import t, c from stdint import * from win32.win32process import TlsAlloc, TlsGetValue, TlsSetValue import stdlib import stdio import string # Maximum provider stack depth (compiler verifies sufficiency; increase if needed) define _MAX_PROVIDER_DEPTH = 32 class _ProviderStack: """Provider stack, stores pairs of field names and pointers.""" # Field names are stored as string pointers: a `char` element would hold a # single byte, truncating the name and breaking every provider lookup. names: [32]str ptrs: [32]rawptr top: uint64 # TLS index (global; all threads share the same index) _tls_index: ulong = 0 @t.TLS def _init_tls(): """Initialize TLS index (executes once; subsequent calls are skipped).""" global _tls_index # Double guard: VPC now implements @t.TLS (a per-function one-shot guard setting __tls_init_done), but this re-check is kept for compatibility with older VPC.exe builds. # _tls_index starts at 0 (TlsAlloc never returns 0 on success). if _tls_index == 0: _tls_index = TlsAlloc() def _get_stack() -> _ProviderStack*: """Obtain current thread's provider stack. Allocate one if none exists.""" _init_tls() stack: _ProviderStack* = TlsGetValue(_tls_index) if stack == None: stack = stdlib.malloc(_ProviderStack.__sizeof__()) string.memset(stack, 0, _ProviderStack.__sizeof__()) TlsSetValue(_tls_index, stack) return stack def _push_provider(field_name: str, ptr: rawptr): """Push a provider (field_name, ptr) onto the stack.""" stack: _ProviderStack* = _get_stack() if stack.top >= _MAX_PROVIDER_DEPTH: stdio.printf("[with] ERROR: provider stack overflow (depth=%lu, max=%d), field '%s' not injected\n", stack.top, _MAX_PROVIDER_DEPTH, field_name) return stack.names[stack.top] = field_name stack.ptrs[stack.top] = ptr stack.top = stack.top + 1 def _pop_provider(): """Pop the top provider entry from the stack.""" stack: _ProviderStack* = _get_stack() if stack.top > 0: stack.top = stack.top - 1 def _find_provider(field_name: str) -> rawptr: """Search for matching field_name starting from stack top. Return associated pointer, or NULL if no match found.""" stack: _ProviderStack* = _get_stack() # Upper bound explicitly cast to t.CInt (signed): the loop is "decrement, stop at -1". If the bound were unsigned (stack.top is a uint64 field), the predicate would degrade to ugt and -1 (= UINT32_MAX unsigned) would make it always false, so the loop body is unreachable and this function always returns NULL (all with-injections break, and _str.upper crashes taking a vtable from NULL). # The explicit cast keeps the signed domain consistent with the decrement semantics. for i in range(int(stack.top) - 1, -1, -1): # Content comparison: every string literal gets its own constant, so the # push/find pointers differ and pointer equality never matches. if string.strcmp(stack.names[i], field_name) == 0: return stack.ptrs[i] return None