dfhack/library/DFProcess-windows.cpp

/*
www.sourceforge.net/projects/dfhack
Copyright (c) 2009 Petr Mrázek (peterix), Kenneth Ferland (Impaler[WrG]), dorf

This software is provided 'as-is', without any express or implied
warranty. In no event will the authors be held liable for any
damages arising from the use of this software.

Permission is granted to anyone to use this software for any
purpose, including commercial applications, and to alter it and
redistribute it freely, subject to the following restrictions:

1. The origin of this software must not be misrepresented; you must
not claim that you wrote the original software. If you use this
software in a product, an acknowledgment in the product documentation
would be appreciated but is not required.

2. Altered source versions must be plainly marked as such, and
must not be misrepresented as being the original software.

3. This notice may not be removed or altered from any source
distribution.
*/
#include "DFCommonInternal.h"
using namespace DFHack;

class NormalProcess::Private
{
    public:
        Private()
        {
            my_datamodel = NULL;
            my_descriptor = NULL;
            my_handle = NULL;
            my_main_thread = NULL;
            my_window = NULL;
            my_pid = 0;
            attached = false;
            suspended = false;
        };
        ~Private(){};
        DataModel* my_datamodel;
        memory_info * my_descriptor;
        DFWindow * my_window;
        ProcessHandle my_handle;
        HANDLE my_main_thread;
        uint32_t my_pid;
        string memFile;
        bool attached;
        bool suspended;
        bool identified;
};

NormalProcess::NormalProcess(uint32_t pid, vector <memory_info> & known_versions)
: d(new Private())
{
    HMODULE hmod = NULL;
    DWORD junk;
    HANDLE hProcess;
    bool found = false;
    
    IMAGE_NT_HEADERS32 pe_header;
    IMAGE_SECTION_HEADER sections[16];
    d->identified = false;
    // open process
    hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pid );
    if (NULL == hProcess)
        return;
    
    // try getting the first module of the process
    if(EnumProcessModules(hProcess, &hmod, 1 * sizeof(HMODULE), &junk) == 0)
    {
        CloseHandle(hProcess);
        cout << "EnumProcessModules fail'd" << endl;
        return; //if enumprocessModules fails, give up
    }
    
    // got base ;)
    uint32_t base = (uint32_t)hmod;
    
    // temporarily assign this to allow some checks
    d->my_handle = hProcess;
    // read from this process
    uint32_t pe_offset = readDWord(base+0x3C);
    read(base + pe_offset                   , sizeof(pe_header), (uint8_t *)&pe_header);
    read(base + pe_offset+ sizeof(pe_header), sizeof(sections) , (uint8_t *)&sections );
    d->my_handle = 0;
    
    // see if there's a version entry that matches this process
    vector<memory_info>::iterator it;
    for ( it=known_versions.begin() ; it < known_versions.end(); it++ )
    {
        // filter by OS
        if(memory_info::OS_WINDOWS != (*it).getOS())
            continue;
        
        // filter by timestamp
        uint32_t pe_timestamp = (*it).getHexValue("pe_timestamp");
        if (pe_timestamp != pe_header.FileHeader.TimeDateStamp)
            continue;
        
        // all went well
        {
            printf("Match found! Using version %s.\n", (*it).getVersion().c_str());
            d->identified = true;
            // give the process a data model and memory layout fixed for the base of first module
            memory_info *m = new memory_info(*it);
            m->RebaseAll(base);
            // keep track of created memory_info object so we can destroy it later
            d->my_descriptor = m;
            // process is responsible for destroying its data model
            d->my_datamodel = new DMWindows40d();
            d->my_pid = pid;
            d->my_handle = hProcess;
            d->identified = true;
            
            // TODO: detect errors in thread enumeration
            vector<uint32_t> threads;
            getThreadIDs( threads );
            d->my_main_thread = OpenThread(THREAD_ALL_ACCESS, FALSE, (DWORD) threads[0]);
            
            found = true;
            break; // break the iterator loop
        }
    }
    // close handle of processes that aren't DF
    if(!found)
    {
        CloseHandle(hProcess);
    }
    else
    {
        d->my_window = new DFWindow(this);
    }
}
/*
*/

NormalProcess::~NormalProcess()
{
    if(d->attached)
    {
        detach();
    }
    // destroy data model. this is assigned by processmanager
    delete d->my_datamodel;
    delete d->my_descriptor;
    if(d->my_handle != NULL)
    {
        CloseHandle(d->my_handle);
    }
    if(d->my_main_thread != NULL)
    {
        CloseHandle(d->my_main_thread);
    }
    if(d->my_window)
    {
        delete d->my_window;
    }
    delete d;
}


DataModel *NormalProcess::getDataModel()
{
    return d->my_datamodel;
}


memory_info * NormalProcess::getDescriptor()
{
    return d->my_descriptor;
}

DFWindow * NormalProcess::getWindow()
{
    return d->my_window;
}

int NormalProcess::getPID()
{
    return d->my_pid;
}

bool NormalProcess::isSuspended()
{
    return d->suspended;
}
bool NormalProcess::isAttached()
{
    return d->attached;
}

bool NormalProcess::isIdentified()
{
    return d->identified;
}

bool NormalProcess::asyncSuspend()
{
    return suspend();
}

bool NormalProcess::suspend()
{
    if(!d->attached)
        return false;
    if(d->suspended)
    {
        return true;
    }
    SuspendThread(d->my_main_thread);
    d->suspended = true;
    return true;
}

bool NormalProcess::forceresume()
{
    if(!d->attached)
        return false;
    while (ResumeThread(d->my_main_thread) > 1);
    d->suspended = false;
    return true;
}


bool NormalProcess::resume()
{
    if(!d->attached)
        return false;
    if(!d->suspended)
    {
        return true;
    }
    ResumeThread(d->my_main_thread);
    d->suspended = false;
    return true;
}

bool NormalProcess::attach()
{
    if(g_pProcess != NULL)
    {
        return false;
    }
    d->attached = true;
    g_pProcess = this;
    suspend();

    return true;
}


bool NormalProcess::detach()
{
    if(!d->attached)
    {
        return false;
    }
    resume();
    d->attached = false;
    g_pProcess = NULL;
    return true;
}

bool NormalProcess::getThreadIDs(vector<uint32_t> & threads )
{
    HANDLE AllThreads = INVALID_HANDLE_VALUE; 
    THREADENTRY32 te32;
    
    AllThreads = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 ); 
    if( AllThreads == INVALID_HANDLE_VALUE ) 
    {
        return false; 
    }
    te32.dwSize = sizeof(THREADENTRY32 ); 
    
    if( !Thread32First( AllThreads, &te32 ) ) 
    {
        CloseHandle( AllThreads );
        return false;
    }
    
    do 
    { 
        if( te32.th32OwnerProcessID == d->my_pid )
        {
            threads.push_back(te32.th32ThreadID);
        }
    } while( Thread32Next(AllThreads, &te32 ) ); 
    
    CloseHandle( AllThreads );
    return true;
}

//FIXME: use VirtualQuery to probe for memory ranges, cross-reference with base-corrected PE segment entries
void NormalProcess::getMemRanges( vector<t_memrange> & ranges )
{
    // code here is taken from hexsearch by Silas Dunmore.
    // As this IMHO isn't a 'sunstantial portion' of anything, I'm not including the MIT license here
    
    // I'm faking this, because there's no way I'm using VirtualQuery
    
    t_memrange temp;
    uint32_t base = d->my_descriptor->getBase();
    temp.start = base + 0x1000; // more fakery.
    temp.end = base + readDWord(base+readDWord(base+0x3C)+0x50)-1; // yay for magic.
    temp.read = 1;
    temp.write = 1;
    temp.execute = 0; // fake
    strcpy(temp.name,"pants");// that's right. I'm calling it pants. Windows can go to HELL
    ranges.push_back(temp);
}

uint8_t NormalProcess::readByte (const uint32_t offset)
{
    uint8_t result;
    ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint8_t), NULL);
    return result;
}

void NormalProcess::readByte (const uint32_t offset,uint8_t &result)
{
    ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint8_t), NULL);
}

uint16_t NormalProcess::readWord (const uint32_t offset)
{
    uint16_t result;
    ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint16_t), NULL);
    return result;
}

void NormalProcess::readWord (const uint32_t offset, uint16_t &result)
{
    ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint16_t), NULL);
}

uint32_t NormalProcess::readDWord (const uint32_t offset)
{
    uint32_t result;
    ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint32_t), NULL);
    return result;
}

void NormalProcess::readDWord (const uint32_t offset, uint32_t &result)
{
    ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint32_t), NULL);
}

void NormalProcess::read (const uint32_t offset, uint32_t size, uint8_t *target)
{
    ReadProcessMemory(d->my_handle, (int*) offset, target, size, NULL);
}

// WRITING
void NormalProcess::writeDWord (const uint32_t offset, uint32_t data)
{
    WriteProcessMemory(d->my_handle, (int*) offset, &data, sizeof(uint32_t), NULL);
}

// using these is expensive.
void NormalProcess::writeWord (uint32_t offset, uint16_t data)
{
    WriteProcessMemory(d->my_handle, (int*) offset, &data, sizeof(uint16_t), NULL);
}

void NormalProcess::writeByte (uint32_t offset, uint8_t data)
{
    WriteProcessMemory(d->my_handle, (int*) offset, &data, sizeof(uint8_t), NULL);
}

void NormalProcess::write (uint32_t offset, uint32_t size, uint8_t *source)
{
    WriteProcessMemory(d->my_handle, (int*) offset, source, size, NULL);
}



///FIXME: reduce use of temporary objects
const string NormalProcess::readCString (const uint32_t offset)
{
    string temp;
    char temp_c[256];
    DWORD read;
    ReadProcessMemory(d->my_handle, (int *) offset, temp_c, 255, &read);
    temp_c[read+1] = 0;
    temp = temp_c;
    return temp;
}