Revert "Nuked many Process classes. Only SHM remains. We'll see how it goes :)"
This reverts commit b3424418e6.
Conflicts:
library/DFProcess-linux-SHM.cpp
library/DFProcess-windows-SHM.cpp
library/DFProcess.h
library/DFProcessEnumerator-linux.cpp
library/DFProcessEnumerator-windows.cpp
Minor manual changes were required.
develop
Petr Mrázek
parent
3e581908c1
commit
f0087926c5
@ -0,0 +1,595 @@
|
||||
/*
|
||||
www.sourceforge.net/projects/dfhack
|
||||
Copyright (c) 2009 Petr Mrázek (peterix), Kenneth Ferland (Impaler[WrG]), dorf
|
||||
|
||||
This software is provided 'as-is', without any express or implied
|
||||
warranty. In no event will the authors be held liable for any
|
||||
damages arising from the use of this software.
|
||||
|
||||
Permission is granted to anyone to use this software for any
|
||||
purpose, including commercial applications, and to alter it and
|
||||
redistribute it freely, subject to the following restrictions:
|
||||
|
||||
1. The origin of this software must not be misrepresented; you must
|
||||
not claim that you wrote the original software. If you use this
|
||||
software in a product, an acknowledgment in the product documentation
|
||||
would be appreciated but is not required.
|
||||
|
||||
2. Altered source versions must be plainly marked as such, and
|
||||
must not be misrepresented as being the original software.
|
||||
|
||||
3. This notice may not be removed or altered from any source
|
||||
distribution.
|
||||
*/
|
||||
#include "DFCommonInternal.h"
|
||||
#include <errno.h>
|
||||
#include <DFError.h>
|
||||
#include <sys/ptrace.h>
|
||||
using namespace DFHack;
|
||||
|
||||
class WineProcess::Private
|
||||
{
|
||||
public:
|
||||
Private()
|
||||
{
|
||||
my_descriptor = NULL;
|
||||
my_handle = NULL;
|
||||
my_window = NULL;
|
||||
my_pid = 0;
|
||||
attached = false;
|
||||
suspended = false;
|
||||
memFileHandle = 0;
|
||||
};
|
||||
~Private(){};
|
||||
DFWindow* my_window;
|
||||
memory_info * my_descriptor;
|
||||
ProcessHandle my_handle;
|
||||
uint32_t my_pid;
|
||||
string memFile;
|
||||
int memFileHandle;
|
||||
bool attached;
|
||||
bool suspended;
|
||||
bool identified;
|
||||
bool validate(char * exe_file, uint32_t pid, char * mem_file, vector <memory_info *> & known_versions);
|
||||
};
|
||||
|
||||
WineProcess::WineProcess(uint32_t pid, vector <memory_info *> & known_versions)
|
||||
: d(new Private())
|
||||
{
|
||||
char dir_name [256];
|
||||
char exe_link_name [256];
|
||||
char mem_name [256];
|
||||
char cwd_name [256];
|
||||
char cmdline_name [256];
|
||||
char target_name[1024];
|
||||
int target_result;
|
||||
|
||||
d->identified = false;
|
||||
|
||||
sprintf(dir_name,"/proc/%d/", pid);
|
||||
sprintf(exe_link_name,"/proc/%d/exe", pid);
|
||||
sprintf(mem_name,"/proc/%d/mem", pid);
|
||||
sprintf(cwd_name,"/proc/%d/cwd", pid);
|
||||
sprintf(cmdline_name,"/proc/%d/cmdline", pid);
|
||||
|
||||
// resolve /proc/PID/exe link
|
||||
target_result = readlink(exe_link_name, target_name, sizeof(target_name)-1);
|
||||
if (target_result == -1)
|
||||
{
|
||||
return;
|
||||
}
|
||||
// make sure we have a null terminated string...
|
||||
target_name[target_result] = 0;
|
||||
|
||||
// FIXME: this fails when the wine process isn't started from the 'current working directory'. strip path data from cmdline
|
||||
// is this windows version of Df running in wine?
|
||||
if(strstr(target_name, "wine-preloader")!= NULL)
|
||||
{
|
||||
// get working directory
|
||||
target_result = readlink(cwd_name, target_name, sizeof(target_name)-1);
|
||||
target_name[target_result] = 0;
|
||||
|
||||
// got path to executable, do the same for its name
|
||||
ifstream ifs ( cmdline_name , ifstream::in );
|
||||
string cmdline;
|
||||
getline(ifs,cmdline);
|
||||
if (cmdline.find("dwarfort-w.exe") != string::npos || cmdline.find("dwarfort.exe") != string::npos || cmdline.find("Dwarf Fortress.exe") != string::npos)
|
||||
{
|
||||
char exe_link[1024];
|
||||
// put executable name and path together
|
||||
sprintf(exe_link,"%s/%s",target_name,cmdline.c_str());
|
||||
|
||||
// create wine process, add it to the vector
|
||||
d->identified = d->validate(exe_link,pid,mem_name,known_versions);
|
||||
d->my_window = new DFWindow(this);
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
bool WineProcess::isSuspended()
|
||||
{
|
||||
return d->suspended;
|
||||
}
|
||||
bool WineProcess::isAttached()
|
||||
{
|
||||
return d->attached;
|
||||
}
|
||||
|
||||
bool WineProcess::isIdentified()
|
||||
{
|
||||
return d->identified;
|
||||
}
|
||||
|
||||
bool WineProcess::Private::validate(char* exe_file, uint32_t pid, char* mem_file, std::vector< memory_info* >& known_versions)
|
||||
{
|
||||
md5wrapper md5;
|
||||
// get hash of the running DF process
|
||||
string hash = md5.getHashFromFile(exe_file);
|
||||
vector<memory_info *>::iterator it;
|
||||
|
||||
// iterate over the list of memory locations
|
||||
for ( it=known_versions.begin() ; it < known_versions.end(); it++ )
|
||||
{
|
||||
string thishash;
|
||||
try
|
||||
{
|
||||
thishash = (*it)->getString("md5");
|
||||
}
|
||||
catch (Error::MissingMemoryDefinition& e)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
// are the md5 hashes the same?
|
||||
if(memory_info::OS_WINDOWS == (*it)->getOS() && hash == thishash)
|
||||
{
|
||||
memory_info * m = *it;
|
||||
my_descriptor = m;
|
||||
my_handle = my_pid = pid;
|
||||
// tell WineProcess about the /proc/PID/mem file
|
||||
memFile = mem_file;
|
||||
identified = true;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
WineProcess::~WineProcess()
|
||||
{
|
||||
if(d->attached)
|
||||
{
|
||||
detach();
|
||||
}
|
||||
if(d->my_window)
|
||||
delete d->my_window;
|
||||
delete d;
|
||||
}
|
||||
|
||||
memory_info * WineProcess::getDescriptor()
|
||||
{
|
||||
return d->my_descriptor;
|
||||
}
|
||||
|
||||
DFWindow * WineProcess::getWindow()
|
||||
{
|
||||
return d->my_window;
|
||||
}
|
||||
|
||||
int WineProcess::getPID()
|
||||
{
|
||||
return d->my_pid;
|
||||
}
|
||||
|
||||
//FIXME: implement
|
||||
bool WineProcess::getThreadIDs(vector<uint32_t> & threads )
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
//FIXME: cross-reference with ELF segment entries?
|
||||
void WineProcess::getMemRanges( vector<t_memrange> & ranges )
|
||||
{
|
||||
char buffer[1024];
|
||||
char permissions[5]; // r/-, w/-, x/-, p/s, 0
|
||||
|
||||
sprintf(buffer, "/proc/%lu/maps", d->my_pid);
|
||||
FILE *mapFile = ::fopen(buffer, "r");
|
||||
uint64_t offset, device1, device2, node;
|
||||
|
||||
while (fgets(buffer, 1024, mapFile))
|
||||
{
|
||||
t_memrange temp;
|
||||
temp.name[0] = 0;
|
||||
sscanf(buffer, "%llx-%llx %s %llx %2llu:%2llu %llu %s",
|
||||
&temp.start,
|
||||
&temp.end,
|
||||
(char*)&permissions,
|
||||
&offset, &device1, &device2, &node,
|
||||
(char*)&temp.name);
|
||||
temp.read = permissions[0] == 'r';
|
||||
temp.write = permissions[1] == 'w';
|
||||
temp.execute = permissions[2] == 'x';
|
||||
ranges.push_back(temp);
|
||||
}
|
||||
}
|
||||
|
||||
bool WineProcess::asyncSuspend()
|
||||
{
|
||||
return suspend();
|
||||
}
|
||||
|
||||
bool WineProcess::suspend()
|
||||
{
|
||||
int status;
|
||||
if(!d->attached)
|
||||
return false;
|
||||
if(d->suspended)
|
||||
return true;
|
||||
if (kill(d->my_handle, SIGSTOP) == -1)
|
||||
{
|
||||
// no, we got an error
|
||||
perror("kill SIGSTOP error");
|
||||
return false;
|
||||
}
|
||||
while(true)
|
||||
{
|
||||
// we wait on the pid
|
||||
pid_t w = waitpid(d->my_handle, &status, 0);
|
||||
if (w == -1)
|
||||
{
|
||||
// child died
|
||||
perror("DF exited during suspend call");
|
||||
return false;
|
||||
}
|
||||
// stopped -> let's continue
|
||||
if (WIFSTOPPED(status))
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
d->suspended = true;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool WineProcess::forceresume()
|
||||
{
|
||||
return resume();
|
||||
}
|
||||
|
||||
bool WineProcess::resume()
|
||||
{
|
||||
if(!d->attached)
|
||||
return false;
|
||||
if(!d->suspended)
|
||||
return true;
|
||||
if (ptrace(PTRACE_CONT, d->my_handle, NULL, NULL) == -1)
|
||||
{
|
||||
// no, we got an error
|
||||
perror("ptrace resume error");
|
||||
return false;
|
||||
}
|
||||
d->suspended = false;
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
bool WineProcess::attach()
|
||||
{
|
||||
int status;
|
||||
if(g_pProcess != NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
// can we attach?
|
||||
if (ptrace(PTRACE_ATTACH , d->my_handle, NULL, NULL) == -1)
|
||||
{
|
||||
// no, we got an error
|
||||
perror("ptrace attach error");
|
||||
cerr << "attach failed on pid " << d->my_handle << endl;
|
||||
return false;
|
||||
}
|
||||
while(true)
|
||||
{
|
||||
// we wait on the pid
|
||||
pid_t w = waitpid(d->my_handle, &status, 0);
|
||||
if (w == -1)
|
||||
{
|
||||
// child died
|
||||
perror("wait inside attach()");
|
||||
return false;
|
||||
}
|
||||
// stopped -> let's continue
|
||||
if (WIFSTOPPED(status))
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
d->suspended = true;
|
||||
|
||||
int proc_pid_mem = open(d->memFile.c_str(),O_RDONLY);
|
||||
if(proc_pid_mem == -1)
|
||||
{
|
||||
ptrace(PTRACE_DETACH, d->my_handle, NULL, NULL);
|
||||
cerr << d->memFile << endl;
|
||||
cerr << "couldn't open /proc/" << d->my_handle << "/mem" << endl;
|
||||
perror("open(memFile.c_str(),O_RDONLY)");
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
d->attached = true;
|
||||
g_pProcess = this;
|
||||
|
||||
d->memFileHandle = proc_pid_mem;
|
||||
return true; // we are attached
|
||||
}
|
||||
}
|
||||
|
||||
bool WineProcess::detach()
|
||||
{
|
||||
if(!d->attached) return false;
|
||||
if(!d->suspended) suspend();
|
||||
int result = 0;
|
||||
// close /proc/PID/mem
|
||||
result = close(d->memFileHandle);
|
||||
if(result == -1)
|
||||
{
|
||||
cerr << "couldn't close /proc/"<< d->my_handle <<"/mem" << endl;
|
||||
perror("mem file close");
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
// detach
|
||||
result = ptrace(PTRACE_DETACH, d->my_handle, NULL, NULL);
|
||||
if(result == -1)
|
||||
{
|
||||
cerr << "couldn't detach from process pid" << d->my_handle << endl;
|
||||
perror("ptrace detach");
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
d->attached = false;
|
||||
g_pProcess = NULL;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// danger: uses recursion!
|
||||
void WineProcess::read (const uint32_t offset, const uint32_t size, uint8_t *target)
|
||||
{
|
||||
if(size == 0) return;
|
||||
|
||||
ssize_t result;
|
||||
result = pread(d->memFileHandle, target,size,offset);
|
||||
if(result != size)
|
||||
{
|
||||
if(result == -1)
|
||||
{
|
||||
cerr << "pread failed: can't read " << size << " bytes at addres " << offset << endl;
|
||||
cerr << "errno: " << errno << endl;
|
||||
errno = 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
read(offset + result, size - result, target + result);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
uint8_t WineProcess::readByte (const uint32_t offset)
|
||||
{
|
||||
uint8_t val;
|
||||
read(offset, 1, &val);
|
||||
return val;
|
||||
}
|
||||
|
||||
void WineProcess::readByte (const uint32_t offset, uint8_t &val )
|
||||
{
|
||||
read(offset, 1, &val);
|
||||
}
|
||||
|
||||
uint16_t WineProcess::readWord (const uint32_t offset)
|
||||
{
|
||||
uint16_t val;
|
||||
read(offset, 2, (uint8_t *) &val);
|
||||
return val;
|
||||
}
|
||||
|
||||
void WineProcess::readWord (const uint32_t offset, uint16_t &val)
|
||||
{
|
||||
read(offset, 2, (uint8_t *) &val);
|
||||
}
|
||||
|
||||
uint32_t WineProcess::readDWord (const uint32_t offset)
|
||||
{
|
||||
uint32_t val;
|
||||
read(offset, 4, (uint8_t *) &val);
|
||||
return val;
|
||||
}
|
||||
void WineProcess::readDWord (const uint32_t offset, uint32_t &val)
|
||||
{
|
||||
read(offset, 4, (uint8_t *) &val);
|
||||
}
|
||||
|
||||
/*
|
||||
* WRITING
|
||||
*/
|
||||
|
||||
void WineProcess::writeDWord (uint32_t offset, uint32_t data)
|
||||
{
|
||||
ptrace(PTRACE_POKEDATA,d->my_handle, offset, data);
|
||||
}
|
||||
|
||||
// using these is expensive.
|
||||
void WineProcess::writeWord (uint32_t offset, uint16_t data)
|
||||
{
|
||||
uint32_t orig = readDWord(offset);
|
||||
orig &= 0xFFFF0000;
|
||||
orig |= data;
|
||||
/*
|
||||
orig |= 0x0000FFFF;
|
||||
orig &= data;
|
||||
*/
|
||||
ptrace(PTRACE_POKEDATA,d->my_handle, offset, orig);
|
||||
}
|
||||
|
||||
void WineProcess::writeByte (uint32_t offset, uint8_t data)
|
||||
{
|
||||
uint32_t orig = readDWord(offset);
|
||||
orig &= 0xFFFFFF00;
|
||||
orig |= data;
|
||||
/*
|
||||
orig |= 0x000000FF;
|
||||
orig &= data;
|
||||
*/
|
||||
ptrace(PTRACE_POKEDATA,d->my_handle, offset, orig);
|
||||
}
|
||||
|
||||
// blah. I hate the kernel devs for crippling /proc/PID/mem. THIS IS RIDICULOUS
|
||||
void WineProcess::write (uint32_t offset, uint32_t size, uint8_t *source)
|
||||
{
|
||||
uint32_t indexptr = 0;
|
||||
while (size > 0)
|
||||
{
|
||||
// default: we push 4 bytes
|
||||
if(size >= 4)
|
||||
{
|
||||
writeDWord(offset, *(uint32_t *) (source + indexptr));
|
||||
offset +=4;
|
||||
indexptr +=4;
|
||||
size -=4;
|
||||
}
|
||||
// last is either three or 2 bytes
|
||||
else if(size >= 2)
|
||||
{
|
||||
writeWord(offset, *(uint16_t *) (source + indexptr));
|
||||
offset +=2;
|
||||
indexptr +=2;
|
||||
size -=2;
|
||||
}
|
||||
// finishing move
|
||||
else if(size == 1)
|
||||
{
|
||||
writeByte(offset, *(uint8_t *) (source + indexptr));
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const std::string WineProcess::readCString (uint32_t offset)
|
||||
{
|
||||
std::string temp;
|
||||
char temp_c[256];
|
||||
int counter = 0;
|
||||
char r;
|
||||
do
|
||||
{
|
||||
r = readByte(offset+counter);
|
||||
temp_c[counter] = r;
|
||||
counter++;
|
||||
} while (r && counter < 255);
|
||||
temp_c[counter] = 0;
|
||||
temp = temp_c;
|
||||
return temp;
|
||||
}
|
||||
|
||||
DfVector WineProcess::readVector (uint32_t offset, uint32_t item_size)
|
||||
{
|
||||
/*
|
||||
MSVC++ vector is four pointers long
|
||||
ptr allocator
|
||||
ptr start
|
||||
ptr end
|
||||
ptr alloc_end
|
||||
|
||||
we don't care about alloc_end because we don't try to add stuff
|
||||
we also don't care about the allocator thing in front
|
||||
*/
|
||||
uint32_t start = g_pProcess->readDWord(offset+4);
|
||||
uint32_t end = g_pProcess->readDWord(offset+8);
|
||||
uint32_t size = (end - start) /4;
|
||||
return DfVector(start,size,item_size);
|
||||
}
|
||||
|
||||
size_t WineProcess::readSTLString (uint32_t offset, char * buffer, size_t bufcapacity)
|
||||
{
|
||||
/*
|
||||
MSVC++ string
|
||||
ptr allocator
|
||||
union
|
||||
{
|
||||
char[16] start;
|
||||
char * start_ptr
|
||||
}
|
||||
Uint32 length
|
||||
Uint32 capacity
|
||||
*/
|
||||
uint32_t start_offset = offset + 4;
|
||||
size_t length = g_pProcess->readDWord(offset + 20);
|
||||
|
||||
size_t capacity = g_pProcess->readDWord(offset + 24);
|
||||
size_t read_real = min(length, bufcapacity-1);// keep space for null termination
|
||||
|
||||
// read data from inside the string structure
|
||||
if(capacity < 16)
|
||||
{
|
||||
g_pProcess->read(start_offset, read_real , (uint8_t *)buffer);
|
||||
}
|
||||
else // read data from what the offset + 4 dword points to
|
||||
{
|
||||
start_offset = g_pProcess->readDWord(start_offset);// dereference the start offset
|
||||
g_pProcess->read(start_offset, read_real, (uint8_t *)buffer);
|
||||
}
|
||||
|
||||
buffer[read_real] = 0;
|
||||
return read_real;
|
||||
}
|
||||
|
||||
const string WineProcess::readSTLString (uint32_t offset)
|
||||
{
|
||||
/*
|
||||
MSVC++ string
|
||||
ptr allocator
|
||||
union
|
||||
{
|
||||
char[16] start;
|
||||
char * start_ptr
|
||||
}
|
||||
Uint32 length
|
||||
Uint32 capacity
|
||||
*/
|
||||
uint32_t start_offset = offset + 4;
|
||||
uint32_t length = g_pProcess->readDWord(offset + 20);
|
||||
uint32_t capacity = g_pProcess->readDWord(offset + 24);
|
||||
char * temp = new char[capacity+1];
|
||||
|
||||
// read data from inside the string structure
|
||||
if(capacity < 16)
|
||||
{
|
||||
g_pProcess->read(start_offset, capacity, (uint8_t *)temp);
|
||||
}
|
||||
else // read data from what the offset + 4 dword points to
|
||||
{
|
||||
start_offset = g_pProcess->readDWord(start_offset);// dereference the start offset
|
||||
g_pProcess->read(start_offset, capacity, (uint8_t *)temp);
|
||||
}
|
||||
|
||||
temp[length] = 0;
|
||||
string ret = temp;
|
||||
delete temp;
|
||||
return ret;
|
||||
}
|
||||
|
||||
string WineProcess::readClassName (uint32_t vptr)
|
||||
{
|
||||
int rtti = readDWord(vptr - 0x4);
|
||||
int typeinfo = readDWord(rtti + 0xC);
|
||||
string raw = readCString(typeinfo + 0xC); // skips the .?AV
|
||||
raw.resize(raw.length() - 4);// trim st@@ from end
|
||||
return raw;
|
||||
}
|
||||
@ -0,0 +1,546 @@
|
||||
/*
|
||||
www.sourceforge.net/projects/dfhack
|
||||
Copyright (c) 2009 Petr Mrázek (peterix), Kenneth Ferland (Impaler[WrG]), dorf
|
||||
|
||||
This software is provided 'as-is', without any express or implied
|
||||
warranty. In no event will the authors be held liable for any
|
||||
damages arising from the use of this software.
|
||||
|
||||
Permission is granted to anyone to use this software for any
|
||||
purpose, including commercial applications, and to alter it and
|
||||
redistribute it freely, subject to the following restrictions:
|
||||
|
||||
1. The origin of this software must not be misrepresented; you must
|
||||
not claim that you wrote the original software. If you use this
|
||||
software in a product, an acknowledgment in the product documentation
|
||||
would be appreciated but is not required.
|
||||
|
||||
2. Altered source versions must be plainly marked as such, and
|
||||
must not be misrepresented as being the original software.
|
||||
|
||||
3. This notice may not be removed or altered from any source
|
||||
distribution.
|
||||
*/
|
||||
#include "DFCommonInternal.h"
|
||||
#include <errno.h>
|
||||
#include <sys/ptrace.h>
|
||||
using namespace DFHack;
|
||||
|
||||
class NormalProcess::Private
|
||||
{
|
||||
public:
|
||||
Private()
|
||||
{
|
||||
my_descriptor = NULL;
|
||||
my_handle = NULL;
|
||||
my_window = NULL;
|
||||
my_pid = 0;
|
||||
attached = false;
|
||||
suspended = false;
|
||||
memFileHandle = 0;
|
||||
};
|
||||
~Private(){};
|
||||
DFWindow* my_window;
|
||||
memory_info * my_descriptor;
|
||||
ProcessHandle my_handle;
|
||||
uint32_t my_pid;
|
||||
string memFile;
|
||||
int memFileHandle;
|
||||
bool attached;
|
||||
bool suspended;
|
||||
bool identified;
|
||||
bool validate(char * exe_file, uint32_t pid, char * mem_file, vector <memory_info *> & known_versions);
|
||||
};
|
||||
|
||||
NormalProcess::NormalProcess(uint32_t pid, vector< memory_info* >& known_versions)
|
||||
: d(new Private())
|
||||
{
|
||||
char dir_name [256];
|
||||
char exe_link_name [256];
|
||||
char mem_name [256];
|
||||
char cwd_name [256];
|
||||
char cmdline_name [256];
|
||||
char target_name[1024];
|
||||
int target_result;
|
||||
|
||||
d->identified = false;
|
||||
|
||||
sprintf(dir_name,"/proc/%d/", pid);
|
||||
sprintf(exe_link_name,"/proc/%d/exe", pid);
|
||||
sprintf(mem_name,"/proc/%d/mem", pid);
|
||||
sprintf(cwd_name,"/proc/%d/cwd", pid);
|
||||
sprintf(cmdline_name,"/proc/%d/cmdline", pid);
|
||||
|
||||
// resolve /proc/PID/exe link
|
||||
target_result = readlink(exe_link_name, target_name, sizeof(target_name)-1);
|
||||
if (target_result == -1)
|
||||
{
|
||||
return;
|
||||
}
|
||||
// make sure we have a null terminated string...
|
||||
target_name[target_result] = 0;
|
||||
|
||||
// is this the regular linux DF?
|
||||
if (strstr(target_name, "dwarfort.exe") != NULL)
|
||||
{
|
||||
// create linux process, add it to the vector
|
||||
d->identified = d->validate(target_name,pid,mem_name,known_versions );
|
||||
d->my_window = new DFWindow(this);
|
||||
return;
|
||||
}
|
||||
}
|
||||
|
||||
bool NormalProcess::isSuspended()
|
||||
{
|
||||
return d->suspended;
|
||||
}
|
||||
bool NormalProcess::isAttached()
|
||||
{
|
||||
return d->attached;
|
||||
}
|
||||
|
||||
bool NormalProcess::isIdentified()
|
||||
{
|
||||
return d->identified;
|
||||
}
|
||||
|
||||
bool NormalProcess::Private::validate(char * exe_file,uint32_t pid, char * memFile, vector <memory_info *> & known_versions)
|
||||
{
|
||||
md5wrapper md5;
|
||||
// get hash of the running DF process
|
||||
string hash = md5.getHashFromFile(exe_file);
|
||||
vector<memory_info *>::iterator it;
|
||||
|
||||
// iterate over the list of memory locations
|
||||
for ( it=known_versions.begin() ; it < known_versions.end(); it++ )
|
||||
{
|
||||
try
|
||||
{
|
||||
if(hash == (*it)->getString("md5")) // are the md5 hashes the same?
|
||||
{
|
||||
memory_info * m = *it;
|
||||
if (memory_info::OS_LINUX == m->getOS())
|
||||
{
|
||||
my_descriptor = m;
|
||||
my_handle = my_pid = pid;
|
||||
}
|
||||
else
|
||||
{
|
||||
// some error happened, continue with next process
|
||||
continue;
|
||||
}
|
||||
// tell NormalProcess about the /proc/PID/mem file
|
||||
this->memFile = memFile;
|
||||
identified = true;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
catch (Error::MissingMemoryDefinition&)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
}
|
||||
return false;
|
||||
}
|
||||
|
||||
NormalProcess::~NormalProcess()
|
||||
{
|
||||
if(d->attached)
|
||||
{
|
||||
detach();
|
||||
}
|
||||
// destroy data model. this is assigned by processmanager
|
||||
if(d->my_window)
|
||||
delete d->my_window;
|
||||
delete d;
|
||||
}
|
||||
|
||||
memory_info * NormalProcess::getDescriptor()
|
||||
{
|
||||
return d->my_descriptor;
|
||||
}
|
||||
|
||||
DFWindow * NormalProcess::getWindow()
|
||||
{
|
||||
return d->my_window;
|
||||
}
|
||||
|
||||
int NormalProcess::getPID()
|
||||
{
|
||||
return d->my_pid;
|
||||
}
|
||||
|
||||
//FIXME: implement
|
||||
bool NormalProcess::getThreadIDs(vector<uint32_t> & threads )
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
||||
//FIXME: cross-reference with ELF segment entries?
|
||||
void NormalProcess::getMemRanges( vector<t_memrange> & ranges )
|
||||
{
|
||||
char buffer[1024];
|
||||
char permissions[5]; // r/-, w/-, x/-, p/s, 0
|
||||
|
||||
sprintf(buffer, "/proc/%lu/maps", d->my_pid);
|
||||
FILE *mapFile = ::fopen(buffer, "r");
|
||||
uint64_t offset, device1, device2, node;
|
||||
|
||||
while (fgets(buffer, 1024, mapFile))
|
||||
{
|
||||
t_memrange temp;
|
||||
temp.name[0] = 0;
|
||||
sscanf(buffer, "%llx-%llx %s %llx %2llu:%2llu %llu %s",
|
||||
&temp.start,
|
||||
&temp.end,
|
||||
(char*)&permissions,
|
||||
&offset, &device1, &device2, &node,
|
||||
(char*)&temp.name);
|
||||
temp.read = permissions[0] == 'r';
|
||||
temp.write = permissions[1] == 'w';
|
||||
temp.execute = permissions[2] == 'x';
|
||||
ranges.push_back(temp);
|
||||
}
|
||||
}
|
||||
|
||||
bool NormalProcess::asyncSuspend()
|
||||
{
|
||||
return suspend();
|
||||
}
|
||||
|
||||
bool NormalProcess::suspend()
|
||||
{
|
||||
int status;
|
||||
if(!d->attached)
|
||||
return false;
|
||||
if(d->suspended)
|
||||
return true;
|
||||
if (kill(d->my_handle, SIGSTOP) == -1)
|
||||
{
|
||||
// no, we got an error
|
||||
perror("kill SIGSTOP error");
|
||||
return false;
|
||||
}
|
||||
while(true)
|
||||
{
|
||||
// we wait on the pid
|
||||
pid_t w = waitpid(d->my_handle, &status, 0);
|
||||
if (w == -1)
|
||||
{
|
||||
// child died
|
||||
perror("DF exited during suspend call");
|
||||
return false;
|
||||
}
|
||||
// stopped -> let's continue
|
||||
if (WIFSTOPPED(status))
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
d->suspended = true;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool NormalProcess::forceresume()
|
||||
{
|
||||
return resume();
|
||||
}
|
||||
|
||||
bool NormalProcess::resume()
|
||||
{
|
||||
if(!d->attached)
|
||||
return false;
|
||||
if(!d->suspended)
|
||||
return true;
|
||||
if (ptrace(PTRACE_CONT, d->my_handle, NULL, NULL) == -1)
|
||||
{
|
||||
// no, we got an error
|
||||
perror("ptrace resume error");
|
||||
return false;
|
||||
}
|
||||
d->suspended = false;
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
bool NormalProcess::attach()
|
||||
{
|
||||
int status;
|
||||
if(g_pProcess != NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
// can we attach?
|
||||
if (ptrace(PTRACE_ATTACH , d->my_handle, NULL, NULL) == -1)
|
||||
{
|
||||
// no, we got an error
|
||||
perror("ptrace attach error");
|
||||
cerr << "attach failed on pid " << d->my_handle << endl;
|
||||
return false;
|
||||
}
|
||||
while(true)
|
||||
{
|
||||
// we wait on the pid
|
||||
pid_t w = waitpid(d->my_handle, &status, 0);
|
||||
if (w == -1)
|
||||
{
|
||||
// child died
|
||||
perror("wait inside attach()");
|
||||
return false;
|
||||
}
|
||||
// stopped -> let's continue
|
||||
if (WIFSTOPPED(status))
|
||||
{
|
||||
break;
|
||||
}
|
||||
}
|
||||
d->suspended = true;
|
||||
|
||||
int proc_pid_mem = open(d->memFile.c_str(),O_RDONLY);
|
||||
if(proc_pid_mem == -1)
|
||||
{
|
||||
ptrace(PTRACE_DETACH, d->my_handle, NULL, NULL);
|
||||
cerr << "couldn't open /proc/" << d->my_handle << "/mem" << endl;
|
||||
perror("open(memFile.c_str(),O_RDONLY)");
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
d->attached = true;
|
||||
g_pProcess = this;
|
||||
|
||||
d->memFileHandle = proc_pid_mem;
|
||||
return true; // we are attached
|
||||
}
|
||||
}
|
||||
|
||||
bool NormalProcess::detach()
|
||||
{
|
||||
if(!d->attached) return false;
|
||||
if(!d->suspended) suspend();
|
||||
int result = 0;
|
||||
// close /proc/PID/mem
|
||||
result = close(d->memFileHandle);
|
||||
if(result == -1)
|
||||
{
|
||||
cerr << "couldn't close /proc/"<< d->my_handle <<"/mem" << endl;
|
||||
perror("mem file close");
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
// detach
|
||||
result = ptrace(PTRACE_DETACH, d->my_handle, NULL, NULL);
|
||||
if(result == -1)
|
||||
{
|
||||
cerr << "couldn't detach from process pid" << d->my_handle << endl;
|
||||
perror("ptrace detach");
|
||||
return false;
|
||||
}
|
||||
else
|
||||
{
|
||||
d->attached = false;
|
||||
g_pProcess = NULL;
|
||||
return true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
// danger: uses recursion!
|
||||
void NormalProcess::read (const uint32_t offset, const uint32_t size, uint8_t *target)
|
||||
{
|
||||
if(size == 0) return;
|
||||
|
||||
ssize_t result;
|
||||
result = pread(d->memFileHandle, target,size,offset);
|
||||
if(result != size)
|
||||
{
|
||||
if(result == -1)
|
||||
{
|
||||
cerr << "pread failed: can't read " << size << " bytes at addres " << offset << endl;
|
||||
cerr << "errno: " << errno << endl;
|
||||
errno = 0;
|
||||
}
|
||||
else
|
||||
{
|
||||
read(offset + result, size - result, target + result);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
uint8_t NormalProcess::readByte (const uint32_t offset)
|
||||
{
|
||||
uint8_t val;
|
||||
read(offset, 1, &val);
|
||||
return val;
|
||||
}
|
||||
|
||||
void NormalProcess::readByte (const uint32_t offset, uint8_t &val )
|
||||
{
|
||||
read(offset, 1, &val);
|
||||
}
|
||||
|
||||
uint16_t NormalProcess::readWord (const uint32_t offset)
|
||||
{
|
||||
uint16_t val;
|
||||
read(offset, 2, (uint8_t *) &val);
|
||||
return val;
|
||||
}
|
||||
|
||||
void NormalProcess::readWord (const uint32_t offset, uint16_t &val)
|
||||
{
|
||||
read(offset, 2, (uint8_t *) &val);
|
||||
}
|
||||
|
||||
uint32_t NormalProcess::readDWord (const uint32_t offset)
|
||||
{
|
||||
uint32_t val;
|
||||
read(offset, 4, (uint8_t *) &val);
|
||||
return val;
|
||||
}
|
||||
void NormalProcess::readDWord (const uint32_t offset, uint32_t &val)
|
||||
{
|
||||
read(offset, 4, (uint8_t *) &val);
|
||||
}
|
||||
|
||||
/*
|
||||
* WRITING
|
||||
*/
|
||||
|
||||
void NormalProcess::writeDWord (uint32_t offset, uint32_t data)
|
||||
{
|
||||
ptrace(PTRACE_POKEDATA,d->my_handle, offset, data);
|
||||
}
|
||||
|
||||
// using these is expensive.
|
||||
void NormalProcess::writeWord (uint32_t offset, uint16_t data)
|
||||
{
|
||||
uint32_t orig = readDWord(offset);
|
||||
orig &= 0xFFFF0000;
|
||||
orig |= data;
|
||||
/*
|
||||
orig |= 0x0000FFFF;
|
||||
orig &= data;
|
||||
*/
|
||||
ptrace(PTRACE_POKEDATA,d->my_handle, offset, orig);
|
||||
}
|
||||
|
||||
void NormalProcess::writeByte (uint32_t offset, uint8_t data)
|
||||
{
|
||||
uint32_t orig = readDWord(offset);
|
||||
orig &= 0xFFFFFF00;
|
||||
orig |= data;
|
||||
/*
|
||||
orig |= 0x000000FF;
|
||||
orig &= data;
|
||||
*/
|
||||
ptrace(PTRACE_POKEDATA,d->my_handle, offset, orig);
|
||||
}
|
||||
|
||||
// blah. I hate the kernel devs for crippling /proc/PID/mem. THIS IS RIDICULOUS
|
||||
void NormalProcess::write (uint32_t offset, uint32_t size, uint8_t *source)
|
||||
{
|
||||
uint32_t indexptr = 0;
|
||||
while (size > 0)
|
||||
{
|
||||
// default: we push 4 bytes
|
||||
if(size >= 4)
|
||||
{
|
||||
writeDWord(offset, *(uint32_t *) (source + indexptr));
|
||||
offset +=4;
|
||||
indexptr +=4;
|
||||
size -=4;
|
||||
}
|
||||
// last is either three or 2 bytes
|
||||
else if(size >= 2)
|
||||
{
|
||||
writeWord(offset, *(uint16_t *) (source + indexptr));
|
||||
offset +=2;
|
||||
indexptr +=2;
|
||||
size -=2;
|
||||
}
|
||||
// finishing move
|
||||
else if(size == 1)
|
||||
{
|
||||
writeByte(offset, *(uint8_t *) (source + indexptr));
|
||||
return;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
const std::string NormalProcess::readCString (uint32_t offset)
|
||||
{
|
||||
std::string temp;
|
||||
char temp_c[256];
|
||||
int counter = 0;
|
||||
char r;
|
||||
do
|
||||
{
|
||||
r = readByte(offset+counter);
|
||||
temp_c[counter] = r;
|
||||
counter++;
|
||||
} while (r && counter < 255);
|
||||
temp_c[counter] = 0;
|
||||
temp = temp_c;
|
||||
return temp;
|
||||
}
|
||||
|
||||
DfVector NormalProcess::readVector (uint32_t offset, uint32_t item_size)
|
||||
{
|
||||
/*
|
||||
GNU libstdc++ vector is three pointers long
|
||||
ptr start
|
||||
ptr end
|
||||
ptr alloc_end
|
||||
|
||||
we don't care about alloc_end because we don't try to add stuff
|
||||
*/
|
||||
uint32_t start = g_pProcess->readDWord(offset);
|
||||
uint32_t end = g_pProcess->readDWord(offset+4);
|
||||
uint32_t size = (end - start) /4;
|
||||
return DfVector(start,size,item_size);
|
||||
}
|
||||
|
||||
struct _Rep_base
|
||||
{
|
||||
uint32_t _M_length;
|
||||
uint32_t _M_capacity;
|
||||
uint32_t _M_refcount;
|
||||
};
|
||||
|
||||
size_t NormalProcess::readSTLString (uint32_t offset, char * buffer, size_t bufcapacity)
|
||||
{
|
||||
_Rep_base header;
|
||||
offset = g_pProcess->readDWord(offset);
|
||||
g_pProcess->read(offset - sizeof(_Rep_base),sizeof(_Rep_base),(uint8_t *)&header);
|
||||
size_t read_real = min((size_t)header._M_length, bufcapacity-1);// keep space for null termination
|
||||
g_pProcess->read(offset,read_real,(uint8_t * )buffer);
|
||||
buffer[read_real] = 0;
|
||||
return read_real;
|
||||
}
|
||||
|
||||
const string NormalProcess::readSTLString (uint32_t offset)
|
||||
{
|
||||
_Rep_base header;
|
||||
|
||||
offset = g_pProcess->readDWord(offset);
|
||||
g_pProcess->read(offset - sizeof(_Rep_base),sizeof(_Rep_base),(uint8_t *)&header);
|
||||
|
||||
// FIXME: use char* everywhere, avoid string
|
||||
char * temp = new char[header._M_length+1];
|
||||
g_pProcess->read(offset,header._M_length+1,(uint8_t * )temp);
|
||||
string ret(temp);
|
||||
delete temp;
|
||||
return ret;
|
||||
}
|
||||
|
||||
string NormalProcess::readClassName (uint32_t vptr)
|
||||
{
|
||||
int typeinfo = readDWord(vptr - 0x4);
|
||||
int typestring = readDWord(typeinfo + 0x4);
|
||||
string raw = readCString(typestring);
|
||||
size_t start = raw.find_first_of("abcdefghijklmnopqrstuvwxyz");// trim numbers
|
||||
size_t end = raw.length();
|
||||
return raw.substr(start,end-start - 2); // trim the 'st' from the end
|
||||
}
|
||||
@ -0,0 +1,482 @@
|
||||
/*
|
||||
www.sourceforge.net/projects/dfhack
|
||||
Copyright (c) 2009 Petr Mrázek (peterix), Kenneth Ferland (Impaler[WrG]), dorf
|
||||
|
||||
This software is provided 'as-is', without any express or implied
|
||||
warranty. In no event will the authors be held liable for any
|
||||
damages arising from the use of this software.
|
||||
|
||||
Permission is granted to anyone to use this software for any
|
||||
purpose, including commercial applications, and to alter it and
|
||||
redistribute it freely, subject to the following restrictions:
|
||||
|
||||
1. The origin of this software must not be misrepresented; you must
|
||||
not claim that you wrote the original software. If you use this
|
||||
software in a product, an acknowledgment in the product documentation
|
||||
would be appreciated but is not required.
|
||||
|
||||
2. Altered source versions must be plainly marked as such, and
|
||||
must not be misrepresented as being the original software.
|
||||
|
||||
3. This notice may not be removed or altered from any source
|
||||
distribution.
|
||||
*/
|
||||
#include "DFCommonInternal.h"
|
||||
using namespace DFHack;
|
||||
|
||||
class NormalProcess::Private
|
||||
{
|
||||
public:
|
||||
Private()
|
||||
{
|
||||
my_descriptor = NULL;
|
||||
my_handle = NULL;
|
||||
my_main_thread = NULL;
|
||||
my_window = NULL;
|
||||
my_pid = 0;
|
||||
attached = false;
|
||||
suspended = false;
|
||||
};
|
||||
~Private(){};
|
||||
memory_info * my_descriptor;
|
||||
DFWindow * my_window;
|
||||
ProcessHandle my_handle;
|
||||
HANDLE my_main_thread;
|
||||
uint32_t my_pid;
|
||||
string memFile;
|
||||
bool attached;
|
||||
bool suspended;
|
||||
bool identified;
|
||||
};
|
||||
|
||||
NormalProcess::NormalProcess(uint32_t pid, vector <memory_info *> & known_versions)
|
||||
: d(new Private())
|
||||
{
|
||||
HMODULE hmod = NULL;
|
||||
DWORD junk;
|
||||
HANDLE hProcess;
|
||||
bool found = false;
|
||||
|
||||
IMAGE_NT_HEADERS32 pe_header;
|
||||
IMAGE_SECTION_HEADER sections[16];
|
||||
d->identified = false;
|
||||
// open process
|
||||
hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pid );
|
||||
if (NULL == hProcess)
|
||||
return;
|
||||
|
||||
// try getting the first module of the process
|
||||
if(EnumProcessModules(hProcess, &hmod, 1 * sizeof(HMODULE), &junk) == 0)
|
||||
{
|
||||
CloseHandle(hProcess);
|
||||
// cout << "EnumProcessModules fail'd" << endl;
|
||||
return; //if enumprocessModules fails, give up
|
||||
}
|
||||
|
||||
// got base ;)
|
||||
uint32_t base = (uint32_t)hmod;
|
||||
|
||||
// temporarily assign this to allow some checks
|
||||
d->my_handle = hProcess;
|
||||
// read from this process
|
||||
uint32_t pe_offset = readDWord(base+0x3C);
|
||||
read(base + pe_offset , sizeof(pe_header), (uint8_t *)&pe_header);
|
||||
read(base + pe_offset+ sizeof(pe_header), sizeof(sections) , (uint8_t *)§ions );
|
||||
d->my_handle = 0;
|
||||
|
||||
// see if there's a version entry that matches this process
|
||||
vector<memory_info*>::iterator it;
|
||||
for ( it=known_versions.begin() ; it < known_versions.end(); it++ )
|
||||
{
|
||||
// filter by OS
|
||||
if(memory_info::OS_WINDOWS != (*it)->getOS())
|
||||
continue;
|
||||
uint32_t pe_timestamp;
|
||||
// filter by timestamp, skip entries without a timestamp
|
||||
try
|
||||
{
|
||||
pe_timestamp = (*it)->getHexValue("pe_timestamp");
|
||||
}
|
||||
catch(Error::MissingMemoryDefinition& e)
|
||||
{
|
||||
continue;
|
||||
}
|
||||
if (pe_timestamp != pe_header.FileHeader.TimeDateStamp)
|
||||
continue;
|
||||
|
||||
// all went well
|
||||
{
|
||||
printf("Match found! Using version %s.\n", (*it)->getVersion().c_str());
|
||||
d->identified = true;
|
||||
// give the process a data model and memory layout fixed for the base of first module
|
||||
memory_info *m = new memory_info(**it);
|
||||
m->RebaseAll(base);
|
||||
// keep track of created memory_info object so we can destroy it later
|
||||
d->my_descriptor = m;
|
||||
// process is responsible for destroying its data model
|
||||
d->my_pid = pid;
|
||||
d->my_handle = hProcess;
|
||||
d->identified = true;
|
||||
|
||||
// TODO: detect errors in thread enumeration
|
||||
vector<uint32_t> threads;
|
||||
getThreadIDs( threads );
|
||||
d->my_main_thread = OpenThread(THREAD_ALL_ACCESS, FALSE, (DWORD) threads[0]);
|
||||
|
||||
found = true;
|
||||
break; // break the iterator loop
|
||||
}
|
||||
}
|
||||
// close handle of processes that aren't DF
|
||||
if(!found)
|
||||
{
|
||||
CloseHandle(hProcess);
|
||||
}
|
||||
else
|
||||
{
|
||||
d->my_window = new DFWindow(this);
|
||||
}
|
||||
}
|
||||
/*
|
||||
*/
|
||||
|
||||
NormalProcess::~NormalProcess()
|
||||
{
|
||||
if(d->attached)
|
||||
{
|
||||
detach();
|
||||
}
|
||||
// destroy our rebased copy of the memory descriptor
|
||||
delete d->my_descriptor;
|
||||
if(d->my_handle != NULL)
|
||||
{
|
||||
CloseHandle(d->my_handle);
|
||||
}
|
||||
if(d->my_main_thread != NULL)
|
||||
{
|
||||
CloseHandle(d->my_main_thread);
|
||||
}
|
||||
if(d->my_window)
|
||||
{
|
||||
delete d->my_window;
|
||||
}
|
||||
delete d;
|
||||
}
|
||||
|
||||
memory_info * NormalProcess::getDescriptor()
|
||||
{
|
||||
return d->my_descriptor;
|
||||
}
|
||||
|
||||
DFWindow * NormalProcess::getWindow()
|
||||
{
|
||||
return d->my_window;
|
||||
}
|
||||
|
||||
int NormalProcess::getPID()
|
||||
{
|
||||
return d->my_pid;
|
||||
}
|
||||
|
||||
bool NormalProcess::isSuspended()
|
||||
{
|
||||
return d->suspended;
|
||||
}
|
||||
bool NormalProcess::isAttached()
|
||||
{
|
||||
return d->attached;
|
||||
}
|
||||
|
||||
bool NormalProcess::isIdentified()
|
||||
{
|
||||
return d->identified;
|
||||
}
|
||||
|
||||
bool NormalProcess::asyncSuspend()
|
||||
{
|
||||
return suspend();
|
||||
}
|
||||
|
||||
bool NormalProcess::suspend()
|
||||
{
|
||||
if(!d->attached)
|
||||
return false;
|
||||
if(d->suspended)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
SuspendThread(d->my_main_thread);
|
||||
d->suspended = true;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool NormalProcess::forceresume()
|
||||
{
|
||||
if(!d->attached)
|
||||
return false;
|
||||
while (ResumeThread(d->my_main_thread) > 1);
|
||||
d->suspended = false;
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
bool NormalProcess::resume()
|
||||
{
|
||||
if(!d->attached)
|
||||
return false;
|
||||
if(!d->suspended)
|
||||
{
|
||||
return true;
|
||||
}
|
||||
ResumeThread(d->my_main_thread);
|
||||
d->suspended = false;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool NormalProcess::attach()
|
||||
{
|
||||
if(g_pProcess != NULL)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
d->attached = true;
|
||||
g_pProcess = this;
|
||||
suspend();
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
bool NormalProcess::detach()
|
||||
{
|
||||
if(!d->attached)
|
||||
{
|
||||
return false;
|
||||
}
|
||||
resume();
|
||||
d->attached = false;
|
||||
g_pProcess = NULL;
|
||||
return true;
|
||||
}
|
||||
|
||||
bool NormalProcess::getThreadIDs(vector<uint32_t> & threads )
|
||||
{
|
||||
HANDLE AllThreads = INVALID_HANDLE_VALUE;
|
||||
THREADENTRY32 te32;
|
||||
|
||||
AllThreads = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 );
|
||||
if( AllThreads == INVALID_HANDLE_VALUE )
|
||||
{
|
||||
return false;
|
||||
}
|
||||
te32.dwSize = sizeof(THREADENTRY32 );
|
||||
|
||||
if( !Thread32First( AllThreads, &te32 ) )
|
||||
{
|
||||
CloseHandle( AllThreads );
|
||||
return false;
|
||||
}
|
||||
|
||||
do
|
||||
{
|
||||
if( te32.th32OwnerProcessID == d->my_pid )
|
||||
{
|
||||
threads.push_back(te32.th32ThreadID);
|
||||
}
|
||||
} while( Thread32Next(AllThreads, &te32 ) );
|
||||
|
||||
CloseHandle( AllThreads );
|
||||
return true;
|
||||
}
|
||||
|
||||
//FIXME: use VirtualQuery to probe for memory ranges, cross-reference with base-corrected PE segment entries
|
||||
void NormalProcess::getMemRanges( vector<t_memrange> & ranges )
|
||||
{
|
||||
// code here is taken from hexsearch by Silas Dunmore.
|
||||
// As this IMHO isn't a 'sunstantial portion' of anything, I'm not including the MIT license here
|
||||
|
||||
// I'm faking this, because there's no way I'm using VirtualQuery
|
||||
|
||||
t_memrange temp;
|
||||
uint32_t base = d->my_descriptor->getBase();
|
||||
temp.start = base + 0x1000; // more fakery.
|
||||
temp.end = base + readDWord(base+readDWord(base+0x3C)+0x50)-1; // yay for magic.
|
||||
temp.read = 1;
|
||||
temp.write = 1;
|
||||
temp.execute = 0; // fake
|
||||
strcpy(temp.name,"pants");// that's right. I'm calling it pants. Windows can go to HELL
|
||||
ranges.push_back(temp);
|
||||
}
|
||||
|
||||
uint8_t NormalProcess::readByte (const uint32_t offset)
|
||||
{
|
||||
uint8_t result;
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint8_t), NULL);
|
||||
return result;
|
||||
}
|
||||
|
||||
void NormalProcess::readByte (const uint32_t offset,uint8_t &result)
|
||||
{
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint8_t), NULL);
|
||||
}
|
||||
|
||||
uint16_t NormalProcess::readWord (const uint32_t offset)
|
||||
{
|
||||
uint16_t result;
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint16_t), NULL);
|
||||
return result;
|
||||
}
|
||||
|
||||
void NormalProcess::readWord (const uint32_t offset, uint16_t &result)
|
||||
{
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint16_t), NULL);
|
||||
}
|
||||
|
||||
uint32_t NormalProcess::readDWord (const uint32_t offset)
|
||||
{
|
||||
uint32_t result;
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint32_t), NULL);
|
||||
return result;
|
||||
}
|
||||
|
||||
void NormalProcess::readDWord (const uint32_t offset, uint32_t &result)
|
||||
{
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, &result, sizeof(uint32_t), NULL);
|
||||
}
|
||||
|
||||
void NormalProcess::read (const uint32_t offset, uint32_t size, uint8_t *target)
|
||||
{
|
||||
ReadProcessMemory(d->my_handle, (int*) offset, target, size, NULL);
|
||||
}
|
||||
|
||||
// WRITING
|
||||
void NormalProcess::writeDWord (const uint32_t offset, uint32_t data)
|
||||
{
|
||||
WriteProcessMemory(d->my_handle, (int*) offset, &data, sizeof(uint32_t), NULL);
|
||||
}
|
||||
|
||||
// using these is expensive.
|
||||
void NormalProcess::writeWord (uint32_t offset, uint16_t data)
|
||||
{
|
||||
WriteProcessMemory(d->my_handle, (int*) offset, &data, sizeof(uint16_t), NULL);
|
||||
}
|
||||
|
||||
void NormalProcess::writeByte (uint32_t offset, uint8_t data)
|
||||
{
|
||||
WriteProcessMemory(d->my_handle, (int*) offset, &data, sizeof(uint8_t), NULL);
|
||||
}
|
||||
|
||||
void NormalProcess::write (uint32_t offset, uint32_t size, uint8_t *source)
|
||||
{
|
||||
WriteProcessMemory(d->my_handle, (int*) offset, source, size, NULL);
|
||||
}
|
||||
|
||||
|
||||
|
||||
///FIXME: reduce use of temporary objects
|
||||
const string NormalProcess::readCString (const uint32_t offset)
|
||||
{
|
||||
string temp;
|
||||
char temp_c[256];
|
||||
DWORD read;
|
||||
ReadProcessMemory(d->my_handle, (int *) offset, temp_c, 255, &read);
|
||||
temp_c[read+1] = 0;
|
||||
temp = temp_c;
|
||||
return temp;
|
||||
}
|
||||
|
||||
DfVector NormalProcess::readVector (uint32_t offset, uint32_t item_size)
|
||||
{
|
||||
/*
|
||||
MSVC++ vector is four pointers long
|
||||
ptr allocator
|
||||
ptr start
|
||||
ptr end
|
||||
ptr alloc_end
|
||||
|
||||
we don't care about alloc_end because we don't try to add stuff
|
||||
we also don't care about the allocator thing in front
|
||||
*/
|
||||
uint32_t start = g_pProcess->readDWord(offset+4);
|
||||
uint32_t end = g_pProcess->readDWord(offset+8);
|
||||
uint32_t size = (end - start) /4;
|
||||
return DfVector(start,size,item_size);
|
||||
}
|
||||
|
||||
size_t NormalProcess::readSTLString (uint32_t offset, char * buffer, size_t bufcapacity)
|
||||
{
|
||||
/*
|
||||
MSVC++ string
|
||||
ptr allocator
|
||||
union
|
||||
{
|
||||
char[16] start;
|
||||
char * start_ptr
|
||||
}
|
||||
Uint32 length
|
||||
Uint32 capacity
|
||||
*/
|
||||
uint32_t start_offset = offset + 4;
|
||||
size_t length = g_pProcess->readDWord(offset + 20);
|
||||
|
||||
size_t capacity = g_pProcess->readDWord(offset + 24);
|
||||
size_t read_real = min(length, bufcapacity-1);// keep space for null termination
|
||||
|
||||
// read data from inside the string structure
|
||||
if(capacity < 16)
|
||||
{
|
||||
g_pProcess->read(start_offset, read_real , (uint8_t *)buffer);
|
||||
}
|
||||
else // read data from what the offset + 4 dword points to
|
||||
{
|
||||
start_offset = g_pProcess->readDWord(start_offset);// dereference the start offset
|
||||
g_pProcess->read(start_offset, read_real, (uint8_t *)buffer);
|
||||
}
|
||||
|
||||
buffer[read_real] = 0;
|
||||
return read_real;
|
||||
}
|
||||
|
||||
const string NormalProcess::readSTLString (uint32_t offset)
|
||||
{
|
||||
/*
|
||||
MSVC++ string
|
||||
ptr allocator
|
||||
union
|
||||
{
|
||||
char[16] start;
|
||||
char * start_ptr
|
||||
}
|
||||
Uint32 length
|
||||
Uint32 capacity
|
||||
*/
|
||||
uint32_t start_offset = offset + 4;
|
||||
uint32_t length = g_pProcess->readDWord(offset + 20);
|
||||
uint32_t capacity = g_pProcess->readDWord(offset + 24);
|
||||
char * temp = new char[capacity+1];
|
||||
|
||||
// read data from inside the string structure
|
||||
if(capacity < 16)
|
||||
{
|
||||
g_pProcess->read(start_offset, capacity, (uint8_t *)temp);
|
||||
}
|
||||
else // read data from what the offset + 4 dword points to
|
||||
{
|
||||
start_offset = g_pProcess->readDWord(start_offset);// dereference the start offset
|
||||
g_pProcess->read(start_offset, capacity, (uint8_t *)temp);
|
||||
}
|
||||
|
||||
temp[length] = 0;
|
||||
string ret = temp;
|
||||
delete temp;
|
||||
return ret;
|
||||
}
|
||||
|
||||
string NormalProcess::readClassName (uint32_t vptr)
|
||||
{
|
||||
int rtti = readDWord(vptr - 0x4);
|
||||
int typeinfo = readDWord(rtti + 0xC);
|
||||
string raw = readCString(typeinfo + 0xC); // skips the .?AV
|
||||
raw.resize(raw.length() - 4);// trim st@@ from end
|
||||
return raw;
|
||||
}
|
||||
Loading…
Reference in New Issue