|
77 | 77 |
|
78 | 78 | # The name of the WDAG (Windows Defender Application Guard) process |
79 | 79 | WDAG_PROCESS_NAME=u'hvsirdpclient' |
| 80 | +# The window class of the WDAG (Windows Defender Application Guard) main window |
| 81 | +WDAG_WINDOW_CLASS_NAME=u'RAIL_WINDOW' |
80 | 82 |
|
81 | 83 | goodUIAWindowClassNames = ( |
82 | 84 | # A WDAG (Windows Defender Application Guard) Window is always native UIA, even if it doesn't report as such. |
@@ -1214,10 +1216,27 @@ def getNearestWindowHandle(self, UIAElement): |
1214 | 1216 | return None |
1215 | 1217 | appModule = appModuleHandler.getAppModuleFromProcessID(processID) |
1216 | 1218 | # WDAG (Windows Defender application Guard) UIA elements should be treated as being from a remote machine, and therefore their window handles are completely invalid on this machine. |
1217 | | - # Therefore, jump all the way up to the root of the WDAG process and use that window handle as it is local to this machine. |
| 1219 | + # Unfortunately the remote UIA tree is not parented into the local tree. |
| 1220 | + # Therefore, just use the currently active WDAG local window as the nearest window. |
1218 | 1221 | if appModule.appName == WDAG_PROCESS_NAME: |
1219 | 1222 | if _isDebug(): |
1220 | 1223 | log.debug("Detected WDAG element") |
| 1224 | + gi = winUser.getGUIThreadInfo(0) |
| 1225 | + if ( |
| 1226 | + winUser.getClassName(gi.hwndActive) == WDAG_WINDOW_CLASS_NAME |
| 1227 | + and winUser.getWindowThreadProcessID(gi.hwndActive)[0] == processID |
| 1228 | + ): |
| 1229 | + if _isDebug(): |
| 1230 | + log.debug( |
| 1231 | + f"using active WDAG local window {self.getWindowHandleDebugString(gi.hwndActive)}" |
| 1232 | + ) |
| 1233 | + return gi.hwndActive |
| 1234 | + else: |
| 1235 | + if _isDebug(): |
| 1236 | + log.debug( |
| 1237 | + f"Active window is not WDAG or is wrong instance: {self.getWindowHandleDebugString(gi.hwndActive)}" |
| 1238 | + ) |
| 1239 | + return None |
1221 | 1240 | condition = utils.createUIAMultiPropertyCondition( |
1222 | 1241 | {UIA.UIA_ClassNamePropertyId: ['ApplicationFrameWindow', 'CabinetWClass']} |
1223 | 1242 | ) |
|
0 commit comments