Ejemplo n.º 1
0
        private NtResult <IContext> GetAmd64Context(ContextFlags flags, bool throw_on_error)
        {
            var context = new ContextAmd64
            {
                ContextFlags = flags
            };

            // Buffer needs to be 16 bytes aligned, so allocate some extract space in case.
            using (var buffer = new SafeHGlobalBuffer(Marshal.SizeOf(context) + 16))
            {
                int  write_ofs = 0;
                long ptr       = buffer.DangerousGetHandle().ToInt64();
                // Almost certainly 16 byte aligned, but just in case.
                if ((ptr & 0xF) != 0)
                {
                    write_ofs = (int)(0x10 - (ptr & 0xF));
                }

                Marshal.StructureToPtr(context, buffer.DangerousGetHandle() + write_ofs, false);
                var sbuffer = buffer.GetStructAtOffset <ContextAmd64>(write_ofs);
                return(NtSystemCalls.NtGetContextThread(Handle, sbuffer).CreateResult(throw_on_error, () => sbuffer.Result).Cast <IContext>());
            }
        }
Ejemplo n.º 2
0
        private IContext GetAmd64Context(ContextFlags flags)
        {
            var context = new ContextAmd64();

            context.ContextFlags = flags;

            // Buffer needs to be 16 bytes aligned, so allocate some extract space in case.
            using (var buffer = new SafeHGlobalBuffer(Marshal.SizeOf(context) + 16))
            {
                int  write_ofs = 0;
                long ptr       = buffer.DangerousGetHandle().ToInt64();
                // Almost certainly 8 byte aligned, but just in case.
                if ((ptr & 0xF) != 0)
                {
                    write_ofs = (int)(0x10 - (ptr & 0xF));
                }

                Marshal.StructureToPtr(context, buffer.DangerousGetHandle() + write_ofs, false);
                var sbuffer = buffer.GetStructAtOffset <ContextAmd64>(write_ofs);
                NtSystemCalls.NtGetContextThread(Handle, sbuffer).ToNtException();
                return(sbuffer.Result);
            }
        }