1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
|
/******************************************************************
*
* kdbgwin - Helper application for DrKonqi
*
* This file is part of the KDE project
*
* Copyright (C) 2010 Ilie Halip <lupuroshu@gmail.com>
*
* This library is free software; you can redistribute it and/or
* modify it under the terms of the GNU Lesser General Public
* License as published by the Free Software Foundation; either
* version 2.1 of the License, or (at your option) version 3, or any
* later version accepted by the membership of KDE e.V. (or its
* successor approved by the membership of KDE e.V.), which shall
* act as a proxy defined in Section 6 of version 3 of the license.
*
* This library is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* Lesser General Public License for more details.
*
* You should have received a copy of the GNU Lesser General Public
* License along with this library. If not, see <http://www.gnu.org/licenses/>
*****************************************************************/
#include "common.h"
#include "process.h"
Process::Process()
: m_bValid(FALSE)
{
}
// we need debug privileges to open the proces with PROCESS_ALL_ACCESS, and
// to successfully use ReadProcessMemory()
BOOL Process::EnableDebugPrivilege()
{
kDebug() << "Enabling debug privilege";
HANDLE hToken = NULL;
if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &hToken))
{
if (GetLastError() == ERROR_NO_TOKEN)
{
if (!ImpersonateSelf(SecurityImpersonation))
{
kError() << "ImpersonateSelf() failed: " << GetLastError();
return FALSE;
}
if (!OpenThreadToken(GetCurrentThread(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, FALSE, &hToken))
{
kError() << "OpenThreadToken() #2 failed: " << GetLastError();
return FALSE;
}
}
else
{
kError() << "OpenThreadToken() #1 failed: " << GetLastError();
return FALSE;
}
}
LUID luid;
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid))
{
assert(false);
kError() << "Cannot lookup privilege: " << GetLastError();
SafeCloseHandle(hToken);
return FALSE;
}
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
tp.Privileges[0].Luid = luid;
if (!AdjustTokenPrivileges(hToken, FALSE, &tp, NULL, (PTOKEN_PRIVILEGES) NULL, (PDWORD) NULL))
{
assert(false);
kError() << "Cannot adjust privilege: " << GetLastError();
SafeCloseHandle(hToken);
return FALSE;
}
SafeCloseHandle(hToken);
return TRUE;
}
BOOL Process::GetInfo(const char* pid, const char* threadId)
{
kDebug() << "Trying to get info about pid=" << pid;
DWORD dwPid = DWORD(atoi(pid));
DWORD dwThread = DWORD(atoi(threadId));
// get handle to the process
HANDLE hProcess = NULL;
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);
assert(hProcess);
if (hProcess == NULL)
{
kError() << "Cannot open process " << dwPid << ": " << GetLastError();
return m_bValid;
}
m_dwPid = dwPid;
m_hProcess = hProcess;
m_dwThread = dwThread;
TCHAR procPath[MAX_PATH * 2 + 1] = {0};
GetModuleFileNameEx(hProcess, NULL, procPath, MAX_PATH*2 + 1);
m_path = QString::fromWCharArray(procPath);
// we can't get the threads for a single process, so get all system's
// threads, and enumerate through them
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, NULL);
if (hSnapshot == INVALID_HANDLE_VALUE)
{
kError() << "CreateToolhelp32Snapshot() failed: " << GetLastError();
assert(false);
return m_bValid;
}
// get process threads
THREADENTRY32 te;
ZeroMemory(&te, sizeof(te));
te.dwSize = sizeof(te);
if (Thread32First(hSnapshot, &te))
{
do
{
if (te.th32OwnerProcessID == dwPid)
{
kDebug() << "Found thread " << te.th32ThreadID << ", adding to list";
HANDLE hThread = NULL;
hThread = OpenThread(THREAD_ALL_ACCESS, FALSE, te.th32ThreadID);
assert(hThread);
if (hThread == NULL)
{
kError() << "Cannot open thread " << te.th32ThreadID << ": " << GetLastError();
continue;
}
m_threads[te.th32ThreadID] = hThread;
// we have at least 1 thread, make this valid
m_bValid = TRUE;
}
}
while (Thread32Next(hSnapshot, &te));
}
SafeCloseHandle(hSnapshot);
assert(m_threads.size() > 0);
// get process modules
HMODULE hMods[1024];
DWORD cbNeeded = 0;
if (!EnumProcessModules(hProcess, hMods, ArrayCount(hMods), &cbNeeded))
{
kError() << "Cannot enumerate modules: " << GetLastError();
return m_bValid;
}
for (size_t i = 0; i < (cbNeeded / sizeof(hMods[0])); i++)
{
/*
* In Windows, a wchar_t has 2 bytes; GCC defines wchar_t as int,
* which is 4 bytes; so i can't use TCHAR here; better off using ushort
* and casting when necessary
*/
ushort szModName[MAX_PATH];
if (GetModuleFileNameEx(hProcess, hMods[i], (LPTSTR) szModName, MAX_PATH))
{
//QString str = QString::fromUtf16(szModName);
//kDebug() << "Got module: " << str;
//m_modules.push_back(QString::fromUtf16(szModName));
m_modules[QString::fromUtf16(szModName)] = hMods[i];
}
}
return m_bValid;
}
|
