527 lines
17 KiB
C++
527 lines
17 KiB
C++
/*
|
|
www.sourceforge.net/projects/dfhack
|
|
Copyright (c) 2009 Petr Mrázek (peterix), Kenneth Ferland (Impaler[WrG]), dorf
|
|
|
|
This software is provided 'as-is', without any express or implied
|
|
warranty. In no event will the authors be held liable for any
|
|
damages arising from the use of this software.
|
|
|
|
Permission is granted to anyone to use this software for any
|
|
purpose, including commercial applications, and to alter it and
|
|
redistribute it freely, subject to the following restrictions:
|
|
|
|
1. The origin of this software must not be misrepresented; you must
|
|
not claim that you wrote the original software. If you use this
|
|
software in a product, an acknowledgment in the product documentation
|
|
would be appreciated but is not required.
|
|
|
|
2. Altered source versions must be plainly marked as such, and
|
|
must not be misrepresented as being the original software.
|
|
|
|
3. This notice may not be removed or altered from any source
|
|
distribution.
|
|
*/
|
|
|
|
#include "DFCommon.h"
|
|
|
|
#include "DFDataModel.h"
|
|
#include "DFMemInfo.h"
|
|
|
|
#include "tinyxml/tinyxml.h"
|
|
#include <iostream>
|
|
|
|
/// HACK: global variables (only one process can be attached at the same time.)
|
|
Process * g_pProcess; ///< current process. non-NULL when picked
|
|
ProcessHandle g_ProcessHandle; ///< cache of handle to current process. used for speed reasons
|
|
FILE * g_ProcessMemFile; ///< opened /proc/PID/mem, valid when attached
|
|
|
|
|
|
#ifdef LINUX_BUILD
|
|
/*
|
|
* LINUX version of the process finder.
|
|
*/
|
|
|
|
#include "md5/md5wrapper.h"
|
|
|
|
Process* ProcessManager::addProcess(const string & exe,ProcessHandle PH, const string & memFile)
|
|
{
|
|
md5wrapper md5;
|
|
// get hash of the running DF process
|
|
string hash = md5.getHashFromFile(exe);
|
|
vector<memory_info>::iterator it;
|
|
|
|
// iterate over the list of memory locations
|
|
for ( it=meminfo.begin() ; it < meminfo.end(); it++ )
|
|
{
|
|
if(hash == (*it).getString("md5")) // are the md5 hashes the same?
|
|
{
|
|
memory_info * m = &*it;
|
|
Process * ret;
|
|
//cout <<"Found process " << PH << ". It's DF version " << m->getVersion() << "." << endl;
|
|
|
|
// df can run under wine on Linux
|
|
if(memory_info::OS_WINDOWS == (*it).getOS())
|
|
{
|
|
ret= new Process(new DMWindows40d(),m,PH, PH);
|
|
}
|
|
else if (memory_info::OS_LINUX == (*it).getOS())
|
|
{
|
|
ret= new Process(new DMLinux40d(),m,PH, PH);
|
|
}
|
|
else
|
|
{
|
|
// some error happened, continue with next process
|
|
continue;
|
|
}
|
|
// tell Process about the /proc/PID/mem file
|
|
ret->setMemFile(memFile);
|
|
processes.push_back(ret);
|
|
return ret;
|
|
}
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
bool ProcessManager::findProcessess()
|
|
{
|
|
DIR *dir_p;
|
|
struct dirent *dir_entry_p;
|
|
string dir_name;
|
|
string exe_link;
|
|
string cwd_link;
|
|
string cmdline_path;
|
|
string cmdline;
|
|
|
|
// ALERT: buffer overrun potential
|
|
char target_name[1024];
|
|
int target_result;
|
|
int errorcount;
|
|
int result;
|
|
|
|
errorcount=0;
|
|
result=0;
|
|
// Open /proc/ directory
|
|
dir_p = opendir("/proc/");
|
|
// Reading /proc/ entries
|
|
while(NULL != (dir_entry_p = readdir(dir_p)))
|
|
{
|
|
// Only PID folders (numbers)
|
|
if (strspn(dir_entry_p->d_name, "0123456789") != strlen(dir_entry_p->d_name))
|
|
{
|
|
continue;
|
|
}
|
|
|
|
// string manipulation - get /proc/PID/exe link and /proc/PID/mem names
|
|
dir_name = "/proc/";
|
|
dir_name += dir_entry_p->d_name;
|
|
dir_name += "/";
|
|
exe_link = dir_name + "exe";
|
|
string mem_name = dir_name + "mem";
|
|
|
|
// resolve /proc/PID/exe link
|
|
target_result = readlink(exe_link.c_str(), target_name, sizeof(target_name)-1);
|
|
if (target_result == -1)
|
|
{
|
|
// bad result from link resolution, continue with another processed
|
|
continue;
|
|
}
|
|
// make sure we have a null terminated string...
|
|
target_name[target_result] = 0;
|
|
|
|
// is this the regular linux DF?
|
|
if (strstr(target_name, "dwarfort.exe") != NULL)
|
|
{
|
|
exe_link = target_name;
|
|
// get PID
|
|
result = atoi(dir_entry_p->d_name);
|
|
// create linux process, add it to the vector
|
|
addProcess(exe_link,result,mem_name);
|
|
// continue with next process
|
|
continue;
|
|
}
|
|
|
|
// FIXME: this fails when the wine process isn't started from the 'current working directory'. strip path data from cmdline
|
|
// DF in wine?
|
|
if(strstr(target_name, "wine-preloader")!= NULL)
|
|
{
|
|
// get working directory
|
|
cwd_link = dir_name + "cwd";
|
|
target_result = readlink(cwd_link.c_str(), target_name, sizeof(target_name)-1);
|
|
target_name[target_result] = 0;
|
|
|
|
// got path to executable, do the same for its name
|
|
cmdline_path = dir_name + "cmdline";
|
|
ifstream ifs ( cmdline_path.c_str() , ifstream::in );
|
|
getline(ifs,cmdline);
|
|
if (cmdline.find("dwarfort.exe") != string::npos || cmdline.find("Dwarf Fortress.exe") != string::npos)
|
|
{
|
|
// put executable name and path together
|
|
exe_link = target_name;
|
|
exe_link += "/";
|
|
exe_link += cmdline;
|
|
|
|
// get PID
|
|
result = atoi(dir_entry_p->d_name);
|
|
|
|
// create wine process, add it to the vector
|
|
addProcess(exe_link,result,mem_name);
|
|
}
|
|
}
|
|
}
|
|
closedir(dir_p);
|
|
// return value depends on if we found some DF processes
|
|
if(processes.size())
|
|
{
|
|
return true;
|
|
}
|
|
return false;
|
|
}
|
|
|
|
#else
|
|
|
|
// some magic - will come in handy when we start doing debugger stuff on Windows
|
|
bool EnableDebugPriv()
|
|
{
|
|
bool bRET = FALSE;
|
|
TOKEN_PRIVILEGES tp;
|
|
HANDLE hToken;
|
|
|
|
if (LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid))
|
|
{
|
|
if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken))
|
|
{
|
|
if (hToken != INVALID_HANDLE_VALUE)
|
|
{
|
|
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
|
|
tp.PrivilegeCount = 1;
|
|
if (AdjustTokenPrivileges(hToken, FALSE, &tp, 0, 0, 0))
|
|
{
|
|
bRET = TRUE;
|
|
}
|
|
CloseHandle(hToken);
|
|
}
|
|
}
|
|
}
|
|
return bRET;
|
|
}
|
|
|
|
// WINDOWS version of the process finder
|
|
bool ProcessManager::findProcessess()
|
|
{
|
|
// Get the list of process identifiers.
|
|
//TODO: make this dynamic. (call first to get the array size and second to really get process handles)
|
|
DWORD ProcArray[512], memoryNeeded, numProccesses;
|
|
HMODULE hmod = NULL;
|
|
DWORD junk;
|
|
HANDLE hProcess;
|
|
bool found = false;
|
|
|
|
IMAGE_NT_HEADERS32 pe_header;
|
|
IMAGE_SECTION_HEADER sections[16];
|
|
|
|
EnableDebugPriv();
|
|
if ( !EnumProcesses( ProcArray, sizeof(ProcArray), &memoryNeeded ) )
|
|
{
|
|
return false;
|
|
}
|
|
|
|
// Calculate how many process identifiers were returned.
|
|
numProccesses = memoryNeeded / sizeof(DWORD);
|
|
|
|
// iterate through processes
|
|
for ( int i = 0; i < numProccesses; i++ )
|
|
{
|
|
found = false;
|
|
// open process
|
|
hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, ProcArray[i] );
|
|
if (NULL == hProcess)
|
|
continue;
|
|
// we've got some process, look at its first module
|
|
if(EnumProcessModules(hProcess, &hmod, 1 * sizeof(HMODULE), &junk))
|
|
{
|
|
// TODO: check module filename to verify that it's DF!
|
|
// got base ;)
|
|
uint32_t base = (uint32_t)hmod;
|
|
// read from this process
|
|
g_ProcessHandle = hProcess;
|
|
uint32_t pe_offset = MreadDWord(base+0x3C);
|
|
Mread(base + pe_offset , sizeof(pe_header), (uint8_t *)&pe_header);
|
|
Mread(base + pe_offset+ sizeof(pe_header), sizeof(sections) , (uint8_t *)§ions );
|
|
// see if there's a version entry that matches this process
|
|
vector<memory_info>::iterator it;
|
|
for ( it=meminfo.begin() ; it < meminfo.end(); it++ )
|
|
{
|
|
// filter by OS
|
|
if(memory_info::OS_WINDOWS == (*it).getOS())
|
|
{
|
|
uint32_t pe_timestamp = (*it).getHexValue("pe_timestamp");
|
|
if (pe_timestamp == pe_header.FileHeader.TimeDateStamp)
|
|
{
|
|
printf("Match found! Using version %s.\n", (*it).getVersion().c_str());
|
|
// give the process a data model and memory layout fixed for the base of first module
|
|
memory_info *m = new memory_info(*it);
|
|
m->RebaseAll(base);
|
|
// keep track of created memory_info objects so we can destroy them later
|
|
destroy_meminfo.push_back(m);
|
|
// process is responsible for destroying its data model
|
|
Process *ret= new Process(new DMWindows40d(),m,hProcess, ProcArray[i]);
|
|
processes.push_back(ret);
|
|
found = true;
|
|
break; // break the iterator loop
|
|
}
|
|
}
|
|
}
|
|
// close handle of processes that aren't DF
|
|
if(!found)
|
|
{
|
|
CloseHandle(hProcess);
|
|
}
|
|
}
|
|
}
|
|
if(processes.size())
|
|
return true;
|
|
return false;
|
|
}
|
|
#endif
|
|
|
|
|
|
void ProcessManager::ParseVTable(TiXmlElement* vtable, memory_info& mem)
|
|
{
|
|
TiXmlElement* pClassEntry;
|
|
TiXmlElement* pClassSubEntry;
|
|
const char * rebase = vtable->Attribute("rebase");
|
|
if(rebase)
|
|
{
|
|
int32_t rebase_offset = strtol(rebase, NULL, 16);
|
|
mem.RebaseVTable(rebase_offset);
|
|
}
|
|
pClassEntry = vtable->FirstChildElement();
|
|
for(;pClassEntry;pClassEntry=pClassEntry->NextSiblingElement())
|
|
{
|
|
string type = pClassEntry->Value();
|
|
const char *cstr_name = pClassEntry->Attribute("name");
|
|
const char *cstr_vtable = pClassEntry->Attribute("vtable");
|
|
if(type== "class")
|
|
{
|
|
mem.setClass(cstr_name, cstr_vtable);
|
|
}
|
|
else if (type == "multiclass")
|
|
{
|
|
const char *cstr_typeoffset = pClassEntry->Attribute("typeoffset");
|
|
int mclass = mem.setMultiClass(cstr_name, cstr_vtable, cstr_typeoffset);
|
|
pClassSubEntry = pClassEntry->FirstChildElement();
|
|
for(;pClassSubEntry;pClassSubEntry=pClassSubEntry->NextSiblingElement())
|
|
{
|
|
type = pClassSubEntry->Value();
|
|
if(type== "class")
|
|
{
|
|
cstr_name = pClassSubEntry->Attribute("name");
|
|
const char *cstr_value = pClassSubEntry->Attribute("type");
|
|
mem.setMultiClassChild(mclass,cstr_name,cstr_value);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
|
|
|
|
void ProcessManager::ParseEntry (TiXmlElement* entry, memory_info& mem, map <string ,TiXmlElement *>& knownEntries)
|
|
{
|
|
TiXmlElement* pMemEntry;
|
|
const char *cstr_version = entry->Attribute("version");
|
|
const char *cstr_os = entry->Attribute("os");
|
|
const char *cstr_base = entry->Attribute("base");
|
|
const char *cstr_rebase = entry->Attribute("rebase");
|
|
if(cstr_base)
|
|
{
|
|
string base = cstr_base;
|
|
ParseEntry(knownEntries[base], mem, knownEntries);
|
|
}
|
|
// mandatory attributes missing?
|
|
if(!(cstr_version && cstr_os))
|
|
{
|
|
cerr << "Bad entry in memory.xml detected, version or os attribute is missing.";
|
|
// skip if we don't have valid attributes
|
|
return;
|
|
}
|
|
string os = cstr_os;
|
|
mem.setVersion(cstr_version);
|
|
mem.setOS(cstr_os);
|
|
|
|
// offset inherited addresses by 'rebase'.
|
|
int32_t rebase = 0;
|
|
if(cstr_rebase)
|
|
{
|
|
rebase = mem.getBase() + strtol(cstr_rebase, NULL, 16);
|
|
mem.RebaseAddresses(rebase);
|
|
}
|
|
|
|
//set base to default, we're overwriting this because the previous rebase could cause havoc on Vista/7
|
|
if(os == "windows")
|
|
{
|
|
// set default image base. this is fixed for base relocation later
|
|
mem.setBase(0x400000);
|
|
}
|
|
else if(os == "linux")
|
|
{
|
|
// this is wrong... I'm not going to do base image relocation on linux though.
|
|
// users are free to use a sane kernel that doesn't do this kind of **** by default
|
|
mem.setBase(0x0);
|
|
}
|
|
else
|
|
{
|
|
cerr << "unknown operating system " << os << endl;
|
|
return;
|
|
}
|
|
// process additional entries
|
|
//cout << "Entry " << cstr_version << " " << cstr_os << endl;
|
|
pMemEntry = entry->FirstChildElement()->ToElement();
|
|
for(;pMemEntry;pMemEntry=pMemEntry->NextSiblingElement())
|
|
{
|
|
// only elements get processed
|
|
const char *cstr_type = pMemEntry->Value();
|
|
const char *cstr_name = pMemEntry->Attribute("name");
|
|
const char *cstr_value = pMemEntry->GetText();
|
|
// check for missing parts
|
|
string type, name, value;
|
|
type = cstr_type;
|
|
if(type == "VTable")
|
|
{
|
|
ParseVTable(pMemEntry, mem);
|
|
continue;
|
|
}
|
|
if( !(cstr_name && cstr_value))
|
|
{
|
|
cerr << "underspecified MemInfo entry" << endl;
|
|
continue;
|
|
}
|
|
name = cstr_name;
|
|
value = cstr_value;
|
|
if (type == "HexValue")
|
|
{
|
|
mem.setHexValue(name, value);
|
|
}
|
|
else if (type == "Address")
|
|
{
|
|
mem.setAddress(name, value);
|
|
}
|
|
else if (type == "Offset")
|
|
{
|
|
mem.setOffset(name, value);
|
|
}
|
|
else if (type == "String")
|
|
{
|
|
mem.setString(name, value);
|
|
}
|
|
else
|
|
{
|
|
cerr << "Unknown MemInfo type: " << type << endl;
|
|
}
|
|
} // for
|
|
} // method
|
|
|
|
|
|
// load the XML file with offsets
|
|
bool ProcessManager::loadDescriptors(string path_to_xml)
|
|
{
|
|
TiXmlDocument doc( path_to_xml.c_str() );
|
|
bool loadOkay = doc.LoadFile();
|
|
TiXmlHandle hDoc(&doc);
|
|
TiXmlElement* pElem;
|
|
TiXmlHandle hRoot(0);
|
|
memory_info mem;
|
|
|
|
if ( loadOkay )
|
|
{
|
|
// block: name
|
|
{
|
|
pElem=hDoc.FirstChildElement().Element();
|
|
// should always have a valid root but handle gracefully if it does
|
|
if (!pElem)
|
|
{
|
|
cerr << "no pElem found" << endl;
|
|
return false;
|
|
}
|
|
string m_name=pElem->Value();
|
|
if(m_name != "DFExtractor")
|
|
{
|
|
cerr << "DFExtractor != " << m_name << endl;
|
|
return false;
|
|
}
|
|
//cout << "got DFExtractor XML!" << endl;
|
|
// save this for later
|
|
hRoot=TiXmlHandle(pElem);
|
|
}
|
|
// transform elements
|
|
{
|
|
// trash existing list
|
|
meminfo.clear();
|
|
TiXmlElement* pMemInfo=hRoot.FirstChild( "MemoryDescriptors" ).FirstChild( "Entry" ).Element();
|
|
map <string ,TiXmlElement *> map_pNamedEntries;
|
|
vector <TiXmlElement *> v_pEntries;
|
|
for( ; pMemInfo; pMemInfo=pMemInfo->NextSiblingElement("Entry"))
|
|
{
|
|
v_pEntries.push_back(pMemInfo);
|
|
const char *id;
|
|
if(id= pMemInfo->Attribute("id"))
|
|
{
|
|
string str_id = id;
|
|
map_pNamedEntries[str_id] = pMemInfo;
|
|
}
|
|
}
|
|
for(uint32_t i = 0; i< v_pEntries.size();i++)
|
|
{
|
|
memory_info mem;
|
|
//FIXME: add a set of entries processed in a step of this cycle, use it to check for infinite loops
|
|
/* recursive */ParseEntry( v_pEntries[i] , mem , map_pNamedEntries);
|
|
meminfo.push_back(mem);
|
|
}
|
|
// process found things here
|
|
}
|
|
return true;
|
|
}
|
|
else
|
|
{
|
|
// load failed
|
|
cerr << "Can't load memory offsets from memory.xml" << endl;
|
|
return false;
|
|
}
|
|
}
|
|
|
|
|
|
uint32_t ProcessManager::size()
|
|
{
|
|
return processes.size();
|
|
};
|
|
|
|
|
|
Process * ProcessManager::operator[](uint32_t index)
|
|
{
|
|
assert(index < processes.size());
|
|
return processes[index];
|
|
};
|
|
|
|
|
|
ProcessManager::ProcessManager( string path_to_xml )
|
|
{
|
|
currentProcess = NULL;
|
|
currentProcessHandle = 0;
|
|
loadDescriptors( path_to_xml );
|
|
}
|
|
|
|
|
|
ProcessManager::~ProcessManager()
|
|
{
|
|
// delete all processes
|
|
for(uint32_t i = 0;i < processes.size();i++)
|
|
{
|
|
delete processes[i];
|
|
}
|
|
//delete all generated memory_info stuff
|
|
for(uint32_t i = 0;i < destroy_meminfo.size();i++)
|
|
{
|
|
delete destroy_meminfo[i];
|
|
}
|
|
}
|