Skip to content

Commit 0d481ca

Browse files
hakrilhakril
committed
Add system.architecture & process.architecture
1 parent 3707a8e commit 0d481ca

File tree

9 files changed

+264
-14
lines changed

9 files changed

+264
-14
lines changed

‎ctypes_generation/definitions/defines/processor.txt‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
#define PROCESSOR_INTEL_386 386
2+
#define PROCESSOR_INTEL_486 486
3+
#define PROCESSOR_INTEL_PENTIUM 586
4+
#define PROCESSOR_INTEL_IA64 2200
5+
#define PROCESSOR_MIPS_R4000 4000 // incl R4101 & R3910 for Windows CE
6+
#define PROCESSOR_ALPHA_21064 21064
7+
#define PROCESSOR_PPC_601 601
8+
#define PROCESSOR_PPC_603 603
9+
#define PROCESSOR_PPC_604 604
10+
#define PROCESSOR_PPC_620 620
11+
#define PROCESSOR_HITACHI_SH3 10003 // Windows CE
12+
#define PROCESSOR_HITACHI_SH3E 10004 // Windows CE
13+
#define PROCESSOR_HITACHI_SH4 10005 // Windows CE
14+
#define PROCESSOR_MOTOROLA_821 821 // Windows CE
15+
#define PROCESSOR_SHx_SH3 103 // Windows CE
16+
#define PROCESSOR_SHx_SH4 104 // Windows CE
17+
#define PROCESSOR_STRONGARM 2577 // Windows CE - 0xA11
18+
#define PROCESSOR_ARM720 1824 // Windows CE - 0x720
19+
#define PROCESSOR_ARM820 2080 // Windows CE - 0x820
20+
#define PROCESSOR_ARM920 2336 // Windows CE - 0x920
21+
#define PROCESSOR_ARM_7TDMI 70001 // Windows CE
22+
#define PROCESSOR_OPTIL 0x494f // MSIL
23+
24+
#define PROCESSOR_ARCHITECTURE_INTEL 0
25+
#define PROCESSOR_ARCHITECTURE_MIPS 1
26+
#define PROCESSOR_ARCHITECTURE_ALPHA 2
27+
#define PROCESSOR_ARCHITECTURE_PPC 3
28+
#define PROCESSOR_ARCHITECTURE_SHX 4
29+
#define PROCESSOR_ARCHITECTURE_ARM 5
30+
#define PROCESSOR_ARCHITECTURE_IA64 6
31+
#define PROCESSOR_ARCHITECTURE_ALPHA64 7
32+
#define PROCESSOR_ARCHITECTURE_MSIL 8
33+
#define PROCESSOR_ARCHITECTURE_AMD64 9
34+
#define PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 10
35+
#define PROCESSOR_ARCHITECTURE_NEUTRAL 11
36+
#define PROCESSOR_ARCHITECTURE_ARM64 12
37+
#define PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64 13
38+
#define PROCESSOR_ARCHITECTURE_UNKNOWN 0xFFFF

‎ctypes_generation/definitions/defines/windef_pe.txt‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -100,4 +100,6 @@
100100
#define IMAGE_FILE_MACHINE_AMD64 0x8664
101101
#define IMAGE_FILE_MACHINE_M32R 0x9041
102102
#define IMAGE_FILE_MACHINE_CEE 0xC0EE
103-
#define IMAGE_FILE_MACHINE_ARM64 0xAA64
103+
#define IMAGE_FILE_MACHINE_ARM64 0xAA64
104+
105+
#define IMAGE_FILE_MACHINE_TARGET_HOST 0x0001 // Useful for indicating we want to interact with the host and not a WoW guest.

‎docs/source/windef_generated.rst‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1145,6 +1145,43 @@ WinDef
11451145
.. autodata:: NMPWAIT_WAIT_FOREVER
11461146
.. autodata:: NMPWAIT_NOWAIT
11471147
.. autodata:: NMPWAIT_USE_DEFAULT_WAIT
1148+
.. autodata:: PROCESSOR_INTEL_386
1149+
.. autodata:: PROCESSOR_INTEL_486
1150+
.. autodata:: PROCESSOR_INTEL_PENTIUM
1151+
.. autodata:: PROCESSOR_INTEL_IA64
1152+
.. autodata:: PROCESSOR_MIPS_R4000
1153+
.. autodata:: PROCESSOR_ALPHA_21064
1154+
.. autodata:: PROCESSOR_PPC_601
1155+
.. autodata:: PROCESSOR_PPC_603
1156+
.. autodata:: PROCESSOR_PPC_604
1157+
.. autodata:: PROCESSOR_PPC_620
1158+
.. autodata:: PROCESSOR_HITACHI_SH3
1159+
.. autodata:: PROCESSOR_HITACHI_SH3E
1160+
.. autodata:: PROCESSOR_HITACHI_SH4
1161+
.. autodata:: PROCESSOR_MOTOROLA_821
1162+
.. autodata:: PROCESSOR_SHx_SH3
1163+
.. autodata:: PROCESSOR_SHx_SH4
1164+
.. autodata:: PROCESSOR_STRONGARM
1165+
.. autodata:: PROCESSOR_ARM720
1166+
.. autodata:: PROCESSOR_ARM820
1167+
.. autodata:: PROCESSOR_ARM920
1168+
.. autodata:: PROCESSOR_ARM_7TDMI
1169+
.. autodata:: PROCESSOR_OPTIL
1170+
.. autodata:: PROCESSOR_ARCHITECTURE_INTEL
1171+
.. autodata:: PROCESSOR_ARCHITECTURE_MIPS
1172+
.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA
1173+
.. autodata:: PROCESSOR_ARCHITECTURE_PPC
1174+
.. autodata:: PROCESSOR_ARCHITECTURE_SHX
1175+
.. autodata:: PROCESSOR_ARCHITECTURE_ARM
1176+
.. autodata:: PROCESSOR_ARCHITECTURE_IA64
1177+
.. autodata:: PROCESSOR_ARCHITECTURE_ALPHA64
1178+
.. autodata:: PROCESSOR_ARCHITECTURE_MSIL
1179+
.. autodata:: PROCESSOR_ARCHITECTURE_AMD64
1180+
.. autodata:: PROCESSOR_ARCHITECTURE_IA32_ON_WIN64
1181+
.. autodata:: PROCESSOR_ARCHITECTURE_NEUTRAL
1182+
.. autodata:: PROCESSOR_ARCHITECTURE_ARM64
1183+
.. autodata:: PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64
1184+
.. autodata:: PROCESSOR_ARCHITECTURE_UNKNOWN
11481185
.. autodata:: HKEY_CLASSES_ROOT
11491186
.. autodata:: HKEY_CURRENT_USER
11501187
.. autodata:: HKEY_LOCAL_MACHINE
@@ -2922,6 +2959,7 @@ WinDef
29222959
.. autodata:: IMAGE_FILE_MACHINE_M32R
29232960
.. autodata:: IMAGE_FILE_MACHINE_CEE
29242961
.. autodata:: IMAGE_FILE_MACHINE_ARM64
2962+
.. autodata:: IMAGE_FILE_MACHINE_TARGET_HOST
29252963
.. autodata:: CERT_QUERY_OBJECT_FILE
29262964
.. autodata:: CERT_QUERY_OBJECT_BLOB
29272965
.. autodata:: CERT_QUERY_CONTENT_CERT

‎tests/test_syswow.py‎

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,9 @@ def test_print_syswow_state():
1717
print(f"{platform.machine()=}")
1818
print(f"{platform.architecture()=}")
1919
print(f"{windows.system.bitness=}")
20+
print(f"{windows.system.architecture=}")
2021
print(f"{windows.current_process.bitness=}")
21-
print(f"{windows.current_process.is_wow_64=}")
22+
print(f"{windows.current_process.architecture=}")
2223
print(f"{env['PROCESSOR_ARCHITECTURE']=}")
2324
print(f"{env.get('PROCESSOR_ARCHITEW6432')=}")
2425

@@ -30,12 +31,6 @@ def test_print_syswow_state():
3031
print(f"{hex(processMachine.value)=}")
3132
print(f"{hex(nativeMachine.value)=}")
3233

33-
print("")
34-
print("GetSystemInfo")
35-
windows.utils.sprint(windows.utils.get_system_info(native=False), name="SystemInfo")
36-
print("")
37-
print("GetNativeSystemInfo")
38-
windows.utils.sprint(windows.utils.get_system_info(native=True), name="NativeSystemInfo")
3934

4035
@process_syswow_only
4136
class TestSyswowCurrentProcess(object):

‎windows/generated_def/__init__.py‎

Lines changed: 53 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,5 +67,57 @@ def bitness():
6767
from .windef import *
6868
from .interfaces import *
6969

70-
70+
# Define custom Flag mappers for define list that should be enums
71+
72+
PROCESSOR_ARCHITECTURE_MAPPER = FlagMapper(
73+
PROCESSOR_ARCHITECTURE_INTEL,
74+
PROCESSOR_ARCHITECTURE_MIPS,
75+
PROCESSOR_ARCHITECTURE_ALPHA,
76+
PROCESSOR_ARCHITECTURE_PPC,
77+
PROCESSOR_ARCHITECTURE_SHX,
78+
PROCESSOR_ARCHITECTURE_ARM,
79+
PROCESSOR_ARCHITECTURE_IA64,
80+
PROCESSOR_ARCHITECTURE_ALPHA64,
81+
PROCESSOR_ARCHITECTURE_MSIL,
82+
PROCESSOR_ARCHITECTURE_AMD64,
83+
PROCESSOR_ARCHITECTURE_IA32_ON_WIN64,
84+
PROCESSOR_ARCHITECTURE_NEUTRAL,
85+
PROCESSOR_ARCHITECTURE_ARM64,
86+
PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64,
87+
PROCESSOR_ARCHITECTURE_UNKNOWN,
88+
IMAGE_FILE_MACHINE_TARGET_HOST
89+
)
90+
91+
IMAGE_FILE_MACHINE_MAPPER = FlagMapper(
92+
IMAGE_FILE_MACHINE_UNKNOWN,
93+
IMAGE_FILE_MACHINE_I386,
94+
IMAGE_FILE_MACHINE_R3000,
95+
IMAGE_FILE_MACHINE_R4000,
96+
IMAGE_FILE_MACHINE_R10000,
97+
IMAGE_FILE_MACHINE_WCEMIPSV2,
98+
IMAGE_FILE_MACHINE_ALPHA,
99+
IMAGE_FILE_MACHINE_SH3,
100+
IMAGE_FILE_MACHINE_SH3DSP,
101+
IMAGE_FILE_MACHINE_SH3E,
102+
IMAGE_FILE_MACHINE_SH4,
103+
IMAGE_FILE_MACHINE_SH5,
104+
IMAGE_FILE_MACHINE_ARM,
105+
IMAGE_FILE_MACHINE_THUMB,
106+
IMAGE_FILE_MACHINE_ARMNT,
107+
IMAGE_FILE_MACHINE_AM33,
108+
IMAGE_FILE_MACHINE_POWERPC,
109+
IMAGE_FILE_MACHINE_POWERPCFP,
110+
IMAGE_FILE_MACHINE_IA64,
111+
IMAGE_FILE_MACHINE_MIPS16,
112+
IMAGE_FILE_MACHINE_ALPHA64,
113+
IMAGE_FILE_MACHINE_MIPSFPU,
114+
IMAGE_FILE_MACHINE_MIPSFPU16,
115+
IMAGE_FILE_MACHINE_TRICORE,
116+
IMAGE_FILE_MACHINE_CEF,
117+
IMAGE_FILE_MACHINE_EBC,
118+
IMAGE_FILE_MACHINE_AMD64,
119+
IMAGE_FILE_MACHINE_M32R,
120+
IMAGE_FILE_MACHINE_CEE,
121+
IMAGE_FILE_MACHINE_ARM64
122+
)
71123

‎windows/generated_def/meta.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1722,6 +1722,7 @@
17221722
'IMAGE_FILE_MACHINE_SH3E',
17231723
'IMAGE_FILE_MACHINE_SH4',
17241724
'IMAGE_FILE_MACHINE_SH5',
1725+
'IMAGE_FILE_MACHINE_TARGET_HOST',
17251726
'IMAGE_FILE_MACHINE_THUMB',
17261727
'IMAGE_FILE_MACHINE_TRICORE',
17271728
'IMAGE_FILE_MACHINE_UNKNOWN',
@@ -2421,7 +2422,44 @@
24212422
'PRIORITY_BIT',
24222423
'PRIORITY_EQUAL_FIRST',
24232424
'PRIORITY_EQUAL_LAST',
2425+
'PROCESSOR_ALPHA_21064',
2426+
'PROCESSOR_ARCHITECTURE_ALPHA',
2427+
'PROCESSOR_ARCHITECTURE_ALPHA64',
2428+
'PROCESSOR_ARCHITECTURE_AMD64',
2429+
'PROCESSOR_ARCHITECTURE_ARM',
2430+
'PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64',
2431+
'PROCESSOR_ARCHITECTURE_ARM64',
2432+
'PROCESSOR_ARCHITECTURE_IA32_ON_WIN64',
2433+
'PROCESSOR_ARCHITECTURE_IA64',
2434+
'PROCESSOR_ARCHITECTURE_INTEL',
2435+
'PROCESSOR_ARCHITECTURE_MIPS',
2436+
'PROCESSOR_ARCHITECTURE_MSIL',
2437+
'PROCESSOR_ARCHITECTURE_NEUTRAL',
2438+
'PROCESSOR_ARCHITECTURE_PPC',
2439+
'PROCESSOR_ARCHITECTURE_SHX',
2440+
'PROCESSOR_ARCHITECTURE_UNKNOWN',
2441+
'PROCESSOR_ARM720',
2442+
'PROCESSOR_ARM820',
2443+
'PROCESSOR_ARM920',
2444+
'PROCESSOR_ARM_7TDMI',
24242445
'PROCESSOR_FEATURE_MAX',
2446+
'PROCESSOR_HITACHI_SH3',
2447+
'PROCESSOR_HITACHI_SH3E',
2448+
'PROCESSOR_HITACHI_SH4',
2449+
'PROCESSOR_INTEL_386',
2450+
'PROCESSOR_INTEL_486',
2451+
'PROCESSOR_INTEL_IA64',
2452+
'PROCESSOR_INTEL_PENTIUM',
2453+
'PROCESSOR_MIPS_R4000',
2454+
'PROCESSOR_MOTOROLA_821',
2455+
'PROCESSOR_OPTIL',
2456+
'PROCESSOR_PPC_601',
2457+
'PROCESSOR_PPC_603',
2458+
'PROCESSOR_PPC_604',
2459+
'PROCESSOR_PPC_620',
2460+
'PROCESSOR_SHx_SH3',
2461+
'PROCESSOR_SHx_SH4',
2462+
'PROCESSOR_STRONGARM',
24252463
'PROCESS_ALL_ACCESS',
24262464
'PROCESS_CREATE_PROCESS',
24272465
'PROCESS_CREATE_THREAD',

‎windows/generated_def/windef.py‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1169,6 +1169,43 @@ def HRESULT_FACILITY(hr):
11691169
NMPWAIT_WAIT_FOREVER = make_flag("NMPWAIT_WAIT_FOREVER", 0xffffffff)
11701170
NMPWAIT_NOWAIT = make_flag("NMPWAIT_NOWAIT", 0x00000001)
11711171
NMPWAIT_USE_DEFAULT_WAIT = make_flag("NMPWAIT_USE_DEFAULT_WAIT", 0x00000000)
1172+
PROCESSOR_INTEL_386 = make_flag("PROCESSOR_INTEL_386", 386)
1173+
PROCESSOR_INTEL_486 = make_flag("PROCESSOR_INTEL_486", 486)
1174+
PROCESSOR_INTEL_PENTIUM = make_flag("PROCESSOR_INTEL_PENTIUM", 586)
1175+
PROCESSOR_INTEL_IA64 = make_flag("PROCESSOR_INTEL_IA64", 2200)
1176+
PROCESSOR_MIPS_R4000 = make_flag("PROCESSOR_MIPS_R4000", 4000)
1177+
PROCESSOR_ALPHA_21064 = make_flag("PROCESSOR_ALPHA_21064", 21064)
1178+
PROCESSOR_PPC_601 = make_flag("PROCESSOR_PPC_601", 601)
1179+
PROCESSOR_PPC_603 = make_flag("PROCESSOR_PPC_603", 603)
1180+
PROCESSOR_PPC_604 = make_flag("PROCESSOR_PPC_604", 604)
1181+
PROCESSOR_PPC_620 = make_flag("PROCESSOR_PPC_620", 620)
1182+
PROCESSOR_HITACHI_SH3 = make_flag("PROCESSOR_HITACHI_SH3", 10003)
1183+
PROCESSOR_HITACHI_SH3E = make_flag("PROCESSOR_HITACHI_SH3E", 10004)
1184+
PROCESSOR_HITACHI_SH4 = make_flag("PROCESSOR_HITACHI_SH4", 10005)
1185+
PROCESSOR_MOTOROLA_821 = make_flag("PROCESSOR_MOTOROLA_821", 821)
1186+
PROCESSOR_SHx_SH3 = make_flag("PROCESSOR_SHx_SH3", 103)
1187+
PROCESSOR_SHx_SH4 = make_flag("PROCESSOR_SHx_SH4", 104)
1188+
PROCESSOR_STRONGARM = make_flag("PROCESSOR_STRONGARM", 2577)
1189+
PROCESSOR_ARM720 = make_flag("PROCESSOR_ARM720", 1824)
1190+
PROCESSOR_ARM820 = make_flag("PROCESSOR_ARM820", 2080)
1191+
PROCESSOR_ARM920 = make_flag("PROCESSOR_ARM920", 2336)
1192+
PROCESSOR_ARM_7TDMI = make_flag("PROCESSOR_ARM_7TDMI", 70001)
1193+
PROCESSOR_OPTIL = make_flag("PROCESSOR_OPTIL", 0x494f)
1194+
PROCESSOR_ARCHITECTURE_INTEL = make_flag("PROCESSOR_ARCHITECTURE_INTEL", 0)
1195+
PROCESSOR_ARCHITECTURE_MIPS = make_flag("PROCESSOR_ARCHITECTURE_MIPS", 1)
1196+
PROCESSOR_ARCHITECTURE_ALPHA = make_flag("PROCESSOR_ARCHITECTURE_ALPHA", 2)
1197+
PROCESSOR_ARCHITECTURE_PPC = make_flag("PROCESSOR_ARCHITECTURE_PPC", 3)
1198+
PROCESSOR_ARCHITECTURE_SHX = make_flag("PROCESSOR_ARCHITECTURE_SHX", 4)
1199+
PROCESSOR_ARCHITECTURE_ARM = make_flag("PROCESSOR_ARCHITECTURE_ARM", 5)
1200+
PROCESSOR_ARCHITECTURE_IA64 = make_flag("PROCESSOR_ARCHITECTURE_IA64", 6)
1201+
PROCESSOR_ARCHITECTURE_ALPHA64 = make_flag("PROCESSOR_ARCHITECTURE_ALPHA64", 7)
1202+
PROCESSOR_ARCHITECTURE_MSIL = make_flag("PROCESSOR_ARCHITECTURE_MSIL", 8)
1203+
PROCESSOR_ARCHITECTURE_AMD64 = make_flag("PROCESSOR_ARCHITECTURE_AMD64", 9)
1204+
PROCESSOR_ARCHITECTURE_IA32_ON_WIN64 = make_flag("PROCESSOR_ARCHITECTURE_IA32_ON_WIN64", 10)
1205+
PROCESSOR_ARCHITECTURE_NEUTRAL = make_flag("PROCESSOR_ARCHITECTURE_NEUTRAL", 11)
1206+
PROCESSOR_ARCHITECTURE_ARM64 = make_flag("PROCESSOR_ARCHITECTURE_ARM64", 12)
1207+
PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64 = make_flag("PROCESSOR_ARCHITECTURE_ARM32_ON_WIN64", 13)
1208+
PROCESSOR_ARCHITECTURE_UNKNOWN = make_flag("PROCESSOR_ARCHITECTURE_UNKNOWN", 0xFFFF)
11721209
HKEY_CLASSES_ROOT = make_flag("HKEY_CLASSES_ROOT", ( 0x80000000 ))
11731210
HKEY_CURRENT_USER = make_flag("HKEY_CURRENT_USER", ( 0x80000001 ))
11741211
HKEY_LOCAL_MACHINE = make_flag("HKEY_LOCAL_MACHINE", ( 0x80000002 ))
@@ -2946,6 +2983,7 @@ def HRESULT_FACILITY(hr):
29462983
IMAGE_FILE_MACHINE_M32R = make_flag("IMAGE_FILE_MACHINE_M32R", 0x9041)
29472984
IMAGE_FILE_MACHINE_CEE = make_flag("IMAGE_FILE_MACHINE_CEE", 0xC0EE)
29482985
IMAGE_FILE_MACHINE_ARM64 = make_flag("IMAGE_FILE_MACHINE_ARM64", 0xAA64)
2986+
IMAGE_FILE_MACHINE_TARGET_HOST = make_flag("IMAGE_FILE_MACHINE_TARGET_HOST", 0x0001)
29492987
CERT_QUERY_OBJECT_FILE = make_flag("CERT_QUERY_OBJECT_FILE", 0x00000001)
29502988
CERT_QUERY_OBJECT_BLOB = make_flag("CERT_QUERY_OBJECT_BLOB", 0x00000002)
29512989
CERT_QUERY_CONTENT_CERT = make_flag("CERT_QUERY_CONTENT_CERT", 1)

‎windows/winobject/process.py‎

Lines changed: 36 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -64,14 +64,30 @@ def exit_code(self):
6464

6565

6666
class Process(utils.AutoHandle):
67-
@utils.fixedpropety
67+
@utils.fixedproperty
6868
def is_wow_64(self):
6969
"""``True`` if the process is a SysWow64 process (32bit process on 64bits system).
7070
7171
:type: :class:`bool`
7272
"""
73-
# return utils.is_wow_64(self.handle)
74-
return utils.is_wow_64(self.limited_handle)
73+
if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process):
74+
return False
75+
Wow64Process = gdef.BOOL()
76+
windows.winproxy.IsWow64Process(self.handle, Wow64Process)
77+
return bool(Wow64Process)
78+
79+
80+
81+
@utils.fixedproperty
82+
def is_wow_64_2(self):
83+
if not windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
84+
return None, None
85+
processMachine = gdef.USHORT()
86+
nativeMachine = gdef.USHORT()
87+
windows.winproxy.IsWow64Process2(self.handle, processMachine, nativeMachine)
88+
return (gdef.IMAGE_FILE_MACHINE_MAPPER[processMachine.value],
89+
gdef.IMAGE_FILE_MACHINE_MAPPER[nativeMachine.value])
90+
7591

7692
@utils.fixedpropety
7793
def bitness(self):
@@ -85,6 +101,22 @@ def bitness(self):
85101
return 32
86102
return 64
87103

104+
@utils.fixedproperty
105+
def architecture(self):
106+
# Syswow2 will exactly tell us the architecture
107+
if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
108+
process_machine, native_machine = self.is_wow_64_2
109+
try:
110+
return utils.image_file_machine_to_processor_architecture(process_machine)
111+
except KeyError as e:
112+
raise ValueError("Unknown IsWow64Process2(process_machine:#x) -> {0}".format(process_machine))
113+
114+
# No IsWow64Process2 -> No ARM64
115+
# So its up on x86 -> x64 based on process bitness
116+
if self.bitness == 32:
117+
return gdef.PROCESSOR_ARCHITECTURE_INTEL
118+
return gdef.PROCESSOR_ARCHITECTURE_AMD64
119+
88120
@utils.fixedpropety
89121
def limited_handle(self):
90122
if windows.system.version[0] <= 5:
@@ -648,7 +680,7 @@ def peb(self):
648680
"""
649681
return PEB.from_address(self.get_peb_builtin()())
650682

651-
@utils.fixedpropety
683+
@utils.fixedproperty
652684
def bitness(self):
653685
"""The bitness of the process
654686

‎windows/winobject/system.py‎

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,6 @@
1010
import windows.generated_def as gdef
1111

1212

13-
1413
from windows.winobject import process
1514
from windows.winobject import network
1615
from windows.winobject import registry
@@ -586,6 +585,24 @@ def kuser_shared_data(self):
586585
# These are the part that do not move much between XP & Win10
587586
return gdef.PFW_MINIMAL_KUSER_SHARED_DATA.from_address(gdef.MM_SHARED_USER_DATA_VA)
588587

588+
@utils.fixedproperty
589+
def architecture(self):
590+
# Retrieve system processor architecture
591+
# It's not that easy as x64-on-ARM64 will lie on most API except IsWow64Process2
592+
# EX: GetNativeSystemInfo will returns PROCESSOR_ARCHITECTURE_AMD64
593+
if windows.winproxy.is_implemented(windows.winproxy.IsWow64Process2):
594+
process_machine, native_machine = windows.current_process.is_wow_64_2
595+
try:
596+
return utils.image_file_machine_to_processor_architecture(native_machine)
597+
except KeyError as e:
598+
raise ValueError("Unknown IsWow64Process2(native_machine:#x) -> {0}".format(native_machine))
599+
600+
# No IsWow64Process2 -> assert it cannot be ARM64 and thus GetNativeSystemInfo will not lie ?
601+
sysinfo = gdef.SYSTEM_INFO()
602+
windows.winproxy.GetNativeSystemInfo(sysinfo)
603+
return gdef.PROCESSOR_ARCHITECTURE_MAPPER[sysinfo.wProcessorArchitecture]
604+
605+
589606

590607
@staticmethod
591608
def enumerate_processes():

0 commit comments

Comments
 (0)