Tuesday, August 1, 2017

Predefined slots for the P/Invoke tool

I previously added a lasterror command to my P/Invoke command-line tool that prints the last Win32 error to the screen, but that's not very helpful if the last error needs to be used in a call. Since getting the last error is a very common thing to do when troubleshooting, I introduced an automatically defined slot for it, which is updated after every call.

It might be useful for some scripts to have the parent process's ID (say, a different program was invoking this tool to do something to itself). Getting that information is hugely inconvenient without WMI, which is hugely inconvenient to use in native code. So parentpid became a predefined slot as well. pid (the current process's ID) was added to match.

The addition of parentpid allows for scripts like this one, which enables SeRestorePrivilege on its calling process:

call kernel32.dll!OpenProcess /return native /into prochandle (int 0x400, int 0, slotdata parentpid); newslot native token;
call advapi32.dll!OpenProcessToken /return int (slotdata prochandle, int 0x20, slotptr token);
newslot block luid = int 0, int 0;
call advapi32.dll!LookupPrivilegeValueW /return int (nullptr, lpwstr "SeRestorePrivilege", slotptr luid);
newslot block privs = int 1, slotdata luid, int 2;
call advapi32.dll!AdjustTokenPrivileges /return int (slotdata token, int 0, slotptr privs, slotsize privs as int, nullptr, nullptr)

No comments:

Post a Comment