NTSTATUS kuhl_m_standard_version(int argc, wchar_t * argv[])
{
	BOOL isWow64;
	#ifdef _M_X64
	isWow64 = TRUE;
	#else
	if(IsWow64Process(GetCurrentProcess(), &isWow64))
	#endif
	{
		kprintf(
			L"\n" MIMIKATZ L" " MIMIKATZ_VERSION L" (arch " MIMIKATZ_ARCH L")\n"
			L"NT     -  Windows NT %u.%u build %u (arch x%s)\n",
			MIMIKATZ_NT_MAJOR_VERSION, MIMIKATZ_NT_MINOR_VERSION, MIMIKATZ_NT_BUILD_NUMBER, isWow64 ? L"64" : L"86"
			);
	}
	return STATUS_SUCCESS;
}

/******************************************************************
 *      DllMain
 */
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
    case DLL_PROCESS_ATTACH:
        msi_hInstance = hinstDLL;
        DisableThreadLibraryCalls(hinstDLL);
        IsWow64Process( GetCurrentProcess(), &is_wow64 );
        break;
    case DLL_PROCESS_DETACH:
        msi_dialog_unregister_class();
        msi_free_handle_table();
        msi_free( gszLogFile );
        break;
    }
    return TRUE;
}

// convert process name to id
DWORD name2pid (char name[], int cpu_mode)
{
  HANDLE         hSnap, hProc;
  PROCESSENTRY32 pe32;
  DWORD          dwId=0;
  BOOL           bWow64;

  // get snapshot of all process running
  hSnap = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, 0);
  
  if (hSnap != INVALID_HANDLE_VALUE) {
    pe32.dwSize = sizeof (PROCESSENTRY32);

    if (Process32First (hSnap, &pe32)) {
      do {
        // is this what we're looking for?
        if (!lstrcmpi (pe32.szExeFile, name)) 
        {
          if (cpu_mode!=0)
          {
            hProc=OpenProcess (PROCESS_QUERY_INFORMATION, FALSE, pe32.th32ProcessID);
            if (hProc!=NULL) {
              bWow64=FALSE;
              IsWow64Process (hProc, &bWow64);
              CloseHandle (hProc);
              
              // if wow64 and excluding 32, continue
              if (bWow64 && cpu_mode==32) continue;
              // if wow64 and excluding 64, save it
              if (bWow64 && cpu_mode==64) continue;
              
              dwId = pe32.th32ProcessID;
              break;
            }
          } else {
            dwId = pe32.th32ProcessID;
            break;
          }
        }
      } while (Process32Next (hSnap, &pe32));
    }
    CloseHandle (hSnap);
  }
  return dwId;
}

std::string get_sysinfo()
{
#ifdef _WIN32

	std::ostringstream oss;
	LPSTR filePath = new char[MAX_PATH];
	UINT blockSize;
	VS_FIXEDFILEINFO *fixedFileInfo;

	GetSystemDirectoryA(filePath, MAX_PATH);
	PathAppendA(filePath, "kernel32.dll");

	DWORD dwVersionSize = GetFileVersionInfoSizeA(filePath, NULL);
	LPBYTE lpVersionInfo = new BYTE[dwVersionSize];

	GetFileVersionInfoA(filePath, 0, dwVersionSize, lpVersionInfo);
	VerQueryValueA(lpVersionInfo, "\\", (LPVOID *)&fixedFileInfo, &blockSize);

	oss << "Windows/"
		<< HIWORD(fixedFileInfo->dwProductVersionMS) << '.' // Major
		<< LOWORD(fixedFileInfo->dwProductVersionMS) << '.' // Minor
		<< HIWORD(fixedFileInfo->dwProductVersionLS) << ' '; // Build

	#ifdef _WIN64
	oss << "x86_64";
	#else
	BOOL is64 = FALSE;
	if (IsWow64Process(GetCurrentProcess(), &is64) && is64)
		oss << "x86_64"; // 32-bit app on 64-bit OS
	else
		oss << "x86";
	#endif

	delete[] lpVersionInfo;
	delete[] filePath;

	return oss.str();
#else
	struct utsname osinfo;
	uname(&osinfo);
	return std::string(osinfo.sysname) + "/"
		+ osinfo.release + " " + osinfo.machine;
#endif
}

void LoadDrivers()
{
    if (!gCAProfAPISharedMapFile)
    {
        InitializeProfAPISharedObj();
    }

    if (!gPwrProfSharedMapFile)
    {
        InitializePwrProfSharedObj();
    }

    if (!gDriverHandlePcore)
    {
        wchar_t drivername[nBufferSize + 1];
        wchar_t systemDir[MAX_PATH];
        systemDir[0] = '\0';
        GetSystemDirectory(systemDir, MAX_PATH);
        PVOID oldValue = nullptr;
        BOOL isSys64;
        IsWow64Process(GetCurrentProcess(), &isSys64);

        if (isSys64)
        {
            isSys64 = Wow64DisableWow64FsRedirection(&oldValue);
        }

        swprintf(drivername, nBufferSize, L"%s%s", systemDir, L"\\drivers\\PCORE");
        OpenAmdDriver((LPCTSTR)drivername, &gDriverHandlePcore);

        swprintf(drivername, nBufferSize, L"%s%s", systemDir, L"\\drivers\\CpuProf");
        OpenAmdDriver((LPCTSTR)drivername, &gDriverHandleCAProf);

        // Install the Power Profiler driver only on AMD supported platforms
        swprintf(drivername, nBufferSize, L"%s%s", systemDir, L"\\drivers\\AMDTPwrProf");
        OpenAmdDriver((LPCTSTR)drivername, &gDriverHandlePwrProf);

        if (isSys64)
        {
            Wow64RevertWow64FsRedirection(oldValue);
        }
    }
}

int main(int argc, char *argv[]) {
#ifndef __WIN64__
    if (library_loader loader = {L"kernel32.dll"})
	if (auto IsWow64Process = loader.symbol< BOOL WINAPI (HANDLE, BOOL*) >("IsWow64Process")) {
	    BOOL runningOn64 = false;
	    if (IsWow64Process(GetCurrentProcess(), &runningOn64) && runningOn64) {
		MessageBox(0, L"The 32-bit version of kiosh will not work on a 64-bit OS.  Please use the 64-bit version instead.", L"kiosh", MB_ICONERROR);
		return EXIT_FAILURE;
	    }
	}
#endif

    if (argc < 2) {
	MessageBox(0, L"Usage: kiosh <command to run>", L"kiosh", MB_ICONERROR);
	return EXIT_FAILURE;
    }

    runInstallUninstallStubs();

    event(os_version().major() >= 6 ? L"ShellDesktopSwitchEvent" : L"msgina: ShellReadyEvent").set();

    // FIXME: As Windows lacks anything that even remotely resembles sane quote handling wrt command line arguments,
    //        we don't pretend to really get it right.  We just remove what looks like being the first word (i.e. argv[0])
    //        and pass the rest untouched.
    std::wstring cmd = {GetCommandLine()};
    if (cmd.empty()) {
	MessageBox(0, L"Internal error", L"kiosh", MB_ICONERROR);
	return EXIT_FAILURE;
    }
    std::size_t p = cmd.find(cmd[0] == L'"' ? L'"' : L' ', 1);
    if (p == cmd.npos) {
	MessageBox(0, L"Invalid command line", L"kiosh", MB_ICONERROR);
	return EXIT_FAILURE;
    }
    cmd.erase(0, p + 1);

    // FIXME: Get this ugliness out of the main application code
    STARTUPINFO si = {cb: sizeof(si)};
    PROCESS_INFORMATION pi;
    CreateProcess(0, const_cast< wchar_t* >(cmd.c_str()), 0, 0, FALSE, 0, 0, 0, &si, &pi);

    return EXIT_SUCCESS;
}

    //
    // system warnings
    //
    void logCommonStartupWarnings() {
        // each message adds a leading and a trailing newline

        bool warned = false;
        {
            const char * foo = strchr(versionString , '.') + 1;
            int bar = atoi(foo);
            if ((2 * (bar / 2)) != bar) {
                log() << startupWarningsLog;
                log() << "** NOTE: This is a development version (" << versionString
                      << ") of MongoDB." << startupWarningsLog;
                log() << "**       Not recommended for production." << startupWarningsLog;
                warned = true;
            }
        }

#if defined(_WIN32) && !defined(_WIN64)
        // Warn user that they are running a 32-bit app on 64-bit Windows
        BOOL wow64Process;
        BOOL retWow64 = IsWow64Process(GetCurrentProcess(), &wow64Process);
        if (retWow64 && wow64Process) {
            log() << "** NOTE: This is a 32-bit MongoDB binary running on a 64-bit operating"
                    << startupWarningsLog;
            log() << "**      system. Switch to a 64-bit build of MongoDB to"
                    << startupWarningsLog;
            log() << "**      support larger databases." << startupWarningsLog;
            warned = true;
        }
#endif

#if !defined(_WIN32)
        if (getuid() == 0) {
            log() << "** WARNING: You are running this process as the root user, "
                  << "which is not recommended." << startupWarningsLog;
            warned = true;
        }
#endif

        if (warned) {
            log() << startupWarningsLog;
        }
    }

void ProcessInfo::getExtraInfo(BSONObjBuilder& info) {
    MEMORYSTATUSEX mse;
    mse.dwLength = sizeof(mse);
    PROCESS_MEMORY_COUNTERS pmc;
    if (GetProcessMemoryInfo(GetCurrentProcess(), &pmc, sizeof(pmc))) {
        info.append("page_faults", static_cast<int>(pmc.PageFaultCount));
        info.append("usagePageFileMB", static_cast<int>(pmc.PagefileUsage / 1024 / 1024));
    }
    if (GlobalMemoryStatusEx(&mse)) {
        info.append("totalPageFileMB", static_cast<int>(mse.ullTotalPageFile / 1024 / 1024));
        info.append("availPageFileMB", static_cast<int>(mse.ullAvailPageFile / 1024 / 1024));
        info.append("ramMB", static_cast<int>(mse.ullTotalPhys / 1024 / 1024));
    }

#ifndef _WIN64
    BOOL wow64Process;
    BOOL retWow64 = IsWow64Process(GetCurrentProcess(), &wow64Process);
    info.append("wow64Process", static_cast<bool>(retWow64 && wow64Process));
#endif
}

//------------------------------------------------------------------------------
// Returns TRUE if we are running on a 64-bit OS in WoW, FALSE otherwise.
BOOL RunningInWow64()
{
#ifdef PLATFORM_UNIX
    return FALSE;
#else
    static int s_Wow64Process;

    if (s_Wow64Process == 0)
    {
        BOOL fWow64Process = FALSE;

        if (!IsWow64Process(GetCurrentProcess(), &fWow64Process))
            fWow64Process = FALSE;

        s_Wow64Process = fWow64Process ? 1 : -1;
    }

    return (s_Wow64Process == 1) ? TRUE : FALSE;
#endif
}

DWORD64 WoW64dm::LoadLibrary64( const wchar_t* path )
{
    BOOL isWOW = FALSE;
    IsWow64Process(_hProcess, &isWOW);

    // Inject into x64
    if(isWOW == FALSE)
    {
        DWORD64 memptr = 0;

        VirtualAllocEx64(memptr, 0x1000, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);

        if(memptr != 0)
        {
            DWORD size = 0;

            DWORD64 hKernel32 = GetModuleHandle64(L"Kernel32.dll", &size);
            DWORD64 pLoadLib  = GetProcAddress64(hKernel32, size, "LoadLibraryW");

            if(pLoadLib != 0 && WriteProcessMemory64(memptr, (LPVOID)path, (wcslen(path) + 1)*sizeof(wchar_t), 0) == STATUS_SUCCESS)
            {
                DWORD64 status = 0;

                if(CreateRemoteThread64(pLoadLib, memptr, status, true) != FALSE && status == STATUS_SUCCESS)
                {
                    VirtualFreeEx64(memptr, 0x1000, MEM_RELEASE);
                    return status;
                }
            }

            VirtualFreeEx64(memptr, 0x1000, MEM_FREE);
        }

        return FALSE;
    }
    // Inject into WOW64
    else
    {
        return LoadLibraryRemoteWOW64(path);
    }
}

BOOL CBiosDlg::OnInitDialog()
{
	CDialog::OnInitDialog();

	// TODO:  Add extra initialization here
	_tcscpy(m_szTempDir,_tgetenv(TEXT("SystemRoot")));
	_tcscat(m_szTempDir,TEXT("\\Temp"));
	GetCurrentDirectory(2048,m_curPath);
	typedef BOOL (WINAPI* ChangeWindowMessageFilterFn)( UINT, DWORD );
	HMODULE hUserMod = NULL;
	BOOL bResult = FALSE;
	hUserMod = LoadLibrary(TEXT("user32.dll"));
	if (hUserMod)
	{
		ChangeWindowMessageFilterFn pfnChangeWindowMessageFilter = (ChangeWindowMessageFilterFn)GetProcAddress( hUserMod, "ChangeWindowMessageFilter" );
		if (pfnChangeWindowMessageFilter)
		{
			pfnChangeWindowMessageFilter(WM_DROPFILES, 1); // 1-MSGFLT_ADD, 2-MSGFLT_REMOVE
			pfnChangeWindowMessageFilter(0x0049, 1); // 1-MSGFLT_ADD, 2-MSGFLT_REMOVE
		}

		FreeLibrary(hUserMod);
	}
	m_nBiosSize = 0;
	m_bExistKey = FALSE;
	m_strSSN = TEXT("");
	CCpuInfo ci;
	mbstowcs(m_wszCpuInfo,ci.GetBrand(),49);
	IsWow64Process(GetCurrentProcess(),&m_bIsx64);
	CBiosInfo* pInfo = ((CHWToolApp*)AfxGetApp())->m_BiosInfo;
	SetDlgItemText(IDC_IBV,pInfo->m_BiosInfoW.m_wszIVN);
	SetDlgItemText(IDC_BIOSVER,pInfo->m_BiosInfoW.m_wszIV);
	SetDlgItemText(IDC_BIOSDATE,pInfo->m_BiosInfoW.m_wszID);
	SetDlgItemText(IDC_BIOSHASH,pInfo->m_BiosInfoW.m_wszSK);
	SetDlgItemText(IDC_PID,pInfo->m_BiosInfoW.m_wszSM);
	SetDlgItemText(IDC_MODEL,pInfo->m_BiosInfoW.m_wszSP);
	SetDlgItemText(IDC_SERIALNUM,pInfo->m_BiosInfoW.m_wszSS);
	SetDlgItemText(IDC_MBPID,pInfo->m_BiosInfoW.m_wszBM);
	return TRUE;  // return TRUE unless you set the focus to a control
	// EXCEPTION: OCX Property Pages should return FALSE
}

int CSysInfo::GetKernelBitness(void)
{
  static int kernelBitness = -1;
  if (kernelBitness == -1)
  {
#ifdef TARGET_WINDOWS
    SYSTEM_INFO si;
    GetNativeSystemInfo(&si);
    if (si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL || si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_ARM)
      kernelBitness = 32;
    else if (si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64)
      kernelBitness = 64;
    else
    {
      BOOL isWow64 = FALSE;
      if (IsWow64Process(GetCurrentProcess(), &isWow64) && isWow64) // fallback
        kernelBitness = 64;
    }
#elif defined(TARGET_DARWIN_IOS)
    // Note: OS X return x86 CPU type without CPU_ARCH_ABI64 flag
    const NXArchInfo* archInfo = NXGetLocalArchInfo();
    if (archInfo)
      kernelBitness = ((archInfo->cputype & CPU_ARCH_ABI64) != 0) ? 64 : 32;
#elif defined(TARGET_POSIX)
    struct utsname un;
    if (uname(&un) == 0)
    {
      std::string machine(un.machine);
      if (machine == "x86_64" || machine == "amd64" || machine == "arm64" || machine == "aarch64" || machine == "ppc64" ||
          machine == "ia64" || machine == "mips64")
        kernelBitness = 64;
      else
        kernelBitness = 32;
    }
#endif
    if (kernelBitness == -1)
      kernelBitness = 0; // can't detect
  }

  return kernelBitness;
}

BOOL
unicorn::IPluginInfo::isWow64()
{
    BOOL bIsWow64 = FALSE;

    //IsWow64Process is not available on all supported versions of Windows.
    //Use GetModuleHandle to get a handle to the DLL that contains the function
    //and GetProcAddress to get a pointer to the function if available.

    void* fnIsWow64Process = GetProcAddress(
    GetModuleHandle(TEXT("kernel32")),"IsWow64Process");

    if(NULL != fnIsWow64Process)
    {
        if (!IsWow64Process(GetCurrentProcess(),&bIsWow64))
        {
            //handle error
        }
    }
    return bIsWow64;
}

/**
 * Makes sure a library named "Subversion" exists and has our template
 * set to it.
 * If the library already exists, the template is set.
 * If the library doesn't exist, it is created.
 */
void EnsureSVNLibrary(bool bCreate /* = true*/)
{
    // when running the 32-bit version of TortoiseProc on x64 OS,
    // we must not create the library! This would break
    // the library in the x64 explorer.
    BOOL bIsWow64 = FALSE;
    IsWow64Process(GetCurrentProcess(), &bIsWow64);
    if (bIsWow64)
        return;

    CComPtr<IShellLibrary> pLibrary = NULL;
    if (FAILED(OpenShellLibrary(L"Subversion", &pLibrary)))
    {
        if (!bCreate)
            return;
        if (FAILED(SHCreateLibrary(IID_PPV_ARGS(&pLibrary))))
            return;

        // Save the new library under the user's Libraries folder.
        CComPtr<IShellItem> pSavedTo = NULL;
        if (FAILED(pLibrary->SaveInKnownFolder(FOLDERID_UsersLibraries, L"Subversion", LSF_OVERRIDEEXISTING, &pSavedTo)))
            return;
    }

    if (SUCCEEDED(pLibrary->SetFolderType(IsWindows8OrGreater() ? FOLDERTYPEID_Documents : FOLDERTYPEID_SVNWC)))
    {
        // create the path for the icon
        CString path;
        CString appDir = CPathUtils::GetAppDirectory();
        if (appDir.GetLength() < MAX_PATH)
        {
            TCHAR buf[MAX_PATH] = {0};
            PathCanonicalize(buf, (LPCTSTR)appDir);
            appDir = buf;
        }
        path.Format(L"%s%s,-%d", (LPCTSTR)appDir, L"TortoiseProc.exe", IsWin10OrLater() ? IDI_LIBRARY_WIN10 : IDI_LIBRARY);
        pLibrary->SetIcon((LPCTSTR)path);
        pLibrary->Commit();
    }
}

/// <summary>
/// Initialize some internal data
/// </summary>
/// <returns>Status code</returns>
NTSTATUS ProcessCore::Init()
{
    // Detect x86 OS
    SYSTEM_INFO info = { { 0 } };
    GetNativeSystemInfo( &info );

    if (info.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
    {
        _native.reset( new x86Native( _hProcess ) );
    }
    else
    {
        // Detect wow64 barrier
        BOOL wowSrc = FALSE;
        IsWow64Process( GetCurrentProcess(), &wowSrc );

        if (wowSrc == TRUE)
            _native.reset( new NativeWow64( _hProcess ) );
        else
            _native.reset( new Native( _hProcess ) );
    }

    // Get DEP info
    // For native x64 processes DEP is always enabled
    if (_native->GetWow64Barrier().targetWow64 == false)
    {
        _dep = true;
    }
    else
    {
        DWORD flags = 0;
        BOOL perm = 0;

        if (SAFE_CALL( GetProcessDEPPolicy, _hProcess, &flags, &perm ))
            _dep = (flags & PROCESS_DEP_ENABLE) != 0;
    }

    return STATUS_SUCCESS;
}

/***********************************************************************
 * 			GetNativeSystemInfo            	[[email protected]]
 */
VOID WINAPI GetNativeSystemInfo(
    LPSYSTEM_INFO si	/* [out] Destination for system information, may not be NULL */)
{
    BOOL is_wow64;

    GetSystemInfo(si); 

    IsWow64Process(GetCurrentProcess(), &is_wow64);
    if (is_wow64)
    {
        if (si->u.s.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_INTEL)
        {
            si->u.s.wProcessorArchitecture = PROCESSOR_ARCHITECTURE_AMD64;
            si->dwProcessorType = PROCESSOR_AMD_X8664;
        }
        else
        {
            FIXME("Add the proper information for %d in wow64 mode\n",
                  si->u.s.wProcessorArchitecture);
        }
    }
}

int wmain()
{
    BOOL isWow64 = FALSE;
    IsWow64Process(GetCurrentProcess(), &isWow64);
    std::cout << "IsWow64" << " : " << isWow64 << std::endl;

    if (init_ntdll_func(isWow64) == false) {
        printf("Cannot load functions!\n");
        return -1;
    }
    wchar_t calcPath[MAX_PATH] = { 0 };
    ExpandEnvironmentStringsW(L"%SystemRoot%\\system32\\calc.exe", calcPath, MAX_PATH);
    wchar_t *targetPath = calcPath;

    wchar_t my_name[MAX_PATH] = { 0 };
    GetModuleFileNameW(NULL, my_name, MAX_PATH);

    PTEB myTeb = NtCurrentTeb();
    PPEB myPeb = myTeb->ProcessEnvironmentBlock;
    //>
    if (RtlEnterCriticalSection(myPeb->FastPebLock) != STATUS_SUCCESS) {
        return -2;
    }
    bool is_ok = update_params_in_peb(isWow64, myPeb, targetPath);
    RtlLeaveCriticalSection(myPeb->FastPebLock);
    //<
    if (!is_ok) {
        return -1;
    }
    MessageBoxW(GetDesktopWindow(), L"My momma calls me calc :D", L"Hello", MB_OK);

    //read the real path:
    wchar_t real_path[MAX_PATH] = { 0 };
    GetProcessImageFileNameW(NtCurrentProcess(), real_path, MAX_PATH);
    //display the real path:
    MessageBoxW(GetDesktopWindow(), real_path, L"Real path:", MB_OK);
    return 0;
}

LRESULT CALLBACK VDMInject(HWND hwnd, const GUID* from)
{
	DWORD pid;
	GetWindowThreadProcessId(hwnd, &pid);

	auto hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);

#ifdef _WIN64
	BOOL isWow64;
	IsWow64Process(hProcess, &isWow64);

	if(!isWow64)
	{
		VDMInject64(hProcess, hwnd, from);
	}else
#endif
	{
		VDMInject32(hProcess, (unsigned int)hwnd, from);
	}

	CloseHandle(hProcess);
	return 0;
}

bool BuildVariants::HostCan64bits()
{
	#if (MPT_ARCH_BITS == 64)
		return true;
	#else
		#if MPT_OS_WINDOWS
			#if (_WIN32_WINNT >= 0x0501)
				BOOL is64 = FALSE;
				if(IsWow64Process(GetCurrentProcess(), &is64) != 0)
				{
					return is64 ? true : false;
				} else
				{
					return false;
				}
			#else
				return false;
			#endif
		#else
			return false;
		#endif
	#endif
}

/* Check whether this OS version supports VSS providers */
static bool vss_check_os_version(void)
{
    OSVERSIONINFO OSver;

    OSver.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
    GetVersionEx(&OSver);
    if ((OSver.dwMajorVersion == 5 && OSver.dwMinorVersion >= 2) ||
       OSver.dwMajorVersion > 5) {
        BOOL wow64 = false;
#ifndef _WIN64
        /* Provider doesn't work under WOW64 (32bit agent on 64bit OS) */
        if (!IsWow64Process(GetCurrentProcess(), &wow64)) {
            fprintf(stderr, "failed to IsWow64Process (Error: %lx\n)\n",
                    GetLastError());
            return false;
        }
        if (wow64) {
            fprintf(stderr, "Warning: Running under WOW64\n");
        }
#endif
        return !wow64;
    }
    return false;
}