1. fixed NtCreateProcess to do some buffer checks and moved the implementation to an internal function so it can be shared with PsCreateSystemProcess(). Also don't leak so many resources on failures

2. processes should acuire a cid handle for their unique process id
3. fixed several instances in structures where process ids were DWORD/ULONG instead of HANDLEs

svn path=/trunk/; revision=13301
This commit is contained in:
Thomas Bluemel 2005-01-26 00:03:05 +00:00
parent e91cfb5065
commit b55653e57c
27 changed files with 538 additions and 357 deletions

View file

@ -19,7 +19,7 @@ typedef struct
typedef struct
{
ULONG NewProcessId;
HANDLE NewProcessId;
ULONG Flags;
PCONTROLDISPATCHER CtrlDispatcher;
} CSRSS_CREATE_PROCESS_REQUEST, *PCSRSS_CREATE_PROCESS_REQUEST;
@ -359,7 +359,7 @@ typedef struct
typedef struct
{
DWORD ProcessId;
HANDLE ProcessId;
} CSRSS_REGISTER_SERVICES_PROCESS_REQUEST, *PCSRSS_REGISTER_SERVICES_PROCESS_REQUEST;
typedef struct
@ -476,7 +476,7 @@ typedef struct
typedef struct
{
HANDLE Handle;
DWORD ProcessId;
HANDLE ProcessId;
} CSRSS_DUPLICATE_HANDLE_REQUEST, *PCSRSS_DUPLICATE_HANDLE_REQUEST;
typedef struct
@ -562,7 +562,7 @@ typedef struct
typedef struct
{
DWORD ProcessId;
HANDLE ProcessId;
BOOL Register;
} CSRSS_REGISTER_LOGON_PROCESS_REQUEST, *PCSRSS_REGISTER_LOGON_PROCESS_REQUEST;

View file

@ -395,7 +395,7 @@ BOOLEAN STDCALL PsGetVersion (PULONG MajorVersion OPTIONAL,
LARGE_INTEGER STDCALL PsGetProcessExitTime(VOID);
BOOLEAN STDCALL PsIsThreadTerminating(struct _ETHREAD* Thread);
NTSTATUS STDCALL PsLookupProcessByProcessId(IN PVOID ProcessId,
NTSTATUS STDCALL PsLookupProcessByProcessId(IN HANDLE ProcessId,
OUT PEPROCESS *Process);
NTSTATUS STDCALL PsLookupProcessThreadByCid(IN PCLIENT_ID Cid,

View file

@ -684,8 +684,8 @@ typedef struct _PROCESS_BASIC_INFORMATION
PPEB PebBaseAddress;
KAFFINITY AffinityMask;
KPRIORITY BasePriority;
ULONG UniqueProcessId;
ULONG InheritedFromUniqueProcessId;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
// Information class 1
@ -1332,8 +1332,8 @@ typedef struct _SYSTEM_PROCESSES_NT4
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
@ -1350,8 +1350,8 @@ typedef struct _SYSTEM_PROCESSES_NT5
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;

View file

@ -206,7 +206,7 @@ DuplicateConsoleHandle (HANDLE hConsole,
Request.Type = CSRSS_DUPLICATE_HANDLE;
Request.Data.DuplicateHandleRequest.Handle = hConsole;
Request.Data.DuplicateHandleRequest.ProcessId = GetCurrentProcessId();
Request.Data.DuplicateHandleRequest.ProcessId = GetTeb()->Cid.UniqueProcess;
Status = CsrClientCallServer(&Request,
&Reply,
sizeof(CSRSS_API_REQUEST),

View file

@ -1157,9 +1157,9 @@ CreateProcessW
&ProcessBasicInfo,
sizeof(ProcessBasicInfo),
&retlen);
DPRINT("ProcessBasicInfo.UniqueProcessId %d\n",
DPRINT("ProcessBasicInfo.UniqueProcessId 0x%x\n",
ProcessBasicInfo.UniqueProcessId);
lpProcessInformation->dwProcessId = ProcessBasicInfo.UniqueProcessId;
lpProcessInformation->dwProcessId = (DWORD)ProcessBasicInfo.UniqueProcessId;
/*
* Tell the csrss server we are creating a new process

View file

@ -324,7 +324,7 @@ GetProcessId(HANDLE Process)
return 0;
}
return ProcessBasic.UniqueProcessId;
return (DWORD)ProcessBasic.UniqueProcessId;
}

View file

@ -83,7 +83,7 @@ EnumProcessesCallback(IN PSYSTEM_PROCESSES CurrentProcess,
}
/* return current process */
*Context->lpidProcess = CurrentProcess->ProcessId;
*Context->lpidProcess = (DWORD)CurrentProcess->ProcessId;
/* go to next array slot */
Context->lpidProcess++;

View file

@ -104,7 +104,7 @@ RegisterServicesProcess(DWORD ServicesProcessId)
NTSTATUS Status;
Request.Type = CSRSS_REGISTER_SERVICES_PROCESS;
Request.Data.RegisterServicesProcessRequest.ProcessId = ServicesProcessId;
Request.Data.RegisterServicesProcessRequest.ProcessId = (HANDLE)ServicesProcessId;
Status = CsrClientCallServer(&Request,
&Reply,

View file

@ -196,7 +196,7 @@ NtOpenMutant(OUT PHANDLE MutantHandle,
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
DPRINT1("NtOpenMutant(0x%x, 0x%x, 0x%x)\n", MutantHandle, DesiredAccess, ObjectAttributes);
DPRINT("NtOpenMutant(0x%x, 0x%x, 0x%x)\n", MutantHandle, DesiredAccess, ObjectAttributes);
PreviousMode = ExGetPreviousMode();

View file

@ -401,7 +401,7 @@ QSI_DEF(SystemPerformanceInformation)
return (STATUS_INFO_LENGTH_MISMATCH);
}
PsLookupProcessByProcessId((PVOID) 1, &TheIdleProcess);
TheIdleProcess = PsInitialSystemProcess; /* FIXME */
Spi->IdleTime.QuadPart = TheIdleProcess->Pcb.KernelTime * 100000LL;
@ -505,8 +505,6 @@ QSI_DEF(SystemPerformanceInformation)
Spi->SecondLevelTbFills = 0; /* FIXME */
Spi->SystemCalls = 0; /* FIXME */
ObDereferenceObject(TheIdleProcess);
return (STATUS_SUCCESS);
}
@ -609,7 +607,7 @@ QSI_DEF(SystemProcessInformation)
SpiCur->BasePriority = pr->Pcb.BasePriority;
SpiCur->ProcessId = pr->UniqueProcessId;
SpiCur->InheritedFromProcessId = (DWORD)(pr->InheritedFromUniqueProcessId);
SpiCur->InheritedFromProcessId = pr->InheritedFromUniqueProcessId;
SpiCur->HandleCount = ObpGetHandleCountByHandleTable(&pr->HandleTable);
SpiCur->VmCounters.PeakVirtualSize = pr->PeakVirtualSize;
SpiCur->VmCounters.VirtualSize = pr->VirtualSize.QuadPart;
@ -949,7 +947,7 @@ QSI_DEF(SystemFullMemoryInformation)
}
DPRINT("SystemFullMemoryInformation\n");
PsLookupProcessByProcessId((PVOID) 1, &TheIdleProcess);
TheIdleProcess = PsInitialSystemProcess; /* FIXME */
DPRINT("PID: %d, KernelTime: %u PFFree: %d PFUsed: %d\n",
TheIdleProcess->UniqueProcessId,
@ -963,8 +961,6 @@ QSI_DEF(SystemFullMemoryInformation)
*Spi = MiMemoryConsumers[MC_USER].PagesUsed;
ObDereferenceObject(TheIdleProcess);
return (STATUS_SUCCESS);
}

View file

@ -296,7 +296,7 @@ typedef struct _MM_PAGEOP
* These fields are used to identify the operation if it is against a
* virtual memory area.
*/
ULONG Pid;
HANDLE Pid;
PVOID Address;
/*
* These fields are used to identify the operation if it is against a
@ -569,10 +569,10 @@ VOID
MmReleasePageOp(PMM_PAGEOP PageOp);
PMM_PAGEOP
MmGetPageOp(PMEMORY_AREA MArea, ULONG Pid, PVOID Address,
MmGetPageOp(PMEMORY_AREA MArea, HANDLE Pid, PVOID Address,
PMM_SECTION_SEGMENT Segment, ULONG Offset, ULONG OpType, BOOL First);
PMM_PAGEOP
MmCheckForPageOp(PMEMORY_AREA MArea, ULONG Pid, PVOID Address,
MmCheckForPageOp(PMEMORY_AREA MArea, HANDLE Pid, PVOID Address,
PMM_SECTION_SEGMENT Segment, ULONG Offset);
VOID
MmInitializePageOp(VOID);

View file

@ -323,7 +323,7 @@ struct _EPROCESS
/* Unknown. */
PKTHREAD LockOwner; /* 090 */
/* Process id. */
ULONG UniqueProcessId; /* 094 */
HANDLE UniqueProcessId; /* 094 */
/* Unknown. */
LIST_ENTRY ActiveProcessLinks; /* 098 */
/* Unknown. */

View file

@ -140,13 +140,13 @@ KiInsertProfile(PKPROFILE Profile)
}
else
{
ULONG Pid;
HANDLE Pid;
PKPROCESS_PROFILE current;
PLIST_ENTRY current_entry;
PLIST_ENTRY ListHead;
Pid = Profile->Process->UniqueProcessId;
ListHead = &ProcessProfileListHashTable[Pid % PROFILE_HASH_TABLE_SIZE];
ListHead = &ProcessProfileListHashTable[(ULONG_PTR)Pid % PROFILE_HASH_TABLE_SIZE];
current_entry = ListHead;
while(current_entry != ListHead)
@ -154,7 +154,7 @@ KiInsertProfile(PKPROFILE Profile)
current = CONTAINING_RECORD(current_entry, KPROCESS_PROFILE,
ListEntry);
if (current->Pid == (HANDLE)Pid)
if (current->Pid == Pid)
{
KiInsertProfileIntoProcess(&current->ProfileListHead, Profile);
KeReleaseSpinLock(&ProfileListLock, oldIrql);
@ -166,7 +166,7 @@ KiInsertProfile(PKPROFILE Profile)
current = ExAllocatePool(NonPagedPool, sizeof(KPROCESS_PROFILE));
current->Pid = (HANDLE)Pid;
current->Pid = Pid;
InitializeListHead(&current->ProfileListHead);
InsertTailList(ListHead, &current->ListEntry);
@ -188,7 +188,7 @@ VOID KiRemoveProfile(PKPROFILE Profile)
}
else
{
ULONG Pid;
HANDLE Pid;
PLIST_ENTRY ListHead;
PKPROCESS_PROFILE current;
PLIST_ENTRY current_entry;
@ -196,7 +196,7 @@ VOID KiRemoveProfile(PKPROFILE Profile)
RemoveEntryList(&Profile->ListEntry);
Pid = Profile->Process->UniqueProcessId;
ListHead = &ProcessProfileListHashTable[Pid % PROFILE_HASH_TABLE_SIZE];
ListHead = &ProcessProfileListHashTable[(ULONG_PTR)Pid % PROFILE_HASH_TABLE_SIZE];
current_entry = ListHead;
while(current_entry != ListHead)
@ -204,7 +204,7 @@ VOID KiRemoveProfile(PKPROFILE Profile)
current = CONTAINING_RECORD(current_entry, KPROCESS_PROFILE,
ListEntry);
if (current->Pid == (HANDLE)Pid)
if (current->Pid == Pid)
{
if (IsListEmpty(&current->ProfileListHead))
{

View file

@ -272,7 +272,7 @@ MmNotPresentFaultVirtualMemory(PMADDRESS_SPACE AddressSpace,
/*
* Get or create a page operation
*/
PageOp = MmGetPageOp(MemoryArea, (ULONG)MemoryArea->Process->UniqueProcessId,
PageOp = MmGetPageOp(MemoryArea, MemoryArea->Process->UniqueProcessId,
(PVOID)PAGE_ROUND_DOWN(Address), NULL, 0,
MM_PAGEOP_PAGEIN, FALSE);
if (PageOp == NULL)

View file

@ -67,7 +67,7 @@ MmReleasePageOp(PMM_PAGEOP PageOp)
}
PMM_PAGEOP
MmCheckForPageOp(PMEMORY_AREA MArea, ULONG Pid, PVOID Address,
MmCheckForPageOp(PMEMORY_AREA MArea, HANDLE Pid, PVOID Address,
PMM_SECTION_SEGMENT Segment, ULONG Offset)
{
ULONG_PTR Hash;
@ -129,7 +129,7 @@ MmCheckForPageOp(PMEMORY_AREA MArea, ULONG Pid, PVOID Address,
}
PMM_PAGEOP
MmGetPageOp(PMEMORY_AREA MArea, ULONG Pid, PVOID Address,
MmGetPageOp(PMEMORY_AREA MArea, HANDLE Pid, PVOID Address,
PMM_SECTION_SEGMENT Segment, ULONG Offset, ULONG OpType, BOOL First)
/*
* FUNCTION: Get a page operation descriptor corresponding to

View file

@ -136,7 +136,7 @@ MmWritePagePhysicalAddress(PFN_TYPE Page)
/*
* Get or create a pageop
*/
PageOp = MmGetPageOp(MemoryArea, 0, 0,
PageOp = MmGetPageOp(MemoryArea, NULL, 0,
MemoryArea->Data.SectionData.Segment,
Offset, MM_PAGEOP_PAGEOUT, TRUE);
@ -163,7 +163,7 @@ MmWritePagePhysicalAddress(PFN_TYPE Page)
}
else if (Type == MEMORY_AREA_VIRTUAL_MEMORY)
{
PageOp = MmGetPageOp(MemoryArea, Address < (PVOID)KERNEL_BASE ? Process->UniqueProcessId : 0,
PageOp = MmGetPageOp(MemoryArea, Address < (PVOID)KERNEL_BASE ? Process->UniqueProcessId : NULL,
Address, NULL, 0, MM_PAGEOP_PAGEOUT, TRUE);
if (PageOp == NULL)
@ -260,7 +260,7 @@ MmPageOutPhysicalAddress(PFN_TYPE Page)
/*
* Get or create a pageop
*/
PageOp = MmGetPageOp(MemoryArea, 0, 0,
PageOp = MmGetPageOp(MemoryArea, NULL, 0,
MemoryArea->Data.SectionData.Segment,
Offset, MM_PAGEOP_PAGEOUT, TRUE);
if (PageOp == NULL)
@ -286,7 +286,7 @@ MmPageOutPhysicalAddress(PFN_TYPE Page)
}
else if (Type == MEMORY_AREA_VIRTUAL_MEMORY)
{
PageOp = MmGetPageOp(MemoryArea, Address < (PVOID)KERNEL_BASE ? Process->UniqueProcessId : 0,
PageOp = MmGetPageOp(MemoryArea, Address < (PVOID)KERNEL_BASE ? Process->UniqueProcessId : NULL,
Address, NULL, 0, MM_PAGEOP_PAGEOUT, TRUE);
if (PageOp == NULL)
{

View file

@ -665,7 +665,7 @@ MmNotPresentFaultSectionView(PMADDRESS_SPACE AddressSpace,
/*
* Get or create a page operation descriptor
*/
PageOp = MmGetPageOp(MemoryArea, 0, 0, Segment, Offset, MM_PAGEOP_PAGEIN, FALSE);
PageOp = MmGetPageOp(MemoryArea, NULL, 0, Segment, Offset, MM_PAGEOP_PAGEIN, FALSE);
if (PageOp == NULL)
{
DPRINT1("MmGetPageOp failed\n");
@ -1187,7 +1187,7 @@ MmAccessFaultSectionView(PMADDRESS_SPACE AddressSpace,
/*
* Get or create a pageop
*/
PageOp = MmGetPageOp(MemoryArea, 0, 0, Segment, Offset,
PageOp = MmGetPageOp(MemoryArea, NULL, 0, Segment, Offset,
MM_PAGEOP_ACCESSFAULT, FALSE);
if (PageOp == NULL)
{
@ -3589,7 +3589,7 @@ MmFreeSectionPage(PVOID Context, MEMORY_AREA* MemoryArea, PVOID Address,
Section = MArea->Data.SectionData.Section;
Segment = MArea->Data.SectionData.Segment;
PageOp = MmCheckForPageOp(MArea, 0, NULL, Segment, Offset);
PageOp = MmCheckForPageOp(MArea, NULL, NULL, Segment, Offset);
while (PageOp)
{
@ -3606,7 +3606,7 @@ MmFreeSectionPage(PVOID Context, MEMORY_AREA* MemoryArea, PVOID Address,
MmLockAddressSpace(&MArea->Process->AddressSpace);
MmLockSectionSegment(Segment);
MmspCompleteAndReleasePageOp(PageOp);
PageOp = MmCheckForPageOp(MArea, 0, NULL, Segment, Offset);
PageOp = MmCheckForPageOp(MArea, NULL, NULL, Segment, Offset);
}
Entry = MmGetPageEntrySectionSegment(Segment, Offset);

View file

@ -70,7 +70,7 @@ PsCreateCidHandle(PVOID Object, POBJECT_TYPE ObjectType, PHANDLE Handle)
cido->Obj.Object = Object;
KeAcquireSpinLock(&CidLock, &oldIrql);
cido->Handle = (HANDLE)(++CidCounter);
cido->Handle = (HANDLE)((ULONG_PTR)(++CidCounter) << 2);
InsertTailList(&CidHead, &cido->Entry);
KeReleaseSpinLock(&CidLock, oldIrql);

View file

@ -23,7 +23,6 @@ POBJECT_TYPE EXPORTED PsProcessType = NULL;
LIST_ENTRY PsProcessListHead;
static KSPIN_LOCK PsProcessListLock;
static ULONG PiNextProcessUniqueId = 0; /* TODO */
static LARGE_INTEGER ShortPsLockDelay, PsLockTimeout;
static GENERIC_MAPPING PiProcessMapping = {STANDARD_RIGHTS_READ | PROCESS_QUERY_INFORMATION | PROCESS_VM_READ,
@ -192,14 +191,35 @@ NtOpenProcessTokenEx(
{
PACCESS_TOKEN Token;
HANDLE hToken;
NTSTATUS Status;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PreviousMode = ExGetPreviousMode();
if(PreviousMode == UserMode)
{
_SEH_TRY
{
ProbeForWrite(TokenHandle,
sizeof(HANDLE),
sizeof(ULONG));
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
}
Status = PsOpenTokenOfProcess(ProcessHandle,
&Token);
if (!NT_SUCCESS(Status))
if(NT_SUCCESS(Status))
{
return(Status);
}
Status = ObCreateHandle(PsGetCurrentProcess(),
Token,
DesiredAccess,
@ -207,11 +227,18 @@ NtOpenProcessTokenEx(
&hToken);
ObDereferenceObject(Token);
if(NT_SUCCESS(Status))
_SEH_TRY
{
Status = MmCopyToCaller(TokenHandle, &hToken, sizeof(HANDLE));
*TokenHandle = hToken;
}
return(Status);
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
}
return Status;
}
@ -224,7 +251,7 @@ PsReferencePrimaryToken(PEPROCESS Process)
ObReferenceObjectByPointer(Process->Token,
TOKEN_ALL_ACCESS,
SepTokenObjectType,
UserMode);
KernelMode);
return(Process->Token);
}
@ -239,16 +266,16 @@ PsOpenTokenOfProcess(HANDLE ProcessHandle,
Status = ObReferenceObjectByHandle(ProcessHandle,
PROCESS_QUERY_INFORMATION,
PsProcessType,
UserMode,
ExGetPreviousMode(),
(PVOID*)&Process,
NULL);
if (!NT_SUCCESS(Status))
if(NT_SUCCESS(Status))
{
return(Status);
}
*Token = PsReferencePrimaryToken(Process);
ObDereferenceObject(Process);
return(STATUS_SUCCESS);
}
return Status;
}
@ -269,7 +296,7 @@ PiKillMostProcesses(VOID)
current_entry = current_entry->Flink;
if (current->UniqueProcessId != PsInitialSystemProcess->UniqueProcessId &&
current->UniqueProcessId != (ULONG)PsGetCurrentProcessId())
current->UniqueProcessId != PsGetCurrentProcessId())
{
PiTerminateProcessThreads(current, STATUS_SUCCESS);
}
@ -373,8 +400,17 @@ PsInitProcessManagment(VOID)
}
#endif
PsInitialSystemProcess->UniqueProcessId =
InterlockedIncrementUL(&PiNextProcessUniqueId); /* TODO */
strcpy(PsInitialSystemProcess->ImageFileName, "System");
Status = PsCreateCidHandle(PsInitialSystemProcess,
PsProcessType,
&PsInitialSystemProcess->UniqueProcessId);
if(!NT_SUCCESS(Status))
{
DPRINT1("Failed to create CID handle (unique process id) for the system process!\n");
return;
}
PsInitialSystemProcess->Win32WindowStation = (HANDLE)0;
KeAcquireSpinLock(&PsProcessListLock, &oldIrql);
@ -383,8 +419,6 @@ PsInitProcessManagment(VOID)
InitializeListHead(&PsInitialSystemProcess->ThreadListHead);
KeReleaseSpinLock(&PsProcessListLock, oldIrql);
strcpy(PsInitialSystemProcess->ImageFileName, "System");
SepCreateSystemProcessToken(PsInitialSystemProcess);
}
@ -610,173 +644,57 @@ IoGetCurrentProcess(VOID)
}
}
/*
* @implemented
*/
NTSTATUS STDCALL
PsCreateSystemProcess(PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes)
{
HANDLE SystemProcessHandle;
NTSTATUS Status;
/* FIXME - what about security? should there be any privilege checks or something
security related? */
Status = ObCreateHandle(PsGetCurrentProcess(),
PsInitialSystemProcess,
PROCESS_CREATE_PROCESS | PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION,
FALSE,
&SystemProcessHandle);
if(!NT_SUCCESS(Status))
{
DPRINT1("Failed to create a handle for the system process!\n");
return Status;
}
Status = NtCreateProcess(ProcessHandle,
DesiredAccess,
ObjectAttributes,
SystemProcessHandle,
FALSE,
NULL,
NULL,
NULL);
NtClose(SystemProcessHandle);
return Status;
}
NTSTATUS STDCALL
NtCreateProcess(OUT PHANDLE ProcessHandle,
NTSTATUS
PspCreateProcess(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN HANDLE ParentProcess OPTIONAL,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL)
/*
* FUNCTION: Creates a process.
* ARGUMENTS:
* ProcessHandle (OUT) = Caller supplied storage for the resulting
* handle
* DesiredAccess = Specifies the allowed or desired access to the
* process can be a combination of
* STANDARD_RIGHTS_REQUIRED| ..
* ObjectAttribute = Initialized attributes for the object, contains
* the rootdirectory and the filename
* ParentProcess = Handle to the parent process.
* InheritObjectTable = Specifies to inherit the objects of the parent
* process if true.
* SectionHandle = Handle to a section object to back the image file
* DebugPort = Handle to a DebugPort if NULL the system default debug
* port will be used.
* ExceptionPort = Handle to a exception port.
* REMARKS:
* This function maps to the win32 CreateProcess.
* RETURNS: Status
*/
{
HANDLE hProcess;
PEPROCESS Process;
PEPROCESS pParentProcess;
PKPROCESS KProcess;
NTSTATUS Status;
KIRQL oldIrql;
PVOID LdrStartupAddr;
PVOID ImageBase;
PEPORT pDebugPort;
PEPORT pExceptionPort;
PVOID BaseAddress;
PMEMORY_AREA MemoryArea;
PHYSICAL_ADDRESS BoundaryAddressMultiple;
KPROCESSOR_MODE PreviousMode;
PVOID ImageBase = NULL;
PEPORT pDebugPort = NULL;
PEPORT pExceptionPort = NULL;
PSECTION_OBJECT SectionObject = NULL;
NTSTATUS Status = STATUS_SUCCESS;
DPRINT("NtCreateProcess(ObjectAttributes %x)\n",ObjectAttributes);
DPRINT("PspCreateProcess(ObjectAttributes %x)\n", ObjectAttributes);
PreviousMode = ExGetPreviousMode();
BoundaryAddressMultiple.QuadPart = 0;
if(ParentProcess != NULL)
{
Status = ObReferenceObjectByHandle(ParentProcess,
PROCESS_CREATE_PROCESS,
PsProcessType,
ExGetPreviousMode(),
PreviousMode,
(PVOID*)&pParentProcess,
NULL);
if (!NT_SUCCESS(Status))
{
DPRINT("NtCreateProcess() = %x\n",Status);
DPRINT1("Failed to reference the parent process: Status: 0x%x\n", Status);
return(Status);
}
Status = ObCreateObject(ExGetPreviousMode(),
PsProcessType,
ObjectAttributes,
ExGetPreviousMode(),
NULL,
sizeof(EPROCESS),
0,
0,
(PVOID*)&Process);
if (!NT_SUCCESS(Status))
{
ObDereferenceObject(pParentProcess);
DPRINT("ObCreateObject() = %x\n",Status);
return(Status);
}
Status = ObInsertObject ((PVOID)Process,
NULL,
DesiredAccess,
0,
NULL,
ProcessHandle);
if (!NT_SUCCESS(Status))
else
{
ObDereferenceObject (Process);
ObDereferenceObject (pParentProcess);
DPRINT("ObInsertObject() = %x\n",Status);
return Status;
pParentProcess = NULL;
}
KeInitializeDispatcherHeader(&Process->Pcb.DispatcherHeader,
InternalProcessType,
sizeof(EPROCESS),
FALSE);
KProcess = &Process->Pcb;
/* Inherit parent process's affinity. */
KProcess->Affinity = pParentProcess->Pcb.Affinity;
KProcess->BasePriority = PROCESS_PRIO_NORMAL;
KProcess->IopmOffset = 0xffff;
KProcess->LdtDescriptor[0] = 0;
KProcess->LdtDescriptor[1] = 0;
InitializeListHead(&KProcess->ThreadListHead);
KProcess->ThreadQuantum = 6;
KProcess->AutoAlignment = 0;
MmInitializeAddressSpace(Process,
&Process->AddressSpace);
Process->UniqueProcessId = InterlockedIncrementUL(&PiNextProcessUniqueId); /* TODO */
Process->InheritedFromUniqueProcessId =
(HANDLE)pParentProcess->UniqueProcessId;
ObCreateHandleTable(pParentProcess,
InheritObjectTable,
Process);
MmCopyMmInfo(ParentProcess, Process);
KeInitializeEvent(&Process->LockEvent, SynchronizationEvent, FALSE);
Process->LockCount = 0;
Process->LockOwner = NULL;
Process->Win32WindowStation = (HANDLE)0;
KeAcquireSpinLock(&PsProcessListLock, &oldIrql);
InsertHeadList(&PsProcessListHead, &Process->ProcessListEntry);
InitializeListHead(&Process->ThreadListHead);
KeReleaseSpinLock(&PsProcessListLock, oldIrql);
ExInitializeFastMutex(&Process->TebLock);
Process->Pcb.State = PROCESS_STATE_ACTIVE;
/*
* Add the debug port
*/
@ -785,18 +703,14 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
Status = ObReferenceObjectByHandle(DebugPort,
PORT_ALL_ACCESS,
LpcPortObjectType,
UserMode,
PreviousMode,
(PVOID*)&pDebugPort,
NULL);
if (!NT_SUCCESS(Status))
{
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
ZwClose(*ProcessHandle);
*ProcessHandle = NULL;
return(Status);
DPRINT1("Failed to reference the debug port: Status: 0x%x\n", Status);
goto exitdereferenceobjects;
}
Process->DebugPort = pDebugPort;
}
/*
@ -807,107 +721,75 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
Status = ObReferenceObjectByHandle(ExceptionPort,
PORT_ALL_ACCESS,
LpcPortObjectType,
UserMode,
PreviousMode,
(PVOID*)&pExceptionPort,
NULL);
if (!NT_SUCCESS(Status))
{
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
ZwClose(*ProcessHandle);
*ProcessHandle = NULL;
return(Status);
DPRINT1("Failed to reference the exception port: Status: 0x%x\n", Status);
goto exitdereferenceobjects;
}
Process->ExceptionPort = pExceptionPort;
}
/*
* Now we have created the process proper
*/
MmLockAddressSpace(&Process->AddressSpace);
/* Protect the highest 64KB of the process address space */
BaseAddress = (PVOID)MmUserProbeAddress;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_NO_ACCESS,
&BaseAddress,
0x10000,
PAGE_NOACCESS,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace);
DPRINT1("Failed to protect the highest 64KB of the process address space\n");
KEBUGCHECK(0);
}
/* Protect the lowest 64KB of the process address space */
#if 0
BaseAddress = (PVOID)0x00000000;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_NO_ACCESS,
&BaseAddress,
0x10000,
PAGE_NOACCESS,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace);
DPRINT1("Failed to protect the lowest 64KB of the process address space\n");
KEBUGCHECK(0);
}
#endif
/* Protect the 60KB above the shared user page */
BaseAddress = (char*)USER_SHARED_DATA + PAGE_SIZE;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_NO_ACCESS,
&BaseAddress,
0x10000 - PAGE_SIZE,
PAGE_NOACCESS,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace);
DPRINT1("Failed to protect the memory above the shared user page\n");
KEBUGCHECK(0);
}
/* Create the shared data page */
BaseAddress = (PVOID)USER_SHARED_DATA;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_SHARED_DATA,
&BaseAddress,
PAGE_SIZE,
PAGE_READONLY,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
MmUnlockAddressSpace(&Process->AddressSpace);
if (!NT_SUCCESS(Status))
{
DPRINT1("Failed to create shared data page\n");
KEBUGCHECK(0);
}
if (SectionHandle != NULL)
{
PSECTION_OBJECT SectionObject;
Status = ObReferenceObjectByHandle(SectionHandle,
0,
MmSectionObjectType,
PreviousMode,
(PVOID*)&SectionObject,
NULL);
if (!NT_SUCCESS(Status))
{
DPRINT1("Failed to reference process image section: Status: 0x%x\n", Status);
goto exitdereferenceobjects;
}
}
Status = ObCreateObject(PreviousMode,
PsProcessType,
ObjectAttributes,
PreviousMode,
NULL,
sizeof(EPROCESS),
0,
0,
(PVOID*)&Process);
if (!NT_SUCCESS(Status))
{
DPRINT1("Failed to create process object, Status: 0x%x\n", Status);
exitdereferenceobjects:
if(SectionObject != NULL)
ObDereferenceObject(SectionObject);
if(pExceptionPort != NULL)
ObDereferenceObject(pExceptionPort);
if(pDebugPort != NULL)
ObDereferenceObject(pDebugPort);
if(pParentProcess != NULL)
ObDereferenceObject(pParentProcess);
return Status;
}
KProcess = &Process->Pcb;
RtlZeroMemory(Process, sizeof(EPROCESS));
Status = PsCreateCidHandle(Process,
PsProcessType,
&Process->UniqueProcessId);
if(!NT_SUCCESS(Status))
{
DPRINT1("Failed to create CID handle (unique process ID)! Status: 0x%x\n", Status);
ObDereferenceObject(Process);
goto exitdereferenceobjects;
}
Process->DebugPort = pDebugPort;
Process->ExceptionPort = pExceptionPort;
if(SectionObject != NULL)
{
UNICODE_STRING FileName;
PWCHAR szSrc;
PCHAR szDest;
@ -916,19 +798,6 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
/*
* Determine the image file name and save it to the EPROCESS structure
*/
Status = ObReferenceObjectByHandle(SectionHandle,
0,
MmSectionObjectType,
UserMode,
(PVOID*)&SectionObject,
NULL);
if (!NT_SUCCESS(Status))
{
DbgPrint("Failed to reference section object\n", Status);
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
return(Status);
}
FileName = SectionObject->FileObject->FileName;
szSrc = (PWCHAR)(FileName.Buffer + (FileName.Length / sizeof(WCHAR)) - 1);
@ -954,51 +823,205 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
{
*(szDest++) = (UCHAR)*(szSrc++);
}
*szDest = '\0';
/* *szDest = '\0'; */
}
KeInitializeDispatcherHeader(&KProcess->DispatcherHeader,
InternalProcessType,
sizeof(EPROCESS),
FALSE);
ObDereferenceObject(SectionObject);
/* Inherit parent process's affinity. */
if(pParentProcess != NULL)
{
KProcess->Affinity = pParentProcess->Pcb.Affinity;
Process->InheritedFromUniqueProcessId = pParentProcess->UniqueProcessId;
Process->SessionId = pParentProcess->SessionId;
}
else
{
Process->ImageFileName[0] = '\0';
KProcess->Affinity = KeActiveProcessors;
}
KProcess->BasePriority = PROCESS_PRIO_NORMAL;
KProcess->IopmOffset = 0xffff;
KProcess->LdtDescriptor[0] = 0;
KProcess->LdtDescriptor[1] = 0;
InitializeListHead(&KProcess->ThreadListHead);
KProcess->ThreadQuantum = 6;
KProcess->AutoAlignment = 0;
MmInitializeAddressSpace(Process,
&Process->AddressSpace);
ObCreateHandleTable(pParentProcess,
InheritObjectTable,
Process);
MmCopyMmInfo(pParentProcess ? pParentProcess : PsInitialSystemProcess, Process);
KeInitializeEvent(&Process->LockEvent, SynchronizationEvent, FALSE);
Process->LockCount = 0;
Process->LockOwner = NULL;
Process->Win32WindowStation = (HANDLE)0;
KeAcquireSpinLock(&PsProcessListLock, &oldIrql);
InsertHeadList(&PsProcessListHead, &Process->ProcessListEntry);
InitializeListHead(&Process->ThreadListHead);
KeReleaseSpinLock(&PsProcessListLock, oldIrql);
ExInitializeFastMutex(&Process->TebLock);
Process->Pcb.State = PROCESS_STATE_ACTIVE;
/*
* Map ntdll
* Now we have created the process proper
*/
Status = LdrpMapSystemDll(*ProcessHandle,
MmLockAddressSpace(&Process->AddressSpace);
/* Protect the highest 64KB of the process address space */
BaseAddress = (PVOID)MmUserProbeAddress;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_NO_ACCESS,
&BaseAddress,
0x10000,
PAGE_NOACCESS,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace);
DPRINT1("Failed to protect the highest 64KB of the process address space\n");
ObDereferenceObject(Process);
goto exitdereferenceobjects;
}
/* Protect the lowest 64KB of the process address space */
#if 0
BaseAddress = (PVOID)0x00000000;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_NO_ACCESS,
&BaseAddress,
0x10000,
PAGE_NOACCESS,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace);
DPRINT1("Failed to protect the lowest 64KB of the process address space\n");
ObDereferenceObject(Process);
goto exitdereferenceobjects;
}
#endif
/* Protect the 60KB above the shared user page */
BaseAddress = (char*)USER_SHARED_DATA + PAGE_SIZE;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_NO_ACCESS,
&BaseAddress,
0x10000 - PAGE_SIZE,
PAGE_NOACCESS,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace);
DPRINT1("Failed to protect the memory above the shared user page\n");
ObDereferenceObject(Process);
goto exitdereferenceobjects;
}
/* Create the shared data page */
BaseAddress = (PVOID)USER_SHARED_DATA;
Status = MmCreateMemoryArea(Process,
&Process->AddressSpace,
MEMORY_AREA_SHARED_DATA,
&BaseAddress,
PAGE_SIZE,
PAGE_READONLY,
&MemoryArea,
FALSE,
FALSE,
BoundaryAddressMultiple);
MmUnlockAddressSpace(&Process->AddressSpace);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace); /* FIXME ? */
DPRINT1("Failed to create shared data page\n");
ObDereferenceObject(Process);
goto exitdereferenceobjects;
}
#if 1
/*
* FIXME - the handle should be created after all things are initialized, NOT HERE!
*/
Status = ObInsertObject ((PVOID)Process,
NULL,
DesiredAccess,
0,
NULL,
&hProcess);
if (!NT_SUCCESS(Status))
{
MmUnlockAddressSpace(&Process->AddressSpace); /* FIXME ? */
DPRINT1("Failed to create a handle for the process\n");
ObDereferenceObject(Process);
goto exitdereferenceobjects;
}
#endif
/*
* FIXME - Map ntdll
*/
Status = LdrpMapSystemDll(hProcess, /* FIXME - hProcess shouldn't be available at this point! */
&LdrStartupAddr);
if (!NT_SUCCESS(Status))
{
DbgPrint("LdrpMapSystemDll failed (Status %x)\n", Status);
MmUnlockAddressSpace(&Process->AddressSpace); /* FIXME ? */
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
return(Status);
goto exitdereferenceobjects;
}
/*
* Map the process image
*/
if (SectionHandle != NULL)
if (SectionObject != NULL)
{
ULONG ViewSize = 0;
DPRINT("Mapping process image\n");
Status = LdrpMapImage(*ProcessHandle,
SectionHandle,
&ImageBase);
Status = MmMapViewOfSection(SectionObject,
Process,
(PVOID*)&ImageBase,
0,
ViewSize,
NULL,
&ViewSize,
0,
MEM_COMMIT,
PAGE_READWRITE);
if (!NT_SUCCESS(Status))
{
DbgPrint("LdrpMapImage failed (Status %x)\n", Status);
DbgPrint("Failed to map the process section (Status %x)\n", Status);
MmUnlockAddressSpace(&Process->AddressSpace); /* FIXME ? */
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
return(Status);
goto exitdereferenceobjects;
}
}
else
{
ImageBase = NULL;
}
if(pParentProcess != NULL)
{
/*
* Duplicate the token
*/
@ -1007,25 +1030,26 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
{
DbgPrint("SepInitializeNewProcess failed (Status %x)\n", Status);
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
return(Status);
goto exitdereferenceobjects;
}
}
else
{
/* FIXME */
}
/*
*
* FIXME - Create PEB
*/
DPRINT("Creating PEB\n");
Status = PsCreatePeb(*ProcessHandle,
Status = PsCreatePeb(hProcess, /* FIXME - hProcess shouldn't be available at this point! */
Process,
ImageBase);
if (!NT_SUCCESS(Status))
{
DbgPrint("NtCreateProcess() Peb creation failed: Status %x\n",Status);
ObDereferenceObject(Process);
ObDereferenceObject(pParentProcess);
ZwClose(*ProcessHandle);
*ProcessHandle = NULL;
return(Status);
goto exitdereferenceobjects;
}
/*
@ -1058,9 +1082,139 @@ NtCreateProcess(OUT PHANDLE ProcessHandle,
PspRunCreateProcessNotifyRoutines(Process, TRUE);
/*
* FIXME - the handle should be created not before this point!
*/
#if 0
Status = ObInsertObject ((PVOID)Process,
NULL,
DesiredAccess,
0,
NULL,
&hProcess);
#endif
if (NT_SUCCESS(Status))
{
_SEH_TRY
{
*ProcessHandle = hProcess;
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
}
/*
* don't dereference the debug port, exception port and section object even
* if ObInsertObject() failed, the process is alive! We just couldn't return
* the handle to the caller!
*/
ObDereferenceObject(Process);
if(pParentProcess != NULL)
ObDereferenceObject(pParentProcess);
return(STATUS_SUCCESS);
return Status;
}
/*
* @implemented
*/
NTSTATUS STDCALL
PsCreateSystemProcess(PHANDLE ProcessHandle,
ACCESS_MASK DesiredAccess,
POBJECT_ATTRIBUTES ObjectAttributes)
{
return PspCreateProcess(ProcessHandle,
DesiredAccess,
ObjectAttributes,
NULL, /* no parent process */
FALSE,
NULL,
NULL,
NULL);
}
/*
* @implemented
*/
NTSTATUS STDCALL
NtCreateProcess(OUT PHANDLE ProcessHandle,
IN ACCESS_MASK DesiredAccess,
IN POBJECT_ATTRIBUTES ObjectAttributes OPTIONAL,
IN HANDLE ParentProcess,
IN BOOLEAN InheritObjectTable,
IN HANDLE SectionHandle OPTIONAL,
IN HANDLE DebugPort OPTIONAL,
IN HANDLE ExceptionPort OPTIONAL)
/*
* FUNCTION: Creates a process.
* ARGUMENTS:
* ProcessHandle (OUT) = Caller supplied storage for the resulting
* handle
* DesiredAccess = Specifies the allowed or desired access to the
* process can be a combination of
* STANDARD_RIGHTS_REQUIRED| ..
* ObjectAttribute = Initialized attributes for the object, contains
* the rootdirectory and the filename
* ParentProcess = Handle to the parent process.
* InheritObjectTable = Specifies to inherit the objects of the parent
* process if true.
* SectionHandle = Handle to a section object to back the image file
* DebugPort = Handle to a DebugPort if NULL the system default debug
* port will be used.
* ExceptionPort = Handle to a exception port.
* REMARKS:
* This function maps to the win32 CreateProcess.
* RETURNS: Status
*/
{
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status = STATUS_SUCCESS;
PreviousMode = ExGetPreviousMode();
if(PreviousMode != KernelMode)
{
_SEH_TRY
{
ProbeForWrite(ProcessHandle,
sizeof(HANDLE),
sizeof(ULONG));
}
_SEH_HANDLE
{
Status = _SEH_GetExceptionCode();
}
_SEH_END;
if(!NT_SUCCESS(Status))
{
return Status;
}
}
if(ParentProcess == NULL)
{
Status = STATUS_INVALID_PARAMETER;
}
else
{
Status = PspCreateProcess(ProcessHandle,
DesiredAccess,
ObjectAttributes,
ParentProcess,
InheritObjectTable,
SectionHandle,
DebugPort,
ExceptionPort);
}
return Status;
}
@ -1123,7 +1277,7 @@ NtOpenProcess(OUT PHANDLE ProcessHandle,
{
current = CONTAINING_RECORD(current_entry, EPROCESS,
ProcessListEntry);
if (current->UniqueProcessId == (ULONG)ClientId->UniqueProcess)
if (current->UniqueProcessId == ClientId->UniqueProcess)
{
if (current->Pcb.State == PROCESS_STATE_TERMINATED)
{
@ -1220,7 +1374,7 @@ NtQueryInformationProcess(IN HANDLE ProcessHandle,
ProcessBasicInformationP->UniqueProcessId =
Process->UniqueProcessId;
ProcessBasicInformationP->InheritedFromUniqueProcessId =
(ULONG)Process->InheritedFromUniqueProcessId;
Process->InheritedFromUniqueProcessId;
ProcessBasicInformationP->BasePriority =
Process->Pcb.BasePriority;
@ -2418,7 +2572,7 @@ PsIsProcessBeingDebugged(
* @implemented
*/
NTSTATUS STDCALL
PsLookupProcessByProcessId(IN PVOID ProcessId,
PsLookupProcessByProcessId(IN HANDLE ProcessId,
OUT PEPROCESS *Process)
{
KIRQL oldIrql;
@ -2433,7 +2587,7 @@ PsLookupProcessByProcessId(IN PVOID ProcessId,
current = CONTAINING_RECORD(current_entry,
EPROCESS,
ProcessListEntry);
if (current->UniqueProcessId == (ULONG)ProcessId)
if (current->UniqueProcessId == ProcessId)
{
*Process = current;
ObReferenceObject(current);

View file

@ -36,12 +36,12 @@ VOID STDCALL CsrInitProcessData(VOID)
RtlInitializeCriticalSection( &ProcessDataLock );
}
PCSRSS_PROCESS_DATA STDCALL CsrGetProcessData(ULONG ProcessId)
PCSRSS_PROCESS_DATA STDCALL CsrGetProcessData(HANDLE ProcessId)
{
ULONG hash;
PCSRSS_PROCESS_DATA pProcessData;
hash = ProcessId % (sizeof(ProcessData) / sizeof(*ProcessData));
hash = (ULONG_PTR)ProcessId % (sizeof(ProcessData) / sizeof(*ProcessData));
LOCK;
@ -55,12 +55,12 @@ PCSRSS_PROCESS_DATA STDCALL CsrGetProcessData(ULONG ProcessId)
return pProcessData;
}
PCSRSS_PROCESS_DATA STDCALL CsrCreateProcessData(ULONG ProcessId)
PCSRSS_PROCESS_DATA STDCALL CsrCreateProcessData(HANDLE ProcessId)
{
ULONG hash;
PCSRSS_PROCESS_DATA pProcessData;
hash = ProcessId % (sizeof(ProcessData) / sizeof(*ProcessData));
hash = (ULONG_PTR)ProcessId % (sizeof(ProcessData) / sizeof(*ProcessData));
LOCK;
@ -94,13 +94,13 @@ PCSRSS_PROCESS_DATA STDCALL CsrCreateProcessData(ULONG ProcessId)
return pProcessData;
}
NTSTATUS STDCALL CsrFreeProcessData(ULONG Pid)
NTSTATUS STDCALL CsrFreeProcessData(HANDLE Pid)
{
ULONG hash;
int c;
PCSRSS_PROCESS_DATA pProcessData, pPrevProcessData = NULL;
hash = Pid % (sizeof(ProcessData) / sizeof(*ProcessData));
hash = (ULONG_PTR)Pid % (sizeof(ProcessData) / sizeof(*ProcessData));
LOCK;

View file

@ -123,18 +123,18 @@ ClientConnectionThread(HANDLE ServerPort)
if (LpcRequest.Header.MessageType == LPC_PORT_CLOSED)
{
CsrFreeProcessData( (ULONG)LpcRequest.Header.ClientId.UniqueProcess );
CsrFreeProcessData( LpcRequest.Header.ClientId.UniqueProcess );
break;
}
Request = (PCSRSS_API_REQUEST)&LpcRequest;
Reply = (PCSRSS_API_REPLY)&LpcReply;
ProcessData = CsrGetProcessData((ULONG)LpcRequest.Header.ClientId.UniqueProcess);
ProcessData = CsrGetProcessData(LpcRequest.Header.ClientId.UniqueProcess);
if (ProcessData == NULL)
{
DPRINT1("CSR: Message %d: Unable to find data for process %d\n",
LpcRequest.Header.MessageType, (ULONG)LpcRequest.Header.ClientId.UniqueProcess);
DPRINT1("CSR: Message %d: Unable to find data for process 0x%x\n",
LpcRequest.Header.MessageType, LpcRequest.Header.ClientId.UniqueProcess);
break;
}
@ -187,11 +187,11 @@ ServerApiPortThead(PVOID PortHandle)
break;
}
ProcessData = CsrCreateProcessData((ULONG)Request.Header.ClientId.UniqueProcess);
ProcessData = CsrCreateProcessData(Request.Header.ClientId.UniqueProcess);
if (ProcessData == NULL)
{
DPRINT1("Unable to allocate or find data for process %d\n",
(ULONG)Request.Header.ClientId.UniqueProcess);
DPRINT1("Unable to allocate or find data for process 0x%x\n",
Request.Header.ClientId.UniqueProcess);
Status = STATUS_UNSUCCESSFUL;
break;
}

View file

@ -36,7 +36,7 @@ typedef struct _CSRSS_PROCESS_DATA
PCSRSS_CONSOLE Console;
ULONG HandleTableSize;
Object_t ** HandleTable;
ULONG ProcessId;
HANDLE ProcessId;
ULONG ShutdownLevel;
ULONG ShutdownFlags;
HANDLE ConsoleEvent;
@ -106,9 +106,9 @@ VOID STDCALL CsrInitConsoleSupport(VOID);
/* api/process.c */
VOID STDCALL CsrInitProcessData(VOID);
PCSRSS_PROCESS_DATA STDCALL CsrGetProcessData(ULONG ProcessId);
PCSRSS_PROCESS_DATA STDCALL CsrCreateProcessData(ULONG ProcessId);
NTSTATUS STDCALL CsrFreeProcessData( ULONG Pid );
PCSRSS_PROCESS_DATA STDCALL CsrGetProcessData(HANDLE ProcessId);
PCSRSS_PROCESS_DATA STDCALL CsrCreateProcessData(HANDLE ProcessId);
NTSTATUS STDCALL CsrFreeProcessData( HANDLE Pid );
/* api/handle.c */
NTSTATUS FASTCALL CsrRegisterObjectDefinitions(PCSRSS_OBJECT_DEFINITION NewDefinitions);

View file

@ -80,10 +80,26 @@ ConioConsoleCtrlEvent(DWORD Event, PCSRSS_PROCESS_DATA ProcessData)
if (ProcessData->CtrlDispatcher)
{
Process = OpenProcess(PROCESS_DUP_HANDLE, FALSE, ProcessData->ProcessId);
if (NULL == Process)
OBJECT_ATTRIBUTES ObjectAttributes;
CLIENT_ID ClientId;
NTSTATUS Status;
ClientId.UniqueThread = NULL;
ClientId.UniqueProcess = ProcessData->ProcessId;
InitializeObjectAttributes(&ObjectAttributes,
NULL,
0,
NULL,
NULL);
/* using OpenProcess is not optimal due to HANDLE vs. DWORD PIDs... */
Status = NtOpenProcess(&Process,
PROCESS_DUP_HANDLE,
&ObjectAttributes,
&ClientId);
if (!NT_SUCCESS(Status))
{
DPRINT1("Failed for handle duplication\n");
DPRINT1("Failed for handle duplication, Status: 0x%x\n", Status);
return;
}
@ -248,6 +264,8 @@ CsrInitConsole(PCSRSS_CONSOLE Console)
CSR_API(CsrAllocConsole)
{
PCSRSS_CONSOLE Console;
OBJECT_ATTRIBUTES ObjectAttributes;
CLIENT_ID ClientId;
HANDLE Process;
NTSTATUS Status;
@ -301,10 +319,22 @@ CSR_API(CsrAllocConsole)
return Reply->Status = Status;
}
Process = OpenProcess(PROCESS_DUP_HANDLE, FALSE, ProcessData->ProcessId);
if (NULL == Process)
ClientId.UniqueThread = NULL;
ClientId.UniqueProcess = ProcessData->ProcessId;
InitializeObjectAttributes(&ObjectAttributes,
NULL,
0,
NULL,
NULL);
/* using OpenProcess is not optimal due to HANDLE vs. DWORD PIDs... */
Status = NtOpenProcess(&Process,
PROCESS_DUP_HANDLE,
&ObjectAttributes,
&ClientId);
if (!NT_SUCCESS(Status))
{
DPRINT1("OpenProcess() failed for handle duplication\n");
DPRINT1("NtOpenProcess() failed for handle duplication, Status: 0x%x\n", Status);
Console->Header.ReferenceCount--;
ProcessData->Console = 0;
Win32CsrReleaseObject(ProcessData, Reply->Data.AllocConsoleReply.OutputHandle);
@ -312,6 +342,7 @@ CSR_API(CsrAllocConsole)
Reply->Status = Status;
return Status;
}
if (! DuplicateHandle(GetCurrentProcess(), ProcessData->Console->ActiveEvent,
Process, &ProcessData->ConsoleEvent, EVENT_ALL_ACCESS, FALSE, 0))
{

View file

@ -17,7 +17,7 @@
#include <debug.h>
static HWND LogonNotifyWindow = NULL;
static DWORD LogonProcess = 0;
static HANDLE LogonProcess = NULL;
CSR_API(CsrRegisterLogonProcess)
{
@ -35,7 +35,7 @@ CSR_API(CsrRegisterLogonProcess)
}
else
{
if ((DWORD) Request->Header.ClientId.UniqueProcess != LogonProcess)
if (Request->Header.ClientId.UniqueProcess != LogonProcess)
{
DPRINT1("Current logon process 0x%x, can't deregister from process 0x%x\n",
LogonProcess, Request->Header.ClientId.UniqueProcess);
@ -64,7 +64,7 @@ CSR_API(CsrSetLogonNotifyWindow)
Reply->Status = STATUS_INVALID_HANDLE;
return Reply->Status;
}
if (WindowCreator != LogonProcess)
if (WindowCreator != (DWORD)LogonProcess)
{
DPRINT1("Trying to register window not created by winlogon as notify window\n");
Reply->Status = STATUS_ACCESS_DENIED;

View file

@ -37,14 +37,14 @@ PUSER_MESSAGE_QUEUE W32kGetPrimitiveMessageQueue() {
}
BOOL FASTCALL
IntRegisterLogonProcess(DWORD ProcessId, BOOL Register)
IntRegisterLogonProcess(HANDLE ProcessId, BOOL Register)
{
PEPROCESS Process;
NTSTATUS Status;
CSRSS_API_REQUEST Request;
CSRSS_API_REPLY Reply;
Status = PsLookupProcessByProcessId((PVOID)ProcessId,
Status = PsLookupProcessByProcessId(ProcessId,
&Process);
if (!NT_SUCCESS(Status))
{
@ -519,7 +519,7 @@ NtUserCallTwoParam(
}
case TWOPARAM_ROUTINE_REGISTERLOGONPROC:
return (DWORD)IntRegisterLogonProcess(Param1, (BOOL)Param2);
return (DWORD)IntRegisterLogonProcess((HANDLE)Param1, (BOOL)Param2);
case TWOPARAM_ROUTINE_SETSYSCOLORS:
{

View file

@ -297,8 +297,8 @@ typedef struct _SYSTEM_PROCESSES {
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
HANDLE ProcessId;
HANDLE InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
@ -1461,8 +1461,8 @@ typedef struct _PROCESS_BASIC_INFORMATION {
PPEB PebBaseAddress;
KAFFINITY AffinityMask;
KPRIORITY BasePriority;
ULONG UniqueProcessId;
ULONG InheritedFromUniqueProcessId;
HANDLE UniqueProcessId;
HANDLE InheritedFromUniqueProcessId;
} PROCESS_BASIC_INFORMATION, *PPROCESS_BASIC_INFORMATION;
typedef struct _PROCESS_ACCESS_TOKEN {

View file

@ -3287,7 +3287,7 @@ NTKERNELAPI
NTSTATUS
NTAPI
PsLookupProcessByProcessId (
IN PVOID ProcessId,
IN HANDLE ProcessId,
OUT PEPROCESS *Process
);