OLD | NEW |
| (Empty) |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | |
2 // Use of this source code is governed by a BSD-style license that can be | |
3 // found in the LICENSE file. | |
4 | |
5 #include "base/test/test_process_killer_win.h" | |
6 | |
7 #include <windows.h> | |
8 #include <winternl.h> | |
9 | |
10 #include <algorithm> | |
11 | |
12 #include "base/logging.h" | |
13 #include "base/process/kill.h" | |
14 #include "base/process/process_iterator.h" | |
15 #include "base/strings/string_util.h" | |
16 #include "base/win/scoped_handle.h" | |
17 | |
18 namespace { | |
19 | |
20 typedef LONG WINAPI | |
21 NtQueryInformationProcess( | |
22 IN HANDLE ProcessHandle, | |
23 IN PROCESSINFOCLASS ProcessInformationClass, | |
24 OUT PVOID ProcessInformation, | |
25 IN ULONG ProcessInformationLength, | |
26 OUT PULONG ReturnLength OPTIONAL | |
27 ); | |
28 | |
29 // Get the function pointer to NtQueryInformationProcess in NTDLL.DLL | |
30 static bool GetQIP(NtQueryInformationProcess** qip_func_ptr) { | |
31 static NtQueryInformationProcess* qip_func = | |
32 reinterpret_cast<NtQueryInformationProcess*>( | |
33 GetProcAddress(GetModuleHandle(L"ntdll.dll"), | |
34 "NtQueryInformationProcess")); | |
35 DCHECK(qip_func) << "Could not get pointer to NtQueryInformationProcess."; | |
36 *qip_func_ptr = qip_func; | |
37 return qip_func != NULL; | |
38 } | |
39 | |
40 // Get the command line of a process | |
41 bool GetCommandLineForProcess(uint32 process_id, base::string16* cmd_line) { | |
42 DCHECK(process_id != 0); | |
43 DCHECK(cmd_line); | |
44 | |
45 // Open the process | |
46 base::win::ScopedHandle process_handle(::OpenProcess( | |
47 PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, | |
48 false, | |
49 process_id)); | |
50 if (!process_handle) { | |
51 DLOG(ERROR) << "Failed to open process " << process_id << ", last error = " | |
52 << GetLastError(); | |
53 } | |
54 | |
55 // Obtain Process Environment Block | |
56 NtQueryInformationProcess* qip_func = NULL; | |
57 if (process_handle) { | |
58 GetQIP(&qip_func); | |
59 } | |
60 | |
61 // Read the address of the process params from the peb. | |
62 DWORD process_params_address = 0; | |
63 if (qip_func) { | |
64 PROCESS_BASIC_INFORMATION info = { 0 }; | |
65 // NtQueryInformationProcess returns an NTSTATUS for whom negative values | |
66 // are negative. Just check for that instead of pulling in DDK macros. | |
67 if ((qip_func(process_handle.Get(), | |
68 ProcessBasicInformation, | |
69 &info, | |
70 sizeof(info), | |
71 NULL)) < 0) { | |
72 DLOG(ERROR) << "Failed to invoke NtQueryProcessInformation, last error = " | |
73 << GetLastError(); | |
74 } else { | |
75 BYTE* peb = reinterpret_cast<BYTE*>(info.PebBaseAddress); | |
76 | |
77 // The process command line parameters are (or were once) located at | |
78 // the base address of the PEB + 0x10 for 32 bit processes. 64 bit | |
79 // processes have a different PEB struct as per | |
80 // http://msdn.microsoft.com/en-us/library/aa813706(VS.85).aspx. | |
81 // TODO(robertshield): See about doing something about this. | |
82 SIZE_T bytes_read = 0; | |
83 if (!::ReadProcessMemory(process_handle.Get(), | |
84 peb + 0x10, | |
85 &process_params_address, | |
86 sizeof(process_params_address), | |
87 &bytes_read)) { | |
88 DLOG(ERROR) << "Failed to read process params address, last error = " | |
89 << GetLastError(); | |
90 } | |
91 } | |
92 } | |
93 | |
94 // Copy all the process parameters into a buffer. | |
95 bool success = false; | |
96 base::string16 buffer; | |
97 if (process_params_address) { | |
98 SIZE_T bytes_read; | |
99 RTL_USER_PROCESS_PARAMETERS params = { 0 }; | |
100 if (!::ReadProcessMemory(process_handle.Get(), | |
101 reinterpret_cast<void*>(process_params_address), | |
102 ¶ms, | |
103 sizeof(params), | |
104 &bytes_read)) { | |
105 DLOG(ERROR) << "Failed to read RTL_USER_PROCESS_PARAMETERS, " | |
106 << "last error = " << GetLastError(); | |
107 } else { | |
108 // Read the command line parameter | |
109 const int max_cmd_line_len = std::min( | |
110 static_cast<int>(params.CommandLine.MaximumLength), | |
111 4096); | |
112 buffer.resize(max_cmd_line_len + 1); | |
113 if (!::ReadProcessMemory(process_handle.Get(), | |
114 params.CommandLine.Buffer, | |
115 &buffer[0], | |
116 max_cmd_line_len, | |
117 &bytes_read)) { | |
118 DLOG(ERROR) << "Failed to copy process command line, " | |
119 << "last error = " << GetLastError(); | |
120 } else { | |
121 *cmd_line = buffer; | |
122 success = true; | |
123 } | |
124 } | |
125 } | |
126 | |
127 return success; | |
128 } | |
129 | |
130 // Used to filter processes by process ID. | |
131 class ArgumentFilter : public base::ProcessFilter { | |
132 public: | |
133 explicit ArgumentFilter(const base::string16& argument) | |
134 : argument_to_find_(argument) {} | |
135 | |
136 // Returns true to indicate set-inclusion and false otherwise. This method | |
137 // should not have side-effects and should be idempotent. | |
138 virtual bool Includes(const base::ProcessEntry& entry) const { | |
139 bool found = false; | |
140 base::string16 command_line; | |
141 if (GetCommandLineForProcess(entry.pid(), &command_line)) { | |
142 base::string16::const_iterator it = | |
143 std::search(command_line.begin(), | |
144 command_line.end(), | |
145 argument_to_find_.begin(), | |
146 argument_to_find_.end(), | |
147 base::CaseInsensitiveCompareASCII<wchar_t>()); | |
148 found = (it != command_line.end()); | |
149 } | |
150 return found; | |
151 } | |
152 | |
153 protected: | |
154 base::string16 argument_to_find_; | |
155 }; | |
156 | |
157 } // namespace | |
158 | |
159 namespace base { | |
160 | |
161 bool KillAllNamedProcessesWithArgument(const string16& process_name, | |
162 const string16& argument) { | |
163 ArgumentFilter argument_filter(argument); | |
164 return base::KillProcesses(process_name, 0, &argument_filter); | |
165 } | |
166 | |
167 } // namespace base | |
OLD | NEW |