1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
use std::ffi::OsString;
use std::os::windows::ffi::OsStringExt;
use winapi::shared::minwindef::{DWORD, FALSE, MAX_PATH, ULONG};
use winapi::shared::ntdef::PUNICODE_STRING;
use winapi::shared::ntdef::{NTSTATUS, NULL, PVOID, USHORT, VOID};
use winapi::um::processthreadsapi::{
    GetThreadId, OpenProcess, OpenThread, ResumeThread, SuspendThread,
};
use winapi::um::winbase::QueryFullProcessImageNameW;
use winapi::um::winnt::{
    ACCESS_MASK, HANDLE, MAXIMUM_ALLOWED, PROCESS_QUERY_INFORMATION, PROCESS_SUSPEND_RESUME,
    PROCESS_VM_READ, THREAD_ALL_ACCESS, THREAD_GET_CONTEXT, THREAD_QUERY_INFORMATION, WCHAR,
};

pub use read_process_memory::{CopyAddress, Pid, ProcessHandle};

pub type Tid = Pid;

use super::Error;

#[cfg(feature = "unwind")]
mod symbolication;
#[cfg(feature = "unwind")]
mod unwinder;

#[cfg(feature = "unwind")]
pub use self::symbolication::Symbolicator;
#[cfg(feature = "unwind")]
pub use self::unwinder::Unwinder;

pub struct Process {
    pub pid: Pid,
    pub handle: ProcessHandle,
}

#[link(name = "ntdll")]
extern "system" {
    // using these undocumented api's seems to be the best way to suspend/resume a process
    // on windows (using the toolhelp32snapshot api to get threads doesn't seem practical tbh)
    // https://j00ru.vexillium.org/2009/08/suspending-processes-in-windows/
    fn RtlNtStatusToDosError(status: NTSTATUS) -> ULONG;
    fn NtSuspendProcess(process: HANDLE) -> NTSTATUS;
    fn NtResumeProcess(process: HANDLE) -> NTSTATUS;

    fn NtQueryInformationThread(
        thread: HANDLE,
        info_class: u32,
        info: PVOID,
        info_len: ULONG,
        ret_len: *mut ULONG,
    ) -> NTSTATUS;
    fn NtQueryInformationProcess(
        process: HANDLE,
        info_class: u32,
        info: PVOID,
        info_len: ULONG,
        ret_len: *mut ULONG,
    ) -> NTSTATUS;

    fn NtGetNextThread(
        process: HANDLE,
        thread: HANDLE,
        access: ACCESS_MASK,
        attributes: ULONG,
        flags: ULONG,
        new_thread: *mut HANDLE,
    ) -> NTSTATUS;
    fn NtGetNextProcess(
        process: HANDLE,
        access: ACCESS_MASK,
        attributes: ULONG,
        flags: ULONG,
        new_process: *mut HANDLE,
    ) -> NTSTATUS;

}

impl Process {
    pub fn new(pid: Pid) -> Result<Process, Error> {
        // we can't just use try_into_process_handle here because we need some additional permissions
        unsafe {
            let handle = OpenProcess(
                PROCESS_VM_READ
                    | PROCESS_SUSPEND_RESUME
                    | PROCESS_QUERY_INFORMATION
                    | THREAD_QUERY_INFORMATION
                    | THREAD_GET_CONTEXT,
                FALSE,
                pid,
            );
            if handle == (0 as std::os::windows::io::RawHandle) {
                return Err(Error::from(std::io::Error::last_os_error()));
            }
            Ok(Process {
                pid,
                handle: handle.into(),
            })
        }
    }

    pub fn handle(&self) -> ProcessHandle {
        self.handle.clone()
    }

    pub fn exe(&self) -> Result<String, Error> {
        unsafe {
            let mut size = MAX_PATH as DWORD;
            let mut filename: [WCHAR; MAX_PATH] = std::mem::zeroed();
            let ret = QueryFullProcessImageNameW(*self.handle, 0, filename.as_mut_ptr(), &mut size);
            if ret == 0 {
                return Err(std::io::Error::last_os_error().into());
            }
            Ok(OsString::from_wide(&filename[0..size as usize])
                .to_string_lossy()
                .into_owned())
        }
    }

    pub fn lock(&self) -> Result<Lock, Error> {
        Ok(Lock::new(self.handle.clone())?)
    }

    pub fn cwd(&self) -> Result<String, Error> {
        // TODO: get the CWD.
        // seems a little involved: http://wj32.org/wp/2009/01/24/howto-get-the-command-line-of-processes/
        // steps:
        //      1) NtQueryInformationProcess to get PebBaseAddress, which ProcessParameters
        //          is at some constant offset (+10 on 32 bit etc)
        //      2) ReadProcessMemory to get RTL_USER_PROCESS_PARAMETERS struct
        //      3) get CWD from the struct (has UNICODE_DATA object with ptr + length to CWD)
        unimplemented!("cwd is unimplemented on windows")
    }

    pub fn cmdline(&self) -> Result<Vec<String>, Error> {
        unsafe {
            // figure how much storage we need to allocate for cmdline.
            let mut size: ULONG = 0;
            NtQueryInformationProcess(
                *self.handle,
                60,
                std::ptr::null_mut(),
                0,
                &size as *const _ as *mut _,
            );
            if size == 0 {
                // the above call always fails (with an error like 'The program issued a command but the
                // command length is incorrect.'). It should set the size to how many chars we need to allocate
                // . If the size is still 0 though, default to some decently sized number
                size = 65536;
            }

            //  Get the commandline
            let storage = vec![0_u16; size as usize];
            let ret = NtQueryInformationProcess(
                *self.handle,
                60,
                (&storage as &[u16]) as *const _ as *mut _,
                size,
                &size as *const _ as *mut _,
            );

            if ret != 0 {
                return Err(Error::from(std::io::Error::from_raw_os_error(
                    RtlNtStatusToDosError(ret) as i32,
                )));
            }

            let unicode: PUNICODE_STRING = (&storage as &[u16]) as *const _ as *mut _;
            let chars =
                std::slice::from_raw_parts((*unicode).Buffer, (*unicode).Length as usize / 2);
            let mut ret = Vec::new();
            ret.push(String::from_utf16_lossy(chars));
            Ok(ret)
        }
    }

    pub fn threads(&self) -> Result<Vec<Thread>, Error> {
        let mut ret = Vec::new();
        unsafe {
            let mut thread: HANDLE = std::mem::zeroed();
            while NtGetNextThread(
                *self.handle,
                thread,
                MAXIMUM_ALLOWED,
                0,
                0,
                &mut thread as *mut HANDLE,
            ) == 0
            {
                ret.push(Thread {
                    thread: thread.into(),
                });
            }
        }
        Ok(ret)
    }

    pub fn child_processes(&self) -> Result<Vec<(Pid, Pid)>, Error> {
        let mut processes = std::collections::HashMap::new();
        unsafe {
            // we're using NtGetNextProcess - mainly because the TLHelp32 code
            // seemed crazy slow when I was first using it for getting the threads.
            // This does have a downside, in that this will include processes that
            // aren't the child of the current one and doesn't include the ppid.
            // SO we're also using NtQueryInformationProcess to get the PROCESS_BASIC_INFORMATION
            // to get the ppid and then later filter down to the correct list
            // This might be worth coming back to a later date and benchmarking
            // against tlhelp32 Process32First/Process32Next code - but seems to work
            // well enough for now
            let mut process: HANDLE = *self.handle;
            while NtGetNextProcess(process, MAXIMUM_ALLOWED, 0, 0, &mut process as *mut HANDLE) == 0
            {
                let mut basic_info = std::mem::zeroed::<PROCESS_BASIC_INFORMATION>();
                let size: ULONG = 0;
                let retcode = NtQueryInformationProcess(
                    process,
                    0,
                    &mut basic_info as *const _ as *mut _,
                    std::mem::size_of_val(&basic_info) as ULONG,
                    &size as *const _ as *mut _,
                );
                if retcode == 0 {
                    processes.insert(
                        basic_info.unique_process_id as Pid,
                        basic_info.inherited_from_unique_process_id as Pid,
                    );
                }
            }
        }
        Ok(crate::filter_child_pids(self.pid, &processes))
    }
    #[cfg(feature = "unwind")]
    pub fn unwinder(&self) -> Result<unwinder::Unwinder, Error> {
        unwinder::Unwinder::new(*self.handle)
    }
    #[cfg(feature = "unwind")]
    pub fn symbolicator(&self) -> Result<Symbolicator, Error> {
        Symbolicator::new(*self.handle)
    }
}

impl super::ProcessMemory for Process {
    fn read(&self, addr: usize, buf: &mut [u8]) -> Result<(), Error> {
        Ok(self.handle.copy_address(addr, buf)?)
    }
}

#[derive(Eq, PartialEq, Hash, Clone)]
pub struct Thread {
    thread: ProcessHandle,
}

impl Thread {
    pub fn new(tid: Tid) -> Result<Thread, Error> {
        // we can't just use try_into_prcess_handle here because we need some additional permissions
        unsafe {
            let thread = OpenThread(THREAD_ALL_ACCESS, FALSE, tid);
            if thread == (0 as std::os::windows::io::RawHandle) {
                return Err(Error::from(std::io::Error::last_os_error()));
            }

            Ok(Thread {
                thread: thread.into(),
            })
        }
    }
    pub fn lock(&self) -> Result<ThreadLock, Error> {
        ThreadLock::new(self.thread.clone())
    }

    pub fn id(&self) -> Result<Tid, Error> {
        unsafe { Ok(GetThreadId(*self.thread)) }
    }

    pub fn active(&self) -> Result<bool, Error> {
        // Getting whether a thread is active or not is surprisingly difficult on windows
        // we're getting the syscall the thread is doing here, and then checking against a list
        // of known waiting syscalls to get this
        unsafe {
            let mut data = std::mem::zeroed::<THREAD_LAST_SYSCALL_INFORMATION>();
            let ret = NtQueryInformationThread(
                *self.thread,
                21,
                &mut data as *mut _ as *mut VOID,
                std::mem::size_of::<THREAD_LAST_SYSCALL_INFORMATION>() as u32,
                NULL as *mut u32,
            );

            // if we're not in a syscall, we're active
            if ret != 0 {
                return Ok(true);
            }

            // otherwise assume we're idle
            Ok(false)
        }
    }
}

pub struct Lock {
    process: ProcessHandle,
}

impl Lock {
    pub fn new(process: ProcessHandle) -> Result<Lock, Error> {
        unsafe {
            let ret = NtSuspendProcess(*process);
            if ret != 0 {
                return Err(Error::from(std::io::Error::from_raw_os_error(
                    RtlNtStatusToDosError(ret) as i32,
                )));
            }
        }
        Ok(Lock { process })
    }
}

impl Drop for Lock {
    fn drop(&mut self) {
        unsafe {
            let ret = NtResumeProcess(*self.process);
            if ret != 0 {
                panic!(
                    "Failed to resume process: {}",
                    std::io::Error::from_raw_os_error(RtlNtStatusToDosError(ret) as i32)
                );
            }
        }
    }
}

pub struct ThreadLock {
    thread: ProcessHandle,
}

impl ThreadLock {
    pub fn new(thread: ProcessHandle) -> Result<ThreadLock, Error> {
        unsafe {
            let ret = SuspendThread(*thread);
            if ret.wrapping_add(1) == 0 {
                return Err(std::io::Error::last_os_error().into());
            }

            Ok(ThreadLock { thread })
        }
    }
}

impl Drop for ThreadLock {
    fn drop(&mut self) {
        unsafe {
            if ResumeThread(*self.thread).wrapping_add(1) == 0 {
                panic!(
                    "Failed to resume thread {}",
                    std::io::Error::last_os_error()
                );
            }
        }
    }
}

#[repr(C)]
#[derive(Copy, Clone, Debug)]
struct THREAD_LAST_SYSCALL_INFORMATION {
    arg1: PVOID,
    syscall_number: USHORT,
}

#[repr(C)]
#[derive(Copy, Clone, Debug)]
struct PROCESS_BASIC_INFORMATION {
    exit_status: NTSTATUS,
    peb_base_address: *mut libc::c_void,
    affinity_mask: *mut ULONG,
    base_priority: ULONG,
    unique_process_id: HANDLE,
    inherited_from_unique_process_id: HANDLE,
}

unsafe impl Send for Process {}