchronization.
//
HANDLE Mutant;
//
// Pointer to the base address of the process image.
//
PVOID ImageBaseAddress;
//
// Pointer to the process loader data.
//
PPEB_LDR_DATA Ldr;
//
// Pointer to the process parameters.
//
PRTL_USER_PROCESS_PARAMETERS_FULL ProcessParameters;
//
// Reserved.
//
PVOID SubSystemData;
//
// Pointer to the process default heap.
//
PVOID ProcessHeap;
// ...
} PEB_FULL, *PPEB_FULL;
typedef struct _TEB_FULL
{
//
// Thread Information Block (TIB) contains the thread's stack, base and limit addresses, the current stack pointer, and the exception list.
//
NT_TIB NtTib;
//
// Reserved.
//
PVOID EnvironmentPointer;
//
// Client ID for this thread.
//
CLIENT_ID ClientId;
//
// A handle to an active Remote Procedure Call (RPC) if the thread is currently involved in an RPC operation.
//
PVOID ActiveRpcHandle;
//
// A pointer to the __declspec(thread) local storage array.
//
PVOID ThreadLocalStoragePointer;
//
// A pointer to the Process Environment Block (PEB), which contains information about the process.
//
PPEB_FULL ProcessEnvironmentBlock;
//
// The previous Win32 error value for this thread.
//
ULONG LastErrorValue;
//
// The number of critical sections currently owned by this thread.
//
ULONG CountOfOwnedCriticalSections;
//
// Reserved.
//
PVOID CsrClientThread;
//
// Reserved for win32k.sys
//
PVOID Win32ThreadInfo;
//
// Reserved for user32.dll
//
ULONG User32Reserved[26];
//
// Reserved for winsrv.dll
//
ULONG UserReserved[5];
//
// Reserved.
//
PVOID WOW32Reserved;
//
// The LCID of the current thread. (Kernel32!GetThreadLocale)
//
LCID CurrentLocale;
} TEB_FULL, *PTEB_FULL;
static inline PTEB_FULL ffGetTeb()
{
return (PTEB_FULL) NtCurrentTeb();
}
static inline PPEB_FULL ffGetPeb()
{
return ffGetTeb()->ProcessEnvironmentBlock;
}
NTSYSAPI NTSTATUS NTAPI RtlExpandEnvironmentStrings(