Skip to content

Commit a5b5c06

Browse files
hakrilhakril
authored
Merge pull request #78 from hakril/arm64
Minimal ARM64 consideration
2 parents 7abda41 + 520fa86 commit a5b5c06

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+5374
-2786
lines changed

‎.github/workflows/tests.yml

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -94,3 +94,35 @@ jobs:
9494
secondary_rate_limit_wait_seconds: 90
9595
seconds_between_github_writes: 10
9696
seconds_between_github_reads: 1
97+
98+
# tests_arm64:
99+
# needs: generate_ctypes
100+
# timeout-minutes: 15
101+
# runs-on: windows-ARM64
102+
# continue-on-error: true
103+
#
104+
# strategy:
105+
# fail-fast: false
106+
# matrix:
107+
# python-version: [3.11]
108+
# python-architecture: [x86, x64, arm64]
109+
# include:
110+
# # Translate architecture to bitness for py.exe commandline
111+
# - python-bitness-to-test: 32
112+
# python-architecture: x86
113+
# - python-bitness-to-test: 64
114+
# python-architecture: x64
115+
# - python-bitness-to-test: arm64
116+
# python-architecture: arm64
117+
#
118+
# steps:
119+
# - uses: actions/checkout@v4
120+
#
121+
# - name: Listing python versions availables
122+
# run: py -0
123+
#
124+
# - name: Testing PFW execute
125+
# run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -c "import windows; print(windows)"
126+
#
127+
# - name: Arm64 pytests
128+
# run: py -${{ matrix.python-version}}-${{ matrix.python-bitness-to-test}} -m pytest tests -k "not test_debugger" -v -s -r fEsx

‎ctypes_generation/definitions/defines/proc_thread_attributes.txt

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
// We have a rare case of defines that depends on an enum
2+
// Which is PROC_THREAD_ATTRIBUTE_NUM
3+
// So i Will just define a copy of those as define here
4+
// Define version copied from: https://github.com/winsiderss/systeminformer/blob/master/phnt/include/ntpsapi.h#L2666
5+
// Thx to them, as always :)
6+
7+
#define ProcThreadAttributeParentProcess 0 // in HANDLE
8+
#define ProcThreadAttributeExtendedFlags 1 // in ULONG (EXTENDED_PROCESS_CREATION_FLAG_*)
9+
#define ProcThreadAttributeHandleList 2 // in HANDLE[]
10+
#define ProcThreadAttributeGroupAffinity 3 // in GROUP_AFFINITY // since WIN7
11+
#define ProcThreadAttributePreferredNode 4 // in USHORT
12+
#define ProcThreadAttributeIdealProcessor 5 // in PROCESSOR_NUMBER
13+
#define ProcThreadAttributeUmsThread 6 // in UMS_CREATE_THREAD_ATTRIBUTES
14+
#define ProcThreadAttributeMitigationPolicy 7 // in ULONG, ULONG64, or ULONG64[2]
15+
#define ProcThreadAttributePackageFullName 8 // in WCHAR[] // since WIN8
16+
#define ProcThreadAttributeSecurityCapabilities 9 // in SECURITY_CAPABILITIES
17+
#define ProcThreadAttributeConsoleReference 10 // BaseGetConsoleReference (kernelbase.dll)
18+
#define ProcThreadAttributeProtectionLevel 11 // in ULONG (PROTECTION_LEVEL_*) // since WINBLUE
19+
#define ProcThreadAttributeOsMaxVersionTested 12 // in MAXVERSIONTESTED_INFO // since THRESHOLD // (from exe.manifest)
20+
#define ProcThreadAttributeJobList 13 // in HANDLE[]
21+
#define ProcThreadAttributeChildProcessPolicy 14 // in ULONG (PROCESS_CREATION_CHILD_PROCESS_*) // since THRESHOLD2
22+
#define ProcThreadAttributeAllApplicationPackagesPolicy 15 // in ULONG (PROCESS_CREATION_ALL_APPLICATION_PACKAGES_*) // since REDSTONE
23+
#define ProcThreadAttributeWin32kFilter 16 // in WIN32K_SYSCALL_FILTER
24+
#define ProcThreadAttributeSafeOpenPromptOriginClaim 17 // in SE_SAFE_OPEN_PROMPT_RESULTS
25+
#define ProcThreadAttributeDesktopAppPolicy 18 // in ULONG (PROCESS_CREATION_DESKTOP_APP_*) // since RS2
26+
#define ProcThreadAttributeBnoIsolation 19 // in PROC_THREAD_BNOISOLATION_ATTRIBUTE
27+
#define ProcThreadAttributePseudoConsole 22 // in HANDLE (HPCON) // since RS5
28+
#define ProcThreadAttributeIsolationManifest 23 // in ISOLATION_MANIFEST_PROPERTIES // rev (diversenok) // since 19H2+
29+
#define ProcThreadAttributeMitigationAuditPolicy 24 // in ULONG, ULONG64, or ULONG64[2] // since 21H1
30+
#define ProcThreadAttributeMachineType 25 // in USHORT // since 21H2
31+
#define ProcThreadAttributeComponentFilter 26 // in ULONG
32+
#define ProcThreadAttributeEnableOptionalXStateFeatures 27 // in ULONG64 // since WIN11
33+
#define ProcThreadAttributeCreateStore 28 // ULONG // rev (diversenok)
34+
#define ProcThreadAttributeTrustedApp 29
35+
#define ProcThreadAttributeSveVectorLength 30
36+
37+
// Real definition of value usef by API
38+
// From: https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3568
39+
// macro ProcThreadAttributeValue is recoded in python in template.py
40+
// I replace TRUE by True && FALSE by False for native python compat :)
41+
42+
#define PROC_THREAD_ATTRIBUTE_NUMBER 0x0000FFFF
43+
#define PROC_THREAD_ATTRIBUTE_THREAD 0x00010000 // Attribute may be used with thread creation
44+
#define PROC_THREAD_ATTRIBUTE_INPUT 0x00020000 // Attribute is input only
45+
#define PROC_THREAD_ATTRIBUTE_ADDITIVE 0x00040000 // Attribute may be "accumulated," e.g. bitmasks,
46+
47+
#define PROC_THREAD_ATTRIBUTE_PARENT_PROCESS \
48+
ProcThreadAttributeValue (ProcThreadAttributeParentProcess, False, True, False)
49+
#define PROC_THREAD_ATTRIBUTE_HANDLE_LIST \
50+
ProcThreadAttributeValue (ProcThreadAttributeHandleList, False, True, False)
51+
52+
#define PROC_THREAD_ATTRIBUTE_GROUP_AFFINITY \
53+
ProcThreadAttributeValue (ProcThreadAttributeGroupAffinity, True, True, False)
54+
#define PROC_THREAD_ATTRIBUTE_PREFERRED_NODE \
55+
ProcThreadAttributeValue (ProcThreadAttributePreferredNode, False, True, False)
56+
#define PROC_THREAD_ATTRIBUTE_IDEAL_PROCESSOR \
57+
ProcThreadAttributeValue (ProcThreadAttributeIdealProcessor, True, True, False)
58+
#define PROC_THREAD_ATTRIBUTE_UMS_THREAD \
59+
ProcThreadAttributeValue (ProcThreadAttributeUmsThread, True, True, False)
60+
#define PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY \
61+
ProcThreadAttributeValue (ProcThreadAttributeMitigationPolicy, False, True, False)
62+
63+
#define PROC_THREAD_ATTRIBUTE_SECURITY_CAPABILITIES \
64+
ProcThreadAttributeValue (ProcThreadAttributeSecurityCapabilities, False, True, False)
65+
66+
#define PROC_THREAD_ATTRIBUTE_PROTECTION_LEVEL \
67+
ProcThreadAttributeValue (ProcThreadAttributeProtectionLevel, False, True, False)
68+
69+
#define PROC_THREAD_ATTRIBUTE_PSEUDOCONSOLE \
70+
ProcThreadAttributeValue (ProcThreadAttributePseudoConsole, False, True, False)
71+
72+
#define PROC_THREAD_ATTRIBUTE_MACHINE_TYPE \
73+
ProcThreadAttributeValue (ProcThreadAttributeMachineType, False, True, False)
74+
75+
#define PROC_THREAD_ATTRIBUTE_ENABLE_OPTIONAL_XSTATE_FEATURES \
76+
ProcThreadAttributeValue (ProcThreadAttributeEnableOptionalXStateFeatures, True, True, False)
77+
78+
#define PROC_THREAD_ATTRIBUTE_SVE_VECTOR_LENGTH \
79+
ProcThreadAttributeValue (ProcThreadAttributeSveVectorLength, False, True, False)

‎ctypes_generation/definitions/defines/processor.txt

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#define PROCESSOR_INTEL_386 386
2+
#define PROCESSOR_INTEL_486 486
3+
#define PROCESSOR_INTEL_PENTIUM 586
4+
#define PROCESSOR_INTEL_IA64 2200
5+
#define PROCESSOR_MIPS_R4000 4000 // incl R4101 & R3910 for Windows CE
6+
#define PROCESSOR_ALPHA_21064 21064
7+
#define PROCESSOR_PPC_601 601
8+
#define PROCESSOR_PPC_603 603
9+
#define PROCESSOR_PPC_604 604
10+
#define PROCESSOR_PPC_620 620
11+
#define PROCESSOR_HITACHI_SH3 10003 // Windows CE
12+
#define PROCESSOR_HITACHI_SH3E 10004 // Windows CE
13+
#define PROCESSOR_HITACHI_SH4 10005 // Windows CE
14+
#define PROCESSOR_MOTOROLA_821 821 // Windows CE
15+
#define PROCESSOR_SHx_SH3 103 // Windows CE
16+
#define PROCESSOR_SHx_SH4 104 // Windows CE
17+
#define PROCESSOR_STRONGARM 2577 // Windows CE - 0xA11
18+
#define PROCESSOR_ARM720 1824 // Windows CE - 0x720
19+
#define PROCESSOR_ARM820 2080 // Windows CE - 0x820
20+
#define PROCESSOR_ARM920 2336 // Windows CE - 0x920
21+
#define PROCESSOR_ARM_7TDMI 70001 // Windows CE
22+
#define PROCESSOR_OPTIL 0x494f // MSIL
23+
24+
#define PROCESSOR_ARCHITECTURE_INTEL 0
25+
#define PROCESSOR_ARCHITECTURE_MIPS 1
26+
#define PROCESSOR_ARCHITECTURE_ALPHA 2
27+
#define PROCESSOR_ARCHITECTURE_PPC 3
28+
#define PROCESSOR_ARCHITECTURE_SHX 4
29+
#define PROCESSOR_ARCHITECTURE_ARM 5
30+
#define PROCESSOR_ARCHITECTURE_IA64 6
31+
#define PROCESSOR_ARCHITECTURE_ALPHA64 7
32+
#define PROCESSOR_ARCHITECTURE_MSIL 8
33+
#define PROCESSOR_ARCHITECTURE_AMD64 9
34+
#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 10
35+
#define PROCESSOR_ARCHITECTURE_NEUTRAL 11
36+
#define PROCESSOR_ARCHITECTURE_ARM64 12
37+
#define PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64 13
38+
#define PROCESSOR_ARCHITECTURE_UNKNOWN 0xFFFF

‎ctypes_generation/definitions/defines/template.py

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,3 +24,19 @@ def CTL_CODE(DeviceType, Function, Method, Access):
2424

2525
def HRESULT_FACILITY(hr):
2626
return (((hr) >> 16) & 0x1fff)
27+
28+
# https://github.com/microsoft/win32metadata/blob/6af96d8470751e13a4e3f579f84b7b8b3ca398e1/generation/WinSDK/RecompiledIdlHeaders/um/WinBase.h#L3562
29+
# Original MACRO:
30+
31+
#define ProcThreadAttributeValue(Number, Thread, Input, Additive) \
32+
# (((Number) & PROC_THREAD_ATTRIBUTE_NUMBER) | \
33+
# ((Thread != FALSE) ? PROC_THREAD_ATTRIBUTE_THREAD : 0) | \
34+
# ((Input != FALSE) ? PROC_THREAD_ATTRIBUTE_INPUT : 0) | \
35+
# ((Additive != FALSE) ? PROC_THREAD_ATTRIBUTE_ADDITIVE : 0))
36+
37+
def ProcThreadAttributeValue(Number, Thread, Input, Additive):
38+
return ((Number & PROC_THREAD_ATTRIBUTE_NUMBER) |
39+
(Thread and PROC_THREAD_ATTRIBUTE_THREAD) |
40+
(Input and PROC_THREAD_ATTRIBUTE_INPUT) |
41+
(Additive and PROC_THREAD_ATTRIBUTE_ADDITIVE))
42+

‎ctypes_generation/definitions/defines/thread_context.txt

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
// Atrget architecture description
2+
3+
#define CONTEXT_I386 0x00010000 // An old PFW error in case ?
4+
#define CONTEXT_AMD64 0x00100000
5+
#define CONTEXT_ARM 0x00200000
6+
#define CONTEXT_ARM64 0x00400000
7+
#define CONTEXT_i386 0x00010000L // this assumes that i386 and
8+
#define CONTEXT_i486 0x00010000L // i486 have identical context records
9+
#define WOW64_CONTEXT_i386 0x00010000 // this assumes that i386 and
10+
#define WOW64_CONTEXT_i486 0x00010000 // i486 have identical context records
11+
12+
// Not perfect, should be explicitly for an architecture
13+
14+
#define CONTEXT_CONTROL 0x00000001L
15+
#define CONTEXT_INTEGER 0x00000002L
16+
#define CONTEXT_SEGMENTS 0x00000004L
17+
#define CONTEXT_FLOATING_POINT 0x00000008L
18+
#define CONTEXT_DEBUG_REGISTERS 0x00000010L
19+
#define CONTEXT_EXTENDED_REGISTERS 0x00000020L
20+
#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
21+
#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
22+
23+
#define CONTEXT_XSTATE (CONTEXT_I386 | 0x00000040L)
24+
25+
// WOW64
26+
27+
28+
29+
#define WOW64_CONTEXT_CONTROL (WOW64_CONTEXT_i386 | 0x00000001L) // SS:SP, CS:IP, FLAGS, BP
30+
#define WOW64_CONTEXT_INTEGER (WOW64_CONTEXT_i386 | 0x00000002L) // AX, BX, CX, DX, SI, DI
31+
#define WOW64_CONTEXT_SEGMENTS (WOW64_CONTEXT_i386 | 0x00000004L) // DS, ES, FS, GS
32+
#define WOW64_CONTEXT_FLOATING_POINT (WOW64_CONTEXT_i386 | 0x00000008L) // 387 state
33+
#define WOW64_CONTEXT_DEBUG_REGISTERS (WOW64_CONTEXT_i386 | 0x00000010L) // DB 0-3,6,7
34+
#define WOW64_CONTEXT_EXTENDED_REGISTERS (WOW64_CONTEXT_i386 | 0x00000020L) // cpu specific extensions
35+
36+
#define WOW64_CONTEXT_FULL (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS)
37+
38+
#define WOW64_CONTEXT_ALL (WOW64_CONTEXT_CONTROL | WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_SEGMENTS | \
39+
WOW64_CONTEXT_FLOATING_POINT | WOW64_CONTEXT_DEBUG_REGISTERS | \
40+
WOW64_CONTEXT_EXTENDED_REGISTERS)
41+
42+
#define WOW64_CONTEXT_XSTATE (WOW64_CONTEXT_i386 | 0x00000040L)
43+
44+
#define WOW64_CONTEXT_EXCEPTION_ACTIVE 0x08000000
45+
#define WOW64_CONTEXT_SERVICE_ACTIVE 0x10000000
46+
#define WOW64_CONTEXT_EXCEPTION_REQUEST 0x40000000
47+
#define WOW64_CONTEXT_EXCEPTION_REPORTING 0x80000000
48+
49+
// ARM64
50+
51+
#define CONTEXT_ARM64_CONTROL (CONTEXT_ARM64 | 0x1L)
52+
#define CONTEXT_ARM64_INTEGER (CONTEXT_ARM64 | 0x2L)
53+
#define CONTEXT_ARM64_FLOATING_POINT (CONTEXT_ARM64 | 0x4L)
54+
#define CONTEXT_ARM64_DEBUG_REGISTERS (CONTEXT_ARM64 | 0x8L)
55+
#define CONTEXT_ARM64_X18 (CONTEXT_ARM64 | 0x10L)
56+
57+
#define CONTEXT_UNWOUND_TO_CALL 0x20000000
58+
#define CONTEXT_RET_TO_GUEST 0x04000000
59+
60+
#define ARM64_MAX_BREAKPOINTS 8
61+
#define ARM64_MAX_WATCHPOINTS 2

‎ctypes_generation/definitions/defines/windef.txt

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -130,22 +130,6 @@
130130
#define TH32CS_SNAPALL (TH32CS_SNAPHEAPLIST | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD | TH32CS_SNAPMODULE)
131131
#define TH32CS_INHERIT 0x80000000
132132

133-
#define CONTEXT_I386 0x00010000
134-
#define CONTEXT_AMD64 0x00100000
135-
#define CONTEXT_ARM 0x00200000
136-
#define CONTEXT_ARM64 0x00400000
137-
138-
#define CONTEXT_CONTROL 0x00000001L
139-
#define CONTEXT_INTEGER 0x00000002L
140-
#define CONTEXT_SEGMENTS 0x00000004L
141-
#define CONTEXT_FLOATING_POINT 0x00000008L
142-
#define CONTEXT_DEBUG_REGISTERS 0x00000010L
143-
#define CONTEXT_EXTENDED_REGISTERS 0x00000020L
144-
#define CONTEXT_FULL (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS)
145-
#define CONTEXT_ALL (CONTEXT_FULL | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS | CONTEXT_EXTENDED_REGISTERS)
146-
147-
#define CONTEXT_XSTATE (CONTEXT_I386 | 0x00000040L)
148-
149133

150134
#define PAGE_NOACCESS 0x01
151135
#define PAGE_READONLY 0x02

‎ctypes_generation/definitions/defines/windef_pe.txt

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,4 +100,6 @@
100100
#define IMAGE_FILE_MACHINE_AMD64 0x8664
101101
#define IMAGE_FILE_MACHINE_M32R 0x9041
102102
#define IMAGE_FILE_MACHINE_CEE 0xC0EE
103-
#define IMAGE_FILE_MACHINE_ARM64 0xAA64
103+
#define IMAGE_FILE_MACHINE_ARM64 0xAA64
104+
105+
#define IMAGE_FILE_MACHINE_TARGET_HOST 0x0001 // Useful for indicating we want to interact with the host and not a WoW guest.

‎ctypes_generation/definitions/functions/process.txt

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,19 @@ BOOL FreeLibrary(
6565
HMODULE hLibModule
6666
);
6767

68+
BOOL GetProcessInformation(
69+
[in] HANDLE hProcess,
70+
[in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
71+
LPVOID ProcessInformation,
72+
[in] DWORD ProcessInformationSize
73+
);
74+
75+
BOOL SetProcessInformation(
76+
[in] HANDLE hProcess,
77+
[in] PROCESS_INFORMATION_CLASS ProcessInformationClass,
78+
LPVOID ProcessInformation,
79+
[in] DWORD ProcessInformationSize
80+
);
6881

6982
/* Not documented by seems present since dawn of time (WRK)
7083
I Prefere PVOID as a return value to allow simple cast to PEB subclass in process.py*/

‎ctypes_generation/definitions/functions/sysinfo.txt

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,4 +59,12 @@ BOOL LookupAccountNameW(
5959
LPWSTR ReferencedDomainName,
6060
LPDWORD cchReferencedDomainName,
6161
PSID_NAME_USE peUse
62+
);
63+
64+
PVOID GetNativeSystemInfo(
65+
[out] LPSYSTEM_INFO lpSystemInfo
66+
);
67+
68+
PVOID GetSystemInfo(
69+
[out] LPSYSTEM_INFO lpSystemInfo
6270
);

‎ctypes_generation/definitions/functions/syswow64.txt

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
BOOL IsWow64Process(
2+
[in] HANDLE hProcess,
3+
[out] PBOOL Wow64Process
4+
);
5+
6+
BOOL IsWow64Process2(
7+
[in] HANDLE hProcess,
8+
[out] USHORT *pProcessMachine,
9+
[out, optional] USHORT *pNativeMachine
10+
);
11+
12+
HRESULT IsWow64GuestMachineSupported(
13+
[in] USHORT WowGuestMachine,
14+
[out] BOOL *MachineIsSupported
15+
);
16+
17+
UINT GetSystemWow64DirectoryA(
18+
[out] LPSTR lpBuffer,
19+
[in] UINT uSize
20+
);
21+
22+
UINT GetSystemWow64DirectoryW(
23+
[out] LPWSTR lpBuffer,
24+
[in] UINT uSize
25+
);
26+
27+
UINT GetSystemWow64Directory2A(
28+
[out] LPSTR lpBuffer,
29+
[in] UINT uSize,
30+
[in] WORD ImageFileMachineType
31+
);
32+
33+
UINT GetSystemWow64Directory2W(
34+
[out] LPWSTR lpBuffer,
35+
[in] UINT uSize,
36+
[in] WORD ImageFileMachineType
37+
);
38+
39+
BOOL Wow64DisableWow64FsRedirection(
40+
[out] PVOID *OldValue
41+
);
42+
43+
BOOLEAN Wow64EnableWow64FsRedirection(
44+
BOOLEAN Wow64FsEnableRedirection
45+
);
46+
47+
BOOL Wow64RevertWow64FsRedirection(
48+
[in] PVOID OlValue
49+
);
50+
51+
BOOL Wow64GetThreadContext(
52+
HANDLE hThread,
53+
PWOW64_CONTEXT lpContext
54+
);
55+
56+
BOOL Wow64SetThreadContext(
57+
HANDLE hThread,
58+
WOW64_CONTEXT *lpContext
59+
);
60+
61+
USHORT Wow64SetThreadDefaultGuestMachine(
62+
USHORT Machine
63+
);
64+
65+
DWORD Wow64SuspendThread(
66+
HANDLE hThread
67+
);
68+
69+
NTSTATUS WINAPI NtWow64ReadVirtualMemory64(
70+
_In_ HANDLE hProcess,
71+
_In_ ULONG64 lpBaseAddress,
72+
_Out_ LPVOID lpBuffer,
73+
_In_ ULONG64 nSize,
74+
_Out_ PULONG64 lpNumberOfBytesRead
75+
);
76+
77+
NTSTATUS WINAPI NtWow64WriteVirtualMemory64(
78+
_In_ HANDLE hProcess,
79+
_In_ ULONG64 lpBaseAddress,
80+
_Out_ LPVOID lpBuffer,
81+
_In_ ULONG64 nSize,
82+
_Out_ PULONG64 lpNumberOfBytesWritten
83+
);

0 commit comments

Comments
 (0)