Mercurial > minori
annotate dep/animone/src/fd/win32.cc @ 270:0718f538c5f9
dep/animone: filter open files by access mode
| author | Paper <paper@paper.us.eu.org> |
|---|---|
| date | Fri, 12 Apr 2024 19:13:50 -0400 |
| parents | 09c5bd74fe93 |
| children | 65df2813d0de |
| rev | line source |
|---|---|
| 258 | 1 #include "animone/fd/win32.h" |
| 2 #include "animone.h" | |
| 3 #include "animone/util/win32.h" | |
| 4 | |
| 5 #include <stdexcept> | |
| 6 #include <string> | |
| 7 #include <unordered_map> | |
| 8 #include <vector> | |
| 9 | |
| 10 #include <fileapi.h> | |
| 11 #include <handleapi.h> | |
| 12 #include <libloaderapi.h> | |
| 13 #include <ntdef.h> | |
| 14 #include <psapi.h> | |
| 15 #include <shlobj.h> | |
| 16 #include <stringapiset.h> | |
| 17 #include <tlhelp32.h> | |
| 18 #include <windows.h> | |
| 19 #include <winternl.h> | |
| 20 | |
| 21 /* This file is noticably more complex than Unix and Linux, and that's because | |
| 22 * there is no "simple" way to get the paths of a file. In fact, this thing requires | |
| 23 * you to use *internal functions* that can't even be linked to, hence why we have to | |
| 24 * use GetProcAddress and such. What a mess. | |
| 25 * | |
| 26 * Speaking of which, because this file uses internal functions of the OS, it is not | |
| 27 * guaranteed to work far into the future. However, it has worked since NT 6.0 (Vista) | |
| 28 * at least, so it's unlikely to be changed much ever. | |
| 29 */ | |
| 30 | |
| 31 /* SystemExtendedHandleInformation is only available in NT 5.1+ (XP and higher) and provides information for | |
| 32 * 32-bit PIDs, unlike SystemHandleInformation | |
| 33 * | |
| 34 * TODO: implement SystemHandleInformation for systems older than XP | |
| 35 */ | |
| 36 static constexpr SYSTEM_INFORMATION_CLASS SystemExtendedHandleInformation = static_cast<SYSTEM_INFORMATION_CLASS>(0x40); | |
| 37 static constexpr NTSTATUS STATUS_INFO_LENGTH_MISMATCH = 0xC0000004UL; | |
| 38 | |
| 39 /* this is filled in at runtime because it's not guaranteed to be (and isn't) | |
| 40 * constant between different versions of Windows */ | |
| 41 static unsigned short file_type_index = 0; | |
| 42 | |
| 43 struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX { | |
| 44 PVOID Object; | |
| 45 ULONG_PTR UniqueProcessId; | |
| 46 HANDLE HandleValue; | |
| 47 ACCESS_MASK GrantedAccess; | |
| 48 USHORT CreatorBackTraceIndex; | |
| 49 USHORT ObjectTypeIndex; | |
| 50 ULONG HandleAttributes; | |
| 51 ULONG Reserved; | |
| 52 }; | |
| 53 | |
| 54 struct SYSTEM_HANDLE_INFORMATION_EX { | |
| 55 ULONG_PTR NumberOfHandles; | |
| 56 ULONG_PTR Reserved; | |
| 57 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1]; | |
| 58 }; | |
| 59 | |
| 60 namespace animone::internal::win32 { | |
| 61 | |
| 62 class Ntdll { | |
| 63 public: | |
| 64 Ntdll() { | |
| 65 ntdll = ::GetModuleHandleW(L"ntdll.dll"); | |
| 66 nt_query_system_information = reinterpret_cast<decltype(::NtQuerySystemInformation)*>( | |
| 67 ::GetProcAddress(ntdll, "NtQuerySystemInformation")); | |
| 68 nt_query_object = reinterpret_cast<decltype(::NtQueryObject)*>(::GetProcAddress(ntdll, "NtQueryObject")); | |
| 69 } | |
| 70 | |
| 71 NTSTATUS QuerySystemInformation(SYSTEM_INFORMATION_CLASS cls, PVOID sysinfo, ULONG len, | |
|
267
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
72 PULONG retlen){ |
|
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
73 return nt_query_system_information(cls, sysinfo, len, retlen); |
|
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
74 } |
| 258 | 75 |
| 76 NTSTATUS QueryObject(HANDLE handle, OBJECT_INFORMATION_CLASS cls, PVOID objinf, ULONG objinflen, PULONG retlen) { | |
| 77 return nt_query_object(handle, cls, objinf, objinflen, retlen); | |
| 78 } | |
| 79 | |
| 80 private: | |
| 81 HMODULE ntdll; | |
| 82 decltype(::NtQuerySystemInformation)* nt_query_system_information; | |
| 83 decltype(::NtQueryObject)* nt_query_object; | |
|
267
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
84 }; |
| 258 | 85 |
| 86 Ntdll ntdll; | |
| 87 | |
| 88 static HANDLE DuplicateHandle(HANDLE process_handle, HANDLE handle) { | |
| 89 HANDLE dup_handle = nullptr; | |
| 90 const bool result = | |
| 91 ::DuplicateHandle(process_handle, handle, ::GetCurrentProcess(), &dup_handle, 0, false, DUPLICATE_SAME_ACCESS); | |
| 92 return result ? dup_handle : nullptr; | |
| 93 } | |
| 94 | |
| 95 static std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> GetSystemHandleInformation() { | |
| 96 /* we should really put a cap on this */ | |
| 97 ULONG cb = 1 << 19; | |
| 98 NTSTATUS status = STATUS_NO_MEMORY; | |
|
267
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
99 std::unique_ptr<SYSTEM_HANDLE_INFORMATION_EX> info; |
| 258 | 100 |
| 101 do { | |
|
267
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
102 info.reset(reinterpret_cast<SYSTEM_HANDLE_INFORMATION_EX*>(malloc(cb *= 2))); |
| 258 | 103 if (!info) |
| 104 continue; | |
| 105 | |
| 106 status = ntdll.QuerySystemInformation(SystemExtendedHandleInformation, info.get(), cb, &cb); | |
| 107 } while (status == STATUS_INFO_LENGTH_MISMATCH); | |
| 108 | |
| 109 if (!NT_SUCCESS(status)) | |
| 110 return {}; | |
| 111 | |
| 112 std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> res; | |
| 113 | |
| 114 ULONG_PTR handles = info->NumberOfHandles; | |
| 115 if (!handles) | |
| 116 return {}; | |
| 117 | |
| 118 res.reserve(handles); | |
| 119 | |
| 120 SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* entry = info->Handles; | |
| 121 do { | |
| 122 if (entry) | |
| 123 res.push_back(*(entry++)); | |
| 124 } while (--handles); | |
| 125 | |
| 126 return res; | |
| 127 } | |
| 128 | |
| 129 static std::wstring GetHandleType(HANDLE handle) { | |
| 130 OBJECT_TYPE_INFORMATION info = {0}; | |
| 131 ntdll.QueryObject(handle, ObjectTypeInformation, &info, sizeof(info), NULL); | |
| 132 return std::wstring(info.TypeName.Buffer, info.TypeName.Length); | |
| 133 } | |
| 134 | |
| 135 static std::wstring GetFinalPathNameByHandle(HANDLE handle) { | |
| 136 std::wstring buffer; | |
| 137 | |
| 138 DWORD size = ::GetFinalPathNameByHandleW(handle, NULL, 0, FILE_NAME_NORMALIZED | VOLUME_NAME_DOS); | |
| 139 buffer.resize(size); | |
| 140 ::GetFinalPathNameByHandleW(handle, &buffer.front(), buffer.size(), FILE_NAME_NORMALIZED | VOLUME_NAME_DOS); | |
| 141 | |
| 142 return buffer; | |
| 143 } | |
| 144 | |
| 145 static bool IsFileHandle(HANDLE handle, unsigned short object_type_index) { | |
| 146 if (file_type_index) | |
| 147 return object_type_index == file_type_index; | |
| 148 else if (!handle) | |
| 149 return true; | |
| 150 else if (GetHandleType(handle) == L"File") { | |
| 151 file_type_index = object_type_index; | |
| 152 return true; | |
| 153 } | |
| 154 return false; | |
| 155 } | |
| 156 | |
| 157 static bool IsFileMaskOk(ACCESS_MASK access_mask) { | |
| 158 if (!(access_mask & FILE_READ_DATA)) | |
| 159 return false; | |
| 160 | |
| 161 if ((access_mask & FILE_APPEND_DATA) || (access_mask & FILE_WRITE_EA) || (access_mask & FILE_WRITE_ATTRIBUTES)) | |
| 162 return false; | |
| 163 | |
| 164 return true; | |
| 165 } | |
| 166 | |
| 167 static bool IsFilePathOk(const std::wstring& path) { | |
| 168 if (path.empty()) | |
| 169 return false; | |
| 170 | |
| 171 if (IsSystemDirectory(path)) | |
| 172 return false; | |
| 173 | |
| 174 const auto file_attributes = GetFileAttributesW(path.c_str()); | |
| 175 if ((file_attributes == INVALID_FILE_ATTRIBUTES) || (file_attributes & FILE_ATTRIBUTE_DIRECTORY)) | |
| 176 return false; | |
| 177 | |
| 178 return true; | |
| 179 } | |
| 180 | |
| 181 bool GetProcessName(pid_t pid, std::string& name) { | |
|
267
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
182 std::wstring wname = GetProcessPath(pid); |
| 258 | 183 if (wname.empty()) |
| 184 return false; | |
| 185 | |
|
267
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
186 name = ToUtf8String(GetFileNameWithoutExtension(GetFileNameFromPath(wname))); |
|
09c5bd74fe93
win32: make builds work again
Paper <paper@paper.us.eu.org>
parents:
258
diff
changeset
|
187 return true; |
| 258 | 188 } |
| 189 | |
| 190 bool EnumerateOpenProcesses(process_proc_t process_proc) { | |
| 191 HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); | |
| 192 if (hProcessSnap == INVALID_HANDLE_VALUE) | |
| 193 return false; | |
| 194 | |
| 195 PROCESSENTRY32 pe32; | |
| 196 pe32.dwSize = sizeof(PROCESSENTRY32); | |
| 197 | |
| 198 if (!::Process32First(hProcessSnap, &pe32)) | |
| 199 return false; | |
| 200 | |
| 201 if (!process_proc({pe32.th32ProcessID, pe32.szExeFile})) | |
| 202 return false; | |
| 203 | |
| 204 while (::Process32Next(hProcessSnap, &pe32)) | |
| 205 if (!process_proc({pe32.th32ProcessID, pe32.szExeFile})) | |
| 206 return false; | |
| 207 | |
| 208 ::CloseHandle(hProcessSnap); | |
| 209 | |
| 210 return true; | |
| 211 } | |
| 212 | |
| 213 /* this could be changed to being a callback, but... I'm too lazy right now :) */ | |
| 214 bool EnumerateOpenFiles(const std::set<pid_t>& pids, open_file_proc_t open_file_proc) { | |
| 215 if (!open_file_proc) | |
| 216 return false; | |
| 217 | |
| 218 std::unordered_map<pid_t, Handle> proc_handles; | |
| 219 | |
| 220 for (const pid_t& pid : pids) { | |
| 221 const HANDLE handle = ::OpenProcess(PROCESS_DUP_HANDLE, false, pid); | |
| 222 if (handle != INVALID_HANDLE_VALUE) | |
| 223 proc_handles[pid] = Handle(handle); | |
| 224 } | |
| 225 | |
| 226 if (proc_handles.empty()) | |
| 227 return false; | |
| 228 | |
| 229 std::vector<SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX> info = GetSystemHandleInformation(); | |
| 230 | |
| 231 for (const auto& h : info) { | |
| 232 const pid_t pid = h.UniqueProcessId; | |
| 233 if (!pids.count(pid)) | |
| 234 continue; | |
| 235 | |
| 236 if (!IsFileHandle(nullptr, h.ObjectTypeIndex)) | |
| 237 continue; | |
| 238 | |
| 239 if (!IsFileMaskOk(h.GrantedAccess)) | |
| 240 continue; | |
| 241 | |
| 242 Handle handle(DuplicateHandle(proc_handles[pid].get(), h.HandleValue)); | |
| 243 if (handle.get() == INVALID_HANDLE_VALUE) | |
| 244 continue; | |
| 245 | |
| 246 if (GetFileType(handle.get()) != FILE_TYPE_DISK) | |
| 247 continue; | |
| 248 | |
| 249 const std::wstring path = GetFinalPathNameByHandle(handle.get()); | |
| 250 if (!IsFilePathOk(path)) | |
| 251 continue; | |
| 252 | |
| 253 if (!open_file_proc({pid, ToUtf8String(path)})) | |
| 254 return false; | |
| 255 } | |
| 256 | |
| 257 return true; | |
| 258 } | |
| 259 | |
| 260 } // namespace animone::internal::win32 |