c++ - CreateToolhelp32Snapshot : INVALID_HANDLE_VALUE (ERROR_PARTIAL_COPY)

Question

此代码在 64 位应用程序中运行。目标应用程序是 32 位的。

每次运行此代码时，CreateToolhelp32Snapshot() 都会返回 INVALID_HANDLE_VALUE，然后 GetLastError() 会返回 ERROR_PARTIAL_COPY .因此它跳过循环并返回 false。

BOOL HookInjector::InjectIntoProcess(DWORD pID)
{
    //Get Handle to Remote Process
    HANDLE Proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
    ....
    //Check to see if 64-bit or 32-bit application
    IsWow64Process(Proc, &isWow64);
    size_t szCurProc = sizeof(void*); //returns 8
    if (isWow64)
    {
        __debugbreak();
        //Get list of all Modules associated with the Process
        HANDLE hProc32Module;
        do {
            hProc32Module = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE32, pID);
        }
        while ((hProc32Module == INVALID_HANDLE_VALUE) && (GetLastError() == ERROR_BAD_LENGTH));

    if (hProc32Module == INVALID_HANDLE_VALUE) {
        __debugbreak();
        DWORD err = GetLastError(); //just to see the error code which is 0x12b
        return false;
    }

        //Find the module for Kernel.dll and get the base address of it
        MODULEENTRY32 entryModule;
        entryModule.dwSize = sizeof(MODULEENTRY32);
        BOOL isGetModuleSuccess = Module32First(hProc32Module, &entryModule);
        DWORD errEndofList = GetLastError();
        BOOL isSuccessful = false;
        while (errEndofList != ERROR_NO_MORE_FILES && isGetModuleSuccess)
        {
            if (_tcscmp(entryModule.szModule, KERNEL32_DLL)){
                isSuccessful = true;
                break;
            }
            isGetModuleSuccess = Module32Next(hProc32Module, &entryModule);
            errEndofList = GetLastError();
        }

        if (!isSuccessful)
        {
            __debugbreak();
            CloseHandle(hProc32Module);
            return false;
        }

        //Get handle for Kernel.dll module
        hKernel32 = entryModule.hModule;
        CloseHandle(hProc32Module);
    }
    else
    {
        ....

Answer 1

根据documentation , CreateToolhelp32Snapshot() 仅当 CreateToolhelp32Snapshot() 被试图访问 64 位进程的 32 位进程调用时失败并返回 ERROR_PARTIAL_COPY:

If the specified process is a 64-bit process and the caller is a 32-bit process, this function fails and the last error code is ERROR_PARTIAL_COPY (299).

确保您的应用确实是为 64 位编译的。 TH32CS_SNAPMODULE32 只有在 64 位进程中调用 CreateToolhelp32Snapshot() 时才有意义:

TH32CS_SNAPMODULE32
0x00000010
Includes all 32-bit modules of the process specified in th32ProcessID in the snapshot when called from a 64-bit process.

您也没有考虑到 GetLastError() 仅在 API 函数失败时更新，除非另有说明。您的循环假设 GetLastError() 在每次 API 调用后都会更新，这是不正确的。

尝试更像这样的东西:

BOOL HookInjector::InjectIntoProcess(DWORD pID)
{
    //Get Handle to Remote Process
    HANDLE Proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
    ....

    DWORD dwFlag;
    #ifdef _WIN64
    //Check if Remote Process is a 32-bit application
    BOOL isWow64 = FALSE;
    IsWow64Process(Proc, &isWow64);
    if (!isWow64) return false;
    // TH32CS_SNAPMODULE32 includes 32bit modules when used by a 64bit process...
    dwFlag = TH32CS_SNAPMODULE32;
    #else
    // TH32CS_SNAPMODULE includes 32bit modules when used by a 32bit process...
    dwFlag = TH32CS_SNAPMODULE;
    #endif

    __debugbreak();

    //Get list of all Modules associated with the Process

    HANDLE hProc32Module;
    do {
        hProc32Module = CreateToolhelp32Snapshot(dwFlag, pID);
    }
    while ((hProc32Module == INVALID_HANDLE_VALUE) && (GetLastError() == ERROR_BAD_LENGTH));

    if (hProc32Module == INVALID_HANDLE_VALUE) {
        __debugbreak();
        return false;
    }

    //Find the module for Kernel.dll and get the base address of it

    hKernel32 = NULL;

    MODULEENTRY32 entryModule = {0};
    entryModule.dwSize = sizeof(MODULEENTRY32);

    BOOL isGetModuleSuccess = Module32First(hProc32Module, &entryModule);
    while (isGetModuleSuccess) {
        if (_tcscmp(entryModule.szModule, KERNEL32_DLL)) {
            hKernel32 = entryModule.hModule;
            break;
        }
        isGetModuleSuccess = Module32Next(hProc32Module, &entryModule);
    }

    if (!hKernel32) {
        __debugbreak();
        CloseHandle(hProc32Module);
        return false;
    }

    CloseHandle(hProc32Module);

    ....
}