1005 lines
25 KiB
C++
1005 lines
25 KiB
C++
/*++
|
|
|
|
Copyright (c) 2000 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
WoWTask.cpp
|
|
|
|
Abstract:
|
|
|
|
Functions that retrieve process-history related information from
|
|
16-bit environment. This includes the retrieval of the correct
|
|
__PROCESS_HISTORY that was passed in from the parent (32-bit)process
|
|
and tracing the process history through WOW
|
|
|
|
Notes:
|
|
|
|
|
|
History:
|
|
|
|
10/26/00 VadimB Created
|
|
|
|
--*/
|
|
|
|
|
|
#include "precomp.h"
|
|
|
|
// This module has been given an official blessing to use the str routines.
|
|
#include "LegalStr.h"
|
|
|
|
IMPLEMENT_SHIM_BEGIN(Win2kPropagateLayer)
|
|
#include "ShimHookMacro.h"
|
|
|
|
#include "Win2kPropagateLayer.h"
|
|
|
|
|
|
typedef struct tagFINDWOWTASKDATA {
|
|
BOOL bFound;
|
|
DWORD dwProcessId;
|
|
DWORD dwThreadId;
|
|
WORD hMod16;
|
|
WORD hTask16;
|
|
|
|
} FINDWOWTASKDATA, *PFINDWOWTASKDATA;
|
|
|
|
|
|
//
|
|
// Dynamically Linked apis
|
|
//
|
|
// from WOW32.dll
|
|
//
|
|
|
|
typedef LPVOID (WINAPI *PFNWOWGetVDMPointer)(DWORD vp,
|
|
DWORD dwBytes,
|
|
BOOL fProtectedMode);
|
|
|
|
//
|
|
// from vdmdbg.dll - defined in the header file
|
|
//
|
|
//
|
|
|
|
typedef INT (WINAPI *PFNVDMEnumTaskWOW)(DWORD dwProcessId,
|
|
TASKENUMPROC fp,
|
|
LPARAM lparam);
|
|
|
|
//
|
|
// Api importing -- modules
|
|
//
|
|
WCHAR g_wszWOW32ModName[] = L"wow32.dll";
|
|
WCHAR g_wszVdmDbgModName[] = L"VdmDbg.dll";
|
|
|
|
//
|
|
// Api importing - module handles and function pointers
|
|
//
|
|
|
|
HMODULE g_hWow32;
|
|
HMODULE g_hVdmDbg;
|
|
BOOL g_bInitialized; // set to true when imports are initialized
|
|
|
|
PFNWOWGetVDMPointer g_pfnWOWGetVDMPointer;
|
|
PFNVDMEnumTaskWOW g_pfnVDMEnumTaskWOW;
|
|
|
|
extern BOOL* g_pSeparateWow;
|
|
|
|
|
|
//
|
|
// function in this module to import apis
|
|
//
|
|
|
|
BOOL ImportWowApis(VOID);
|
|
|
|
|
|
//
|
|
// Marcro to access 16-bit memory
|
|
//
|
|
|
|
|
|
#define SEGPTR(seg,off) ((g_pfnWOWGetVDMPointer)((((ULONG)seg) << 16) | (off), 0, TRUE))
|
|
|
|
//
|
|
// task enum proc, called back from vdmdbg
|
|
//
|
|
|
|
BOOL WINAPI MyTaskEnumProc(
|
|
DWORD dwThreadId,
|
|
WORD hMod16,
|
|
WORD hTask16,
|
|
LPARAM lParam
|
|
)
|
|
{
|
|
PFINDWOWTASKDATA pFindData = (PFINDWOWTASKDATA)lParam;
|
|
|
|
if (dwThreadId == pFindData->dwThreadId) {
|
|
pFindData->hMod16 = hMod16;
|
|
pFindData->hTask16 = hTask16;
|
|
pFindData->bFound = TRUE;
|
|
return TRUE;
|
|
}
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
BOOL FindWowTask(
|
|
DWORD dwProcessId,
|
|
DWORD dwThreadId,
|
|
PFINDWOWTASKDATA pFindData
|
|
)
|
|
{
|
|
RtlZeroMemory(pFindData, sizeof(*pFindData));
|
|
|
|
pFindData->dwProcessId = dwProcessId;
|
|
pFindData->dwThreadId = dwThreadId;
|
|
|
|
g_pfnVDMEnumTaskWOW(dwProcessId, (TASKENUMPROC)MyTaskEnumProc, (LPARAM)pFindData);
|
|
|
|
return pFindData->bFound;
|
|
}
|
|
|
|
|
|
//
|
|
// get the pointer to task database block from hTask
|
|
//
|
|
|
|
|
|
PTDB
|
|
GetTDB(
|
|
WORD wTDB
|
|
)
|
|
{
|
|
PTDB pTDB;
|
|
|
|
pTDB = (PTDB)SEGPTR(wTDB, 0);
|
|
if (NULL == pTDB || TDB_SIGNATURE != pTDB->TDB_sig) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[GetTDB] TDB is invalid for task 0x%x",
|
|
(DWORD)wTDB);
|
|
return NULL;
|
|
}
|
|
|
|
return pTDB;
|
|
}
|
|
|
|
|
|
//
|
|
// GetModName
|
|
// wTDB - TDB entry
|
|
// szModName - pointer to the buffer that receives module name
|
|
// buffer should be at least 9 characters long
|
|
//
|
|
// returns FALSE if the entry is invalid
|
|
|
|
|
|
BOOL
|
|
GetModName(
|
|
WORD wTDB,
|
|
PCH szModName
|
|
)
|
|
{
|
|
PTDB pTDB;
|
|
PCH pch;
|
|
|
|
pTDB = GetTDB(wTDB);
|
|
if (NULL == pTDB) {
|
|
return FALSE;
|
|
}
|
|
|
|
RtlCopyMemory(szModName, pTDB->TDB_ModName, 8 * sizeof(CHAR)); // we have modname now
|
|
szModName[8] = '\0';
|
|
|
|
pch = &szModName[8];
|
|
while (*(--pch) == ' ') {
|
|
*pch = 0;
|
|
}
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
//
|
|
// ShimGetTaskFileName
|
|
// IN wTask - 16-bit task handle
|
|
// Returns:
|
|
// Fully qualified exe that is running in this task's context
|
|
//
|
|
|
|
|
|
PSZ
|
|
ShimGetTaskFileName(
|
|
WORD wTask
|
|
)
|
|
{
|
|
PSZ pszFileName = NULL;
|
|
PTDB pTDB;
|
|
|
|
pTDB = GetTDB(wTask);
|
|
if (NULL == pTDB) {
|
|
// this is really bad -- the module is invalid, debug output is generated by GetTDB
|
|
return pszFileName;
|
|
}
|
|
|
|
if (NULL == pTDB->TDB_pModule) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimGetTaskFileName] module pointer is NULL for 0x%x",
|
|
(DWORD)wTask);
|
|
return pszFileName;
|
|
}
|
|
|
|
pszFileName = (PSZ)SEGPTR(pTDB->TDB_pModule, (*(WORD *)SEGPTR(pTDB->TDB_pModule, 10)) + 8);
|
|
return pszFileName;
|
|
}
|
|
|
|
|
|
PSZ
|
|
ShimGetTaskEnvptr(
|
|
WORD hTask16
|
|
)
|
|
{
|
|
PTDB pTDB = GetTDB(hTask16);
|
|
PSZ pszEnv = NULL;
|
|
PDOSPDB pPSP;
|
|
|
|
if (NULL == pTDB) {
|
|
LOGN( eDbgLevelError,
|
|
"[ShimGetTaskEnvptr] Bad TDB entry 0x%x", hTask16);
|
|
return NULL;
|
|
}
|
|
|
|
//
|
|
// Prepare environment data - this buffer is used when we're starting a new task from the
|
|
// root of the chain (as opposed to spawning from an existing 16-bit task)
|
|
//
|
|
|
|
pPSP = (PDOSPDB)SEGPTR(pTDB->TDB_PDB, 0); // psp
|
|
|
|
if (pPSP != NULL) {
|
|
pszEnv = (PCH)SEGPTR(pPSP->PDB_environ, 0);
|
|
}
|
|
|
|
return pszEnv;
|
|
}
|
|
|
|
|
|
// IsWowExec
|
|
// IN wTDB - entry into the task database
|
|
// Returns:
|
|
// TRUE if this particular entry points to WOWEXEC
|
|
//
|
|
// Note:
|
|
// WOWEXEC is a special stub module that always runs on NTVDM
|
|
// new tasks are spawned by wowexec (in the most typical case)
|
|
// it is therefore the "root" module and it's environment's contents
|
|
// should not be counted, since we don't know what was ntvdm's parent process
|
|
//
|
|
|
|
BOOL
|
|
IsWOWExec(
|
|
WORD wTDB
|
|
)
|
|
{
|
|
PTDB pTDB;
|
|
PTDB pTDBParent;
|
|
CHAR szModName[9];
|
|
|
|
pTDB = GetTDB(wTDB);
|
|
if (NULL == pTDB) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[IsWOWExec] Bad TDB entry 0x%x",
|
|
(DWORD)wTDB);
|
|
return FALSE;
|
|
}
|
|
|
|
if (!GetModName(wTDB, szModName)) { // can we get modname ?
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[IsWOWExec] GetModName failed.");
|
|
return FALSE;
|
|
}
|
|
|
|
return (0 == _strcmpi(szModName, "wowexec")); // is the module named WOWEXEC ?
|
|
}
|
|
|
|
//
|
|
// ImportWowApis
|
|
// Function imports necessary apis from wow32.dll and vdmdbg.dll
|
|
//
|
|
//
|
|
|
|
BOOL
|
|
ImportWowApis(
|
|
VOID
|
|
)
|
|
{
|
|
g_hWow32 = LoadLibraryW(g_wszWOW32ModName);
|
|
|
|
if (g_hWow32 == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ImportWowApis] Failed to load wow32.dll Error 0x%x",
|
|
GetLastError());
|
|
goto Fail;
|
|
}
|
|
|
|
g_pfnWOWGetVDMPointer = (PFNWOWGetVDMPointer)GetProcAddress(g_hWow32, "WOWGetVDMPointer");
|
|
|
|
if (g_pfnWOWGetVDMPointer == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ImportWowApis] Failed to get address of WOWGetVDMPointer Error 0x%x",
|
|
GetLastError());
|
|
goto Fail;
|
|
}
|
|
|
|
g_hVdmDbg = LoadLibraryW(g_wszVdmDbgModName);
|
|
|
|
if (g_hVdmDbg == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ImportWowApis] Failed to load vdmdbg.dll Error 0x%x",
|
|
GetLastError());
|
|
goto Fail;
|
|
}
|
|
|
|
g_pfnVDMEnumTaskWOW = (PFNVDMEnumTaskWOW)GetProcAddress(g_hVdmDbg, "VDMEnumTaskWOW");
|
|
|
|
if (g_pfnVDMEnumTaskWOW == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ImportWowApis] Failed to get address of VDMEnumTaskWOW Error 0x%x",
|
|
GetLastError());
|
|
goto Fail;
|
|
}
|
|
|
|
g_bInitialized = TRUE;
|
|
|
|
return TRUE;
|
|
|
|
Fail:
|
|
|
|
if (g_hWow32) {
|
|
FreeLibrary(g_hWow32);
|
|
g_hWow32 = NULL;
|
|
}
|
|
if (g_hVdmDbg) {
|
|
FreeLibrary(g_hVdmDbg);
|
|
g_hVdmDbg = NULL;
|
|
}
|
|
g_pfnWOWGetVDMPointer = NULL;
|
|
g_pfnVDMEnumTaskWOW = NULL;
|
|
|
|
return FALSE;
|
|
|
|
}
|
|
|
|
|
|
/////////////////////////////////////////////////////////////////////////////////////////////
|
|
//
|
|
//
|
|
// WOWTaskList
|
|
//
|
|
// We maintain a shadow list of running wow tasks complete with respective process history and
|
|
// inherited process history
|
|
//
|
|
//
|
|
|
|
typedef struct tagWOWTASKLISTITEM* PWOWTASKLISTITEM;
|
|
|
|
typedef struct tagWOWTASKLISTITEM {
|
|
|
|
WORD hTask16; // 16-bit tdb entry
|
|
|
|
DWORD dwThreadId; // thread id of the task
|
|
|
|
WOWENVDATA EnvData; // environment data (process history, compat layer, etc)
|
|
|
|
PWOWTASKLISTITEM pTaskNext;
|
|
|
|
} WOWTASKLISTITEM;
|
|
|
|
PWOWTASKLISTITEM g_pWowTaskList;
|
|
|
|
|
|
/*++
|
|
|
|
FindWowTaskInfo
|
|
|
|
IN hTask16 16-bit task's handle
|
|
IN dwThreadId OPTIONAL 32-bit thread id of the task, might be 0
|
|
|
|
Returns: pointer to the task information structure
|
|
|
|
--*/
|
|
|
|
PWOWTASKLISTITEM
|
|
FindWowTaskInfo(
|
|
WORD hTask16,
|
|
DWORD dwThreadId
|
|
)
|
|
{
|
|
PWOWTASKLISTITEM pTask = g_pWowTaskList;
|
|
|
|
while (NULL != pTask) {
|
|
|
|
if (hTask16 == pTask->hTask16) {
|
|
|
|
if (dwThreadId == 0 || dwThreadId == pTask->dwThreadId) {
|
|
break;
|
|
}
|
|
}
|
|
|
|
pTask = pTask->pTaskNext;
|
|
}
|
|
|
|
return pTask;
|
|
}
|
|
|
|
/*++
|
|
|
|
UpdateWowTaskList
|
|
|
|
IN hTask16 16-bit task's handle
|
|
|
|
Returns: True if the task was added successfully
|
|
Note: wowexec is not among the "legitimate" tasks
|
|
|
|
--*/
|
|
|
|
|
|
BOOL
|
|
UpdateWowTaskList(
|
|
WORD hTask16
|
|
)
|
|
{
|
|
PTDB pTDB;
|
|
WORD wTaskParent;
|
|
PWOWTASKLISTITEM pTaskParent = NULL;
|
|
LPSTR lpszFileName;
|
|
PSZ pszEnv;
|
|
WOWENVDATA EnvData;
|
|
PWOWENVDATA pData = NULL;
|
|
DWORD dwLength;
|
|
PWOWTASKLISTITEM pTaskNew;
|
|
PCH pBuffer;
|
|
PDOSPDB pPSP;
|
|
BOOL bSuccess;
|
|
|
|
//
|
|
// see that we are initialized, import apis
|
|
//
|
|
if (!g_bInitialized) { // first call, link apis
|
|
bSuccess = ImportWowApis();
|
|
if (!bSuccess) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[UpdateWowTaskList] Failed to import apis.");
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
//
|
|
// If this task is WOWEXEC -- just return, it's not an error condition, but we don't need
|
|
// wowexec in our list
|
|
//
|
|
|
|
if (IsWOWExec(hTask16)) { // this is ok, we don't want wowexec
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// next, see what the parent item is, to do so -- access it through TDB
|
|
//
|
|
|
|
pTDB = GetTDB(hTask16);
|
|
if (NULL == pTDB) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[UpdateWowTaskList] Bad TDB entry 0x%x",
|
|
hTask16);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Prepare environment data - this buffer is used when we're starting a new task from the
|
|
// root of the chain (as opposed to spawning from an existing 16-bit task)
|
|
//
|
|
|
|
RtlZeroMemory(&EnvData, sizeof(EnvData));
|
|
pData = &EnvData;
|
|
|
|
wTaskParent = pTDB->TDB_Parent;
|
|
|
|
if (IsWOWExec(wTaskParent) || GetTDB(wTaskParent) == NULL) {
|
|
//
|
|
// Root task, extract process history, compat layer, etc
|
|
//
|
|
pszEnv = NULL;
|
|
pPSP = (PDOSPDB)SEGPTR(pTDB->TDB_PDB, 0); // psp
|
|
|
|
if (pPSP != NULL) {
|
|
pszEnv = (PCH)SEGPTR(pPSP->PDB_environ, 0);
|
|
}
|
|
|
|
//
|
|
// we have a pointer to the current environment here, pData is initialized
|
|
//
|
|
if (pszEnv != NULL) {
|
|
pData->pszProcessHistory = ShimFindEnvironmentVar(g_szProcessHistoryVar,
|
|
pszEnv,
|
|
&pData->pszProcessHistoryVal);
|
|
|
|
pData->pszCompatLayer = ShimFindEnvironmentVar(g_szCompatLayerVar,
|
|
pszEnv,
|
|
&pData->pszCompatLayerVal);
|
|
|
|
pData->pszShimFileLog = ShimFindEnvironmentVar(g_szShimFileLogVar,
|
|
pszEnv,
|
|
&pData->pszShimFileLogVal);
|
|
}
|
|
|
|
} else {
|
|
//
|
|
// Not a root task, find parent process
|
|
//
|
|
pTaskParent = FindWowTaskInfo(wTaskParent, 0); // we can't determine which thread owns the task
|
|
|
|
if (pTaskParent == NULL) {
|
|
//
|
|
// something is very wrong
|
|
// we can't inherit
|
|
//
|
|
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[UpdateWowTaskList] Task 0x%x is not root but parent not listed 0x%x",
|
|
(DWORD)hTask16,
|
|
(DWORD)wTaskParent);
|
|
//
|
|
// we still allow building up process history. The initial variables will be empty
|
|
//
|
|
|
|
|
|
} else {
|
|
//
|
|
// inherit everything from the parent and add it's module name (later)
|
|
//
|
|
|
|
pData = &pTaskParent->EnvData;
|
|
}
|
|
}
|
|
|
|
//
|
|
// Get the filename involved
|
|
//
|
|
//
|
|
|
|
lpszFileName = ShimGetTaskFileName(hTask16);
|
|
|
|
//
|
|
// now calculate how much space is required to hold all of the data
|
|
//
|
|
|
|
dwLength = sizeof(WOWTASKLISTITEM) +
|
|
(NULL == pData->pszProcessHistory ? 0 : (strlen(pData->pszProcessHistory) + 1) * sizeof(CHAR)) +
|
|
(NULL == pData->pszCompatLayer ? 0 : (strlen(pData->pszCompatLayer) + 1) * sizeof(CHAR)) +
|
|
(NULL == pData->pszShimFileLog ? 0 : (strlen(pData->pszShimFileLog) + 1) * sizeof(CHAR)) +
|
|
(NULL == pData->pszCurrentProcessHistory ? 0 : (strlen(pData->pszCurrentProcessHistory) + 1) * sizeof(CHAR)) +
|
|
(NULL == lpszFileName ? 0 : (strlen(lpszFileName) + 1) * sizeof(CHAR));
|
|
|
|
|
|
pTaskNew = (PWOWTASKLISTITEM)ShimMalloc(dwLength);
|
|
|
|
if (pTaskNew == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[UpdateWowTaskList] failed to allocate 0x%x bytes",
|
|
dwLength);
|
|
return FALSE;
|
|
}
|
|
|
|
RtlZeroMemory(pTaskNew, dwLength);
|
|
|
|
//
|
|
// now this entry has to be setup
|
|
// process history is first
|
|
//
|
|
|
|
pBuffer = (PCH)(pTaskNew + 1);
|
|
|
|
pTaskNew->hTask16 = hTask16;
|
|
pTaskNew->dwThreadId = GetCurrentThreadId();
|
|
|
|
if (pData->pszProcessHistory != NULL) {
|
|
|
|
//
|
|
// Copy process history. The processHistoryVal is a pointer into the buffer
|
|
// pointed to by pszProcessHistory: __PROCESS_HISTORY=c:\foo;c:\docs~1\install
|
|
// then pszProcessHistoryVal will point here ---------^
|
|
//
|
|
// we are copying the data and moving the pointer using the calculated offset
|
|
|
|
pTaskNew->EnvData.pszProcessHistory = pBuffer;
|
|
strcpy(pTaskNew->EnvData.pszProcessHistory, pData->pszProcessHistory);
|
|
pTaskNew->EnvData.pszProcessHistoryVal = pTaskNew->EnvData.pszProcessHistory +
|
|
(INT)(pData->pszProcessHistoryVal - pData->pszProcessHistory);
|
|
//
|
|
// There is enough space in the buffer to accomodate all the strings, so
|
|
// move pointer past current string to point at the "empty" space
|
|
//
|
|
|
|
pBuffer += strlen(pData->pszProcessHistory) + 1;
|
|
}
|
|
|
|
if (pData->pszCompatLayer != NULL) {
|
|
pTaskNew->EnvData.pszCompatLayer = pBuffer;
|
|
strcpy(pTaskNew->EnvData.pszCompatLayer, pData->pszCompatLayer);
|
|
pTaskNew->EnvData.pszCompatLayerVal = pTaskNew->EnvData.pszCompatLayer +
|
|
(INT)(pData->pszCompatLayerVal - pData->pszCompatLayer);
|
|
pBuffer += strlen(pData->pszCompatLayer) + 1;
|
|
}
|
|
|
|
if (pData->pszShimFileLog != NULL) {
|
|
pTaskNew->EnvData.pszShimFileLog = pBuffer;
|
|
strcpy(pTaskNew->EnvData.pszShimFileLog, pData->pszShimFileLog);
|
|
pTaskNew->EnvData.pszShimFileLogVal = pTaskNew->EnvData.pszShimFileLog +
|
|
(INT)(pData->pszShimFileLogVal - pData->pszShimFileLog);
|
|
pBuffer += strlen(pData->pszShimFileLog) + 1;
|
|
}
|
|
|
|
if (pData->pszCurrentProcessHistory != NULL || lpszFileName != NULL) {
|
|
//
|
|
// Now process history
|
|
//
|
|
pTaskNew->EnvData.pszCurrentProcessHistory = pBuffer;
|
|
|
|
if (pData->pszCurrentProcessHistory != NULL) {
|
|
strcpy(pTaskNew->EnvData.pszCurrentProcessHistory, pData->pszCurrentProcessHistory);
|
|
strcat(pTaskNew->EnvData.pszCurrentProcessHistory, ";");
|
|
}
|
|
|
|
if (lpszFileName != NULL) {
|
|
strcat(pTaskNew->EnvData.pszCurrentProcessHistory, lpszFileName);
|
|
}
|
|
}
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[UpdateWowTaskList] Running : \"%s\"",
|
|
lpszFileName);
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[UpdateWowTaskList] ProcessHistory : \"%s\"",
|
|
pTaskNew->EnvData.pszCurrentProcessHistory);
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[UpdateWowTaskList] BaseProcessHistory: \"%s\"",
|
|
pTaskNew->EnvData.pszProcessHistory);
|
|
|
|
LOGN(
|
|
eDbgLevelInfo,
|
|
"[UpdateWowTaskList] CompatLayer : \"%s\"",
|
|
pTaskNew->EnvData.pszCompatLayer);
|
|
|
|
|
|
//
|
|
// We are done, link the entry into the list
|
|
//
|
|
pTaskNew->pTaskNext = g_pWowTaskList;
|
|
|
|
g_pWowTaskList = pTaskNew;
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
|
|
/*++
|
|
|
|
CleanupWowTaskList
|
|
|
|
IN hTask16 16-bit task handle that is to be removed from the list of running tasks
|
|
|
|
Returns : TRUE if the function succeeds
|
|
|
|
--*/
|
|
|
|
BOOL
|
|
CleanupWowTaskList(
|
|
WORD hTask16
|
|
)
|
|
{
|
|
PWOWTASKLISTITEM pTask = g_pWowTaskList;
|
|
PWOWTASKLISTITEM pTaskPrev = NULL;
|
|
|
|
while (pTask != NULL) {
|
|
|
|
if (pTask->hTask16 == hTask16) {
|
|
// this is the item
|
|
break;
|
|
}
|
|
|
|
pTaskPrev = pTask;
|
|
pTask = pTask->pTaskNext;
|
|
}
|
|
|
|
if (pTask == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[CleanupWowTaskList] Failed to locate task information for 0x%x",
|
|
(DWORD)hTask16);
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
if (pTaskPrev == NULL) {
|
|
|
|
g_pWowTaskList = pTask->pTaskNext;
|
|
|
|
} else {
|
|
|
|
pTaskPrev->pTaskNext = pTask->pTaskNext;
|
|
|
|
}
|
|
|
|
ShimFree(pTask);
|
|
|
|
return TRUE;
|
|
|
|
}
|
|
|
|
/*++
|
|
|
|
ShimRetrieveVariablesEx
|
|
|
|
IN pData Structure that receives pointers to all the relevant environment information
|
|
for the calling thread. The threads are scheduled non-preemptively by user and
|
|
threadid is used to identify the calling 16-bit task
|
|
All the real work on information retrieval is done in UpdateWowTaskList
|
|
|
|
Returns: TRUE if success
|
|
--*/
|
|
|
|
BOOL
|
|
ShimRetrieveVariablesEx(
|
|
PWOWENVDATA pData
|
|
)
|
|
{
|
|
DWORD dwProcessId = GetCurrentProcessId();
|
|
DWORD dwThreadId = GetCurrentThreadId();
|
|
PWOWTASKLISTITEM pTask;
|
|
FINDWOWTASKDATA FindData;
|
|
WORD hTask;
|
|
BOOL bSuccess;
|
|
|
|
RtlZeroMemory(pData, sizeof(*pData));
|
|
|
|
if (!g_bInitialized) { // first call, link apis
|
|
bSuccess = ImportWowApis();
|
|
if (!bSuccess) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimRetrieveVariablesEx] Failed to import apis.");
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
if (!FindWowTask(dwProcessId, dwThreadId, &FindData)) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimRetrieveVariablesEx] Task not found ProcessId 0x%x ThreadId 0x%x",
|
|
dwProcessId,
|
|
dwThreadId);
|
|
return FALSE;
|
|
}
|
|
|
|
hTask = FindData.hTask16;
|
|
|
|
pTask = FindWowTaskInfo(hTask, dwThreadId);
|
|
|
|
if (pTask == NULL) {
|
|
LOGN(
|
|
eDbgLevelError,
|
|
"[ShimRetrieveVariablesEx] Failed to locate wow task.");
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Found this one. Copy the info.
|
|
//
|
|
RtlMoveMemory(pData, &pTask->EnvData, sizeof(*pData));
|
|
|
|
return TRUE;
|
|
}
|
|
|
|
/*++
|
|
ShimThisProcess
|
|
|
|
Function invokes Shim Engine for dynamic shimming of the current process
|
|
Which happens to be ntvdm, naturally. This ntvdm is a separate ntvdm
|
|
(which is insured through various checks in CheckAndShimNTVDM)
|
|
|
|
--*/
|
|
|
|
BOOL
|
|
ShimThisProcess(
|
|
HMODULE hModShimEngine,
|
|
HSDB hSDB,
|
|
SDBQUERYRESULT* pQueryResult
|
|
)
|
|
{
|
|
typedef BOOL (WINAPI *PFNDynamicShim)(LPCWSTR , HSDB , SDBQUERYRESULT*, LPCSTR);
|
|
PFNDynamicShim pfnDynamicShim = NULL;
|
|
WCHAR wszFileName[MAX_PATH];
|
|
DWORD dwLength;
|
|
|
|
pfnDynamicShim = (PFNDynamicShim) GetProcAddress(hModShimEngine, "SE_DynamicShim");
|
|
if (NULL == pfnDynamicShim) {
|
|
LOGN( eDbgLevelError,
|
|
"[ShimThisProcess] failed to obtain dynamic shim proc address\n");
|
|
return FALSE;
|
|
}
|
|
|
|
dwLength = GetModuleFileNameW(GetModuleHandle(NULL), wszFileName, CHARCOUNT(wszFileName));
|
|
if (!dwLength || dwLength > CHARCOUNT(wszFileName)) {
|
|
LOGN( eDbgLevelError,
|
|
"[ShimThisProcess] failed to obtain module file name\n");
|
|
return FALSE;
|
|
}
|
|
|
|
return pfnDynamicShim(wszFileName, hSDB, pQueryResult, NULL);
|
|
}
|
|
|
|
/*++
|
|
CheckAndShimNTVDM
|
|
|
|
Procedure checks ntvdm application for having to be shimmed. If an application is located in
|
|
appcompat database, this ntvdm would have to be running as a separate ntvdm (explorer is shimmed as
|
|
well, as a result it will have checked the binary first and set the separate vdm flag in CreateProcess)
|
|
|
|
Further, this call comes through InitTask (intercepted between ntvdm and user32) -- as a parameter it
|
|
takes hTask16 - which we're able to use to retrieve application's environment and other important
|
|
information.
|
|
--*/
|
|
|
|
|
|
BOOL
|
|
CheckAndShimNTVDM(
|
|
WORD hTask16
|
|
)
|
|
{
|
|
HMODULE hModShimEngine;
|
|
PSZ pszTaskFileName = NULL;
|
|
CString csTaskFileName;
|
|
DWORD dwExeCount;
|
|
PSZ pszEnv = NULL;
|
|
PTDB pTDB = NULL;
|
|
PVOID pEnvNew = NULL;
|
|
PDOSPDB pPSP;
|
|
BOOL bSuccess = FALSE;
|
|
BOOL bMatch;
|
|
BOOL bNewEnv = FALSE;
|
|
HSDB hSDB;
|
|
NTSTATUS Status;
|
|
SDBQUERYRESULT QueryResult;
|
|
DWORD dwFlags;
|
|
|
|
hModShimEngine = GetModuleHandle(TEXT("shim.dll"));
|
|
if (hModShimEngine == NULL) {
|
|
// impossible -- shim.dll is not injected!!!
|
|
return FALSE;
|
|
}
|
|
|
|
if (g_pSeparateWow != NULL && *g_pSeparateWow == FALSE) {
|
|
//
|
|
// not a separate wow
|
|
//
|
|
LOGN( eDbgLevelError,
|
|
"[CheckAndShimNTVDM] running in shared wow, no shimming\n");
|
|
return FALSE;
|
|
}
|
|
|
|
if (!g_bInitialized) { // first call, link apis
|
|
bSuccess = ImportWowApis();
|
|
if (!bSuccess) {
|
|
LOGN( eDbgLevelError,
|
|
"[CheckAndShimNTVDM] Failed to import apis.\n");
|
|
return FALSE;
|
|
}
|
|
}
|
|
|
|
if (IsWOWExec(hTask16)) {
|
|
LOGN( eDbgLevelError,
|
|
"[CheckAndShimNTVDM] not touching wowexec\n");
|
|
|
|
return FALSE;
|
|
}
|
|
|
|
csTaskFileName = ShimGetTaskFileName(hTask16);
|
|
if (csTaskFileName.IsEmpty()) {
|
|
LOGN( eDbgLevelError,
|
|
"[CheckAndShimNTVDM] failed to get the filename for task 0x%lx\n", hTask16);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// init database
|
|
//
|
|
hSDB = SdbInitDatabase(0, NULL);
|
|
|
|
if (hSDB == NULL) {
|
|
LOGN( eDbgLevelError,
|
|
"[CheckAndShimNTVDM] failed to init shim database\n");
|
|
return FALSE;
|
|
}
|
|
|
|
|
|
//
|
|
// process history please --
|
|
// if we end up here, we are a separate ntvdm
|
|
// running with a process history in the env, was retrieved in init
|
|
//
|
|
|
|
pTDB = GetTDB(hTask16);
|
|
if (NULL == pTDB) {
|
|
LOGN( eDbgLevelError, "[UpdateWowTaskList] Bad TDB entry 0x%x", hTask16);
|
|
return FALSE;
|
|
}
|
|
|
|
//
|
|
// Prepare environment data - this buffer is used when we're starting a new task from the
|
|
// root of the chain (as opposed to spawning from an existing 16-bit task)
|
|
//
|
|
|
|
pszEnv = ShimGetTaskEnvptr(hTask16);
|
|
if (NULL != pszEnv) {
|
|
Status = ShimCloneEnvironment(&pEnvNew, (LPVOID)pszEnv, FALSE);
|
|
if (!NT_SUCCESS(Status)) {
|
|
LOGN( eDbgLevelError,
|
|
"[CheckAndShimNTVDM] cannot clone environment 0x%lx\n", Status);
|
|
pEnvNew = NULL;
|
|
bNewEnv = TRUE;
|
|
}
|
|
|
|
//
|
|
// if this call has come the way of VDM - we need to carry over our environment stuff
|
|
// which is stored separately in this shim
|
|
//
|
|
// should the call to ShimCloneEnvironment fail, we will have pEnvNew == NULL
|
|
// and bNewEnv = TRUE, as a result, we shall try again to clone the environment
|
|
|
|
|
|
dwFlags = CREATE_UNICODE_ENVIRONMENT;
|
|
pEnvNew = ShimCreateWowEnvironment_U(pEnvNew, &dwFlags, bNewEnv);
|
|
}
|
|
|
|
//
|
|
// run detection please
|
|
//
|
|
|
|
bMatch = SdbGetMatchingExe(hSDB,
|
|
(LPCWSTR)csTaskFileName,
|
|
NULL, // we can give out module name as well -- but WHY?
|
|
(LPCWSTR)pEnvNew,
|
|
0,
|
|
&QueryResult);
|
|
|
|
if (bMatch) {
|
|
bSuccess = ShimThisProcess(hModShimEngine, hSDB, &QueryResult);
|
|
}
|
|
|
|
if (pEnvNew != NULL) {
|
|
ShimFreeEnvironment(pEnvNew);
|
|
}
|
|
|
|
return bSuccess;
|
|
}
|
|
|
|
|
|
|
|
IMPLEMENT_SHIM_END
|
|
|