PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON?的十六进制值是多少

Question

我想在C#程序中使用UpdateProcThreadAttribute()接口调用，但是我找不到PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON的十六进制值。根据PInvoke.net的说法，我只能在Microsoft's website上找到(0x00000001ui64 << 44)，但我不知道如何将其实现到我的代码中，并将其用作IntPtr。

Answer 1

在C/C++中，0x00000001ui64是一个值为1的无符号64位整数，<< 44将该值左移44位。左移相当于乘以2，因此将1与2相乘44的结果是17592186044416，在十六进制中是0x100000000000UL，或者是0x1000_0000_0000UL，表示可靠性。

仅供参考，C#具有C/C++所具有的same bit-shift operators。

LPPROC_THREAD_ATTRIBUTE_LIST是指向PROC_THREAD_ATTRIBUTE_LIST结构的指针。调用InitializeProcThreadAttributeList() 1次以确定该列表需要多大，然后分配该大小的内存，并再次调用InitializeProcThreadAttributeList()初始化该列表。

例如(另请参阅.NET : How to PInvoke UpdateProcThreadAttribute)：

const int PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY = 0x20007;
const long PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON = 0x100000000000L;

[DllImport("kernel32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool InitializeProcThreadAttributeList(
     IntPtr lpAttributeList,
     int dwAttributeCount,
     int dwFlags,
     ref IntPtr lpSize);

[DllImport("kernel32.dll", SetLastError=true)]
public static extern bool DeleteProcThreadAttributeList(IntPtr lpAttributeList);

[DllImport("kernel32.dll", SetLastError=true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool UpdateProcThreadAttribute(
     IntPtr lpAttributeList,
     uint dwFlags,
     IntPtr Attribute,
     IntPtr lpValue,
     IntPtr cbSize,
     IntPtr lpPreviousValue,
     IntPtr lpReturnSize);

...

IntPtr attrListSize = 0;
InitializeProcThreadAttributeList(
    IntPtr.Zero,
    1,
    0,
    ref attrListSize);

IntPtr attrList = Marshal.AllocHGlobal(attrListSize);
InitializeProcThreadAttributeList(
    attrList,
    1,
    0,
    ref attrListSize);

IntPtr lpValue = Marshal.AllocHGlobal(sizeof(long));
Marshal.WriteInt64(lpValue, PROCESS_CREATION_MITIGATION_POLICY_BLOCK_NON_MICROSOFT_BINARIES_ALWAYS_ON);

UpdateProcThreadAttribute(
    attrList,
    0,
    (IntPtr)PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY,
    lpValue,
    sizeof(long),
    IntPtr.Zero,
    IntPtr.Zero
);

// use attrList as needed, ie in STARTUPINFOEX.lpAttributeList ...

DeleteProcThreadAttributeList(attrList);

Marshal.FreeHGlobal(lpValue);
Marshal.FreeHGlobal(attrList);