win: Support reading process info cross-bitness

util/win/process_structs.h

+// Copyright 2015 The Crashpad Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_
+#define CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_
+
+#include <windows.h>
+
+namespace crashpad {

[Mark Mentovai, 2015/03/09 16:11:46]

Although we rarely have subnamespaces inside “crashpad” (aside from “test” and
“internal”), I think one is called for here, in the same way that the Mac
equivalent uses crashpad::process_types. Can we use crashpad::process_structs
here? That would let us get rid of the _T on each structure, and it makes it
more obvious at use sites that we’re working with our custom type. (The _T tends
to get lots when you’re reading, especially because the Windows structs are all
full of underscores and capital letters to begin with.)

[scottmg, 2015/03/09 21:16:37]

Done.

+
+//! \brief Selected structures from winternl.h, ntddk.h, and `dt ntdll!xxx`,

[Mark Mentovai, 2015/03/09 16:11:46]

You should have a //! \{ before this, and a //! \} at the end of the file, so
that this comment is used as the documentation for everything in the contained
group. Otherwise, it’ll wind up being applied only to the first thing that
follows it.

[scottmg, 2015/03/09 21:16:36]

Done.

+//!     customized to have both x86 and x64 sizes available.
+//!
+//! The structure and field names follow the Windows names for clarity. We do,
+//! however, use plain integral types rather than pointer types (DWORD/DWORD64,
+//! rather than e.g. PVOID). This is both easier to define, and avoids
+//! accidentally treating them as pointers into the current address space.
+//!
+//! In all cases, the `T` in the templates below must be either DWORD for

[Mark Mentovai, 2015/03/09 16:11:46]

I think I’d like traits a little better, so that the definitions could use
something like T::Pointer, T::UIntPtr, etc. That helps things be a little more
documentary. It’s important in the code that uses this too, where “T peb_address
= …” isn’t as obvious as “Traits::Pointer peb_address = …”.

[scottmg, 2015/03/09 21:16:37]

The user code does get better, but this gets pretty ugly. Better that way I
suppose. Done.

+//! targeting x86 or DWORD64 for targeting x64.
+
+#pragma pack(push, 1)

[Mark Mentovai, 2015/03/09 16:11:46]

Is this true for the native structs too? Or are you accounting for padding
manually in a way that the native structs didn’t have to because they just rely
on native packing? It seems like the latter based on your use of unions and
padding fields—in that case, add a comment (//, not //!) saying that padding is
up to you in here.

[scottmg, 2015/03/09 21:16:37]

Right, I set it to 1 so that it would explicitly match what the OS calls expect.
It could have been left up to natural packing and padding, but this seemed a bit
safer/clearer when matching the `dt` dumps. Added a comment.

+
+template <class T> struct PROCESS_BASIC_INFORMATION_T {
+  union {
+    DWORD ExitStatus;
+    T padding_for_x64_0;
+  };
+  T PebBaseAddress;
+  T AffinityMask;
+  union {
+    DWORD BasePriority;
+    T padding_for_x64_1;
+  };
+  T UniqueProcessId;
+  T InheritedFromUniqueProcessId;
+};
+
+template <class T> struct LIST_ENTRY_T {
+  T Flink;
+  T Blink;
+};
+
+template <class T> struct UNICODE_STRING_T {
+  union {
+    struct {
+      USHORT Length;
+      USHORT MaximumLength;
+    };
+    T padding_for_x64;
+  };
+  T Buffer;
+};
+
+template <class T> struct PEB_LDR_DATA_T {
+  ULONG Length;
+  DWORD Initialized;
+  T SsHandle;
+  LIST_ENTRY_T<T> InLoadOrderModuleList;
+  LIST_ENTRY_T<T> InMemoryOrderModuleList;
+  LIST_ENTRY_T<T> InInitializationOrderModuleList;
+};
+
+template <class T> struct LDR_DATA_TABLE_ENTRY_T {
+  LIST_ENTRY_T<T> InLoadOrderLinks;
+  LIST_ENTRY_T<T> InMemoryOrderLinks;
+  LIST_ENTRY_T<T> InInitializationOrderLinks;
+  T DllBase;
+  T EntryPoint;
+  union {
+    ULONG SizeOfImage;
+    T padding_for_x86;
+  };
+  UNICODE_STRING_T<T> FullDllName;
+  UNICODE_STRING_T<T> BaseDllName;
+  ULONG Flags;
+  USHORT ObsoleteLoadCount;
+  USHORT TlsIndex;
+  LIST_ENTRY_T<T> HashLinks;
+  ULONG TimeDateStamp;
+};
+
+template <class T> struct CURDIR_T {
+  UNICODE_STRING_T<T> DosPath;
+  T Handle;
+};
+
+template <class T> struct STRING_T {
+  union {
+    struct {
+      DWORD Length;
+      DWORD MaximumLength;
+    };
+    T padding_for_x64;
+  };
+  T Buffer;
+};
+
+template <class T> struct RTL_DRIVE_LETTER_CURDIR_T {
+  WORD Flags;
+  WORD Length;
+  DWORD TimeStamp;
+  STRING_T<T> DosPath;
+};
+
+template <class T> struct RTL_USER_PROCESS_PARAMETERS_T {
+  DWORD MaximumLength;
+  DWORD Length;
+  DWORD Flags;
+  DWORD DebugFlags;
+  T ConsoleHandle;
+  union {
+    DWORD ConsoleFlags;
+    T padding_for_x86;
+  };
+  T StandardInput;
+  T StandardOutput;
+  T StandardError;
+  CURDIR_T<T> CurrentDirectory;
+  UNICODE_STRING_T<T> DllPath;
+  UNICODE_STRING_T<T> ImagePathName;
+  UNICODE_STRING_T<T> CommandLine;
+  T Environment;
+  DWORD StartingX;
+  DWORD StartingY;
+  DWORD CountX;
+  DWORD CountY;
+  DWORD CountCharsX;
+  DWORD CountCharsY;
+  DWORD FillAttribute;
+  DWORD WindowFlags;
+  DWORD ShowWindowFlags;
+  UNICODE_STRING_T<T> WindowTitle;
+  UNICODE_STRING_T<T> DesktopInfo;
+  UNICODE_STRING_T<T> ShellInfo;
+  UNICODE_STRING_T<T> RuntimeData;
+  RTL_DRIVE_LETTER_CURDIR_T<T> CurrentDirectores[32];  // sic.

[Mark Mentovai, 2015/03/09 16:11:46]

Ha!

+};
+
+template <class T> struct GdiHandleBufferCountForBitness;
+template <> struct GdiHandleBufferCountForBitness<DWORD> {
+  enum { value = 34 };
+};
+template <> struct GdiHandleBufferCountForBitness<DWORD64> {
+  enum { value = 60 };
+};
+
+template <class T> struct PEB_T {
+  union {
+    struct {
+      BYTE InheritedAddressSpace;
+      BYTE ReadImageFileExecOptions;
+      BYTE BeingDebugged;
+      BYTE BitField;
+    };
+    T padding_for_x64_0;
+  };
+  T Mutant;
+  T ImageBaseAddress;
+  T Ldr;
+  T ProcessParameters;
+  T SubSystemData;
+  T ProcessHeap;
+  T FastPebLock;
+  T AtlThunkSListPtr;
+  T IFEOKey;
+  T CrossProcessFlags;
+  T KernelCallbackTable;
+  DWORD SystemReserved;
+  DWORD AtlThunkSListPtr32;
+  T ApiSetMap;
+  union {
+    DWORD TlsExpansionCounter;
+    T padding_for_x64_1;
+  };
+  T TlsBitmap;
+  DWORD TlsBitmapBits[2];
+  T ReadOnlySharedMemoryBase;
+  T SparePvoid0;
+  T ReadOnlyStaticServerData;
+  T AnsiCodePageData;
+  T OemCodePageData;
+  T UnicodeCaseTableData;
+  DWORD NumberOfProcessors;
+  DWORD NtGlobalFlag;
+  LARGE_INTEGER CriticalSectionTimeout;
+  T HeapSegmentReserve;
+  T HeapSegmentCommit;
+  T HeapDeCommitTotalFreeThreshold;
+  T HeapDeCommitFreeBlockThreadhold;
+  DWORD NumberOfHeaps;
+  DWORD MaximumNumberOfHeaps;
+  T ProcessHeaps;
+  T GdiSharedHandleTable;
+  T ProcessStarterHelper;
+  DWORD GdiDCAttributeList;
+  T LoaderLock;
+  DWORD OSMajorVersion;
+  DWORD OSMinorVersion;
+  WORD OSBuildNumber;
+  WORD OSCSDVersion;
+  DWORD OSPlatformId;
+  DWORD ImageSubsystem;
+  DWORD ImageSubsystemMajorVersion;
+  union {
+    DWORD ImageSubsystemMinorVersion;
+    T padding_for_x64_2;
+  };
+  T ActiveProcessAffinityMask;
+  DWORD GdiHandleBuffer[GdiHandleBufferCountForBitness<T>::value];
+  T PostProcessInitRoutine;
+  T TlsExpansionBitmap;
+  DWORD TlsExpansionBitmapBits[32];
+  union {
+    DWORD SessionId;
+    T padding_for_x64_3;
+  };
+  ULARGE_INTEGER AppCompatFlags;
+  ULARGE_INTEGER AppCompatFlagsUser;
+  T pShimData;
+  T AppCompatInfo;
+  UNICODE_STRING_T<T> CSDVersion;
+  T ActivationContextData;
+  T ProcessAssemblyStorageMap;
+  T SystemDefaultActivationContextData;
+  T SystemAssemblyStorageMap;
+  T MinimumStackCommit;
+  T FlsCallback;
+  LIST_ENTRY_T<T> FlsListHead;
+  T FlsBitmap;
+  DWORD FlsBitmapBits[4];
+  DWORD FlsHighIndex;
+};
+
+#pragma pack(pop)
+
+}  // namespace crashpad
+
+#endif  // CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_