Correct PROCESS_BASIC_INFORMATION for 64 bit Windows.

sandbox/win/src/nt_internals.h

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // This file holds definitions related to the ntdll API.
 
 #ifndef SANDBOX_WIN_SRC_NT_INTERNALS_H__
 #define SANDBOX_WIN_SRC_NT_INTERNALS_H__
 
 #include <windows.h>
@@ skipping 293 matching lines @@
 // Partial definition only:
 typedef enum _PROCESSINFOCLASS {
   ProcessBasicInformation = 0,
   ProcessExecuteFlags = 0x22
 } PROCESSINFOCLASS;
 
 typedef PVOID PPEB;
 typedef PVOID KPRIORITY;
 
 typedef struct _PROCESS_BASIC_INFORMATION {
-  NTSTATUS ExitStatus;
+  PVOID ExitStatus;

[scottmg, 2015/09/03 16:18:52]

This should be NTSTATUS on both x86 and x64, followed by 4bytes padding on x64.

MSDN documentation likely makes the reserved fields PVOID to imply that they're
opaque/internal but to make sure the size is correct.

[rickyz (no longer on Chrome), 2015/09/03 19:16:29]

Done.

   PPEB PebBaseAddress;
   KAFFINITY AffinityMask;
   KPRIORITY BasePriority;

[scottmg, 2015/09/03 16:18:52]

KPRIORITY is also 4 bytes, so this should be followed by 4 bytes padding on
x64...

[rickyz (no longer on Chrome), 2015/09/03 19:16:29]

Oops, fixed the definition of KPRIORITY in the file.

-  ULONG UniqueProcessId;
-  ULONG InheritedFromUniqueProcessId;
+  ULONG_PTR UniqueProcessId;

[scottmg, 2015/09/03 16:18:52]

... because both the ProcessIds are both ULONG_PTR.

[rickyz (no longer on Chrome), 2015/09/03 19:16:29]

Yeah.. the ExitStatus one I can understand - that's just being explicit about
alignment. I have no idea why they reserve 8 bytes for process ids here - it's
like CLIENT_ID where the process/thread ids are HANDLEs instead of DWORDs.

Anyway, I switched to the union approach that crashpad uses.

+  PVOID InheritedFromUniqueProcessId;
 } PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
 
 typedef NTSTATUS (WINAPI *NtQueryInformationProcessFunction)(
   IN HANDLE ProcessHandle,
   IN PROCESSINFOCLASS ProcessInformationClass,
   OUT PVOID ProcessInformation,
   IN ULONG ProcessInformationLength,
   OUT PULONG ReturnLength OPTIONAL);
 
 typedef NTSTATUS (WINAPI *NtSetInformationProcessFunction)(
@@ skipping 351 matching lines @@
 
 struct PROCESS_ACCESS_TOKEN {
   HANDLE token;
   HANDLE thread;
 };
 
 const unsigned int NtProcessInformationAccessToken = 9;
 
 #endif  // SANDBOX_WIN_SRC_NT_INTERNALS_H__