Commit eee33ac
authored
Merge pull request #60 from supervoidcoder/command-and-git-peb
This adds the "`Command:`" entry in win-witr! This took unnecessarily longer than it had to because I used undocumented ntdll.dll functions to walk the PEB of a process. This meant I had to manually write support for all of these scenarios:
- ARM64 --> ARM64
- x64 --> x64
- x86 --> x86
- x64 --> x86 (via WoW64)
- x86 --> x64 (this sounds very illegal, but it actually uses another undocumented function that reads the memory "virtually" so you can access it. even then there's still other tricks like Heaven's Gate so it's really not that impossible)
- ARM64 --> WoW64
Most of it was copy-paste, but it took me basically a whole week. The fun part is? This could've been all easily avoided if I had just used WMI like the original witr, which used Get-CimInstance (which is WMI under the hood)! But WMI is notorious for being slow, adding around 200ms for EVERY query, which is a lot. So I did all this work and almost 700 extra lines of code just to scrape off a few hundred milliseconds. Hey, at least it was exciting! MWAHHhAHAHAHAH5 files changed
Lines changed: 708 additions & 65 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
5 | 5 | | |
6 | 6 | | |
7 | 7 | | |
| 8 | + | |
8 | 9 | | |
9 | 10 | | |
10 | 11 | | |
| |||
65 | 66 | | |
66 | 67 | | |
67 | 68 | | |
| 69 | + | |
| 70 | + | |
| 71 | + | |
| 72 | + | |
68 | 73 | | |
69 | 74 | | |
| 75 | + | |
70 | 76 | | |
71 | 77 | | |
72 | 78 | | |
73 | | - | |
74 | | - | |
75 | | - | |
76 | | - | |
| 79 | + | |
77 | 80 | | |
78 | 81 | | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
310 | 310 | | |
311 | 311 | | |
312 | 312 | | |
313 | | - | |
| 313 | + | |
314 | 314 | | |
315 | | - | |
316 | | - | |
317 | | - | |
318 | | - | |
319 | | - | |
320 | | - | |
321 | | - | |
322 | | - | |
323 | | - | |
324 | | - | |
325 | | - | |
326 | | - | |
327 | | - | |
328 | | - | |
329 | | - | |
330 | | - | |
331 | | - | |
332 | | - | |
333 | | - | |
334 | | - | |
335 | | - | |
336 | | - | |
337 | | - | |
338 | | - | |
339 | | - | |
| 315 | + | |
| 316 | + | |
| 317 | + | |
| 318 | + | |
| 319 | + | |
| 320 | + | |
| 321 | + | |
| 322 | + | |
| 323 | + | |
| 324 | + | |
| 325 | + | |
| 326 | + | |
| 327 | + | |
| 328 | + | |
| 329 | + | |
| 330 | + | |
| 331 | + | |
| 332 | + | |
| 333 | + | |
| 334 | + | |
| 335 | + | |
| 336 | + | |
| 337 | + | |
| 338 | + | |
340 | 339 | | |
341 | 340 | | |
342 | 341 | | |
| |||
0 commit comments