1017 lines
24 KiB
C
1017 lines
24 KiB
C
/*++
|
|
|
|
Copyright (c) 1994-1998 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
tlist.c
|
|
|
|
Abstract:
|
|
|
|
This module implements a task list application.
|
|
|
|
Author:
|
|
|
|
Wesley Witt (wesw) 20-May-1994
|
|
Mike Sartain (mikesart) 28-Oct-1994 Added detailed task information
|
|
Julian Jiggins (julianj) 19-Mar-1998 Added list processes using specific module feature
|
|
Shaun Cox (shaunco) 9-Jul-1998 Display services running in processes
|
|
|
|
Environment:
|
|
|
|
User Mode
|
|
|
|
--*/
|
|
|
|
#include "pch.h"
|
|
#pragma hdrstop
|
|
#include <dbghelp.h>
|
|
#include "psapi.h"
|
|
|
|
|
|
#define BAD_PID ((DWORD)-1)
|
|
|
|
|
|
DWORD numTasks;
|
|
TASK_LIST tlist[MAX_TASKS];
|
|
BOOL fShowServices;
|
|
BOOL fShowMtsPackages;
|
|
|
|
const char *Blanks = " ";
|
|
|
|
|
|
VOID Usage(VOID);
|
|
VOID PrintThreadInfo(PTASK_LIST pTaskList);
|
|
BOOL FMatchTaskName(LPTSTR szPN, LPTSTR szWindowTitle, LPTSTR szProcessName);
|
|
VOID GetFirstPidWithName(LPTSTR szTask);
|
|
|
|
VOID
|
|
PrintTask(
|
|
DWORD i
|
|
)
|
|
{
|
|
BOOL NameShown = FALSE;
|
|
|
|
printf( "%4d %-16s", tlist[i].dwProcessId, tlist[i].ProcessName );
|
|
|
|
if (fShowServices && tlist[i].ServiceNames[0]) {
|
|
printf( "Svcs: %s", tlist[i].ServiceNames);
|
|
NameShown = TRUE;
|
|
}
|
|
|
|
if (fShowMtsPackages && tlist[i].MtsPackageNames[0]) {
|
|
printf( "%sMts: %s", NameShown ? " " : "",
|
|
tlist[i].MtsPackageNames);
|
|
NameShown = TRUE;
|
|
}
|
|
|
|
if (!NameShown && tlist[i].hwnd) {
|
|
if (fShowServices || fShowMtsPackages) {
|
|
printf( "Title: %s", tlist[i].WindowTitle );
|
|
}
|
|
else {
|
|
printf( " %s", tlist[i].WindowTitle );
|
|
}
|
|
}
|
|
|
|
printf( "\n" );
|
|
}
|
|
|
|
VOID
|
|
PrintTaskTree(
|
|
DWORD level,
|
|
DWORD id
|
|
)
|
|
{
|
|
DWORD i;
|
|
|
|
DetectOrphans( tlist, numTasks );
|
|
for (i=0; i<numTasks; i++) {
|
|
if (tlist[i].flags) {
|
|
continue;
|
|
}
|
|
|
|
// NOTE: The format of the output below should stay fixed forever. There are tools
|
|
// at MS that depend on it.
|
|
|
|
if (level == 0 || tlist[i].dwInheritedFromProcessId == id) {
|
|
printf( "%.*s", level*2, Blanks );
|
|
printf( "%s (%d)", tlist[i].ProcessName, tlist[i].dwProcessId );
|
|
if (tlist[i].hwnd) {
|
|
printf( " %s", tlist[i].WindowTitle );
|
|
}
|
|
printf( "\n" );
|
|
tlist[i].flags = TRUE;
|
|
if (tlist[i].dwProcessId != 0) {
|
|
PrintTaskTree( level+1, tlist[i].dwProcessId );
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
int __cdecl
|
|
main(
|
|
int argc,
|
|
char *argv[]
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Main entrypoint for the TLIST application. This app prints
|
|
a task list to stdout. The task list include the process id,
|
|
task name, ant the window title.
|
|
|
|
Arguments:
|
|
|
|
argc - argument count
|
|
argv - array of pointers to arguments
|
|
|
|
Return Value:
|
|
|
|
0 - success
|
|
|
|
--*/
|
|
|
|
{
|
|
DWORD i;
|
|
TASK_LIST_ENUM te;
|
|
BOOL fTree;
|
|
BOOL fFindTasksUsingModule;
|
|
BOOL fPidOnly = FALSE;
|
|
DWORD cchPN = 0;
|
|
LPSTR szPN = NULL;
|
|
DWORD dwPID = BAD_PID;
|
|
DWORD dwNumServices = 0;
|
|
LPENUM_SERVICE_STATUS_PROCESS pServiceInfo = NULL;
|
|
|
|
if (argc > 1 && (argv[1][0] == '-' || argv[1][0] == '/') && argv[1][1] == '?') {
|
|
Usage();
|
|
}
|
|
|
|
fTree = FALSE;
|
|
fFindTasksUsingModule = FALSE;
|
|
if (argc > 1) {
|
|
if ((argv[1][0] == '-' || argv[1][0] == '/') && (argv[1][1] == 't' || argv[1][1] == 'T')) {
|
|
fTree = TRUE;
|
|
} else if ((argv[1][0] == '-' || argv[1][0] == '/') && (argv[1][1] == 's' || argv[1][1] == 'S')) {
|
|
fShowServices = TRUE;
|
|
} else if ((argv[1][0] == '-' || argv[1][0] == '/') && (argv[1][1] == 'k' || argv[1][1] == 'K')) {
|
|
fShowMtsPackages = TRUE;
|
|
} else if ((argv[1][0] == '-' || argv[1][0] == '/') && (argv[1][1] == 'p' || argv[1][1] == 'P') && argc == 3) {
|
|
_strlwr(argv[2]);
|
|
if (!strcmp(argv[2], "system process")) {
|
|
printf("0\n");
|
|
return 0;
|
|
}
|
|
fPidOnly = TRUE;
|
|
} else if ((argv[1][0] == '-' || argv[1][0] == '/') && (argv[1][1] == 'p' || argv[1][1] == 'P') && argc == 4) {
|
|
_strlwr(argv[2]);
|
|
if (!strcmp(argv[2], "system")) {
|
|
_strlwr(argv[3]);
|
|
if (!strcmp(argv[3], "process")) {
|
|
printf("0\n");
|
|
return 0;
|
|
}
|
|
}
|
|
Usage();
|
|
} else if ((argv[1][0] == '-' || argv[1][0] == '/') && (argv[1][1] == 'm' || argv[1][1] == 'M') && argc == 3) {
|
|
fFindTasksUsingModule = TRUE;
|
|
} else {
|
|
szPN = argv[1];
|
|
if (!(dwPID = atol(szPN)) && szPN[0] != '0' && szPN[1] != 0) {
|
|
dwPID = BAD_PID;
|
|
cchPN = strlen(szPN);
|
|
_strupr(szPN);
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// lets be god
|
|
//
|
|
EnableDebugPriv();
|
|
|
|
//#if 0 // XXX olegk - enable the block after RI with debugger tree
|
|
//
|
|
// Include 32bit modules in enumeration
|
|
//
|
|
{
|
|
DWORD SymOpt = SymGetOptions();
|
|
SymOpt |= SYMOPT_INCLUDE_32BIT_MODULES;
|
|
SymSetOptions(SYMOPT_INCLUDE_32BIT_MODULES);
|
|
}
|
|
//#endif // XXX olegk
|
|
|
|
//
|
|
// get the task list for the system
|
|
//
|
|
//
|
|
// Get the process information for all active Win32 services.
|
|
// This allows us to print the service names next to the processes
|
|
// that host them.
|
|
//
|
|
dwNumServices = GetServiceProcessInfo( &pServiceInfo );
|
|
|
|
numTasks = GetTaskListEx(
|
|
tlist,
|
|
MAX_TASKS,
|
|
cchPN || (dwPID != BAD_PID),
|
|
dwNumServices,
|
|
pServiceInfo);
|
|
|
|
free( pServiceInfo );
|
|
|
|
if (fShowMtsPackages) {
|
|
AddMtsPackageNames(tlist, numTasks);
|
|
}
|
|
|
|
//
|
|
// enumerate all windows and try to get the window
|
|
// titles for each task
|
|
//
|
|
te.tlist = tlist;
|
|
te.numtasks = numTasks;
|
|
GetWindowTitles( &te );
|
|
|
|
//
|
|
// print the task list
|
|
//
|
|
if (fTree) {
|
|
PrintTaskTree( 0, 0 );
|
|
} else if (fFindTasksUsingModule) {
|
|
PrintTasksUsingModule(argv[2]);
|
|
} else if (fPidOnly) {
|
|
GetFirstPidWithName(argv[2]);
|
|
} else {
|
|
for (i=0; i<numTasks; i++) {
|
|
if ((dwPID == BAD_PID) && (!cchPN)) {
|
|
PrintTask( i );
|
|
}
|
|
else
|
|
if ((dwPID == tlist[i].dwProcessId) ||
|
|
(cchPN && FMatchTaskName(szPN, tlist[i].WindowTitle, tlist[i].ProcessName))) {
|
|
PrintTask( i );
|
|
PrintThreadInfo(tlist + i);
|
|
}
|
|
|
|
if (tlist[i].pThreadInfo) {
|
|
free(tlist[i].pThreadInfo);
|
|
}
|
|
}
|
|
}
|
|
|
|
//
|
|
// end of program
|
|
//
|
|
return 0;
|
|
}
|
|
|
|
|
|
VOID
|
|
GetFirstPidWithName(
|
|
LPTSTR szTask
|
|
)
|
|
/*++
|
|
Routine Description:
|
|
|
|
Returns the PID of the first task with a Name matching the specified
|
|
Name. IF no task is found -1 is returned
|
|
Arguments:
|
|
|
|
szTask - module name to search for
|
|
|
|
--*/
|
|
{
|
|
DWORD i;
|
|
CHAR szPName[PROCESS_SIZE + 1];
|
|
CHAR szNameWExe[PROCESS_SIZE + 1];
|
|
|
|
strcpy(szNameWExe, szTask);
|
|
strcat(szNameWExe, ".exe");
|
|
|
|
for (i=0; i<numTasks; i++) {
|
|
strcpy(szPName, tlist[i].ProcessName);
|
|
_strlwr(szPName);
|
|
|
|
if ((!strcmp(szPName, szTask))||(!strcmp(szPName, szNameWExe))) {
|
|
if (tlist[i].dwProcessId != 0) {
|
|
printf("%d\n", tlist[i].dwProcessId);
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
printf("-1\n");
|
|
}
|
|
|
|
|
|
VOID
|
|
Usage(
|
|
VOID
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Prints usage text for this tool.
|
|
|
|
Arguments:
|
|
|
|
None.
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
fprintf( stderr,
|
|
"Microsoft (R) Windows NT (TM) Version 5.1 TLIST\n"
|
|
VER_LEGALCOPYRIGHT_STR
|
|
"\n\n"
|
|
"usage: TLIST"
|
|
" <<-m <pattern>> | <-t> | <pid> | <pattern> | <-p <processname>>> | <-k> | <-s>\n"
|
|
" [options]:\n"
|
|
" -t\n"
|
|
" Print Task Tree\n\n"
|
|
" <pid>\n"
|
|
" List module information for this task.\n\n"
|
|
" <pattern>\n"
|
|
" The pattern can be a complete task\n"
|
|
" name or a regular expression pattern\n"
|
|
" to use as a match. Tlist matches the\n"
|
|
" supplied pattern against the task names\n"
|
|
" and the window titles.\n\n"
|
|
" -k\n"
|
|
" Show MTS packages active in each process.\n\n"
|
|
" -m <pattern>\n"
|
|
" Lists all tasks that have DLL modules loaded\n"
|
|
" in them that match the given pattern name\n\n"
|
|
" -s\n"
|
|
" Show services active in each process.\n\n"
|
|
" -p <processname>\n"
|
|
" Returns the PID of the process specified or -1\n"
|
|
" if the specified process doesn't exist. If there\n"
|
|
" are multiple instances of the process running only\n"
|
|
" the instance with the first PID value is returned.\n\n"
|
|
"\n");
|
|
ExitProcess(0);
|
|
}
|
|
|
|
|
|
//
|
|
// Routines used to list all processes that have a specific module in use
|
|
//
|
|
|
|
BOOL
|
|
FindSpecificModuleCallback(
|
|
LPSTR Name,
|
|
DWORD_PTR Base,
|
|
DWORD Size,
|
|
PVOID Context
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Callback function for module enumeration to find a specific module
|
|
|
|
Arguments:
|
|
|
|
Name - Module name
|
|
Base - Base address
|
|
Size - Size of image
|
|
Context - User context pointer
|
|
|
|
Return Value:
|
|
|
|
TRUE - Continue enumeration
|
|
FALSE - Stop enumeration
|
|
|
|
--*/
|
|
|
|
{
|
|
PFIND_MODULE_INFO pFindModuleInfo;
|
|
|
|
pFindModuleInfo = (PFIND_MODULE_INFO)Context;
|
|
|
|
if (MatchPattern(Name, pFindModuleInfo->szModuleToFind))
|
|
{
|
|
pFindModuleInfo->fFound = TRUE;
|
|
strcpy(pFindModuleInfo->szMatchingModuleName, Name);
|
|
return FALSE; // Found Module so stop enumerating
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
IsTaskUsingModule(
|
|
PTASK_LIST pTask,
|
|
LPTSTR szModuleName,
|
|
LPTSTR szMatchingModuleName
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Checks if the given task has the given module loaded
|
|
|
|
Arguments:
|
|
|
|
pTaskList - task to search for module
|
|
szModule - module name to search for
|
|
|
|
Return Value:
|
|
|
|
TRUE - if the module is loaded in the task
|
|
FALSE - if the module is not loaded in the task
|
|
|
|
--*/
|
|
|
|
{
|
|
FIND_MODULE_INFO FindModuleInfo;
|
|
|
|
FindModuleInfo.fFound = FALSE;
|
|
FindModuleInfo.szModuleToFind = szModuleName;
|
|
FindModuleInfo.szMatchingModuleName = szMatchingModuleName;
|
|
|
|
EnumerateLoadedModules(
|
|
(HANDLE) UlongToPtr(pTask->dwProcessId),
|
|
FindSpecificModuleCallback,
|
|
&FindModuleInfo
|
|
);
|
|
|
|
return FindModuleInfo.fFound;
|
|
}
|
|
|
|
void
|
|
PrintTasksUsingModule(
|
|
LPTSTR szModuleName
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Enumerates through all the tasks in the system looking for those that
|
|
have loaded modules of the given name.
|
|
|
|
Arguments:
|
|
|
|
szModule - module name to search for
|
|
|
|
Return Value:
|
|
|
|
None
|
|
|
|
--*/
|
|
|
|
{
|
|
BOOL fUsed = FALSE;
|
|
DWORD i;
|
|
CHAR szMatchingModuleName[64];
|
|
|
|
_strupr(szModuleName); // Needed for wildcarding
|
|
|
|
for (i=0; i<numTasks; i++) {
|
|
if (IsTaskUsingModule(tlist + i, szModuleName, szMatchingModuleName)) {
|
|
printf("%s - ", szMatchingModuleName);
|
|
PrintTask( i );
|
|
fUsed = TRUE;
|
|
}
|
|
}
|
|
if (!fUsed) {
|
|
printf( "No tasks found using %s\n", szModuleName );
|
|
}
|
|
}
|
|
|
|
|
|
BOOL
|
|
GetVersionStuff(
|
|
LPTSTR szFileName,
|
|
VS_FIXEDFILEINFO *pvsRet
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Get fixedfileinfo for szFileName.
|
|
|
|
Arguments:
|
|
|
|
szFileName - name of file
|
|
pvsRet - fixedfileinfo return struct
|
|
|
|
Return Value:
|
|
|
|
TRUE - success
|
|
FALSE - failure
|
|
|
|
--*/
|
|
|
|
{
|
|
DWORD dwHandle;
|
|
DWORD dwLength;
|
|
BOOL fRet = FALSE;
|
|
LPVOID lpvData = NULL;
|
|
|
|
if (!(dwLength = GetFileVersionInfoSize(szFileName, &dwHandle))) {
|
|
goto err;
|
|
}
|
|
|
|
if (lpvData = malloc(dwLength)) {
|
|
if (GetFileVersionInfo(szFileName, 0, dwLength, lpvData)) {
|
|
|
|
UINT uLen;
|
|
VS_FIXEDFILEINFO *pvs;
|
|
DWORD *pdwTranslation;
|
|
DWORD dwDefLang = 0x409;
|
|
|
|
if (!VerQueryValue(lpvData, "\\VarFileInfo\\Translation",
|
|
&pdwTranslation, &uLen)) {
|
|
// if we can't get the langid, default to usa
|
|
pdwTranslation = &dwDefLang;
|
|
uLen = sizeof(DWORD);
|
|
}
|
|
|
|
if (VerQueryValue(lpvData, "\\", (LPVOID *)&pvs, &uLen)) {
|
|
*pvsRet = *pvs;
|
|
fRet = TRUE;
|
|
}
|
|
}
|
|
}
|
|
|
|
err:
|
|
if (lpvData)
|
|
free(lpvData);
|
|
return fRet;
|
|
}
|
|
|
|
BOOL
|
|
EnumLoadedModulesCallback(
|
|
LPSTR Name,
|
|
DWORD_PTR Base,
|
|
DWORD Size,
|
|
PVOID Context
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Callback function for module enumeration
|
|
|
|
Arguments:
|
|
|
|
Name - Module name
|
|
Base - Base address
|
|
Size - Size of image
|
|
Context - User context pointer
|
|
|
|
Return Value:
|
|
|
|
TRUE - Continue enumeration
|
|
FALSE - Stop enumeration
|
|
|
|
--*/
|
|
|
|
{
|
|
VS_FIXEDFILEINFO vs;
|
|
CHAR szBuffer[100];
|
|
|
|
|
|
szBuffer[0] = 0;
|
|
if (GetVersionStuff( Name, &vs )) {
|
|
wsprintf( szBuffer, "%u.%u.%u.%u %s",
|
|
HIWORD(vs.dwFileVersionMS),
|
|
LOWORD(vs.dwFileVersionMS),
|
|
HIWORD(vs.dwFileVersionLS),
|
|
LOWORD(vs.dwFileVersionLS),
|
|
vs.dwFileFlags & VS_FF_DEBUG ? "dbg" : "shp"
|
|
);
|
|
}
|
|
printf( " %18.18s 0x%08x %s\n", szBuffer, Base, Name );
|
|
return TRUE;
|
|
}
|
|
|
|
BOOL
|
|
PrintModuleList(
|
|
ULONG ProcessId
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Prints list of modules in ProcessId
|
|
|
|
Arguments:
|
|
|
|
ProcessID - process id
|
|
|
|
Return Value:
|
|
|
|
TRUE - success
|
|
FALSE - failure
|
|
|
|
--*/
|
|
|
|
{
|
|
EnumerateLoadedModules(
|
|
(HANDLE) UlongToPtr(ProcessId),
|
|
EnumLoadedModulesCallback,
|
|
NULL
|
|
);
|
|
return TRUE;
|
|
}
|
|
|
|
DWORD
|
|
GetWin32StartAddress(
|
|
HANDLE hThread
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Get starting address for thread
|
|
|
|
Arguments:
|
|
|
|
hThread
|
|
|
|
Return Value:
|
|
|
|
Starting Thread address or 0
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
DWORD ThreadInformation;
|
|
|
|
// make sure we have a handle
|
|
if (!hThread)
|
|
return 0;
|
|
|
|
// get the threadinfo
|
|
Status = NtQueryInformationThread(hThread, ThreadQuerySetWin32StartAddress,
|
|
&ThreadInformation, sizeof(ThreadInformation), NULL);
|
|
if (!NT_SUCCESS(Status))
|
|
return 0;
|
|
|
|
return ThreadInformation;
|
|
}
|
|
|
|
ULONG
|
|
GetLastThreadErr(
|
|
HANDLE hThread
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Get Last Error for a Thread
|
|
|
|
Arguments:
|
|
|
|
hThread
|
|
|
|
Return Value:
|
|
|
|
LastError or 0
|
|
|
|
--*/
|
|
|
|
{
|
|
TEB Teb;
|
|
NTSTATUS Status;
|
|
HANDLE hProcess;
|
|
ULONG LastErrorValue;
|
|
THREAD_BASIC_INFORMATION ThreadInformation;
|
|
|
|
// make sure we have a handle
|
|
if (!hThread)
|
|
return 0;
|
|
|
|
// query for basic thread info
|
|
Status = NtQueryInformationThread(hThread, ThreadBasicInformation,
|
|
&ThreadInformation, sizeof(ThreadInformation), NULL);
|
|
if (!NT_SUCCESS(Status))
|
|
return 0;
|
|
|
|
// get handle to process
|
|
if (!(hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE,
|
|
(DWORD)(DWORD_PTR)ThreadInformation.ClientId.UniqueProcess))) {
|
|
return 0;
|
|
}
|
|
|
|
__try {
|
|
// read the TEB from the process and get the last error value
|
|
if (ReadProcessMemory(hProcess,
|
|
ThreadInformation.TebBaseAddress, &Teb, sizeof(TEB), NULL)) {
|
|
LastErrorValue = Teb.LastErrorValue;
|
|
}
|
|
}
|
|
__except(EXCEPTION_EXECUTE_HANDLER) {
|
|
}
|
|
|
|
// close the hProcess
|
|
CloseHandle(hProcess);
|
|
|
|
return LastErrorValue;
|
|
}
|
|
|
|
BOOL
|
|
FPrintPEBInfo(
|
|
HANDLE hProcess
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Prints cmdline and cwd of hProcess
|
|
|
|
Arguments:
|
|
|
|
hProcess.
|
|
|
|
Return Value:
|
|
|
|
TRUE - success
|
|
FALSE - failure
|
|
|
|
--*/
|
|
|
|
{
|
|
PEB Peb;
|
|
NTSTATUS Status;
|
|
PROCESS_BASIC_INFORMATION BasicInfo;
|
|
BOOL fRet = FALSE;
|
|
WCHAR szT[MAX_PATH * 2];
|
|
RTL_USER_PROCESS_PARAMETERS ProcessParameters;
|
|
|
|
Status = NtQueryInformationProcess(hProcess, ProcessBasicInformation,
|
|
&BasicInfo, sizeof(BasicInfo), NULL);
|
|
if (!NT_SUCCESS(Status)) {
|
|
SetLastError(RtlNtStatusToDosError(Status));
|
|
return fRet;
|
|
}
|
|
|
|
__try {
|
|
// get the PEB
|
|
if (ReadProcessMemory(hProcess, BasicInfo.PebBaseAddress, &Peb,
|
|
sizeof(PEB), NULL)) {
|
|
// get the processparameters
|
|
if (ReadProcessMemory(hProcess, Peb.ProcessParameters,
|
|
&ProcessParameters, sizeof(ProcessParameters), NULL)) {
|
|
// get the CWD
|
|
if (ReadProcessMemory(hProcess,
|
|
ProcessParameters.CurrentDirectory.DosPath.Buffer, szT,
|
|
sizeof(szT), NULL)) {
|
|
wprintf(L" CWD: %s\n", szT);
|
|
}
|
|
|
|
// get cmdline
|
|
if (ReadProcessMemory(hProcess, ProcessParameters.CommandLine.Buffer,
|
|
szT, sizeof(szT), NULL)) {
|
|
wprintf(L" CmdLine: %s\n", szT);
|
|
}
|
|
|
|
fRet = TRUE;
|
|
}
|
|
}
|
|
}
|
|
__except(EXCEPTION_EXECUTE_HANDLER) {
|
|
}
|
|
|
|
return fRet;
|
|
}
|
|
|
|
|
|
// copied from the win32 API code since we need to run on NT 4 and this is a
|
|
// new API to NT 5
|
|
|
|
HANDLE
|
|
TlistOpenThread(
|
|
DWORD dwDesiredAccess,
|
|
BOOL bInheritHandle,
|
|
DWORD dwThreadId
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
A handle to a thread object may be created using OpenThread.
|
|
|
|
Opening a thread creates a handle to the specified thread.
|
|
Associated with the thread handle is a set of access rights that
|
|
may be performed using the thread handle. The caller specifies the
|
|
desired access to the thread using the DesiredAccess parameter.
|
|
|
|
Arguments:
|
|
|
|
mDesiredAccess - Supplies the desired access to the thread object.
|
|
For NT/Win32, this access is checked against any security
|
|
descriptor on the target thread. The following object type
|
|
specific access flags can be specified in addition to the
|
|
STANDARD_RIGHTS_REQUIRED access flags.
|
|
|
|
DesiredAccess Flags:
|
|
|
|
THREAD_TERMINATE - This access is required to terminate the
|
|
thread using TerminateThread.
|
|
|
|
THREAD_SUSPEND_RESUME - This access is required to suspend and
|
|
resume the thread using SuspendThread and ResumeThread.
|
|
|
|
THREAD_GET_CONTEXT - This access is required to use the
|
|
GetThreadContext API on a thread object.
|
|
|
|
THREAD_SET_CONTEXT - This access is required to use the
|
|
SetThreadContext API on a thread object.
|
|
|
|
THREAD_SET_INFORMATION - This access is required to set certain
|
|
information in the thread object.
|
|
|
|
THREAD_SET_THREAD_TOKEN - This access is required to set the
|
|
thread token using SetTokenInformation.
|
|
|
|
THREAD_QUERY_INFORMATION - This access is required to read
|
|
certain information from the thread object.
|
|
|
|
SYNCHRONIZE - This access is required to wait on a thread object.
|
|
|
|
THREAD_ALL_ACCESS - This set of access flags specifies all of the
|
|
possible access flags for a thread object.
|
|
|
|
bInheritHandle - Supplies a flag that indicates whether or not the
|
|
returned handle is to be inherited by a new process during
|
|
process creation. A value of TRUE indicates that the new
|
|
process will inherit the handle.
|
|
|
|
dwThreadId - Supplies the thread id of the thread to open.
|
|
|
|
Return Value:
|
|
|
|
NON-NULL - Returns an open handle to the specified thread. The
|
|
handle may be used by the calling process in any API that
|
|
requires a handle to a thread. If the open is successful, the
|
|
handle is granted access to the thread object only to the
|
|
extent that it requested access through the DesiredAccess
|
|
parameter.
|
|
|
|
NULL - The operation failed. Extended error status is available
|
|
using GetLastError.
|
|
|
|
--*/
|
|
|
|
{
|
|
NTSTATUS Status;
|
|
OBJECT_ATTRIBUTES Obja;
|
|
HANDLE Handle;
|
|
CLIENT_ID ClientId;
|
|
|
|
ClientId.UniqueThread = (HANDLE)LongToHandle(dwThreadId);
|
|
ClientId.UniqueProcess = (HANDLE)NULL;
|
|
|
|
InitializeObjectAttributes(
|
|
&Obja,
|
|
NULL,
|
|
(bInheritHandle ? OBJ_INHERIT : 0),
|
|
NULL,
|
|
NULL
|
|
);
|
|
Status = NtOpenThread(
|
|
&Handle,
|
|
(ACCESS_MASK)dwDesiredAccess,
|
|
&Obja,
|
|
&ClientId
|
|
);
|
|
if ( NT_SUCCESS(Status) ) {
|
|
return Handle;
|
|
}
|
|
else {
|
|
return NULL;
|
|
}
|
|
}
|
|
|
|
|
|
|
|
VOID
|
|
PrintThreadInfo(
|
|
PTASK_LIST pTaskList
|
|
)
|
|
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
Prints all kinds of info about a task
|
|
|
|
Arguments:
|
|
|
|
PTASK_LIST of task to print
|
|
|
|
Return Value:
|
|
|
|
None.
|
|
|
|
--*/
|
|
|
|
{
|
|
UINT nThread;
|
|
HANDLE hProcess;
|
|
|
|
// from \\kernel\razzle2\src\ntos\inc\ke.h
|
|
#define MAX_THREADSTATE (sizeof(szThreadState) / sizeof(TCHAR *))
|
|
static const TCHAR *szThreadState[] = {
|
|
"Initialized",
|
|
"Ready ",
|
|
"Running ",
|
|
"Standby ",
|
|
"Terminated",
|
|
"Waiting ",
|
|
"Transition",
|
|
"??? " };
|
|
|
|
// get a handle to the process
|
|
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pTaskList->dwProcessId);
|
|
if (!hProcess)
|
|
return;
|
|
|
|
// print the CWD and CmdLine
|
|
FPrintPEBInfo(hProcess);
|
|
|
|
printf( " VirtualSize: %6ld KB"
|
|
" PeakVirtualSize: %6ld KB\n",
|
|
pTaskList->VirtualSize / 1024,
|
|
pTaskList->PeakVirtualSize / 1024);
|
|
|
|
printf( " WorkingSetSize:%6ld KB"
|
|
" PeakWorkingSetSize:%6ld KB\n",
|
|
pTaskList->WorkingSetSize / 1024,
|
|
pTaskList->PeakWorkingSetSize / 1024);
|
|
|
|
printf( " NumberOfThreads: %ld\n",
|
|
pTaskList->NumberOfThreads);
|
|
|
|
// if we got any threadinfo, spit it out
|
|
if (pTaskList->pThreadInfo) {
|
|
for (nThread = 0; nThread < pTaskList->NumberOfThreads; nThread++) {
|
|
|
|
PTHREAD_INFO pThreadInfo = &pTaskList->pThreadInfo[nThread];
|
|
HANDLE hThread = TlistOpenThread(THREAD_QUERY_INFORMATION, FALSE,
|
|
(DWORD)(DWORD_PTR)pThreadInfo->UniqueThread);
|
|
|
|
printf(" %4d Win32StartAddr:0x%08x LastErr:0x%08x State:%s\n",
|
|
HandleToUlong(pThreadInfo->UniqueThread),
|
|
GetWin32StartAddress(hThread),
|
|
GetLastThreadErr(hThread),
|
|
szThreadState[min(pThreadInfo->ThreadState, MAX_THREADSTATE - 1)]);
|
|
|
|
if (hThread)
|
|
NtClose(hThread);
|
|
}
|
|
}
|
|
|
|
// print the modules
|
|
PrintModuleList( pTaskList->dwProcessId );
|
|
|
|
// close the hProcess
|
|
CloseHandle(hProcess);
|
|
}
|
|
|
|
BOOL
|
|
FMatchTaskName(
|
|
LPTSTR szPN,
|
|
LPTSTR szWindowTitle,
|
|
LPTSTR szProcessName
|
|
)
|
|
{
|
|
LPTSTR szT;
|
|
TCHAR szTName[PROCESS_SIZE];
|
|
|
|
strncpy( szTName, szProcessName, PROCESS_SIZE );
|
|
if (szT = strchr( szTName, '.' ))
|
|
szT[0] = '\0';
|
|
|
|
if (MatchPattern( szTName, szPN ) ||
|
|
MatchPattern( szProcessName, szPN ) ||
|
|
MatchPattern( szWindowTitle, szPN )) {
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|