You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
NOTE: this may be deprecated by HaloSPV3/HXE#288 in the future. In which case, we can instead check a process's executable path to find MCC's root directory.
Only a 64-bit process can inspect another 64-bit process's modules.
HXE can remain 32-bit if this functionality is offloaded to a 64-bit app.
Embedding a small app within HXE to be extracted when needed seems to be the best delivery option. The alternative is to download the latest release during the Compile stage so it is embedded in the Install payload.
Elevated Operations When Access Is Denied
If the current process tries to access a filesystem, registry, process, etc. resource and is denied access due to insufficient permissions, we can start an elevated sub-process and tell it what to do via IPC.
When a User process attempts to access an Elevated process, they will be greeted with
Unhandledexception. System.ComponentModel.Win32Exception (5):Accessisdenied.atSystem.Diagnostics.ProcessManager.OpenProcess(Int32processId,Int32access,BooleanthrowIfExited)
at System.Diagnostics.Process.GetProcessHandle(Int32access,BooleanthrowIfExited)
at System.Diagnostics.Process.GetOrOpenProcessHandle()
at System.Diagnostics.Process.get_SafeHandle()
Related Issues
Purposes
MCC process inspection
NOTE: this may be deprecated by HaloSPV3/HXE#288 in the future. In which case, we can instead check a process's executable path to find MCC's root directory.
Embedding a small app within HXE to be extracted when needed seems to be the best delivery option. The alternative is to download the latest release during the Compile stage so it is embedded in the Install payload.
Elevated Operations When Access Is Denied
When a User process attempts to access an Elevated process, they will be greeted with
Solutions
https://www.c-sharpcorner.com/article/inter-process-communication/
gRPC
https://devblogs.microsoft.com/dotnet/grpc-in-dotnet-6/
https://docs.microsoft.com/en-us/dotnet/architecture/grpc-for-wcf-developers/rpc-types
https://docs.microsoft.com/en-us/aspnet/core/grpc/?view=aspnetcore-6.0
You can use gRPC with an IPC transport like Unix domain sockets
https://github.com/grpc/grpc-dotnet
https://www.nuget.org/profiles/grpc-packages
https://www.nuget.org/packages/Grpc.Net.Client
https://www.nuget.org/packages/Grpc.Net.ClientFactory
IpcServiceFramework
can be configured to work over TCP or named pipes.
JSON RPC
JSON-RPC.NET
StreamJsonRpc
Can be used over most streams. Works with Pipes, WebSockets, etc, and has testability built-in.
Pipes
How to: Use Anonymous Pipes for Local Interprocess Communication
using Streams over a Pipe is the best way if I want to avoid a web service or gRPC/http
MessagePipe
PipeMethodCalls
https://nicolasdeory.medium.com/simple-ipc-using-named-pipes-in-net-core-7cb1b29f6dab
Protobuf
https://johnkoerner.com/csharp/IPC-in-net-core-using-protobuf/
WCF
https://docs.microsoft.com/en-us/dotnet/framework/wcf/feature-details/duplex-services
https://stackoverflow.com/a/56135/14894786
zeroMQ
The text was updated successfully, but these errors were encountered: