OLD | NEW |
---|---|
1 // Copyright 2015 The Crashpad Authors. All rights reserved. | 1 // Copyright 2015 The Crashpad Authors. All rights reserved. |
2 // | 2 // |
3 // Licensed under the Apache License, Version 2.0 (the "License"); | 3 // Licensed under the Apache License, Version 2.0 (the "License"); |
4 // you may not use this file except in compliance with the License. | 4 // you may not use this file except in compliance with the License. |
5 // You may obtain a copy of the License at | 5 // You may obtain a copy of the License at |
6 // | 6 // |
7 // http://www.apache.org/licenses/LICENSE-2.0 | 7 // http://www.apache.org/licenses/LICENSE-2.0 |
8 // | 8 // |
9 // Unless required by applicable law or agreed to in writing, software | 9 // Unless required by applicable law or agreed to in writing, software |
10 // distributed under the License is distributed on an "AS IS" BASIS, | 10 // distributed under the License is distributed on an "AS IS" BASIS, |
11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
12 // See the License for the specific language governing permissions and | 12 // See the License for the specific language governing permissions and |
13 // limitations under the License. | 13 // limitations under the License. |
14 | 14 |
15 #include "util/win/process_info.h" | 15 #include "util/win/process_info.h" |
16 | 16 |
17 #include <winternl.h> | 17 #include <winternl.h> |
18 | 18 |
19 #include "base/logging.h" | 19 #include "base/logging.h" |
20 #include "base/strings/stringprintf.h" | |
20 #include "util/numeric/safe_assignment.h" | 21 #include "util/numeric/safe_assignment.h" |
22 #include "util/win/ntstatus_logging.h" | |
21 #include "util/win/process_structs.h" | 23 #include "util/win/process_structs.h" |
22 | 24 |
23 namespace crashpad { | 25 namespace crashpad { |
24 | 26 |
25 namespace { | 27 namespace { |
26 | 28 |
27 NTSTATUS NtQueryInformationProcess(HANDLE process_handle, | 29 NTSTATUS NtQueryInformationProcess(HANDLE process_handle, |
28 PROCESSINFOCLASS process_information_class, | 30 PROCESSINFOCLASS process_information_class, |
29 PVOID process_information, | 31 PVOID process_information, |
30 ULONG process_information_length, | 32 ULONG process_information_length, |
(...skipping 42 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
73 PLOG(ERROR) << "ReadProcessMemory UNICODE_STRING"; | 75 PLOG(ERROR) << "ReadProcessMemory UNICODE_STRING"; |
74 return false; | 76 return false; |
75 } | 77 } |
76 if (bytes_read != us.Length) { | 78 if (bytes_read != us.Length) { |
77 LOG(ERROR) << "ReadProcessMemory UNICODE_STRING incorrect size"; | 79 LOG(ERROR) << "ReadProcessMemory UNICODE_STRING incorrect size"; |
78 return false; | 80 return false; |
79 } | 81 } |
80 return true; | 82 return true; |
81 } | 83 } |
82 | 84 |
83 template <class T> bool ReadStruct(HANDLE process, WinVMAddress at, T* into) { | 85 template <class T> |
86 bool ReadStruct(HANDLE process, WinVMAddress at, T* into) { | |
84 SIZE_T bytes_read; | 87 SIZE_T bytes_read; |
85 if (!ReadProcessMemory(process, | 88 if (!ReadProcessMemory(process, |
86 reinterpret_cast<const void*>(at), | 89 reinterpret_cast<const void*>(at), |
87 into, | 90 into, |
88 sizeof(T), | 91 sizeof(T), |
89 &bytes_read)) { | 92 &bytes_read)) { |
90 // We don't have a name for the type we're reading, so include the signature | 93 // We don't have a name for the type we're reading, so include the signature |
91 // to get the type of T. | 94 // to get the type of T. |
92 PLOG(ERROR) << "ReadProcessMemory " << __FUNCSIG__; | 95 PLOG(ERROR) << "ReadProcessMemory " << __FUNCSIG__; |
93 return false; | 96 return false; |
94 } | 97 } |
95 if (bytes_read != sizeof(T)) { | 98 if (bytes_read != sizeof(T)) { |
96 LOG(ERROR) << "ReadProcessMemory " << __FUNCSIG__ << " incorrect size"; | 99 LOG(ERROR) << "ReadProcessMemory " << __FUNCSIG__ << " incorrect size"; |
97 return false; | 100 return false; |
98 } | 101 } |
99 return true; | 102 return true; |
100 } | 103 } |
101 | 104 |
102 } // namespace | 105 } // namespace |
103 | 106 |
104 template <class Traits> | 107 template <class Traits> |
108 bool GetProcessBasicInformation(HANDLE process, | |
109 bool is_wow64, | |
110 ProcessInfo* process_info, | |
111 WinVMAddress* peb_address) { | |
112 ULONG bytes_returned; | |
113 process_types::PROCESS_BASIC_INFORMATION<Traits> process_basic_information; | |
114 NTSTATUS status = | |
115 crashpad::NtQueryInformationProcess(process, | |
116 ProcessBasicInformation, | |
117 &process_basic_information, | |
118 sizeof(process_basic_information), | |
119 &bytes_returned); | |
120 if (!NT_SUCCESS(status)) { | |
121 NTSTATUS_LOG(ERROR, status) << "NtQueryInformationProcess"; | |
122 return false; | |
123 } | |
124 if (bytes_returned != sizeof(process_basic_information)) { | |
125 LOG(ERROR) << "NtQueryInformationProcess incorrect size"; | |
126 return false; | |
127 } | |
128 | |
129 // See https://msdn.microsoft.com/en-us/library/windows/desktop/aa384203 on | |
130 // 32 bit being the correct size for HANDLEs for proceses, even on Windows | |
131 // x64. API functions (e.g. OpenProcess) take only a DWORD, so there's no | |
132 // sense in maintaining the top bits. | |
133 process_info->process_id_ = | |
134 static_cast<DWORD>(process_basic_information.UniqueProcessId); | |
135 process_info->inherited_from_process_id_ = static_cast<DWORD>( | |
136 process_basic_information.InheritedFromUniqueProcessId); | |
137 | |
138 // We now want to read the PEB to gather the rest of our information. The | |
139 // PebBaseAddress as returned above is what we want for 64-on-64 and 32-on-32, | |
140 // but for Wow64, we want to read the 32 bit PEB (a Wow64 process has both). | |
141 // The address of this is found by a second call to NtQueryInformationProcess. | |
142 if (!is_wow64) { | |
143 *peb_address = process_basic_information.PebBaseAddress; | |
144 } else { | |
145 ULONG_PTR wow64_peb_address; | |
146 status = crashpad::NtQueryInformationProcess(process, | |
147 ProcessWow64Information, | |
148 &wow64_peb_address, | |
149 sizeof(wow64_peb_address), | |
150 &bytes_returned); | |
151 if (!NT_SUCCESS(status)) { | |
152 NTSTATUS_LOG(ERROR, status), "NtQueryInformationProcess"; | |
153 return false; | |
154 } | |
155 if (bytes_returned != sizeof(wow64_peb_address)) { | |
156 LOG(ERROR) << "NtQueryInformationProcess incorrect size"; | |
157 return false; | |
158 } | |
159 *peb_address = wow64_peb_address; | |
160 } | |
161 | |
162 return true; | |
163 } | |
164 | |
165 template <class Traits> | |
105 bool ReadProcessData(HANDLE process, | 166 bool ReadProcessData(HANDLE process, |
106 WinVMAddress peb_address_vmaddr, | 167 WinVMAddress peb_address_vmaddr, |
107 ProcessInfo* process_info) { | 168 ProcessInfo* process_info) { |
108 Traits::Pointer peb_address; | 169 Traits::Pointer peb_address; |
109 if (!AssignIfInRange(&peb_address, peb_address_vmaddr)) { | 170 if (!AssignIfInRange(&peb_address, peb_address_vmaddr)) { |
110 LOG(ERROR) << "peb_address_vmaddr " << peb_address_vmaddr | 171 LOG(ERROR) << base::StringPrintf("peb address 0x%x out of range", |
111 << " out of range"; | 172 peb_address_vmaddr); |
112 return false; | 173 return false; |
113 } | 174 } |
114 | 175 |
115 // Try to read the process environment block. | 176 // Try to read the process environment block. |
116 process_types::PEB<Traits> peb; | 177 process_types::PEB<Traits> peb; |
117 if (!ReadStruct(process, peb_address, &peb)) | 178 if (!ReadStruct(process, peb_address, &peb)) |
118 return false; | 179 return false; |
119 | 180 |
120 process_types::RTL_USER_PROCESS_PARAMETERS<Traits> process_parameters; | 181 process_types::RTL_USER_PROCESS_PARAMETERS<Traits> process_parameters; |
121 if (!ReadStruct(process, peb.ProcessParameters, &process_parameters)) | 182 if (!ReadStruct(process, peb.ProcessParameters, &process_parameters)) |
(...skipping 103 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
225 system_info.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64; | 286 system_info.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64; |
226 } | 287 } |
227 | 288 |
228 #if ARCH_CPU_32_BITS | 289 #if ARCH_CPU_32_BITS |
229 if (is_64_bit_) { | 290 if (is_64_bit_) { |
230 LOG(ERROR) << "Reading x64 process from x86 process not supported"; | 291 LOG(ERROR) << "Reading x64 process from x86 process not supported"; |
231 return false; | 292 return false; |
232 } | 293 } |
233 #endif | 294 #endif |
234 | 295 |
235 ULONG bytes_returned; | 296 WinVMAddress peb_address; |
236 // We assume this process is not running on Wow64. The | 297 #if ARCH_CPU_64_BITS |
Mark Mentovai
2015/09/16 18:56:58
Much better. #include "build/build_config.h".
scottmg
2015/09/16 19:38:21
Done.
| |
237 // PROCESS_BASIC_INFORMATION uses the OS size (that is, even Wow64 has a 64 | 298 bool result = GetProcessBasicInformation<process_types::internal::Traits64>( |
238 // bit one.) | 299 process, is_wow64_, this, &peb_address); |
239 // TODO(scottmg): Either support running as Wow64, or check/resolve this at a | |
240 // higher level. | |
241 #if ARCH_CPU_32_BITS | |
242 process_types::PROCESS_BASIC_INFORMATION<process_types::internal::Traits32> | |
243 process_basic_information; | |
244 #else | 300 #else |
245 process_types::PROCESS_BASIC_INFORMATION<process_types::internal::Traits64> | 301 bool result = GetProcessBasicInformation<process_types::internal::Traits32>( |
246 process_basic_information; | 302 process, false, this, &peb_address); |
247 #endif | 303 #endif // ARCH_CPU_64_BITS |
248 NTSTATUS status = | 304 |
249 crashpad::NtQueryInformationProcess(process, | 305 if (!result) { |
250 ProcessBasicInformation, | 306 LOG(ERROR) << "GetProcessBasicInformation failed"; |
251 &process_basic_information, | |
252 sizeof(process_basic_information), | |
253 &bytes_returned); | |
254 if (status < 0) { | |
255 LOG(ERROR) << "NtQueryInformationProcess: status=" << status; | |
256 return false; | |
257 } | |
258 if (bytes_returned != sizeof(process_basic_information)) { | |
259 LOG(ERROR) << "NtQueryInformationProcess incorrect size"; | |
260 return false; | 307 return false; |
261 } | 308 } |
262 | 309 |
263 // See https://msdn.microsoft.com/en-us/library/windows/desktop/aa384203 on | 310 result = is_64_bit_ ? ReadProcessData<process_types::internal::Traits64>( |
264 // 32 bit being the correct size for HANDLEs for proceses, even on Windows | |
265 // x64. API functions (e.g. OpenProcess) take only a DWORD, so there's no | |
266 // sense in maintaining the top bits. | |
267 process_id_ = static_cast<DWORD>(process_basic_information.UniqueProcessId); | |
268 inherited_from_process_id_ = static_cast<DWORD>( | |
269 process_basic_information.InheritedFromUniqueProcessId); | |
270 | |
271 // We now want to read the PEB to gather the rest of our information. The | |
272 // PebBaseAddress as returned above is what we want for 64-on-64 and 32-on-32, | |
273 // but for Wow64, we want to read the 32 bit PEB (a Wow64 process has both). | |
274 // The address of this is found by a second call to NtQueryInformationProcess. | |
275 WinVMAddress peb_address = process_basic_information.PebBaseAddress; | |
276 if (is_wow64_) { | |
277 ULONG_PTR wow64_peb_address; | |
278 status = | |
279 crashpad::NtQueryInformationProcess(process, | |
280 ProcessWow64Information, | |
281 &wow64_peb_address, | |
282 sizeof(wow64_peb_address), | |
283 &bytes_returned); | |
284 if (status < 0) { | |
285 LOG(ERROR) << "NtQueryInformationProcess: status=" << status; | |
286 return false; | |
287 } | |
288 if (bytes_returned != sizeof(wow64_peb_address)) { | |
289 LOG(ERROR) << "NtQueryInformationProcess incorrect size"; | |
290 return false; | |
291 } | |
292 peb_address = wow64_peb_address; | |
293 } | |
294 | |
295 // Read the PEB data using the correct word size. | |
296 bool result = is_64_bit_ ? ReadProcessData<process_types::internal::Traits64>( | |
297 process, peb_address, this) | 311 process, peb_address, this) |
298 : ReadProcessData<process_types::internal::Traits32>( | 312 : ReadProcessData<process_types::internal::Traits32>( |
299 process, peb_address, this); | 313 process, peb_address, this); |
300 if (!result) | 314 if (!result) { |
315 LOG(ERROR) << "ReadProcessData failed"; | |
301 return false; | 316 return false; |
317 } | |
302 | 318 |
303 INITIALIZATION_STATE_SET_VALID(initialized_); | 319 INITIALIZATION_STATE_SET_VALID(initialized_); |
304 return true; | 320 return true; |
305 } | 321 } |
306 | 322 |
307 bool ProcessInfo::Is64Bit() const { | 323 bool ProcessInfo::Is64Bit() const { |
308 INITIALIZATION_STATE_DCHECK_VALID(initialized_); | 324 INITIALIZATION_STATE_DCHECK_VALID(initialized_); |
309 return is_64_bit_; | 325 return is_64_bit_; |
310 } | 326 } |
311 | 327 |
(...skipping 18 matching lines...) Expand all Loading... | |
330 return true; | 346 return true; |
331 } | 347 } |
332 | 348 |
333 bool ProcessInfo::Modules(std::vector<Module>* modules) const { | 349 bool ProcessInfo::Modules(std::vector<Module>* modules) const { |
334 INITIALIZATION_STATE_DCHECK_VALID(initialized_); | 350 INITIALIZATION_STATE_DCHECK_VALID(initialized_); |
335 *modules = modules_; | 351 *modules = modules_; |
336 return true; | 352 return true; |
337 } | 353 } |
338 | 354 |
339 } // namespace crashpad | 355 } // namespace crashpad |
OLD | NEW |