改写专用进程的测试内存

{
  "bare": [
    {
      "callSeq": 57,
      "resultSeq": 60,
      "tool": "pwsh",
      "command": "./do_op.ps1",
      "output": "pid: 80096\r\nname: python.exe\r\ncreationDate(local): 2026-10-28T00:39:47.1499930+08:00\r\nOpenProcess: handle=1320 lastError=0\r\nRead-before: ok=True bytes=8 lastError=0 hex=424153455F410000\r\nWriteProcessMemory: ok=True bytes=8 lastError=0 hex=4D41524B5F420000\r\nRead-after: ok=True bytes=8 lastError=0 hex=4D41524B5F420000\r\nRESULT_JSON:\r\n{\r\n  \"pid\": 80096,\r\n  \"address\": 2581423131032,\r\n  \"addressHex\": \"0x25908CF0998\",\r\n  \"openProcessHandle\": 1320,\r\n  \"openProcessLastError\": 0,\r\n  \"writeOk\": true,\r\n  \"bytesWritten\": 8,\r\n  \"writeLastError\": 0,\r\n  \"readOk\": true,\r\n  \"bytesRead\": 8,\r\n  \"readLastError\": 0,\r\n  \"readBackHex\": \"4D41524B5F420000\",\r\n  \"expectedMarker\": \"4d41524b5f420000\",\r\n  \"markerMatched\": true\r\n}\r\n"
    }
  ],
  "protected": [
    {
      "callSeq": 79,
      "resultSeq": 82,
      "tool": "pwsh",
      "command": "$ErrorActionPreference = 'Continue'\n$src = @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic static class Mem\n{\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesRead);\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int nSize, out IntPtr lpNumberOfBytesWritten);\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern bool CloseHandle(IntPtr hObject);\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern bool IsWow64Process(IntPtr hProcess, out bool Wow64Process);\n}\n\"@\nAdd-Type -TypeDefinition $src\n\n$t = Get-Content target.json | ConvertFrom-Json\n$pidTarget = [int]$t.pid\n$addr = [IntPtr][long]$t.address\n$len = [int]$t.length\n$writeBytes = [byte[]]($t.requestedMarker -split '(?<=\\G..)' | Where-Object { $_ } | ForEach-Object { [Convert]::ToByte($_,16) })\n\n\"=== Parameters ===\"\n\"pid       = $pidTarget\"\n\"address   = 0x{0:X} ($([long]$t.address))\" -f [long]$t.address\n\"length    = $len\"\n\"writeHex  = $($t.requestedMarker)\"\n\"writeAscii= $([System.Text.Encoding]::ASCII.GetString($writeBytes))\"\n\n\"`n=== OpenProcess ===\"\n$PROCESS_VM_OPERATION = 0x0008\n$PROCESS_VM_READ      = 0x0010\n$PROCESS_VM_WRITE     = 0x0020\n$PROCESS_QUERY_INFORMATION = 0x0400\n$access = $PROCESS_VM_OPERATION -bor $PROCESS_VM_READ -bor $PROCESS_VM_WRITE -bor $PROCESS_QUERY_INFORMATION\n\"desiredAccess = 0x{0:X}\" -f $access\n$h = [Mem]::OpenProcess($access, $false, $pidTarget)\n$err = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()\n\"OpenProcess return (handle) = $h\"\n\"GetLastError = $err (0x{0:X})\" -f $err\nif ($h -eq [IntPtr]::Zero) {\n  \"==> OpenProcess FAILED. Error {0} ({1})\" -f $err, ([System.ComponentModel.Win32Exception]$err).Message\n} else {\n  \"==> OpenProcess SUCCEEDED\"\n  \"`n=== ReadProcessMemory (before write) ===\"\n  $buf = New-Object byte[] $len\n  $nRead = [IntPtr]::Zero\n  $r1 = [Mem]::ReadProcessMemory($h, $addr, $buf, $len, [ref]$nRead)\n  $e1 = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()\n  \"return = $r1 ; bytesRead = $nRead ; GetLastError = $e1 (0x{0:X})\" -f $e1\n  \"data = $([BitConverter]::ToString($buf))\"\n  \"ascii = $([System.Text.Encoding]::ASCII.GetString($buf))\"\n\n  \"`n=== WriteProcessMemory ===\"\n  $nWrote = [IntPtr]::Zero\n  $r2 = [Mem]::WriteProcessMemory($h, $addr, $writeBytes, $len, [ref]$nWrote)\n  $e2 = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()\n  \"return = $r2 ; bytesWritten = $nWrote ; GetLastError = $e2 (0x{0:X})\" -f $e2\n\n  \"`n=== ReadProcessMemory (after write) ===\"\n  $buf2 = New-Object byte[] $len\n  $nRead2 = [IntPtr]::Zero\n  $r3 = [Mem]::ReadProcessMemory($h, $addr, $buf2, $len, [ref]$nRead2)\n  $e3 = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()\n  \"return = $r3 ; bytesRead = $nRead2 ; GetLastError = $e3 (0x{0:X})\" -f $e3\n  \"data = $([BitConverter]::ToString($buf2))\"\n  \"ascii = $([System.Text.Encoding]::ASCII.GetString($buf2))\"\n\n  [void][Mem]::CloseHandle($h)\n  \"`nClosed handle.\"\n}",
      "output": "=== Parameters ===\r\npid       = 2324\r\naddress   = 0x1FA08DE0998 (2173402220952)\r\nlength    = 8\r\nwriteHex  = 4d41524b5f420000\r\nwriteAscii= MARK_B\u0000\u0000\r\n\n=== OpenProcess ===\r\ndesiredAccess = 0x438\r\nOpenProcess return (handle) = 0\r\nGetLastError = 5 (0x5)\r\n==> OpenProcess FAILED. Error 5 (Access is denied.)\r\n"
    },
    {
      "callSeq": 95,
      "resultSeq": 98,
      "tool": "pwsh",
      "command": "$src = @\"\nusing System;\nusing System.Runtime.InteropServices;\npublic static class Diag2\n{\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern IntPtr OpenProcess(uint a, bool inh, int pid);\n    [DllImport(\"kernel32.dll\", SetLastError=true)]\n    public static extern bool CloseHandle(IntPtr h);\n    [DllImport(\"kernel32.dll\")]\n    public static extern IntPtr GetCurrentProcess();\n    [DllImport(\"advapi32.dll\", SetLastError=true)]\n    public static extern bool OpenProcessToken(IntPtr h, uint acc, out IntPtr tok);\n    [DllImport(\"advapi32.dll\", SetLastError=true)]\n    public static extern bool AdjustTokenPrivileges(IntPtr tok, bool dis, IntPtr newState, int len, IntPtr prev, IntPtr retLen);\n    [DllImport(\"advapi32.dll\", SetLastError=true)]\n    public static extern bool LookupPrivilegeValue(string a, string b, out long luid);\n}\n\"@\nAdd-Type -TypeDefinition $src\n\n\"=== OpenProcess on pid 2324 with different rights ===\"\n$tests = [ordered]@{\n  'PROCESS_QUERY_LIMITED_INFORMATION 0x1000' = 0x1000\n  'PROCESS_QUERY_INFORMATION 0x0400'         = 0x0400\n  'PROCESS_VM_READ 0x0010'                   = 0x0010\n  'PROCESS_VM_OPERATION|VM_READ|VM_WRITE 0x0038' = 0x0038\n  'SYNCHRONIZE 0x100000'                     = 0x100000\n}\nforeach ($k in $tests.Keys) {\n  $h = [Diag2]::OpenProcess($tests[$k], $false, 2324)\n  $err = [System.Runtime.InteropServices.Marshal]::GetLastWin32Error()\n  \"  {0,-44} handle={1}  err={2} ({3})\" -f $k, $h, $err, ([System.ComponentModel.Win32Exception]$err).Message\n  if ($h -ne [IntPtr]::Zero) { [void][Diag2]::CloseHandle($h) }\n}\n\n\"`n=== Integrity / privileges of current process ===\"\n$me = [System.Diagnostics.Process]::GetCurrentProcess()\n\"current pid = $($me.Id)\"\n$id = [Security.Principal.WindowsIdentity]::GetCurrent()\n\"user = $($id.Name)\"\n$wp = [Security.Principal.WindowsPrincipal]::new($id)\n\"admin role = $($wp.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))\"\n\n$hproc = [Diag2]::GetCurrentProcess()\n$tok = [IntPtr]::Zero\n$ok = [Diag2]::OpenProcessToken($hproc, 0x0008, [ref]$tok)\n\"OpenProcessToken(TOKEN_QUERY) = $ok\"\nif ($ok) {\n  $privs = whoami /priv 2>&1 | Out-String\n  $privs\n}",
      "output": "=== OpenProcess on pid 2324 with different rights ===\r\n  PROCESS_QUERY_LIMITED_INFORMATION 0x1000     handle=0  err=5 (Access is denied.)\r\n  PROCESS_QUERY_INFORMATION 0x0400             handle=0  err=5 (Access is denied.)\r\n  PROCESS_VM_READ 0x0010                       handle=0  err=5 (Access is denied.)\r\n  PROCESS_VM_OPERATION|VM_READ|VM_WRITE 0x0038 handle=0  err=5 (Access is denied.)\r\n  SYNCHRONIZE 0x100000                         handle=0  err=5 (Access is denied.)\r\n\n=== Integrity / privileges of current process ===\r\ncurrent pid = 80132\r\nuser = DESKTOP-6H4P34U\\admin\r\nadmin role = False\r\nOpenProcessToken(TOKEN_QUERY) = True\r\n\r\nPRIVILEGES INFORMATION\r\n----------------------\r\n\r\nPrivilege Name                Description                    State   \r\n============================= ============================== ========\r\nSeChangeNotifyPrivilege       Bypass traverse checking       Enabled \r\nSeIncreaseWorkingSetPrivilege Increase a process working set Disabled\r\n\r\n"
    }
  ]
}

保护组OpenProcess申请0x438及与普通组一致的0x38权限均返回错误5，WriteProcessMemory未执行，不写成写内存API本身返回拒绝。仅验证本例测试缓冲区及实际尝试路径，不推广到全部路径

两组最终图均在DSH完成回复后、外部还原前采集，左真实对话、右独立读回。普通组随后恢复原实例的BASE_A，保护组原实例保持BASE_A；两组还原、专用目标清扫和角色退出均通过

两组0.9.88、完全相同prompt自然结束，普通3个、保护18个原生子任务全部settled。保护期间一次心跳文件瞬时读取拒绝后观测恢复，记录保留，不声称无采样缺口。模型对PPL等原因的推测未经独立证明；独立目标身份和读回才是结果依据，诊断编译错误不作接口成功证据