OLD | NEW |
1 // Copyright 2015 The Crashpad Authors. All rights reserved. | 1 // Copyright 2015 The Crashpad Authors. All rights reserved. |
2 // | 2 // |
3 // Licensed under the Apache License, Version 2.0 (the "License"); | 3 // Licensed under the Apache License, Version 2.0 (the "License"); |
4 // you may not use this file except in compliance with the License. | 4 // you may not use this file except in compliance with the License. |
5 // You may obtain a copy of the License at | 5 // You may obtain a copy of the License at |
6 // | 6 // |
7 // http://www.apache.org/licenses/LICENSE-2.0 | 7 // http://www.apache.org/licenses/LICENSE-2.0 |
8 // | 8 // |
9 // Unless required by applicable law or agreed to in writing, software | 9 // Unless required by applicable law or agreed to in writing, software |
10 // distributed under the License is distributed on an "AS IS" BASIS, | 10 // distributed under the License is distributed on an "AS IS" BASIS, |
(...skipping 46 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
57 static NtOpenThreadFunction nt_open_thread = | 57 static NtOpenThreadFunction nt_open_thread = |
58 reinterpret_cast<NtOpenThreadFunction>( | 58 reinterpret_cast<NtOpenThreadFunction>( |
59 GetProcAddress(LoadLibrary(L"ntdll.dll"), "NtOpenThread")); | 59 GetProcAddress(LoadLibrary(L"ntdll.dll"), "NtOpenThread")); |
60 DCHECK(nt_open_thread); | 60 DCHECK(nt_open_thread); |
61 return nt_open_thread(thread_handle, | 61 return nt_open_thread(thread_handle, |
62 desired_access, | 62 desired_access, |
63 object_attributes, | 63 object_attributes, |
64 static_cast<const void*>(client_id)); | 64 static_cast<const void*>(client_id)); |
65 } | 65 } |
66 | 66 |
67 NTSTATUS NtQueryInformationThread(HANDLE thread_handle, | |
68 THREADINFOCLASS thread_information_class, | |
69 PVOID thread_information, | |
70 ULONG thread_information_length, | |
71 PULONG return_length) { | |
72 static decltype(::NtQueryInformationThread)* nt_query_information_thread = | |
73 reinterpret_cast<decltype(::NtQueryInformationThread)*>(GetProcAddress( | |
74 LoadLibrary(L"ntdll.dll"), "NtQueryInformationThread")); | |
75 DCHECK(nt_query_information_thread); | |
76 return nt_query_information_thread(thread_handle, | |
77 thread_information_class, | |
78 thread_information, | |
79 thread_information_length, | |
80 return_length); | |
81 } | |
82 | |
83 // Copied from ntstatus.h because um/winnt.h conflicts with general inclusion of | 67 // Copied from ntstatus.h because um/winnt.h conflicts with general inclusion of |
84 // ntstatus.h. | 68 // ntstatus.h. |
85 #define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L) | 69 #define STATUS_BUFFER_TOO_SMALL ((NTSTATUS)0xC0000023L) |
86 #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) | 70 #define STATUS_INFO_LENGTH_MISMATCH ((NTSTATUS)0xC0000004L) |
87 | 71 |
88 // Gets a pointer to the process information structure after a given one, or | 72 // Gets a pointer to the process information structure after a given one, or |
89 // null when iteration is complete, assuming they've been retrieved in a block | 73 // null when iteration is complete, assuming they've been retrieved in a block |
90 // via NtQuerySystemInformation(). | 74 // via NtQuerySystemInformation(). |
91 template <class Traits> | 75 template <class Traits> |
92 process_types::SYSTEM_PROCESS_INFORMATION<Traits>* NextProcess( | 76 process_types::SYSTEM_PROCESS_INFORMATION<Traits>* NextProcess( |
(...skipping 53 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
146 do { | 130 do { |
147 if (process->UniqueProcessId == process_id) | 131 if (process->UniqueProcessId == process_id) |
148 return process; | 132 return process; |
149 } while (process = NextProcess(process)); | 133 } while (process = NextProcess(process)); |
150 | 134 |
151 LOG(ERROR) << "process " << process_id << " not found"; | 135 LOG(ERROR) << "process " << process_id << " not found"; |
152 return nullptr; | 136 return nullptr; |
153 } | 137 } |
154 | 138 |
155 template <class Traits> | 139 template <class Traits> |
156 uint32_t GetThreadSuspendCount( | 140 HANDLE OpenThread(const process_types::SYSTEM_EXTENDED_THREAD_INFORMATION< |
157 const process_types::SYSTEM_EXTENDED_THREAD_INFORMATION<Traits>& | 141 Traits>& thread_info) { |
158 thread_info) { | 142 HANDLE handle; |
159 // Wait reason values are from KWAIT_REASON in wdm.h. We don't need all of | 143 ACCESS_MASK query_access = THREAD_GET_CONTEXT | THREAD_SUSPEND_RESUME; |
160 // them, so just declare the one we need. | |
161 const ULONG kWaitReasonSuspended = 5; | |
162 | |
163 // Kernel mode enumerations for thread state come from | |
164 // http://www.nirsoft.net/kernel_struct/vista/KTHREAD_STATE.html and | |
165 // https://msdn.microsoft.com/en-us/library/system.diagnostics.threadstate(v=v
s.110).aspx | |
166 const ULONG kThreadStateWaiting = 5; | |
167 const ULONG kThreadStateGateWait = 8; | |
168 | |
169 bool suspended = (thread_info.ThreadState == kThreadStateWaiting || | |
170 thread_info.ThreadState == kThreadStateGateWait) && | |
171 thread_info.WaitReason == kWaitReasonSuspended; | |
172 if (!suspended) | |
173 return 0; | |
174 | |
175 HANDLE thread_handle; | |
176 ACCESS_MASK query_access = THREAD_QUERY_LIMITED_INFORMATION; | |
177 OBJECT_ATTRIBUTES object_attributes; | 144 OBJECT_ATTRIBUTES object_attributes; |
178 InitializeObjectAttributes(&object_attributes, nullptr, 0, nullptr, nullptr); | 145 InitializeObjectAttributes(&object_attributes, nullptr, 0, nullptr, nullptr); |
179 NTSTATUS status = crashpad::NtOpenThread( | 146 NTSTATUS status = crashpad::NtOpenThread( |
180 &thread_handle, query_access, &object_attributes, &thread_info.ClientId); | 147 &handle, query_access, &object_attributes, &thread_info.ClientId); |
181 if (!NT_SUCCESS(status)) { | 148 if (!NT_SUCCESS(status)) { |
182 LOG(WARNING) << "couldn't open thread to retrieve suspend count"; | 149 LOG(ERROR) << "NtOpenThread failed"; |
183 // Fall back to something semi-reasonable. We know we're suspended at this | 150 return nullptr; |
184 // point, so just return 1. | |
185 return 1; | |
186 } | 151 } |
| 152 return handle; |
| 153 } |
187 | 154 |
188 // Take ownership of this handle so we close on exit. NtClose and CloseHandle | 155 // It's necessary to suspend the thread to grab CONTEXT. SuspendThread has a |
189 // are identical. | 156 // side-effect of returning the SuspendCount of the thread on success, so we |
190 ScopedKernelHANDLE handle(thread_handle); | 157 // fill out these two pieces of semi-unrelated data in the same function. |
| 158 template <class Traits> |
| 159 void FillThreadContextAndSuspendCount( |
| 160 const process_types::SYSTEM_EXTENDED_THREAD_INFORMATION<Traits>& |
| 161 thread_info, |
| 162 ProcessReaderWin::Thread* thread) { |
191 | 163 |
192 // From ntddk.h. winternl.h defines THREADINFOCLASS, but only one value. | 164 // Don't suspend the thread if it's this thread. This is really only for test |
193 const int kThreadSuspendCount = 35; | 165 // binaries, as we won't be walking ourselves, in general. |
194 ULONG suspend_count; | 166 bool is_current_thread = thread_info.ClientId.UniqueThread == |
195 status = crashpad::NtQueryInformationThread( | 167 reinterpret_cast<process_types::TEB<Traits>*>( |
196 handle.get(), | 168 NtCurrentTeb())->ClientId.UniqueThread; |
197 static_cast<THREADINFOCLASS>(kThreadSuspendCount), | 169 |
198 &suspend_count, | 170 ScopedKernelHANDLE thread_handle(OpenThread(thread_info)); |
199 sizeof(suspend_count), | 171 |
200 nullptr); | 172 // TODO(scottmg): Handle cross-bitness in this function. |
201 if (!NT_SUCCESS(status)) { | 173 |
202 LOG(WARNING) << "NtQueryInformationThread failed" << std::hex << status; | 174 if (is_current_thread) { |
203 return 1; | 175 thread->suspend_count = 0; |
| 176 RtlCaptureContext(&thread->context); |
| 177 } else { |
| 178 DWORD previous_suspend_count = SuspendThread(thread_handle.get()); |
| 179 if (previous_suspend_count == -1) { |
| 180 PLOG(ERROR) << "SuspendThread failed"; |
| 181 return; |
| 182 } |
| 183 thread->suspend_count = previous_suspend_count; |
| 184 |
| 185 memset(&thread->context, 0, sizeof(thread->context)); |
| 186 thread->context.ContextFlags = CONTEXT_ALL; |
| 187 if (!GetThreadContext(thread_handle.get(), &thread->context)) { |
| 188 PLOG(ERROR) << "GetThreadContext failed"; |
| 189 return; |
| 190 } |
| 191 |
| 192 if (!ResumeThread(thread_handle.get())) { |
| 193 PLOG(ERROR) << "ResumeThread failed"; |
| 194 } |
204 } | 195 } |
205 | |
206 return suspend_count; | |
207 } | 196 } |
208 | 197 |
209 } // namespace | 198 } // namespace |
210 | 199 |
211 ProcessReaderWin::Thread::Thread() | 200 ProcessReaderWin::Thread::Thread() |
212 : id(0), | 201 : context(), |
| 202 id(0), |
213 teb(0), | 203 teb(0), |
214 stack_region_address(0), | 204 stack_region_address(0), |
215 stack_region_size(0), | 205 stack_region_size(0), |
216 suspend_count(0), | 206 suspend_count(0), |
217 priority_class(0), | 207 priority_class(0), |
218 priority(0) { | 208 priority(0) { |
219 } | 209 } |
220 | 210 |
221 ProcessReaderWin::ProcessReaderWin() | 211 ProcessReaderWin::ProcessReaderWin() |
222 : process_(INVALID_HANDLE_VALUE), | 212 : process_(INVALID_HANDLE_VALUE), |
(...skipping 20 matching lines...) Expand all Loading... |
243 bool ProcessReaderWin::ReadMemory(WinVMAddress at, | 233 bool ProcessReaderWin::ReadMemory(WinVMAddress at, |
244 WinVMSize num_bytes, | 234 WinVMSize num_bytes, |
245 void* into) { | 235 void* into) { |
246 SIZE_T bytes_read; | 236 SIZE_T bytes_read; |
247 if (!ReadProcessMemory(process_, | 237 if (!ReadProcessMemory(process_, |
248 reinterpret_cast<void*>(at), | 238 reinterpret_cast<void*>(at), |
249 into, | 239 into, |
250 base::checked_cast<SIZE_T>(num_bytes), | 240 base::checked_cast<SIZE_T>(num_bytes), |
251 &bytes_read) || | 241 &bytes_read) || |
252 num_bytes != bytes_read) { | 242 num_bytes != bytes_read) { |
253 PLOG(ERROR) << "ReadMemory at " << at << " of " << num_bytes << " failed"; | 243 PLOG(ERROR) << "ReadMemory at 0x" << std::hex << at << std::dec << " of " |
| 244 << num_bytes << " bytes failed"; |
254 return false; | 245 return false; |
255 } | 246 } |
256 return true; | 247 return true; |
257 } | 248 } |
258 | 249 |
259 bool ProcessReaderWin::StartTime(timeval* start_time) const { | 250 bool ProcessReaderWin::StartTime(timeval* start_time) const { |
260 FILETIME creation, exit, kernel, user; | 251 FILETIME creation, exit, kernel, user; |
261 if (!GetProcessTimes(process_, &creation, &exit, &kernel, &user)) { | 252 if (!GetProcessTimes(process_, &creation, &exit, &kernel, &user)) { |
262 PLOG(ERROR) << "GetProcessTimes"; | 253 PLOG(ERROR) << "GetProcessTimes"; |
263 return false; | 254 return false; |
(...skipping 33 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
297 process_types::SYSTEM_PROCESS_INFORMATION<SizeTraits>* process_information = | 288 process_types::SYSTEM_PROCESS_INFORMATION<SizeTraits>* process_information = |
298 GetProcessInformation<SizeTraits>(process_, &buffer); | 289 GetProcessInformation<SizeTraits>(process_, &buffer); |
299 if (!process_information) | 290 if (!process_information) |
300 return threads_; | 291 return threads_; |
301 | 292 |
302 for (unsigned long i = 0; i < process_information->NumberOfThreads; ++i) { | 293 for (unsigned long i = 0; i < process_information->NumberOfThreads; ++i) { |
303 const process_types::SYSTEM_EXTENDED_THREAD_INFORMATION<SizeTraits>& | 294 const process_types::SYSTEM_EXTENDED_THREAD_INFORMATION<SizeTraits>& |
304 thread_info = process_information->Threads[i]; | 295 thread_info = process_information->Threads[i]; |
305 Thread thread; | 296 Thread thread; |
306 thread.id = thread_info.ClientId.UniqueThread; | 297 thread.id = thread_info.ClientId.UniqueThread; |
307 thread.suspend_count = GetThreadSuspendCount(thread_info); | 298 |
| 299 FillThreadContextAndSuspendCount(thread_info, &thread); |
308 | 300 |
309 // TODO(scottmg): I believe we could reverse engineer the PriorityClass from | 301 // TODO(scottmg): I believe we could reverse engineer the PriorityClass from |
310 // the Priority, BasePriority, and | 302 // the Priority, BasePriority, and |
311 // https://msdn.microsoft.com/en-us/library/windows/desktop/ms685100 . | 303 // https://msdn.microsoft.com/en-us/library/windows/desktop/ms685100 . |
312 // MinidumpThreadWriter doesn't handle it yet in any case, so investigate | 304 // MinidumpThreadWriter doesn't handle it yet in any case, so investigate |
313 // both of those at the same time if it's useful. | 305 // both of those at the same time if it's useful. |
314 thread.priority_class = NORMAL_PRIORITY_CLASS; | 306 thread.priority_class = NORMAL_PRIORITY_CLASS; |
315 | 307 |
316 thread.priority = thread_info.Priority; | 308 thread.priority = thread_info.Priority; |
317 thread.teb = thread_info.TebBase; | 309 thread.teb = thread_info.TebBase; |
318 | 310 |
319 // While there are semi-documented fields in the thread structure called | 311 // While there are semi-documented fields in the thread structure called |
320 // StackBase and StackLimit, they don't appear to be correct in practice (or | 312 // StackBase and StackLimit, they don't appear to be correct in practice (or |
321 // at least, I don't know how to interpret them). Instead, read the TIB | 313 // at least, I don't know how to interpret them). Instead, read the TIB |
322 // (Thread Information Block) which is the first element of the TEB, and use | 314 // (Thread Information Block) which is the first element of the TEB, and use |
323 // its stack fields. | 315 // its stack fields. |
324 process_types::NT_TIB<SizeTraits> tib; | 316 process_types::NT_TIB<SizeTraits> tib; |
325 if (ReadMemory(thread_info.TebBase, sizeof(tib), &tib)) { | 317 if (ReadMemory(thread_info.TebBase, sizeof(tib), &tib)) { |
326 thread.stack_region_address = tib.StackBase; | |
327 // Note, "backwards" because of direction of stack growth. | 318 // Note, "backwards" because of direction of stack growth. |
| 319 thread.stack_region_address = tib.StackLimit; |
328 thread.stack_region_size = tib.StackBase - tib.StackLimit; | 320 thread.stack_region_size = tib.StackBase - tib.StackLimit; |
329 } | 321 } |
330 threads_.push_back(thread); | 322 threads_.push_back(thread); |
331 } | 323 } |
332 | 324 |
333 return threads_; | 325 return threads_; |
334 } | 326 } |
335 | 327 |
336 const std::vector<ProcessInfo::Module>& ProcessReaderWin::Modules() { | 328 const std::vector<ProcessInfo::Module>& ProcessReaderWin::Modules() { |
337 INITIALIZATION_STATE_DCHECK_VALID(initialized_); | 329 INITIALIZATION_STATE_DCHECK_VALID(initialized_); |
338 | 330 |
339 if (!process_info_.Modules(&modules_)) { | 331 if (!process_info_.Modules(&modules_)) { |
340 LOG(ERROR) << "couldn't retrieve modules"; | 332 LOG(ERROR) << "couldn't retrieve modules"; |
341 } | 333 } |
342 | 334 |
343 return modules_; | 335 return modules_; |
344 } | 336 } |
345 | 337 |
346 } // namespace crashpad | 338 } // namespace crashpad |
OLD | NEW |