JIT fixes and more improvements (admin check etc.)

Author: therealdreg

x64_dbg_dbg/_dbgfunctions.cpp

@@ -112,6 +112,11 @@ static bool _getjitauto(bool* jit_auto)
     return dbggetjitauto(jit_auto, notfound, NULL, NULL);
 }
 
+static bool _isprocesselevated(void)
+{
+    return IsProcessElevated();
+}
+
 static bool _getpagerights(uint* addr, char* rights)
 {
     return dbggetpagerights(addr, rights);
@@ -198,4 +203,5 @@ void dbgfunctionsinit()
     _dbgfunctions.GetPageRights = _getpagerights;
     _dbgfunctions.SetPageRights = _setpagerights;
     _dbgfunctions.PageRightsToString = _pagerightstostring;
+    _dbgfunctions.IsProcessElevated = _isprocesselevated;
 }

x64_dbg_dbg/_dbgfunctions.h

@@ -60,6 +60,7 @@ typedef bool (*GETPROCESSLIST)(DBGPROCESSINFO** entries, int* count);
 typedef bool (*GETPAGERIGHTS)(duint*, char*);
 typedef bool (*SETPAGERIGHTS)(duint*, char*);
 typedef bool (*PAGERIGHTSTOSTRING)(DWORD, char*);
+typedef bool (*ISPROCESSELEVATED)(void);
 
 typedef struct DBGFUNCTIONS_
 {
@@ -90,6 +91,7 @@ typedef struct DBGFUNCTIONS_
     GETPAGERIGHTS GetPageRights;
     SETPAGERIGHTS SetPageRights;
     PAGERIGHTSTOSTRING PageRightsToString;
+    ISPROCESSELEVATED IsProcessElevated;
 } DBGFUNCTIONS;
 
 #ifdef BUILD_DBG

x64_dbg_dbg/debugger.cpp

@@ -1480,6 +1480,21 @@ void cbDetach()
     return;
 }
 
+
+bool IsProcessElevated()
+{
+
+    HANDLE hToken;
+    DWORD tkInfoLen;
+    TOKEN_ELEVATION tkElevation;
+
+    OpenProcessToken(GetCurrentProcess(), TOKEN_READ, &hToken);
+
+    GetTokenInformation(hToken, TokenElevation, &tkElevation, sizeof(tkElevation), &tkInfoLen);
+
+    return (tkElevation.TokenIsElevated != 0);
+}
+
 bool _readwritejitkey(char* jit_key_value, DWORD* jit_key_vale_size, char* key, arch arch_in, arch* arch_out, readwritejitkey_error_t* error, bool write)
 {
     DWORD key_flags;
@@ -1491,7 +1506,15 @@ bool _readwritejitkey(char* jit_key_value, DWORD* jit_key_vale_size, char* key,
         * error = ERROR_RW;
 
     if(write)
+    {
+        if(!IsProcessElevated())
+        {
+            if(error != NULL)
+                * error = ERROR_RW_NOTADMIN;
+            return false;
+        }
         key_flags = KEY_WRITE;
+    }
     else
         key_flags = KEY_READ;
 
@@ -1512,7 +1535,7 @@ bool _readwritejitkey(char* jit_key_value, DWORD* jit_key_vale_size, char* key,
 
     if(arch_in == x64)
     {
-#ifdef _WIN32
+#ifndef _WIN64
         if(!IsWow64())
         {
             if(error != NULL)

x64_dbg_dbg/debugger.h

@@ -16,7 +16,8 @@ typedef enum
 {
     ERROR_RW = 0,
     ERROR_RW_FILE_NOT_FOUND,
-    ERROR_RW_NOTWOW64
+    ERROR_RW_NOTWOW64,
+    ERROR_RW_NOTADMIN
 } readwritejitkey_error_t;
 
 //structures
@@ -74,6 +75,7 @@ bool _readwritejitkey(char*, DWORD*, char*, arch, arch*, readwritejitkey_error_t
 bool dbggetjitauto(bool*, arch, arch*, readwritejitkey_error_t*);
 bool dbgsetjitauto(bool, arch, arch*, readwritejitkey_error_t*);
 bool dbglistprocesses(std::vector<PROCESSENTRY32>* list);
+bool IsProcessElevated();
 
 void cbStep();
 void cbRtrStep();

x64_dbg_dbg/debugger_commands.cpp

@@ -1437,6 +1437,11 @@ CMDRESULT cbDebugSetJITAuto(int argc, char* argv[])
 {
     arch actual_arch;
     bool set_jit_auto;
+    if(!IsProcessElevated())
+    {
+        dprintf("Error run the debugger as Admin to setjitauto\n");
+        return STATUS_ERROR;
+    }
     if(argc < 2)
     {
         dprintf("Error setting JIT Auto. Use ON:1 or OFF:0 arg or x64/x32, ON:1 or OFF:0.\n");
@@ -1512,6 +1517,11 @@ CMDRESULT cbDebugSetJIT(int argc, char* argv[])
     arch actual_arch;
     char* jit_debugger_cmd;
     char oldjit[MAX_SETTING_SIZE] = "";
+    if(!IsProcessElevated())
+    {
+        dprintf("Error run the debugger as Admin to setjit\n");
+        return STATUS_ERROR;
+    }
     if(argc < 2)
     {
         char path[JIT_ENTRY_DEF_SIZE];
@@ -1619,7 +1629,7 @@ CMDRESULT cbDebugSetJIT(int argc, char* argv[])
             if(rw_error == ERROR_RW_NOTWOW64)
                 dprintf("Error using x64 arg. The debugger is not a WOW64 process\n");
             else
-                dprintf("Error getting JIT %s\n", (actual_arch == x64) ? "x64" : "x32");
+                dprintf("Error setting JIT %s\n", (actual_arch == x64) ? "x64" : "x32");
             return STATUS_ERROR;
         }
     }

x64_dbg_gui/Project/Src/Gui/SettingsDialog.cpp

@@ -191,6 +191,13 @@ void SettingsDialog::LoadSettings()
 
                 ui->chkConfirmBeforeAtt->setCheckState(bool2check(settings.miscSetJITAuto));
             }
+
+            if(!DbgFunctions()->IsProcessElevated())
+            {
+                ui->chkSetJIT->setDisabled(true);
+                ui->chkConfirmBeforeAtt->setDisabled(true);
+                ui->lbladminwarning->setText(QString("Warning: Run the debugger as Admin to enable JIT."));
+            }
         }
     }
     bJitOld = settings.miscSetJIT;

x64_dbg_gui/Project/Src/Gui/SettingsDialog.ui

@@ -516,6 +516,19 @@
       <string>Confirm before attaching</string>
      </property>
     </widget>
+    <widget class="QLabel" name="lbladminwarning">
+     <property name="geometry">
+      <rect>
+       <x>10</x>
+       <y>80</y>
+       <width>271</width>
+       <height>31</height>
+      </rect>
+     </property>
+     <property name="text">
+      <string/>
+     </property>
+    </widget>
    </widget>
   </widget>
   <widget class="QPushButton" name="btnSave">