Progress: implement IPC for windows#20114
Conversation
jacobly0
force-pushed
the
win-prog
branch
5 times, most recently
from
4b96626 to
c040764
Compare
The-King-of-Toasters
left a comment
The-King-of-Toasters
left a comment
There was a problem hiding this comment.
This PR is great, but it goes much farther than just implementing progress IPC for Windows: You've basically rewritten all of the OS API bindings in the process. To be clear: that's a good thing! But this PR needs to be split up into smaller commits to facilitate better reviews.
Furthermore, I'd like to see some tests that ensure the new ACCESS_MASK builder gives the same results as a bitflag before I feel comfortable using this.
Finally, see my comment on NtCreateUserProcess.
|
|
||
| pub extern "kernel32" fn GetPhysicallyInstalledSystemMemory(TotalMemoryInKilobytes: *ULONGLONG) BOOL; | ||
|
|
||
| pub extern "kernel32" fn IsDebuggerPresent() BOOL; |
There was a problem hiding this comment.
I don't believe these are used anywhere.
| } | ||
| } | ||
| } | ||
| switch (windows.ntdll.NtCreateUserProcess( |
There was a problem hiding this comment.
Use NtCreateUserProcess at your own peril. Relevant quote from @zodiacon's "Windows Native API Programming":
There have been several attempts in the Infosec community to utilize
RtlCreateUserProcessand/orNtCreateUserProcessto allow running Windows subsystem applications, with varying degrees of success. Part of the problem is the need to communicate with the Windows Subsystem process (csrss.exe) to notify it of the new process and thread. This turns out to be fragile, as different Windows versions may have somewhat different expectations.
Essentially: you're one the hook if this breaks on newer Windows versions and/or Wine updates.
|
2 months old, no updates. I think we have vague plans to try doing this with shared memory instead, anyway. |
3 participants
The nearby local maximum API surface that would have been required to implement this feature would have introduced a bunch of useless new kernel32 dependencies, so I instead fled two undocumented layers deep into ntdll for the identical functionality in a single syscall.
Closes #20105