Ventoy2Disk/Ventoy2Disk/process.h

   1 /*
   2 * Rufus: The Reliable USB Formatting Utility
   3 * Process search functionality
   4 *
   5 * Modified from Process Hacker:
   6 *   https://github.com/processhacker2/processhacker2/
   7 * Copyright © 2017-2019 Pete Batard <pete@akeo.ie>
   8 * Copyright © 2017 dmex
   9 * Copyright © 2009-2016 wj32
  10 * Copyright (c) 2020, longpanda <admin@ventoy.net>
  11 *
  12 * This program is free software: you can redistribute it and/or modify
  13 * it under the terms of the GNU General Public License as published by
  14 * the Free Software Foundation, either version 3 of the License, or
  15 * (at your option) any later version.
  16 *
  17 * This program is distributed in the hope that it will be useful,
  18 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20 * GNU General Public License for more details.
  21 *
  22 * You should have received a copy of the GNU General Public License
  23 * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include <windows.h>
  27 #include <winnt.h>
  28 #include <winternl.h>
  29
  30 #pragma once
  31
  32 #define PH_LARGE_BUFFER_SIZE                    (256 * 1024 * 1024)
  33
  34 #define STATUS_SUCCESS                                  ((NTSTATUS)0x00000000L)
  35 #define STATUS_ALREADY_COMPLETE                 ((NTSTATUS)0x000000FFL)
  36 #define STATUS_UNSUCCESSFUL                             ((NTSTATUS)0x80000001L)
  37 #define STATUS_BUFFER_OVERFLOW                  ((NTSTATUS)0x80000005L)
  38 #define STATUS_NOT_IMPLEMENTED                  ((NTSTATUS)0xC0000002L)
  39 #define STATUS_INFO_LENGTH_MISMATCH             ((NTSTATUS)0xC0000004L)
  40 //#define STATUS_INVALID_HANDLE                 ((NTSTATUS)0xC0000008L)
  41 #define STATUS_ACCESS_DENIED                    ((NTSTATUS)0xC0000022L)
  42 #define STATUS_BUFFER_TOO_SMALL                 ((NTSTATUS)0xC0000023L)
  43 #define STATUS_OBJECT_TYPE_MISMATCH             ((NTSTATUS)0xC0000024L)
  44 #define STATUS_OBJECT_NAME_INVALID              ((NTSTATUS)0xC0000033L)
  45 #define STATUS_OBJECT_NAME_NOT_FOUND    ((NTSTATUS)0xC0000034L)
  46 #define STATUS_OBJECT_PATH_INVALID              ((NTSTATUS)0xC0000039L)
  47 #define STATUS_SHARING_VIOLATION                ((NTSTATUS)0xC0000043L)
  48 #define STATUS_INSUFFICIENT_RESOURCES   ((NTSTATUS)0xC000009AL)
  49 #define STATUS_NOT_SUPPORTED                    ((NTSTATUS)0xC00000BBL)
  50
  51 #define SystemExtendedHandleInformation    64
  52 #define FileProcessIdsUsingFileInformation 47
  53
  54 // MinGW doesn't know this one yet
  55 #if !defined(PROCESSOR_ARCHITECTURE_ARM64)
  56 #define PROCESSOR_ARCHITECTURE_ARM64       12
  57 #endif
  58
  59 #define NtCurrentProcess() ((HANDLE)(LONG_PTR)-1)
  60
  61 typedef struct _SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX
  62 {
  63     PVOID Object;
  64     ULONG_PTR UniqueProcessId;
  65     ULONG_PTR HandleValue;
  66     ULONG GrantedAccess;
  67     USHORT CreatorBackTraceIndex;
  68     USHORT ObjectTypeIndex;
  69     ULONG HandleAttributes;
  70     ULONG Reserved;
  71 } SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX, *PSYSTEM_HANDLE_TABLE_ENTRY_INFO_EX;
  72
  73 typedef struct _SYSTEM_HANDLE_INFORMATION_EX
  74 {
  75     ULONG_PTR NumberOfHandles;
  76     ULONG_PTR Reserved;
  77     SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
  78 } SYSTEM_HANDLE_INFORMATION_EX, *PSYSTEM_HANDLE_INFORMATION_EX;
  79
  80 #if defined(_MSC_VER)
  81 typedef struct _OBJECT_NAME_INFORMATION
  82 {
  83     UNICODE_STRING Name;
  84 } OBJECT_NAME_INFORMATION, *POBJECT_NAME_INFORMATION;
  85
  86 typedef struct _OBJECT_TYPE_INFORMATION
  87 {
  88     UNICODE_STRING TypeName;
  89     ULONG TotalNumberOfObjects;
  90     ULONG TotalNumberOfHandles;
  91     ULONG TotalPagedPoolUsage;
  92     ULONG TotalNonPagedPoolUsage;
  93     ULONG TotalNamePoolUsage;
  94     ULONG TotalHandleTableUsage;
  95     ULONG HighWaterNumberOfObjects;
  96     ULONG HighWaterNumberOfHandles;
  97     ULONG HighWaterPagedPoolUsage;
  98     ULONG HighWaterNonPagedPoolUsage;
  99     ULONG HighWaterNamePoolUsage;
 100     ULONG HighWaterHandleTableUsage;
 101     ULONG InvalidAttributes;
 102     GENERIC_MAPPING GenericMapping;
 103     ULONG ValidAccessMask;
 104     BOOLEAN SecurityRequired;
 105     BOOLEAN MaintainHandleCount;
 106     UCHAR TypeIndex; // since WINBLUE
 107     CHAR ReservedByte;
 108     ULONG PoolType;
 109     ULONG DefaultPagedPoolCharge;
 110     ULONG DefaultNonPagedPoolCharge;
 111 } OBJECT_TYPE_INFORMATION, *POBJECT_TYPE_INFORMATION;
 112
 113 #define ObjectNameInformation  1
 114 #endif
 115 #define ObjectTypesInformation 3
 116
 117 typedef struct _OBJECT_TYPES_INFORMATION
 118 {
 119     ULONG NumberOfTypes;
 120 } OBJECT_TYPES_INFORMATION, *POBJECT_TYPES_INFORMATION;
 121
 122 typedef struct _PROCESS_BASIC_INFORMATION_WOW64
 123 {
 124     PVOID Reserved1[2];
 125     // MinGW32 screws us with a sizeof(PVOID64) of 4 instead of 8 => Use ULONGLONG instead
 126     ULONGLONG PebBaseAddress;
 127     PVOID Reserved2[4];
 128     ULONG_PTR UniqueProcessId[2];
 129     PVOID Reserved3[2];
 130 } PROCESS_BASIC_INFORMATION_WOW64;
 131
 132 typedef struct _UNICODE_STRING_WOW64
 133 {
 134     USHORT Length;
 135     USHORT MaximumLength;
 136     ULONGLONG Buffer;
 137 } UNICODE_STRING_WOW64;
 138
 139 typedef struct _FILE_PROCESS_IDS_USING_FILE_INFORMATION
 140 {
 141     ULONG NumberOfProcessIdsInList;
 142     ULONG_PTR ProcessIdList[1];
 143 } FILE_PROCESS_IDS_USING_FILE_INFORMATION, *PFILE_PROCESS_IDS_USING_FILE_INFORMATION;
 144
 145 #define ALIGN_UP_BY(Address, Align) (((ULONG_PTR)(Address) + (Align) - 1) & ~((Align) - 1))
 146 #define ALIGN_UP(Address, Type) ALIGN_UP_BY(Address, sizeof(Type))
 147
 148 #define PH_FIRST_OBJECT_TYPE(ObjectTypes) \
 149     (POBJECT_TYPE_INFORMATION)((PCHAR)(ObjectTypes)+ALIGN_UP(sizeof(OBJECT_TYPES_INFORMATION), ULONG_PTR))
 150
 151 #define PH_NEXT_OBJECT_TYPE(ObjectType) \
 152     (POBJECT_TYPE_INFORMATION)((PCHAR)(ObjectType)+sizeof(OBJECT_TYPE_INFORMATION)+\
 153     ALIGN_UP(ObjectType->TypeName.MaximumLength, ULONG_PTR))
 154
 155 // Heaps
 156
 157 typedef struct _RTL_HEAP_ENTRY
 158 {
 159     SIZE_T Size;
 160     USHORT Flags;
 161     USHORT AllocatorBackTraceIndex;
 162     union
 163     {
 164         struct
 165         {
 166             SIZE_T Settable;
 167             ULONG Tag;
 168         } s1;
 169         struct
 170         {
 171             SIZE_T CommittedSize;
 172             PVOID FirstBlock;
 173         } s2;
 174     } u;
 175 } RTL_HEAP_ENTRY, *PRTL_HEAP_ENTRY;
 176
 177 #define RTL_HEAP_BUSY (USHORT)0x0001
 178 #define RTL_HEAP_SEGMENT (USHORT)0x0002
 179 #define RTL_HEAP_SETTABLE_VALUE (USHORT)0x0010
 180 #define RTL_HEAP_SETTABLE_FLAG1 (USHORT)0x0020
 181 #define RTL_HEAP_SETTABLE_FLAG2 (USHORT)0x0040
 182 #define RTL_HEAP_SETTABLE_FLAG3 (USHORT)0x0080
 183 #define RTL_HEAP_SETTABLE_FLAGS (USHORT)0x00e0
 184 #define RTL_HEAP_UNCOMMITTED_RANGE (USHORT)0x0100
 185 #define RTL_HEAP_PROTECTED_ENTRY (USHORT)0x0200
 186
 187 typedef struct _RTL_HEAP_TAG
 188 {
 189     ULONG NumberOfAllocations;
 190     ULONG NumberOfFrees;
 191     SIZE_T BytesAllocated;
 192     USHORT TagIndex;
 193     USHORT CreatorBackTraceIndex;
 194     WCHAR TagName[24];
 195 } RTL_HEAP_TAG, *PRTL_HEAP_TAG;
 196
 197 typedef struct _RTL_HEAP_INFORMATION
 198 {
 199     PVOID BaseAddress;
 200     ULONG Flags;
 201     USHORT EntryOverhead;
 202     USHORT CreatorBackTraceIndex;
 203     SIZE_T BytesAllocated;
 204     SIZE_T BytesCommitted;
 205     ULONG NumberOfTags;
 206     ULONG NumberOfEntries;
 207     ULONG NumberOfPseudoTags;
 208     ULONG PseudoTagGranularity;
 209     ULONG Reserved[5];
 210     PRTL_HEAP_TAG Tags;
 211     PRTL_HEAP_ENTRY Entries;
 212 } RTL_HEAP_INFORMATION, *PRTL_HEAP_INFORMATION;
 213
 214 typedef struct _RTL_PROCESS_HEAPS
 215 {
 216     ULONG NumberOfHeaps;
 217     RTL_HEAP_INFORMATION Heaps[1];
 218 } RTL_PROCESS_HEAPS, *PRTL_PROCESS_HEAPS;
 219
 220 typedef NTSTATUS(NTAPI *PRTL_HEAP_COMMIT_ROUTINE)(
 221     _In_ PVOID Base,
 222     _Inout_ PVOID *CommitAddress,
 223     _Inout_ PSIZE_T CommitSize
 224     );
 225
 226 #if defined(_MSC_VER)
 227 typedef struct _RTL_HEAP_PARAMETERS
 228 {
 229     ULONG Length;
 230     SIZE_T SegmentReserve;
 231     SIZE_T SegmentCommit;
 232     SIZE_T DeCommitFreeBlockThreshold;
 233     SIZE_T DeCommitTotalFreeThreshold;
 234     SIZE_T MaximumAllocationSize;
 235     SIZE_T VirtualMemoryThreshold;
 236     SIZE_T InitialCommit;
 237     SIZE_T InitialReserve;
 238     PRTL_HEAP_COMMIT_ROUTINE CommitRoutine;
 239     SIZE_T Reserved[2];
 240 } RTL_HEAP_PARAMETERS, *PRTL_HEAP_PARAMETERS;
 241 #endif
 242
 243 #define HEAP_SETTABLE_USER_VALUE 0x00000100
 244 #define HEAP_SETTABLE_USER_FLAG1 0x00000200
 245 #define HEAP_SETTABLE_USER_FLAG2 0x00000400
 246 #define HEAP_SETTABLE_USER_FLAG3 0x00000800
 247 #define HEAP_SETTABLE_USER_FLAGS 0x00000e00
 248
 249 #define HEAP_CLASS_0 0x00000000 // Process heap
 250 #define HEAP_CLASS_1 0x00001000 // Private heap
 251 #define HEAP_CLASS_2 0x00002000 // Kernel heap
 252 #define HEAP_CLASS_3 0x00003000 // GDI heap
 253 #define HEAP_CLASS_4 0x00004000 // User heap
 254 #define HEAP_CLASS_5 0x00005000 // Console heap
 255 #define HEAP_CLASS_6 0x00006000 // User desktop heap
 256 #define HEAP_CLASS_7 0x00007000 // CSR shared heap
 257 #define HEAP_CLASS_8 0x00008000 // CSR port heap
 258 #define HEAP_CLASS_MASK 0x0000f000
 259
 260 // Privileges
 261
 262 #define SE_MIN_WELL_KNOWN_PRIVILEGE (2L)
 263 #define SE_CREATE_TOKEN_PRIVILEGE (2L)
 264 #define SE_ASSIGNPRIMARYTOKEN_PRIVILEGE (3L)
 265 #define SE_LOCK_MEMORY_PRIVILEGE (4L)
 266 #define SE_INCREASE_QUOTA_PRIVILEGE (5L)
 267 #define SE_MACHINE_ACCOUNT_PRIVILEGE (6L)
 268 #define SE_TCB_PRIVILEGE (7L)
 269 #define SE_SECURITY_PRIVILEGE (8L)
 270 #define SE_TAKE_OWNERSHIP_PRIVILEGE (9L)
 271 #define SE_LOAD_DRIVER_PRIVILEGE (10L)
 272 #define SE_SYSTEM_PROFILE_PRIVILEGE (11L)
 273 #define SE_SYSTEMTIME_PRIVILEGE (12L)
 274 #define SE_PROF_SINGLE_PROCESS_PRIVILEGE (13L)
 275 #define SE_INC_BASE_PRIORITY_PRIVILEGE (14L)
 276 #define SE_CREATE_PAGEFILE_PRIVILEGE (15L)
 277 #define SE_CREATE_PERMANENT_PRIVILEGE (16L)
 278 #define SE_BACKUP_PRIVILEGE (17L)
 279 #define SE_RESTORE_PRIVILEGE (18L)
 280 #define SE_SHUTDOWN_PRIVILEGE (19L)
 281 #define SE_DEBUG_PRIVILEGE (20L)
 282 #define SE_AUDIT_PRIVILEGE (21L)
 283 #define SE_SYSTEM_ENVIRONMENT_PRIVILEGE (22L)
 284 #define SE_CHANGE_NOTIFY_PRIVILEGE (23L)
 285 #define SE_REMOTE_SHUTDOWN_PRIVILEGE (24L)
 286 #define SE_UNDOCK_PRIVILEGE (25L)
 287 #define SE_SYNC_AGENT_PRIVILEGE (26L)
 288 #define SE_ENABLE_DELEGATION_PRIVILEGE (27L)
 289 #define SE_MANAGE_VOLUME_PRIVILEGE (28L)
 290 #define SE_IMPERSONATE_PRIVILEGE (29L)
 291 #define SE_CREATE_GLOBAL_PRIVILEGE (30L)
 292 #define SE_TRUSTED_CREDMAN_ACCESS_PRIVILEGE (31L)
 293 #define SE_RELABEL_PRIVILEGE (32L)
 294 #define SE_INC_WORKING_SET_PRIVILEGE (33L)
 295 #define SE_TIME_ZONE_PRIVILEGE (34L)
 296 #define SE_CREATE_SYMBOLIC_LINK_PRIVILEGE (35L)
 297 #define SE_MAX_WELL_KNOWN_PRIVILEGE SE_CREATE_SYMBOLIC_LINK_PRIVILEGE
 298
 299
 300
 301 /*
 302 * typedefs for the function prototypes. Use the something like:
 303 *   PF_DECL(FormatEx);
 304 * which translates to:
 305 *   FormatEx_t pfFormatEx = NULL;
 306 * in your code, to declare the entrypoint and then use:
 307 *   PF_INIT(FormatEx, Fmifs);
 308 * which translates to:
 309 *   pfFormatEx = (FormatEx_t) GetProcAddress(GetDLLHandle("fmifs"), "FormatEx");
 310 * to make it accessible.
 311 */
 312 #define         MAX_LIBRARY_HANDLES 32
 313 extern HMODULE  OpenedLibrariesHandle[MAX_LIBRARY_HANDLES];
 314 extern UINT16   OpenedLibrariesHandleSize;
 315 #define         OPENED_LIBRARIES_VARS HMODULE OpenedLibrariesHandle[MAX_LIBRARY_HANDLES]; UINT16 OpenedLibrariesHandleSize = 0
 316 #define         CLOSE_OPENED_LIBRARIES while(OpenedLibrariesHandleSize > 0) FreeLibrary(OpenedLibrariesHandle[--OpenedLibrariesHandleSize])
 317 static __inline HMODULE GetLibraryHandle(char* szLibraryName) {
 318     HMODULE h = NULL;
 319     if ((h = GetModuleHandleA(szLibraryName)) == NULL) {
 320         if (OpenedLibrariesHandleSize >= MAX_LIBRARY_HANDLES) {
 321             Log("Error: MAX_LIBRARY_HANDLES is too small\n");
 322         }
 323         else {
 324             h = LoadLibraryA(szLibraryName);
 325             if (h != NULL)
 326                 OpenedLibrariesHandle[OpenedLibrariesHandleSize++] = h;
 327         }
 328     }
 329     return h;
 330 }
 331 #define PF_TYPE(api, ret, proc, args)           typedef ret (api *proc##_t)args
 332 #define PF_DECL(proc)                                           static proc##_t pf##proc = NULL
 333 #define PF_TYPE_DECL(api, ret, proc, args)      PF_TYPE(api, ret, proc, args); PF_DECL(proc)
 334 #define PF_INIT(proc, name)                                     if (pf##proc == NULL) pf##proc = \
 335     (proc##_t) GetProcAddress(GetLibraryHandle(#name), #proc)
 336 #define PF_INIT_OR_OUT(proc, name)                      do {PF_INIT(proc, name);         \
 337 if (pf##proc == NULL) { Log("Unable to locate %s() in %s.dll: %d\n", \
 338 #proc, #name, GetLastError()); goto out;}    } while (0)
 339
 340 #define PF_INIT_OR_SET_STATUS(proc, name)       do {PF_INIT(proc, name);         \
 341 if ((pf##proc == NULL) && (NT_SUCCESS(status))) status = STATUS_NOT_IMPLEMENTED; \
 342     } while (0)
 343
 344 /* Custom application errors */
 345 #define FAC(f)                         ((f)<<16)
 346 #define APPERR(err)                    (APPLICATION_ERROR_MASK|(err))
 347 #define ERROR_INCOMPATIBLE_FS          0x1201
 348 #define ERROR_CANT_QUICK_FORMAT        0x1202
 349 #define ERROR_INVALID_CLUSTER_SIZE     0x1203
 350 #define ERROR_INVALID_VOLUME_SIZE      0x1204
 351 #define ERROR_CANT_START_THREAD        0x1205
 352 #define ERROR_BADBLOCKS_FAILURE        0x1206
 353 #define ERROR_ISO_SCAN                 0x1207
 354 #define ERROR_ISO_EXTRACT              0x1208
 355 #define ERROR_CANT_REMOUNT_VOLUME      0x1209
 356 #define ERROR_CANT_PATCH               0x120A
 357 #define ERROR_CANT_ASSIGN_LETTER       0x120B
 358 #define ERROR_CANT_MOUNT_VOLUME        0x120C
 359 #define ERROR_BAD_SIGNATURE            0x120D
 360 #define ERROR_CANT_DOWNLOAD            0x120E
 361
 362
 363 #define KB                   1024LL
 364 #define MB                1048576LL
 365 #define GB             1073741824LL
 366 #define TB          1099511627776LL
 367
 368 #ifndef _WINTERNL_
 369 typedef struct _CLIENT_ID {
 370     HANDLE UniqueProcess;
 371     HANDLE UniqueThread;
 372 } CLIENT_ID;
 373 #endif
 374
 375
 376
 377 PF_TYPE_DECL(NTAPI, PVOID, RtlCreateHeap, (ULONG, PVOID, SIZE_T, SIZE_T, PVOID, PRTL_HEAP_PARAMETERS));
 378 PF_TYPE_DECL(NTAPI, PVOID, RtlDestroyHeap, (PVOID));
 379 PF_TYPE_DECL(NTAPI, PVOID, RtlAllocateHeap, (PVOID, ULONG, SIZE_T));
 380 PF_TYPE_DECL(NTAPI, BOOLEAN, RtlFreeHeap, (PVOID, ULONG, PVOID));
 381
 382 PF_TYPE_DECL(NTAPI, NTSTATUS, NtQuerySystemInformation, (SYSTEM_INFORMATION_CLASS, PVOID, ULONG, PULONG));
 383 PF_TYPE_DECL(NTAPI, NTSTATUS, NtQueryInformationFile, (HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS));
 384 PF_TYPE_DECL(NTAPI, NTSTATUS, NtQueryInformationProcess, (HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG));
 385 PF_TYPE_DECL(NTAPI, NTSTATUS, NtWow64QueryInformationProcess64, (HANDLE, ULONG, PVOID, ULONG, PULONG));
 386 PF_TYPE_DECL(NTAPI, NTSTATUS, NtWow64ReadVirtualMemory64, (HANDLE, ULONGLONG, PVOID, ULONG64, PULONG64));
 387 PF_TYPE_DECL(NTAPI, NTSTATUS, NtQueryObject, (HANDLE, OBJECT_INFORMATION_CLASS, PVOID, ULONG, PULONG));
 388 PF_TYPE_DECL(NTAPI, NTSTATUS, NtDuplicateObject, (HANDLE, HANDLE, HANDLE, PHANDLE, ACCESS_MASK, ULONG, ULONG));
 389 PF_TYPE_DECL(NTAPI, NTSTATUS, NtOpenProcess, (PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES, CLIENT_ID*));
 390 PF_TYPE_DECL(NTAPI, NTSTATUS, NtOpenProcessToken, (HANDLE, ACCESS_MASK, PHANDLE));
 391 PF_TYPE_DECL(NTAPI, NTSTATUS, NtAdjustPrivilegesToken, (HANDLE, BOOLEAN, PTOKEN_PRIVILEGES, ULONG, PTOKEN_PRIVILEGES, PULONG));
 392 PF_TYPE_DECL(NTAPI, NTSTATUS, NtClose, (HANDLE));
 393
 394
 395 #define safe_free(p) do {free((void*)p); p = NULL;} while(0)
 396
 397 #define wchar_to_utf8_no_alloc(wsrc, dest, dest_size) \
 398     WideCharToMultiByte(CP_UTF8, 0, wsrc, -1, dest, dest_size, NULL, NULL)
 399 #define utf8_to_wchar_no_alloc(src, wdest, wdest_size) \
 400     MultiByteToWideChar(CP_UTF8, 0, src, -1, wdest, wdest_size)
 401
 402 #define sfree(p) do {if (p != NULL) {free((void*)(p)); p = NULL;}} while(0)
 403 #define wconvert(p)     wchar_t* w ## p = utf8_to_wchar(p)
 404 #define walloc(p, size) wchar_t* w ## p = (p == NULL)?NULL:(wchar_t*)calloc(size, sizeof(wchar_t))
 405 #define wfree(p) sfree(w ## p)
 406