Wow64Subsystem.h

#pragma once

#include "NativeSubsystem.h"
#include "Wow64Local.h"

namespace blackbone
{

class NativeWow64 : public Native
{
public:
    BLACKBONE_API NativeWow64( HANDLE hProcess );
    BLACKBONE_API ~NativeWow64();

    virtual NTSTATUS VirualAllocExT( ptr_t& lpAddress, size_t dwSize, DWORD flAllocationType, DWORD flProtect );

    virtual NTSTATUS VirualFreeExT( ptr_t lpAddress, size_t dwSize, DWORD dwFreeType );

    virtual NTSTATUS VirtualProtectExT( ptr_t lpAddress, DWORD64 dwSize, DWORD flProtect, DWORD* flOld );

    virtual NTSTATUS ReadProcessMemoryT( ptr_t lpBaseAddress, LPVOID lpBuffer, size_t nSize, DWORD64 *lpBytes = nullptr );

    virtual NTSTATUS WriteProcessMemoryT( ptr_t lpBaseAddress, LPCVOID lpBuffer, size_t nSize, DWORD64 *lpBytes = nullptr );

    virtual NTSTATUS VirtualQueryExT( ptr_t lpAddress, PMEMORY_BASIC_INFORMATION64 lpBuffer );

    virtual NTSTATUS VirtualQueryExT( ptr_t lpAddress, MEMORY_INFORMATION_CLASS infoClass, LPVOID lpBuffer, size_t bufSize );

    virtual NTSTATUS QueryProcessInfoT( PROCESSINFOCLASS infoClass, LPVOID lpBuffer, uint32_t bufSize );

    virtual NTSTATUS SetProcessInfoT( PROCESSINFOCLASS infoClass, LPVOID lpBuffer, uint32_t bufSize );

    virtual NTSTATUS CreateRemoteThreadT( HANDLE& hThread, ptr_t entry, ptr_t arg, CreateThreadFlags flags );

    virtual NTSTATUS GetThreadContextT( HANDLE hThread, _CONTEXT64& ctx );

    virtual NTSTATUS GetThreadContextT( HANDLE hThread, _CONTEXT32& ctx );

    virtual NTSTATUS SetThreadContextT( HANDLE hThread, _CONTEXT64& ctx );

    virtual NTSTATUS SetThreadContextT( HANDLE hThread, _CONTEXT32& ctx );

    virtual ptr_t getPEB( _PEB32* ppeb );

    virtual ptr_t getPEB( _PEB64* ppeb );

    virtual ptr_t getTEB( HANDLE hThread, _TEB32* pteb );

    virtual ptr_t getTEB( HANDLE hThread, _TEB64* pteb );

private:
    Wow64Local _local;     // WOW64 helpers
};

}