[REFACT] Renamed a function, small refact. Updated ntddk

hasherezade · Aug 31, 2024 · 01690db · 01690db
1 parent 313c311
commit 01690db
Show file tree

Hide file tree

Showing 5 changed files with 76 additions and 39 deletions.
diff --git a/scanners/scanner.cpp b/scanners/scanner.cpp
@@ -497,7 +497,7 @@ size_t pesieve::ProcessScanner::scanThreads(ProcessScanReport& pReport) //throws
 			return 0;
 		}
 	}
-	if (!pesieve::util::query_thread_details(threads_info)) {
+	if (!pesieve::util::query_threads_details(threads_info)) {
 		if (!args.quiet) {
 			std::cout << "[-] Failed quering thread details." << std::endl;
 		}

diff --git a/scanners/thread_scanner.cpp b/scanners/thread_scanner.cpp
@@ -372,6 +372,7 @@ void pesieve::ThreadScanner::printInfo(const pesieve::util::thread_info& threadi
 	std::cout << std::dec << "TID: " << threadi.tid << "\n";
 	std::cout << std::hex << "\tStart   : ";
 	resolveAddr(threadi.start_addr);
+
 	if (threadi.is_extended) {
 		std::cout << std::hex << "\tSysStart: ";
 		resolveAddr(threadi.ext.sys_start_addr);

diff --git a/utils/ntddk.h b/utils/ntddk.h
@@ -2684,24 +2684,64 @@ typedef enum _PROCESSINFOCLASS {
 //
 // Thread Information Classes
 //
-
-typedef enum _THREADINFOCLASS {
-    ThreadBasicInformation,                            // ??
+typedef enum _THREADINFOCLASS
+{
+    ThreadBasicInformation,
     ThreadTimes,
-    ThreadPriority,                                    // ??
-    ThreadBasePriority,                                // ??
-    ThreadAffinityMask,                                // ??
-    ThreadImpersonationToken,                        // HANDLE
-    ThreadDescriptorTableEntry,                        // ULONG Selector + LDT_ENTRY
-    ThreadEnableAlignmentFaultFixup,                // ??
-    ThreadEventPair,                                // ??
-    ThreadQuerySetWin32StartAddress,                // ??
-    ThreadZeroTlsCell,                                // ??
-    ThreadPerformanceCount,                            // ??
-    ThreadAmILastThread,                            // ??
-    ThreadIdealProcessor,                            // ??
-    ThreadPriorityBoost,                            // ??
-    ThreadSetTlsArrayAddress,                        // ??
+    ThreadPriority,
+    ThreadBasePriority,
+    ThreadAffinityMask,
+    ThreadImpersonationToken, // HANDLE
+    ThreadDescriptorTableEntry, // ULONG Selector + LDT_ENTRY
+    ThreadEnableAlignmentFaultFixup,
+    ThreadEventPair,
+    ThreadQuerySetWin32StartAddress,
+    ThreadZeroTlsCell,
+    ThreadPerformanceCount,
+    ThreadAmILastThread,
+    ThreadIdealProcessor,
+    ThreadPriorityBoost,
+    ThreadSetTlsArrayAddress, //
+    ThreadIsIoPending,
+    ThreadHideFromDebugger,
+    ThreadBreakOnTermination,
+    ThreadSwitchLegacyState,
+    ThreadIsTerminated,
+    ThreadLastSystemCall,
+    ThreadIoPriority,
+    ThreadCycleTime,
+    ThreadPagePriority,
+    ThreadActualBasePriority,
+    ThreadTebInformation,
+    ThreadCSwitchMon,
+    ThreadCSwitchPmu,
+    ThreadWow64Context,
+    ThreadGroupInformation,
+    ThreadUmsInformation,
+    ThreadCounterProfiling,
+    ThreadIdealProcessorEx,
+    ThreadCpuAccountingInformation,
+    ThreadSuspendCount,
+    ThreadHeterogeneousCpuPolicy,
+    ThreadContainerId,
+    ThreadNameInformation,
+    ThreadSelectedCpuSets,
+    ThreadSystemThreadInformation,
+    ThreadActualGroupAffinity,
+    ThreadDynamicCodePolicyInfo,
+    ThreadExplicitCaseSensitivity,
+    ThreadWorkOnBehalfTicket,
+    ThreadSubsystemInformation,
+    ThreadDbgkWerReportActive,
+    ThreadAttachContainer,
+    ThreadManageWritesToExecutableMemory,
+    ThreadPowerThrottlingState,
+    ThreadWorkloadClass,
+    ThreadCreateStateChange,
+    ThreadApplyStateChange,
+    ThreadStrongerBadHandleChecks,
+    ThreadEffectiveIoPriority,
+    ThreadEffectivePagePriority,
     MaxThreadInfoClass
 } THREADINFOCLASS;
 

diff --git a/utils/threads_util.cpp b/utils/threads_util.cpp
@@ -12,7 +12,7 @@
 namespace pesieve {
 	namespace util {
 
-		bool query_thread_start(IN DWORD tid, OUT ULONGLONG& startAddr)
+		bool query_thread_details(IN DWORD tid, OUT pesieve::util::thread_info& info)
 		{
 			static auto mod = GetModuleHandleA("ntdll.dll");
 			if (!mod) return false;
@@ -24,29 +24,28 @@ namespace pesieve {
 			HANDLE hThread = OpenThread(thAccess, 0, tid);
 			if (!hThread)  return false;
 
+			bool isOk = false;
 			ULONG returnedLen = 0;
-			NTSTATUS status = pNtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &startAddr, sizeof(startAddr), &returnedLen);
-			CloseHandle(hThread);
-
-			if (status != 0 || returnedLen != sizeof(startAddr)) {
-#ifdef _DEBUG
-				std::cerr << "Failed to query thread: " << std::hex << status << "\n";
-#endif
-				return false;
+			LPVOID startAddr = 0;
+			NTSTATUS status = 0;
+			status = pNtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress, &startAddr, sizeof(LPVOID), &returnedLen);
+			if (status == 0 && returnedLen == sizeof(startAddr)) {
+				info.start_addr = (ULONGLONG)startAddr;
+				isOk = true;
 			}
-			//std::cout << "\tStart: " << std::hex << startAddr;
-			return true;
+			CloseHandle(hThread);
+			return isOk;
 		}
 
 	}; // namespace util
 }; // namespace pesieve
 
 
-bool pesieve::util::query_thread_details(IN OUT std::map<DWORD, pesieve::util::thread_info>& threads_info)
+bool pesieve::util::query_threads_details(IN OUT std::map<DWORD, pesieve::util::thread_info>& threads_info)
 {
 	for (auto itr = threads_info.begin(); itr != threads_info.end(); ++itr) {
 		pesieve::util::thread_info& info = itr->second;
-		if (!query_thread_start(info.tid, info.start_addr)) return false;
+		if (!query_thread_details(info.tid, info)) return false;
 	}
 	return true;
 }

diff --git a/utils/threads_util.h b/utils/threads_util.h
@@ -38,13 +38,10 @@ namespace pesieve {
 			bool is_extended;
 			thread_info_ext ext;
 
-			_thread_info()
-				: tid(0), start_addr(0), is_extended(false)
-			{
-			}
-
-			_thread_info(DWORD _tid)
-				: tid(_tid), start_addr(0), is_extended(false)
+			_thread_info(DWORD _tid = 0)
+				: tid(_tid), 
+				start_addr(0),
+				is_extended(false)
 			{
 			}
 
@@ -58,7 +55,7 @@ namespace pesieve {
 
 		} thread_info;
 
-		bool query_thread_details(IN OUT std::map<DWORD, thread_info>& threads_info);
+		bool query_threads_details(IN OUT std::map<DWORD, thread_info>& threads_info);
 
 		bool fetch_threads_info(IN DWORD pid, OUT std::map<DWORD, thread_info>& threads_info);