1 /**************************************************************
2 *
3 * Licensed to the Apache Software Foundation (ASF) under one
4 * or more contributor license agreements. See the NOTICE file
5 * distributed with this work for additional information
6 * regarding copyright ownership. The ASF licenses this file
7 * to you under the Apache License, Version 2.0 (the
8 * "License"); you may not use this file except in compliance
9 * with the License. You may obtain a copy of the License at
10 *
11 * http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing,
14 * software distributed under the License is distributed on an
15 * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16 * KIND, either express or implied. See the License for the
17 * specific language governing permissions and limitations
18 * under the License.
19 *
20 *************************************************************/
21
22
23
24 #include "macros.h"
25 #include "win95sys.h"
26 #include <tlhelp32.h>
GetRealProcAddress(HMODULE hModule,LPCSTR lpProcName)27 static FARPROC WINAPI GetRealProcAddress( HMODULE hModule, LPCSTR lpProcName )
28 {
29 FARPROC lpfn = GetProcAddress( hModule, lpProcName );
30
31 if ( lpfn )
32 {
33 if ( 0x68 == *(LPBYTE)lpfn )
34 {
35 /*
36 82C9F460 68 36 49 F8 BF push 0BFF84936h
37 82C9F465 E9 41 62 2F 3D jmp BFF956AB
38 */
39
40 lpfn = (FARPROC)*(LPDWORD)((LPBYTE)lpfn + 1);
41
42 /*
43 BFF956AB 9C pushfd
44 BFF956AC FC cld
45 BFF956AD 50 push eax
46 BFF956AE 53 push ebx
47 BFF956AF 52 push edx
48 BFF956B0 64 8B 15 20 00 00 00 mov edx,dword ptr fs:[20h]
49 BFF956B7 0B D2 or edx,edx
50 BFF956B9 74 09 je BFF956C4
51 BFF956BB 8B 42 04 mov eax,dword ptr [edx+4]
52 BFF956BE 0B C0 or eax,eax
53 BFF956C0 74 07 je BFF956C9
54 BFF956C2 EB 42 jmp BFF95706
55 BFF956C4 5A pop edx
56 BFF956C5 5B pop ebx
57 BFF956C6 58 pop eax
58 BFF956C7 9D popfd
59 BFF956C8 C3 ret
60 */
61 }
62 }
63
64 return lpfn;
65 }
66
67
68 typedef DWORD (WINAPI OBFUSCATE)( DWORD dwPTID );
69 typedef OBFUSCATE *LPOBFUSCATE;
70
Obfuscate(DWORD dwPTID)71 static DWORD WINAPI Obfuscate( DWORD dwPTID )
72 {
73 static LPOBFUSCATE lpfnObfuscate = NULL;
74
75 if ( !lpfnObfuscate )
76 {
77 LPBYTE lpCode = (LPBYTE)GetRealProcAddress( GetModuleHandleA("KERNEL32"), "GetCurrentThreadId" );
78
79 if ( lpCode )
80 {
81 /*
82 GetCurrentThreadId:
83 lpCode + 00 BFF84936 A1 DC 9C FC BF mov eax,[BFFC9CDC] ; This is the real thread id
84 lpcode + 05 BFF8493B FF 30 push dword ptr [eax]
85 lpCode + 07 BFF8493D E8 17 C5 FF FF call BFF80E59 ; call Obfuscate function
86 lpcode + 0C BFF84942 C3 ret
87 */
88
89 DWORD dwOffset = *(LPDWORD)(lpCode + 0x08);
90
91 lpfnObfuscate = (LPOBFUSCATE)(lpCode + 0x0C + dwOffset);
92 /*
93 Obfuscate:
94 BFF80E59 A1 CC 98 FC BF mov eax,[BFFC98CC]
95 BFF80E5E 85 C0 test eax,eax
96 BFF80E60 75 04 jne BFF80E66
97 BFF80E62 33 C0 xor eax,eax
98 BFF80E64 EB 04 jmp BFF80E6A
99 BFF80E66 33 44 24 04 xor eax,dword ptr [esp+4]
100 BFF80E6A C2 04 00 ret 4
101 */
102 }
103
104 }
105
106 return lpfnObfuscate ? lpfnObfuscate( dwPTID ) : 0;
107 }
108
109
GetProcessId_WINDOWS(HANDLE hProcess)110 EXTERN_C DWORD WINAPI GetProcessId_WINDOWS( HANDLE hProcess )
111 {
112 if ( GetCurrentProcess() == hProcess )
113 return GetCurrentProcessId();
114
115 DWORD dwProcessId = 0;
116 PPROCESS_DATABASE pPDB = (PPROCESS_DATABASE)Obfuscate( GetCurrentProcessId() );
117
118 if ( pPDB && K32OBJ_PROCESS == pPDB->Type )
119 {
120 DWORD dwHandleNumber = (DWORD)hProcess >> 2;
121
122 if ( 0 == ((DWORD)hProcess & 0x03) && dwHandleNumber < pPDB->pHandleTable->cEntries )
123 {
124 if (
125 pPDB->pHandleTable->array[dwHandleNumber].pObject &&
126 K32OBJ_PROCESS == pPDB->pHandleTable->array[dwHandleNumber].pObject->Type
127 )
128 dwProcessId = Obfuscate( (DWORD)pPDB->pHandleTable->array[dwHandleNumber].pObject );
129 }
130
131 SetLastError( ERROR_INVALID_HANDLE );
132 }
133
134 return dwProcessId;
135 }
136
137
GetProcessId_NT(HANDLE hProcess)138 EXTERN_C DWORD WINAPI GetProcessId_NT( HANDLE hProcess )
139 {
140 SetLastError( ERROR_CALL_NOT_IMPLEMENTED );
141 return 0;
142 }
143
144
ResolveThunk_GetProcessId(FARPROC * lppfn,LPCSTR lpLibFileName,LPCSTR lpFuncName)145 EXTERN_C void WINAPI ResolveThunk_GetProcessId( FARPROC *lppfn, LPCSTR lpLibFileName, LPCSTR lpFuncName )
146 {
147 if ( (LONG)GetVersion() < 0 )
148 *lppfn = (FARPROC)GetProcessId_WINDOWS;
149 else
150 {
151 FARPROC lpfnResult = GetProcAddress( LoadLibraryA( lpLibFileName ), lpFuncName );
152 if ( !lpfnResult )
153 lpfnResult = (FARPROC)GetProcessId_NT;
154
155 *lppfn = lpfnResult;
156 }
157 }
158
159
160 DEFINE_CUSTOM_THUNK( kernel32, GetProcessId, DWORD, WINAPI, GetProcessId, ( HANDLE hProcess ) );
161