sal/systools/win32/uwinapi/GetProcessId.cpp

   1 /*************************************************************************
   2  *
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * Copyright 2008 by Sun Microsystems, Inc.
   6  *
   7  * OpenOffice.org - a multi-platform office productivity suite
   8  *
   9  * $RCSfile: GetProcessId.cpp,v $
  10  * $Revision: 1.5 $
  11  *
  12  * This file is part of OpenOffice.org.
  13  *
  14  * OpenOffice.org is free software: you can redistribute it and/or modify
  15  * it under the terms of the GNU Lesser General Public License version 3
  16  * only, as published by the Free Software Foundation.
  17  *
  18  * OpenOffice.org is distributed in the hope that it will be useful,
  19  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  20  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  21  * GNU Lesser General Public License version 3 for more details
  22  * (a copy is included in the LICENSE file that accompanied this code).
  23  *
  24  * You should have received a copy of the GNU Lesser General Public License
  25  * version 3 along with OpenOffice.org.  If not, see
  26  * <http://www.openoffice.org/license.html>
  27  * for a copy of the LGPLv3 License.
  28  *
  29  ************************************************************************/
  30
  31 #include "macros.h"
  32 #include "win95sys.h"
  33 #include <tlhelp32.h>
  34 static FARPROC WINAPI GetRealProcAddress( HMODULE hModule, LPCSTR lpProcName )
  35 {
  36     FARPROC     lpfn = GetProcAddress( hModule, lpProcName );
  37
  38     if ( lpfn )
  39     {
  40         if ( 0x68 == *(LPBYTE)lpfn )
  41         {
  42             /*
  43             82C9F460 68 36 49 F8 BF       push        0BFF84936h
  44             82C9F465 E9 41 62 2F 3D       jmp         BFF956AB
  45             */
  46
  47             lpfn = (FARPROC)*(LPDWORD)((LPBYTE)lpfn + 1);
  48
  49             /*
  50             BFF956AB 9C                   pushfd
  51             BFF956AC FC                   cld
  52             BFF956AD 50                   push        eax
  53             BFF956AE 53                   push        ebx
  54             BFF956AF 52                   push        edx
  55             BFF956B0 64 8B 15 20 00 00 00 mov         edx,dword ptr fs:[20h]
  56             BFF956B7 0B D2                or          edx,edx
  57             BFF956B9 74 09                je          BFF956C4
  58             BFF956BB 8B 42 04             mov         eax,dword ptr [edx+4]
  59             BFF956BE 0B C0                or          eax,eax
  60             BFF956C0 74 07                je          BFF956C9
  61             BFF956C2 EB 42                jmp         BFF95706
  62             BFF956C4 5A                   pop         edx
  63             BFF956C5 5B                   pop         ebx
  64             BFF956C6 58                   pop         eax
  65             BFF956C7 9D                   popfd
  66             BFF956C8 C3                   ret
  67             */
  68         }
  69     }
  70
  71     return lpfn;
  72 }
  73
  74
  75 typedef DWORD (WINAPI OBFUSCATE)( DWORD dwPTID );
  76 typedef OBFUSCATE *LPOBFUSCATE;
  77
  78 static DWORD WINAPI Obfuscate( DWORD dwPTID )
  79 {
  80     static LPOBFUSCATE lpfnObfuscate = NULL;
  81
  82     if ( !lpfnObfuscate )
  83     {
  84         LPBYTE lpCode = (LPBYTE)GetRealProcAddress( GetModuleHandleA("KERNEL32"), "GetCurrentThreadId" );
  85
  86         if ( lpCode )
  87         {
  88             /*
  89             GetCurrentThreadId:
  90             lpCode + 00 BFF84936 A1 DC 9C FC BF       mov         eax,[BFFC9CDC]        ; This is the real thread id
  91             lpcode + 05 BFF8493B FF 30                push        dword ptr [eax]
  92             lpCode + 07 BFF8493D E8 17 C5 FF FF       call        BFF80E59                      ; call Obfuscate function
  93             lpcode + 0C BFF84942 C3                   ret
  94             */
  95
  96             DWORD       dwOffset = *(LPDWORD)(lpCode + 0x08);
  97
  98             lpfnObfuscate = (LPOBFUSCATE)(lpCode + 0x0C + dwOffset);
  99             /*
 100             Obfuscate:
 101             BFF80E59 A1 CC 98 FC BF       mov         eax,[BFFC98CC]
 102             BFF80E5E 85 C0                test        eax,eax
 103             BFF80E60 75 04                jne         BFF80E66
 104             BFF80E62 33 C0                xor         eax,eax
 105             BFF80E64 EB 04                jmp         BFF80E6A
 106             BFF80E66 33 44 24 04          xor         eax,dword ptr [esp+4]
 107             BFF80E6A C2 04 00             ret         4
 108             */
 109         }
 110
 111     }
 112
 113     return lpfnObfuscate ? lpfnObfuscate( dwPTID ) : 0;
 114 }
 115
 116
 117 EXTERN_C DWORD WINAPI GetProcessId_WINDOWS( HANDLE hProcess )
 118 {
 119     if ( GetCurrentProcess() == hProcess )
 120         return GetCurrentProcessId();
 121
 122     DWORD       dwProcessId = 0;
 123     PPROCESS_DATABASE   pPDB = (PPROCESS_DATABASE)Obfuscate( GetCurrentProcessId() );
 124
 125     if ( pPDB && K32OBJ_PROCESS == pPDB->Type )
 126     {
 127         DWORD   dwHandleNumber = (DWORD)hProcess >> 2;
 128
 129         if ( 0 == ((DWORD)hProcess & 0x03) && dwHandleNumber < pPDB->pHandleTable->cEntries )
 130         {
 131             if (
 132                 pPDB->pHandleTable->array[dwHandleNumber].pObject &&
 133                 K32OBJ_PROCESS == pPDB->pHandleTable->array[dwHandleNumber].pObject->Type
 134                 )
 135             dwProcessId = Obfuscate( (DWORD)pPDB->pHandleTable->array[dwHandleNumber].pObject );
 136         }
 137
 138         SetLastError( ERROR_INVALID_HANDLE );
 139     }
 140
 141     return dwProcessId;
 142 }
 143
 144
 145 EXTERN_C DWORD WINAPI GetProcessId_NT( HANDLE hProcess )
 146 {
 147     SetLastError( ERROR_CALL_NOT_IMPLEMENTED );
 148     return 0;
 149 }
 150
 151
 152 EXTERN_C void WINAPI ResolveThunk_GetProcessId( FARPROC *lppfn, LPCSTR lpLibFileName, LPCSTR lpFuncName )
 153 {
 154     if ( (LONG)GetVersion() < 0 )
 155         *lppfn = (FARPROC)GetProcessId_WINDOWS;
 156     else
 157     {
 158         FARPROC lpfnResult = GetProcAddress( LoadLibraryA( lpLibFileName ), lpFuncName );
 159         if ( !lpfnResult )
 160             lpfnResult = (FARPROC)GetProcessId_NT;
 161
 162         *lppfn = lpfnResult;
 163     }
 164 }
 165
 166
 167 DEFINE_CUSTOM_THUNK( kernel32, GetProcessId, DWORD, WINAPI, GetProcessId, ( HANDLE hProcess ) );