win: Add implementation of ProcessInfo

util/win/process_info.cc

+// Copyright 2015 The Crashpad Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "util/win/process_info.h"
+
+#include "base/logging.h"
+
+namespace crashpad {
+
+namespace {
+
+NTSTATUS NtQueryInformationProcess(HANDLE process_handle,
+                                   PROCESSINFOCLASS process_information_class,
+                                   PVOID process_information,
+                                   ULONG process_information_length,
+                                   PULONG return_length) {
+  static decltype(::NtQueryInformationProcess)* nt_query_information_process =
+      reinterpret_cast<decltype(::NtQueryInformationProcess)*>(GetProcAddress(
+          LoadLibrary(L"ntdll.dll"), "NtQueryInformationProcess"));
+  DCHECK(nt_query_information_process);
+  return nt_query_information_process(process_handle,
+                                      process_information_class,
+                                      process_information,
+                                      process_information_length,
+                                      return_length);
+}
+
+bool IsProcessWow64(HANDLE process_handle) {
+  static decltype(IsWow64Process)* is_wow64_process =
+      reinterpret_cast<decltype(IsWow64Process)*>(
+          GetProcAddress(LoadLibrary(L"kernel32.dll"), "IsWow64Process"));
+  if (!is_wow64_process)
+    return false;
+  BOOL is_wow64;
+  if (!is_wow64_process(process_handle, &is_wow64)) {
+    PLOG(ERROR) << "IsWow64Process";
+    return false;
+  }
+  return is_wow64;
+}
+
+bool ReadUnicodeString(HANDLE process,
+                       const UNICODE_STRING& us,
+                       std::wstring* result) {
+  if (us.Length == 0) {
+    result->clear();
+    return true;
+  }
+  DCHECK_EQ(us.Length % sizeof(wchar_t), 0u);
+  result->resize(us.Length / sizeof(wchar_t));
+  SIZE_T bytes_read;
+  if (!ReadProcessMemory(
+          process, us.Buffer, &result->operator[](0), us.Length, &bytes_read)) {
+    PLOG(ERROR) << "ReadProcessMemory UNICODE_STRING";
+    return false;
+  }
+  if (bytes_read != us.Length) {
+    LOG(ERROR) << "ReadProcessMemory UNICODE_STRING incorrect size";
+    return false;
+  }
+  return true;
+}
+
+template <class T> bool ReadStruct(HANDLE process, uintptr_t at, T* into) {
+  SIZE_T bytes_read;
+  if (!ReadProcessMemory(process,
+                         reinterpret_cast<const void*>(at),
+                         into,
+                         sizeof(T),
+                         &bytes_read)) {
+    // We don't have a name for the type we're reading, so include the signature
+    // to get the type of T.
+    PLOG(ERROR) << "ReadProcessMemory " << __FUNCSIG__;
+    return false;
+  }
+  if (bytes_read != sizeof(T)) {
+    LOG(ERROR) << "ReadProcessMemory " << __FUNCSIG__ << " incorrect size";
+    return false;
+  }
+  return true;
+}
+
+// PEB_LDR_DATA in winternl.h doesn't document the trailing
+// InInitializationOrderModuleList field. See `dt ntdll!PEB_LDR_DATA`.
+struct FULL_PEB_LDR_DATA : public PEB_LDR_DATA {
+  LIST_ENTRY InInitializationOrderModuleList;
+};
+
+// LDR_DATA_TABLE_ENTRY doesn't include InInitializationOrderLinks, define a
+// complete version here. See `dt ntdll!_LDR_DATA_TABLE_ENTRY`.
+struct FULL_LDR_DATA_TABLE_ENTRY {
+  LIST_ENTRY InLoadOrderLinks;
+  LIST_ENTRY InMemoryOrderLinks;
+  LIST_ENTRY InInitializationOrderLinks;
+  PVOID DllBase;
+  PVOID EntryPoint;
+  ULONG SizeOfImage;
+  UNICODE_STRING FullDllName;
+  UNICODE_STRING BaseDllName;
+  ULONG Flags;
+  WORD LoadCount;
+  WORD TlsIndex;
+  LIST_ENTRY HashLinks;
+  ULONG TimeDateStamp;
+  _ACTIVATION_CONTEXT* EntryPointActivationContext;
+};
+
+}  // namespace
+
+ProcessInfo::ProcessInfo()
+    : process_basic_information_(),
+      command_line_(),
+      modules_(),
+      is_64_bit_(false),
+      is_wow64_(false),
+      initialized_() {
+}
+
+ProcessInfo::~ProcessInfo() {
+}
+
+bool ProcessInfo::Initialize(HANDLE process) {
+  INITIALIZATION_STATE_SET_INITIALIZING(initialized_);
+
+  is_wow64_ = IsProcessWow64(process);
+
+  if (is_wow64_) {
+    // If it's WoW64, then it's 32-on-64.
+    is_64_bit_ = false;
+  } else {
+    // Otherwise, it's either 32 on 32, or 64 on 64. Use GetSystemInfo() to
+    // distinguish between these two cases.
+    SYSTEM_INFO system_info;
+    GetSystemInfo(&system_info);
+    is_64_bit_ =
+        system_info.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64;
+  }
+
+#if ARCH_CPU_64_BITS
+  if (!is_64_bit_) {
+    LOG(ERROR) << "Reading different bitness not yet supported";
+    return false;
+  }
+#else
+  if (is_64_bit_) {
+    LOG(ERROR) << "Reading x64 process from x86 process not supported";
+    return false;
+  }
+#endif
+
+  ULONG bytes_returned;
+  NTSTATUS status =
+      crashpad::NtQueryInformationProcess(process,
+                                          ProcessBasicInformation,
+                                          &process_basic_information_,
+                                          sizeof(process_basic_information_),
+                                          &bytes_returned);
+  if (status < 0) {
+    LOG(ERROR) << "NtQueryInformationProcess: status=" << status;
+    return false;
+  }
+  if (bytes_returned != sizeof(process_basic_information_)) {
+    LOG(ERROR) << "NtQueryInformationProcess incorrect size";
+    return false;
+  }
+
+  // Try to read the process environment block.
+  PEB peb;
+  if (!ReadStruct(process,
+                  reinterpret_cast<uintptr_t>(
+                      process_basic_information_.PebBaseAddress),
+                  &peb)) {
+    return false;
+  }
+
+  RTL_USER_PROCESS_PARAMETERS process_parameters;
+  if (!ReadStruct(process,
+                  reinterpret_cast<uintptr_t>(peb.ProcessParameters),
+                  &process_parameters)) {
+    return false;
+  }
+
+  if (!ReadUnicodeString(
+          process, process_parameters.CommandLine, &command_line_)) {
+    return false;
+  }
+
+  FULL_PEB_LDR_DATA peb_ldr_data;
+  if (!ReadStruct(process, reinterpret_cast<uintptr_t>(peb.Ldr), &peb_ldr_data))
+    return false;
+
+  // Include the first module in the memory order list to get our own name as

[Mark Mentovai, 2015/03/06 03:40:23]

Is this true even if you build an executable with a weird (high) preferred load
address?

[scottmg, 2015/03/06 06:04:07]

Good question! Experimentally, yes, on Win81 at least. It appears to be the
order they were put in memory (i.e. load order) which matches what I observed
before. I haven't found any documentation that describes the difference between
the two other than by basically restating the field names.

I modified the test to load the child executable at a high, fixed image base
(0x7800'0000), and looking at the order in windbg I get:

...
    Ldr.InMemoryOrderModuleList:         00223d20 . 00224258
            Base TimeStamp                     Module
        78000000 54f9408f Mar 05 21:52:15 2015
D:\src\crashpad\crashpad\out\Debug\util_test_process_info_test_child.exe
        77c80000 54b0d74f Jan 09 23:39:59 2015 C:\Windows\SYSTEM32\ntdll.dll
        77010000 532a2e6c Mar 19 16:55:24 2014 C:\Windows\SYSTEM32\KERNEL32.DLL
        777d0000 53eeb460 Aug 15 18:31:12 2014
C:\Windows\SYSTEM32\KERNELBASE.dll
        74090000 53088706 Feb 22 03:16:22 2014 C:\Windows\system32\apphelp.dll
...

That is, it's at the specified high address, and other DLLs appear at lower
addresses, but it's still first in the list. I've included the linker settings
to do that in the patch, so we will at least see a test fail if this assumption
turns out to be false.

+  // it's not included in initialization order below.
+  std::wstring self_module;
+  FULL_LDR_DATA_TABLE_ENTRY self_ldr_data_table_entry;
+  if (!ReadStruct(process,
+                  reinterpret_cast<uintptr_t>(
+                      reinterpret_cast<const char*>(
+                          peb_ldr_data.InMemoryOrderModuleList.Flink) -
+                      offsetof(FULL_LDR_DATA_TABLE_ENTRY, InMemoryOrderLinks)),
+                  &self_ldr_data_table_entry)) {
+    return false;
+  }
+  if (!ReadUnicodeString(
+          process, self_ldr_data_table_entry.FullDllName, &self_module)) {
+    return false;
+  }
+  modules_.push_back(self_module);
+
+  // Walk the PEB LDR structure (doubly-linked list) to get the list of loaded
+  // modules. We use this method rather than EnumProcessModules to get the
+  // modules in initialization order rather than memory order.
+  const LIST_ENTRY* last = peb_ldr_data.InInitializationOrderModuleList.Blink;
+  FULL_LDR_DATA_TABLE_ENTRY ldr_data_table_entry;
+  for (const LIST_ENTRY* cur =
+           peb_ldr_data.InInitializationOrderModuleList.Flink;
+       ;
+       cur = ldr_data_table_entry.InInitializationOrderLinks.Flink) {
+    // |cur| is the pointer to the LIST_ENTRY embedded in the
+    // FULL_LDR_DATA_TABLE_ENTRY, in the target process's address space. So we
+    // need to read from the target, and also offset back to the beginning of
+    // the structure.
+    if (!ReadStruct(
+            process,
+            reinterpret_cast<uintptr_t>(reinterpret_cast<const char*>(cur) -
+                                        offsetof(FULL_LDR_DATA_TABLE_ENTRY,
+                                                 InInitializationOrderLinks)),
+            &ldr_data_table_entry)) {
+      break;
+    }
+    // TODO(scottmg): Capture TimeDateStamp, Checksum, etc. too?
+    std::wstring module;
+    if (!ReadUnicodeString(process, ldr_data_table_entry.FullDllName, &module))
+      break;
+    modules_.push_back(module);
+    if (cur == last)
+      break;
+  }
+
+  INITIALIZATION_STATE_SET_VALID(initialized_);
+  return true;
+}
+
+bool ProcessInfo::Is64Bit() const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  return is_64_bit_;
+}
+
+bool ProcessInfo::IsWow64() const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  return is_wow64_;
+}
+
+pid_t ProcessInfo::ProcessID() const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  return process_basic_information_.UniqueProcessId;
+}
+
+pid_t ProcessInfo::ParentProcessID() const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  return process_basic_information_.InheritedFromUniqueProcessId;
+}
+
+bool ProcessInfo::CommandLine(std::wstring* command_line) const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  *command_line = command_line_;
+  return true;
+}
+
+bool ProcessInfo::Modules(std::vector<std::wstring>* modules) const {
+  INITIALIZATION_STATE_DCHECK_VALID(initialized_);
+  *modules = modules_;
+  return true;
+}
+
+}  // namespace crashpad