OLD | NEW |
| (Empty) |
1 #include "debugger/base/debug_utils.h" | |
2 | |
3 namespace { | |
4 HMODULE sm_LoadNTDLLFunctions(); | |
5 typedef NTSTATUS (NTAPI *pfnNtQueryInformationProcess)( | |
6 IN HANDLE ProcessHandle, | |
7 IN PROCESSINFOCLASS ProcessInformationClass, | |
8 OUT PVOID ProcessInformation, | |
9 IN ULONG ProcessInformationLength, | |
10 OUT PULONG ReturnLength OPTIONAL | |
11 ); | |
12 pfnNtQueryInformationProcess gNtQueryInformationProcess = 0; | |
13 } | |
14 | |
15 namespace debug { | |
16 bool Utils::GetProcessCmdLine(HANDLE ProcessHandle, std::string* cmd_line) { | |
17 if (!gNtQueryInformationProcess) | |
18 sm_LoadNTDLLFunctions(); | |
19 | |
20 if (gNtQueryInformationProcess) { | |
21 PROCESS_BASIC_INFORMATION pbi; | |
22 memset(&pbi, 0, sizeof(pbi)); | |
23 ULONG ReturnLength = 0; | |
24 NTSTATUS st = (*gNtQueryInformationProcess)(ProcessHandle, ProcessBasicInfor
mation, &pbi, sizeof(pbi), &ReturnLength); | |
25 | |
26 PEB* peb_addr = (PEB*)pbi.PebBaseAddress; | |
27 PEB peb; | |
28 memset(&peb, 0, sizeof(peb)); | |
29 | |
30 SIZE_T sz = 0; | |
31 if (!::ReadProcessMemory(ProcessHandle, peb_addr, &peb, sizeof(peb), &sz)) | |
32 return false; | |
33 | |
34 #ifdef _WIN64 | |
35 RTL_USER_PROCESS_PARAMETERS* proc_params_addr = peb.ProcessParameters; | |
36 RTL_USER_PROCESS_PARAMETERS proc_params; | |
37 memset(&proc_params, 0, sizeof(proc_params)); | |
38 if (!::ReadProcessMemory(ProcessHandle, proc_params_addr, &proc_params, size
of(proc_params), &sz)) | |
39 return false; | |
40 | |
41 *cmd_line = ReadUNICODE_STRING(ProcessHandle, proc_params.CommandLine); | |
42 return true; | |
43 #endif | |
44 } | |
45 return false; | |
46 } | |
47 | |
48 std::string Utils::ReadUNICODE_STRING(HANDLE ProcessHandle, const UNICODE_STRING
& str) { | |
49 std::string result; | |
50 if (str.Length > 0) { | |
51 size_t len_in_bytes = 2 * (str.Length + 1); | |
52 wchar_t* w_str = (wchar_t*)malloc(len_in_bytes); | |
53 char* a_str = (char*)malloc(str.Length + 1); | |
54 if ((NULL != w_str) && (NULL != a_str)) { | |
55 SIZE_T sz = 0; | |
56 if (::ReadProcessMemory(ProcessHandle, str.Buffer, w_str, len_in_bytes, &s
z)) { | |
57 | |
58 ::WideCharToMultiByte(CP_ACP, 0, w_str, -1, a_str, str.Length, 0, 0); | |
59 a_str[str.Length] = 0; | |
60 result = a_str; | |
61 } | |
62 free(w_str); | |
63 free(a_str); | |
64 } | |
65 } | |
66 return result; | |
67 } | |
68 | |
69 bool Utils::ReadUnucodeStr(HANDLE ProcessHandle, const void* addr_addr, std::str
ing* str) { | |
70 void* addr = 0; | |
71 SIZE_T sz = 0; | |
72 ::ReadProcessMemory(ProcessHandle, addr_addr, &addr, sizeof(addr), &sz); | |
73 if (sz == 0) | |
74 return false; | |
75 | |
76 char utmp[4096]; | |
77 ::ReadProcessMemory(ProcessHandle, addr, &utmp, sizeof(utmp), &sz); | |
78 if (sz == 0) | |
79 return false; | |
80 | |
81 char* a_str = (char*)malloc(sz + 1); | |
82 a_str[0] = 0; | |
83 ::WideCharToMultiByte(CP_ACP, 0, (LPCWSTR)utmp, -1, a_str, sz/2, 0, 0); | |
84 | |
85 *str = a_str; | |
86 delete a_str; | |
87 return true; | |
88 } | |
89 | |
90 int Utils::GetProcessorWordSizeInBits(HANDLE h) { | |
91 BOOL is_wow = FALSE; | |
92 if (!::IsWow64Process(h, &is_wow)) | |
93 return 0; | |
94 if (is_wow) | |
95 return 32; | |
96 #ifdef _WIN64 | |
97 return 64; | |
98 #else | |
99 return 32; | |
100 #endif | |
101 return 0; | |
102 } | |
103 | |
104 bool Utils::GetProcessName(int pid, std::string* name) { | |
105 HANDLE h_snapshot = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); | |
106 if (INVALID_HANDLE_VALUE == h_snapshot) | |
107 return false; | |
108 | |
109 PROCESSENTRY32 pe = { 0 }; | |
110 pe.dwSize = sizeof(PROCESSENTRY32); | |
111 | |
112 bool found = false; | |
113 if (::Process32First(h_snapshot, &pe)) { | |
114 do { | |
115 if (pe.th32ProcessID == pid) { | |
116 *name = pe.szExeFile; | |
117 found = true; | |
118 } | |
119 } while (::Process32Next(h_snapshot, &pe)); | |
120 } | |
121 ::CloseHandle(h_snapshot); | |
122 return found; | |
123 } | |
124 } // namespace debug | |
125 | |
126 namespace { | |
127 HMODULE sm_LoadNTDLLFunctions() { | |
128 HMODULE hNtDll = LoadLibrary("ntdll.dll"); | |
129 if(hNtDll == NULL) return NULL; | |
130 | |
131 gNtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(hNtD
ll, | |
132 "NtQueryInformationProce
ss"); | |
133 if(gNtQueryInformationProcess == NULL) { | |
134 FreeLibrary(hNtDll); | |
135 return NULL; | |
136 } | |
137 return hNtDll; | |
138 } | |
139 } // namespace | |
OLD | NEW |