|
0
|
1 #include "animone/fd/win32.h"
|
|
|
2 #include "animone.h"
|
|
|
3 #include "animone/util/win32.h"
|
|
|
4
|
|
|
5 #include <stdexcept>
|
|
|
6 #include <string>
|
|
|
7 #include <unordered_map>
|
|
|
8 #include <vector>
|
|
|
9
|
|
|
10 #include <fileapi.h>
|
|
|
11 #include <handleapi.h>
|
|
|
12 #include <libloaderapi.h>
|
|
|
13 #include <ntdef.h>
|
|
|
14 #include <psapi.h>
|
|
|
15 #include <shlobj.h>
|
|
|
16 #include <stringapiset.h>
|
|
|
17 #include <tlhelp32.h>
|
|
|
18 #include <windows.h>
|
|
|
19 #include <winternl.h>
|
|
|
20
|
|
|
21 /* This file is noticably more complex than Unix and Linux, and that's because
|
|
|
22 * there is no "simple" way to get the paths of a file. In fact, this thing requires
|
|
|
23 * you to use *internal functions* that can't even be linked to, hence why we have to
|
|
|
24 * use GetProcAddress and such. What a mess.
|
|
|
25 *
|
|
|
26 * Speaking of which, because this file uses internal functions of the OS, it is not
|
|
|
27 * guaranteed to work far into the future. However, it has worked since NT 6.0 (Vista)
|
|
|
28 * at least, so it's unlikely to be changed much ever.
|
|
|
29 */
|
|
|
30
|
|
|
31 /* SystemExtendedHandleInformation is only available in NT 5.1+ (XP and higher) and provides information for
|
|
|
32 * 32-bit PIDs, unlike SystemHandleInformation
|
|
|
33 *
|
|
|
34 * TODO: implement SystemHandleInformation for systems older than XP
|
|
|
35 */
|
|
|
36 static constexpr SYSTEM_INFORMATION_CLASS SystemExtendedHandleInformation = static_cast<SYSTEM_INFORMATION_CLASS>(0x40);
|
|
|
37 static constexpr NTSTATUS STATUS_INFO_LENGTH_MISMATCH = 0xC0000004UL;
|
|
|
38
|
|
|
39 /* this is filled in at runtime because it's not guaranteed to be (and isn't)
|
|
|
40 * constant between different versions of Windows */
|
|
|
41 static unsigned short file_type_index = 0;
|
|
|
42
|
|
|
43 struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
|
|
|
44 PVOID Object;
|
|
|
45 ULONG_PTR UniqueProcessId;
|
|
|
46 HANDLE HandleValue;
|
|
|
47 ACCESS_MASK GrantedAccess;
|
|
|
48 USHORT CreatorBackTraceIndex;
|
|
|
49 USHORT ObjectTypeIndex;
|
|
|
50 ULONG HandleAttributes;
|
|
|
51 ULONG Reserved;
|
|
|
52 };
|
|
|
53
|
|
|
54 struct SYSTEM_HANDLE_INFORMATION_EX {
|
|
|
55 ULONG_PTR NumberOfHandles;
|
|
|
56 ULONG_PTR Reserved;
|
|
|
57 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
|
|
|
58 };
|
|
|
59
|
|
|
60 namespace animone::internal::win32 {
|
|
|
61
|
|
|
62 class Ntdll {
|
|
|
63 public:
|
|
|
64 Ntdll() {
|
|
|
65 ntdll = ::GetModuleHandleW(L"ntdll.dll");
|
|
|
66 nt_query_system_information = reinterpret_cast<decltype(::NtQuerySystemInformation)*>(
|
|
|
67 ::GetProcAddress(ntdll, "NtQuerySystemInformation"));
|
|
|
68 nt_query_object = reinterpret_cast<decltype(::NtQueryObject)*>(::GetProcAddress(ntdll, "NtQueryObject"));
|
|
|
69 }
|
|
|
70
|
|
|
71 NTSTATUS QuerySystemInformation(SYSTEM_INFORMATION_CLASS cls, PVOID sysinfo, ULONG len,
|
|
3
|
72 PULONG retlen){
|
|
|
73 return nt_query_system_information(cls, sysinfo, len, retlen);
|
|
|
74 }
|
|
0
|
75
|
|
|
76 NTSTATUS QueryObject(HANDLE handle, OBJECT_INFORMATION_CLASS cls, PVOID objinf, ULONG objinflen, PULONG retlen) {
|
|
|
77 return nt_query_object(handle, cls, objinf, objinflen, retlen);
|
|
|
78 }
|
|
|
79
|
|
|
80 private:
|
|
|
81 HMODULE ntdll;
|
|
|
82 decltype(::NtQuerySystemInformation)* nt_query_system_information;
|
|
|
83 decltype(::NtQueryObject)* nt_query_object;
|
|
3
|
84 };
|
|
0
|
85
|
|
|
86 Ntdll ntdll;
|
|
|
87
|
|
|
88 static HANDLE DuplicateHandle(HANDLE process_handle, HANDLE handle) {
|
|
|
89 HANDLE dup_handle = nullptr;
|
|
|
90 const bool result =
|
|
|
91 ::DuplicateHandle(process_handle, handle, ::GetCurrentProcess(), &dup_handle, 0, false, DUPLICATE_SAME_ACCESS);
|
|
|
92 return result ? dup_handle : nullptr;
|
|
|
93 }
|
|
|
94
|
|
|
95 static std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> GetSystemHandleInformation() {
|
|
|
96 /* we should really put a cap on this */
|
|
|
97 ULONG cb = 1 << 19;
|
|
|
98 NTSTATUS status = STATUS_NO_MEMORY;
|
|
3
|
99 std::unique_ptr<SYSTEM_HANDLE_INFORMATION_EX> info;
|
|
0
|
100
|
|
|
101 do {
|
|
3
|
102 info.reset(reinterpret_cast<SYSTEM_HANDLE_INFORMATION_EX*>(malloc(cb *= 2)));
|
|
0
|
103 if (!info)
|
|
|
104 continue;
|
|
|
105
|
|
|
106 status = ntdll.QuerySystemInformation(SystemExtendedHandleInformation, info.get(), cb, &cb);
|
|
|
107 } while (status == STATUS_INFO_LENGTH_MISMATCH);
|
|
|
108
|
|
|
109 if (!NT_SUCCESS(status))
|
|
|
110 return {};
|
|
|
111
|
|
|
112 std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> res;
|
|
|
113
|
|
|
114 ULONG_PTR handles = info->NumberOfHandles;
|
|
|
115 if (!handles)
|
|
|
116 return {};
|
|
|
117
|
|
|
118 res.reserve(handles);
|
|
|
119
|
|
|
120 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* entry = info->Handles;
|
|
|
121 do {
|
|
|
122 if (entry)
|
|
|
123 res.push_back(*(entry++));
|
|
|
124 } while (--handles);
|
|
|
125
|
|
|
126 return res;
|
|
|
127 }
|
|
|
128
|
|
|
129 static std::wstring GetHandleType(HANDLE handle) {
|
|
|
130 OBJECT_TYPE_INFORMATION info = {0};
|
|
|
131 ntdll.QueryObject(handle, ObjectTypeInformation, &info, sizeof(info), NULL);
|
|
|
132 return std::wstring(info.TypeName.Buffer, info.TypeName.Length);
|
|
|
133 }
|
|
|
134
|
|
|
135 static std::wstring GetFinalPathNameByHandle(HANDLE handle) {
|
|
|
136 std::wstring buffer;
|
|
|
137
|
|
|
138 DWORD size = ::GetFinalPathNameByHandleW(handle, NULL, 0, FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
|
|
|
139 buffer.resize(size);
|
|
|
140 ::GetFinalPathNameByHandleW(handle, &buffer.front(), buffer.size(), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS);
|
|
|
141
|
|
|
142 return buffer;
|
|
|
143 }
|
|
|
144
|
|
|
145 static bool IsFileHandle(HANDLE handle, unsigned short object_type_index) {
|
|
|
146 if (file_type_index)
|
|
|
147 return object_type_index == file_type_index;
|
|
|
148 else if (!handle)
|
|
|
149 return true;
|
|
|
150 else if (GetHandleType(handle) == L"File") {
|
|
|
151 file_type_index = object_type_index;
|
|
|
152 return true;
|
|
|
153 }
|
|
|
154 return false;
|
|
|
155 }
|
|
|
156
|
|
|
157 static bool IsFileMaskOk(ACCESS_MASK access_mask) {
|
|
|
158 if (!(access_mask & FILE_READ_DATA))
|
|
|
159 return false;
|
|
|
160
|
|
|
161 if ((access_mask & FILE_APPEND_DATA) || (access_mask & FILE_WRITE_EA) || (access_mask & FILE_WRITE_ATTRIBUTES))
|
|
|
162 return false;
|
|
|
163
|
|
|
164 return true;
|
|
|
165 }
|
|
|
166
|
|
|
167 static bool IsFilePathOk(const std::wstring& path) {
|
|
|
168 if (path.empty())
|
|
|
169 return false;
|
|
|
170
|
|
|
171 if (IsSystemDirectory(path))
|
|
|
172 return false;
|
|
|
173
|
|
|
174 const auto file_attributes = GetFileAttributesW(path.c_str());
|
|
|
175 if ((file_attributes == INVALID_FILE_ATTRIBUTES) || (file_attributes & FILE_ATTRIBUTE_DIRECTORY))
|
|
|
176 return false;
|
|
|
177
|
|
|
178 return true;
|
|
|
179 }
|
|
|
180
|
|
|
181 bool GetProcessName(pid_t pid, std::string& name) {
|
|
3
|
182 std::wstring wname = GetProcessPath(pid);
|
|
0
|
183 if (wname.empty())
|
|
|
184 return false;
|
|
|
185
|
|
3
|
186 name = ToUtf8String(GetFileNameWithoutExtension(GetFileNameFromPath(wname)));
|
|
|
187 return true;
|
|
0
|
188 }
|
|
|
189
|
|
|
190 bool EnumerateOpenProcesses(process_proc_t process_proc) {
|
|
|
191 HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
|
|
|
192 if (hProcessSnap == INVALID_HANDLE_VALUE)
|
|
|
193 return false;
|
|
|
194
|
|
|
195 PROCESSENTRY32 pe32;
|
|
|
196 pe32.dwSize = sizeof(PROCESSENTRY32);
|
|
|
197
|
|
|
198 if (!::Process32First(hProcessSnap, &pe32))
|
|
|
199 return false;
|
|
|
200
|
|
|
201 if (!process_proc({pe32.th32ProcessID, pe32.szExeFile}))
|
|
|
202 return false;
|
|
|
203
|
|
|
204 while (::Process32Next(hProcessSnap, &pe32))
|
|
|
205 if (!process_proc({pe32.th32ProcessID, pe32.szExeFile}))
|
|
|
206 return false;
|
|
|
207
|
|
|
208 ::CloseHandle(hProcessSnap);
|
|
|
209
|
|
|
210 return true;
|
|
|
211 }
|
|
|
212
|
|
|
213 /* this could be changed to being a callback, but... I'm too lazy right now :) */
|
|
|
214 bool EnumerateOpenFiles(const std::set<pid_t>& pids, open_file_proc_t open_file_proc) {
|
|
|
215 if (!open_file_proc)
|
|
|
216 return false;
|
|
|
217
|
|
|
218 std::unordered_map<pid_t, Handle> proc_handles;
|
|
|
219
|
|
|
220 for (const pid_t& pid : pids) {
|
|
|
221 const HANDLE handle = ::OpenProcess(PROCESS_DUP_HANDLE, false, pid);
|
|
|
222 if (handle != INVALID_HANDLE_VALUE)
|
|
|
223 proc_handles[pid] = Handle(handle);
|
|
|
224 }
|
|
|
225
|
|
|
226 if (proc_handles.empty())
|
|
|
227 return false;
|
|
|
228
|
|
|
229 std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> info = GetSystemHandleInformation();
|
|
|
230
|
|
|
231 for (const auto& h : info) {
|
|
|
232 const pid_t pid = h.UniqueProcessId;
|
|
|
233 if (!pids.count(pid))
|
|
|
234 continue;
|
|
|
235
|
|
|
236 if (!IsFileHandle(nullptr, h.ObjectTypeIndex))
|
|
|
237 continue;
|
|
|
238
|
|
|
239 if (!IsFileMaskOk(h.GrantedAccess))
|
|
|
240 continue;
|
|
|
241
|
|
|
242 Handle handle(DuplicateHandle(proc_handles[pid].get(), h.HandleValue));
|
|
|
243 if (handle.get() == INVALID_HANDLE_VALUE)
|
|
|
244 continue;
|
|
|
245
|
|
|
246 if (GetFileType(handle.get()) != FILE_TYPE_DISK)
|
|
|
247 continue;
|
|
|
248
|
|
|
249 const std::wstring path = GetFinalPathNameByHandle(handle.get());
|
|
|
250 if (!IsFilePathOk(path))
|
|
|
251 continue;
|
|
|
252
|
|
|
253 if (!open_file_proc({pid, ToUtf8String(path)}))
|
|
|
254 return false;
|
|
|
255 }
|
|
|
256
|
|
|
257 return true;
|
|
|
258 }
|
|
|
259
|
|
|
260 } // namespace animone::internal::win32
|
