|
0
|
1 #include "animone/fd/win32.h"
|
|
|
2 #include "animone.h"
|
|
|
3 #include "animone/util/win32.h"
|
|
|
4
|
|
|
5 #include <stdexcept>
|
|
|
6 #include <string>
|
|
|
7 #include <unordered_map>
|
|
|
8 #include <vector>
|
|
|
9
|
|
|
10 #include <fileapi.h>
|
|
|
11 #include <handleapi.h>
|
|
|
12 #include <libloaderapi.h>
|
|
|
13 #include <ntdef.h>
|
|
|
14 #include <psapi.h>
|
|
|
15 #include <shlobj.h>
|
|
|
16 #include <stringapiset.h>
|
|
|
17 #include <tlhelp32.h>
|
|
|
18 #include <windows.h>
|
|
|
19 #include <winternl.h>
|
|
|
20
|
|
|
21 /* This file is noticably more complex than Unix and Linux, and that's because
|
|
|
22 * there is no "simple" way to get the paths of a file. In fact, this thing requires
|
|
|
23 * you to use *internal functions* that can't even be linked to, hence why we have to
|
|
|
24 * use GetProcAddress and such. What a mess.
|
|
|
25 *
|
|
|
26 * Speaking of which, because this file uses internal functions of the OS, it is not
|
|
|
27 * guaranteed to work far into the future. However, it has worked since NT 6.0 (Vista)
|
|
|
28 * at least, so it's unlikely to be changed much ever.
|
|
|
29 */
|
|
|
30
|
|
|
31 /* SystemExtendedHandleInformation is only available in NT 5.1+ (XP and higher) and provides information for
|
|
|
32 * 32-bit PIDs, unlike SystemHandleInformation
|
|
|
33 */
|
|
|
34 static constexpr SYSTEM_INFORMATION_CLASS SystemExtendedHandleInformation = static_cast<SYSTEM_INFORMATION_CLASS>(0x40);
|
|
|
35 static constexpr NTSTATUS STATUS_INFO_LENGTH_MISMATCH = 0xC0000004UL;
|
|
|
36
|
|
|
37 /* this is filled in at runtime because it's not guaranteed to be (and isn't)
|
|
|
38 * constant between different versions of Windows */
|
|
|
39 static unsigned short file_type_index = 0;
|
|
|
40
|
|
|
41 struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
|
|
|
42 PVOID Object;
|
|
|
43 ULONG_PTR UniqueProcessId;
|
|
|
44 HANDLE HandleValue;
|
|
|
45 ACCESS_MASK GrantedAccess;
|
|
|
46 USHORT CreatorBackTraceIndex;
|
|
|
47 USHORT ObjectTypeIndex;
|
|
|
48 ULONG HandleAttributes;
|
|
|
49 ULONG Reserved;
|
|
|
50 };
|
|
|
51
|
|
|
52 struct SYSTEM_HANDLE_INFORMATION_EX {
|
|
|
53 ULONG_PTR NumberOfHandles;
|
|
|
54 ULONG_PTR Reserved;
|
|
|
55 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
|
|
|
56 };
|
|
|
57
|
|
|
58 namespace animone::internal::win32 {
|
|
|
59
|
|
|
60 class Ntdll {
|
|
|
61 public:
|
|
|
62 Ntdll() {
|
|
|
63 ntdll = ::GetModuleHandleW(L"ntdll.dll");
|
|
|
64 nt_query_system_information = reinterpret_cast<decltype(::NtQuerySystemInformation)*>(
|
|
|
65 ::GetProcAddress(ntdll, "NtQuerySystemInformation"));
|
|
|
66 nt_query_object = reinterpret_cast<decltype(::NtQueryObject)*>(::GetProcAddress(ntdll, "NtQueryObject"));
|
|
|
67 }
|
|
|
68
|
|
|
69 NTSTATUS QuerySystemInformation(SYSTEM_INFORMATION_CLASS cls, PVOID sysinfo, ULONG len,
|
|
3
|
70 PULONG retlen){
|
|
|
71 return nt_query_system_information(cls, sysinfo, len, retlen);
|
|
|
72 }
|
|
0
|
73
|
|
|
74 NTSTATUS QueryObject(HANDLE handle, OBJECT_INFORMATION_CLASS cls, PVOID objinf, ULONG objinflen, PULONG retlen) {
|
|
|
75 return nt_query_object(handle, cls, objinf, objinflen, retlen);
|
|
|
76 }
|
|
|
77
|
|
|
78 private:
|
|
|
79 HMODULE ntdll;
|
|
|
80 decltype(::NtQuerySystemInformation)* nt_query_system_information;
|
|
|
81 decltype(::NtQueryObject)* nt_query_object;
|
|
3
|
82 };
|
|
0
|
83
|
|
|
84 Ntdll ntdll;
|
|
|
85
|
|
|
86 static HANDLE DuplicateHandle(HANDLE process_handle, HANDLE handle) {
|
|
|
87 HANDLE dup_handle = nullptr;
|
|
|
88 const bool result =
|
|
|
89 ::DuplicateHandle(process_handle, handle, ::GetCurrentProcess(), &dup_handle, 0, false, DUPLICATE_SAME_ACCESS);
|
|
|
90 return result ? dup_handle : nullptr;
|
|
|
91 }
|
|
|
92
|
|
|
93 static std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> GetSystemHandleInformation() {
|
|
|
94 /* we should really put a cap on this */
|
|
|
95 ULONG cb = 1 << 19;
|
|
|
96 NTSTATUS status = STATUS_NO_MEMORY;
|
|
3
|
97 std::unique_ptr<SYSTEM_HANDLE_INFORMATION_EX> info;
|
|
0
|
98
|
|
|
99 do {
|
|
3
|
100 info.reset(reinterpret_cast<SYSTEM_HANDLE_INFORMATION_EX*>(malloc(cb *= 2)));
|
|
0
|
101 if (!info)
|
|
|
102 continue;
|
|
|
103
|
|
|
104 status = ntdll.QuerySystemInformation(SystemExtendedHandleInformation, info.get(), cb, &cb);
|
|
|
105 } while (status == STATUS_INFO_LENGTH_MISMATCH);
|
|
|
106
|
|
|
107 if (!NT_SUCCESS(status))
|
|
|
108 return {};
|
|
|
109
|
|
|
110 std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> res;
|
|
|
111
|
|
|
112 ULONG_PTR handles = info->NumberOfHandles;
|
|
|
113 if (!handles)
|
|
|
114 return {};
|
|
|
115
|
|
|
116 res.reserve(handles);
|
|
|
117
|
|
|
118 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* entry = info->Handles;
|
|
|
119 do {
|
|
|
120 if (entry)
|
|
|
121 res.push_back(*(entry++));
|
|
|
122 } while (--handles);
|
|
|
123
|
|
|
124 return res;
|
|
|
125 }
|
|
|
126
|
|
|
127 static std::wstring GetHandleType(HANDLE handle) {
|
|
|
128 OBJECT_TYPE_INFORMATION info = {0};
|
|
|
129 ntdll.QueryObject(handle, ObjectTypeInformation, &info, sizeof(info), NULL);
|
|
|
130 return std::wstring(info.TypeName.Buffer, info.TypeName.Length);
|
|
|
131 }
|
|
|
132
|
|
|
133 static std::wstring GetFinalPathNameByHandle(HANDLE handle) {
|
|
|
134 std::wstring buffer;
|
|
|
135
|
|
|
136 DWORD size = ::GetFinalPathNameByHandleW(handle, NULL, 0, FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
|
|
|
137 buffer.resize(size);
|
|
|
138 ::GetFinalPathNameByHandleW(handle, &buffer.front(), buffer.size(), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
|
|
|
139
|
|
|
140 return buffer;
|
|
|
141 }
|
|
|
142
|
|
|
143 static bool IsFileHandle(HANDLE handle, unsigned short object_type_index) {
|
|
|
144 if (file_type_index)
|
|
|
145 return object_type_index == file_type_index;
|
|
|
146 else if (!handle)
|
|
|
147 return true;
|
|
|
148 else if (GetHandleType(handle) == L"File") {
|
|
|
149 file_type_index = object_type_index;
|
|
|
150 return true;
|
|
|
151 }
|
|
|
152 return false;
|
|
|
153 }
|
|
|
154
|
|
|
155 static bool IsFileMaskOk(ACCESS_MASK access_mask) {
|
|
|
156 if (!(access_mask & FILE_READ_DATA))
|
|
|
157 return false;
|
|
|
158
|
|
|
159 if ((access_mask & FILE_APPEND_DATA) || (access_mask & FILE_WRITE_EA) || (access_mask & FILE_WRITE_ATTRIBUTES))
|
|
|
160 return false;
|
|
|
161
|
|
|
162 return true;
|
|
|
163 }
|
|
|
164
|
|
|
165 static bool IsFilePathOk(const std::wstring& path) {
|
|
|
166 if (path.empty())
|
|
|
167 return false;
|
|
|
168
|
|
|
169 if (IsSystemDirectory(path))
|
|
|
170 return false;
|
|
|
171
|
|
|
172 const auto file_attributes = GetFileAttributesW(path.c_str());
|
|
|
173 if ((file_attributes == INVALID_FILE_ATTRIBUTES) || (file_attributes & FILE_ATTRIBUTE_DIRECTORY))
|
|
|
174 return false;
|
|
|
175
|
|
|
176 return true;
|
|
|
177 }
|
|
|
178
|
|
|
179 bool GetProcessName(pid_t pid, std::string& name) {
|
|
3
|
180 std::wstring wname = GetProcessPath(pid);
|
|
0
|
181 if (wname.empty())
|
|
|
182 return false;
|
|
|
183
|
|
3
|
184 name = ToUtf8String(GetFileNameWithoutExtension(GetFileNameFromPath(wname)));
|
|
|
185 return true;
|
|
0
|
186 }
|
|
|
187
|
|
|
188 bool EnumerateOpenProcesses(process_proc_t process_proc) {
|
|
|
189 HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
|
190 if (hProcessSnap == INVALID_HANDLE_VALUE)
|
|
|
191 return false;
|
|
|
192
|
|
|
193 PROCESSENTRY32 pe32;
|
|
|
194 pe32.dwSize = sizeof(PROCESSENTRY32);
|
|
|
195
|
|
|
196 if (!::Process32First(hProcessSnap, &pe32))
|
|
|
197 return false;
|
|
|
198
|
|
|
199 if (!process_proc({pe32.th32ProcessID, pe32.szExeFile}))
|
|
|
200 return false;
|
|
|
201
|
|
|
202 while (::Process32Next(hProcessSnap, &pe32))
|
|
|
203 if (!process_proc({pe32.th32ProcessID, pe32.szExeFile}))
|
|
|
204 return false;
|
|
|
205
|
|
|
206 ::CloseHandle(hProcessSnap);
|
|
|
207
|
|
|
208 return true;
|
|
|
209 }
|
|
|
210
|
|
|
211 /* this could be changed to being a callback, but... I'm too lazy right now :) */
|
|
|
212 bool EnumerateOpenFiles(const std::set<pid_t>& pids, open_file_proc_t open_file_proc) {
|
|
|
213 if (!open_file_proc)
|
|
|
214 return false;
|
|
|
215
|
|
|
216 std::unordered_map<pid_t, Handle> proc_handles;
|
|
|
217
|
|
|
218 for (const pid_t& pid : pids) {
|
|
|
219 const HANDLE handle = ::OpenProcess(PROCESS_DUP_HANDLE, false, pid);
|
|
|
220 if (handle != INVALID_HANDLE_VALUE)
|
|
|
221 proc_handles[pid] = Handle(handle);
|
|
|
222 }
|
|
|
223
|
|
|
224 if (proc_handles.empty())
|
|
|
225 return false;
|
|
|
226
|
|
|
227 std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> info = GetSystemHandleInformation();
|
|
|
228
|
|
|
229 for (const auto& h : info) {
|
|
|
230 const pid_t pid = h.UniqueProcessId;
|
|
|
231 if (!pids.count(pid))
|
|
|
232 continue;
|
|
|
233
|
|
|
234 if (!IsFileHandle(nullptr, h.ObjectTypeIndex))
|
|
|
235 continue;
|
|
|
236
|
|
|
237 if (!IsFileMaskOk(h.GrantedAccess))
|
|
|
238 continue;
|
|
|
239
|
|
|
240 Handle handle(DuplicateHandle(proc_handles[pid].get(), h.HandleValue));
|
|
|
241 if (handle.get() == INVALID_HANDLE_VALUE)
|
|
|
242 continue;
|
|
|
243
|
|
|
244 if (GetFileType(handle.get()) != FILE_TYPE_DISK)
|
|
|
245 continue;
|
|
|
246
|
|
|
247 const std::wstring path = GetFinalPathNameByHandle(handle.get());
|
|
|
248 if (!IsFilePathOk(path))
|
|
|
249 continue;
|
|
|
250
|
|
|
251 if (!open_file_proc({pid, ToUtf8String(path)}))
|
|
|
252 return false;
|
|
|
253 }
|
|
|
254
|
|
|
255 return true;
|
|
|
256 }
|
|
|
257
|
|
|
258 } // namespace animone::internal::win32
|
