1 /*************************************************************************
2  *
3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4  *
5  * Copyright 2000, 2010 Oracle and/or its affiliates.
6  *
7  * OpenOffice.org - a multi-platform office productivity suite
8  *
9  * This file is part of OpenOffice.org.
10  *
11  * OpenOffice.org is free software: you can redistribute it and/or modify
12  * it under the terms of the GNU Lesser General Public License version 3
13  * only, as published by the Free Software Foundation.
14  *
15  * OpenOffice.org is distributed in the hope that it will be useful,
16  * but WITHOUT ANY WARRANTY; without even the implied warranty of
17  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18  * GNU Lesser General Public License version 3 for more details
19  * (a copy is included in the LICENSE file that accompanied this code).
20  *
21  * You should have received a copy of the GNU Lesser General Public License
22  * version 3 along with OpenOffice.org.  If not, see
23  * <http://www.openoffice.org/license.html>
24  * for a copy of the LGPLv3 License.
25  *
26  ************************************************************************/
27 
28 #include "macros.h"
29 #include "win95sys.h"
30 #include <tlhelp32.h>
31 static FARPROC WINAPI GetRealProcAddress( HMODULE hModule, LPCSTR lpProcName )
32 {
33     FARPROC	lpfn = GetProcAddress( hModule, lpProcName );
34 
35 	if ( lpfn )
36 	{
37 		if ( 0x68 == *(LPBYTE)lpfn )
38 		{
39 			/*
40 			82C9F460 68 36 49 F8 BF       push        0BFF84936h
41 			82C9F465 E9 41 62 2F 3D       jmp         BFF956AB
42 			*/
43 
44 			lpfn = (FARPROC)*(LPDWORD)((LPBYTE)lpfn + 1);
45 
46 			/*
47 			BFF956AB 9C                   pushfd
48 			BFF956AC FC                   cld
49 			BFF956AD 50                   push        eax
50 			BFF956AE 53                   push        ebx
51 			BFF956AF 52                   push        edx
52 			BFF956B0 64 8B 15 20 00 00 00 mov         edx,dword ptr fs:[20h]
53 			BFF956B7 0B D2                or          edx,edx
54 			BFF956B9 74 09                je          BFF956C4
55 			BFF956BB 8B 42 04             mov         eax,dword ptr [edx+4]
56 			BFF956BE 0B C0                or          eax,eax
57 			BFF956C0 74 07                je          BFF956C9
58 			BFF956C2 EB 42                jmp         BFF95706
59 			BFF956C4 5A                   pop         edx
60 			BFF956C5 5B                   pop         ebx
61 			BFF956C6 58                   pop         eax
62 			BFF956C7 9D                   popfd
63 			BFF956C8 C3                   ret
64 			*/
65 		}
66 	}
67 
68     return lpfn;
69 }
70 
71 
72 typedef DWORD (WINAPI OBFUSCATE)( DWORD dwPTID );
73 typedef OBFUSCATE *LPOBFUSCATE;
74 
75 static DWORD WINAPI Obfuscate( DWORD dwPTID )
76 {
77     static LPOBFUSCATE lpfnObfuscate = NULL;
78 
79 	if ( !lpfnObfuscate )
80 	{
81 		LPBYTE lpCode = (LPBYTE)GetRealProcAddress( GetModuleHandleA("KERNEL32"), "GetCurrentThreadId" );
82 
83 		if ( lpCode )
84 		{
85 			/*
86 			GetCurrentThreadId:
87 			lpCode + 00 BFF84936 A1 DC 9C FC BF       mov         eax,[BFFC9CDC]	; This is the real thread id
88 			lpcode + 05 BFF8493B FF 30                push        dword ptr [eax]
89 			lpCode + 07 BFF8493D E8 17 C5 FF FF       call        BFF80E59			; call Obfuscate function
90 			lpcode + 0C BFF84942 C3                   ret
91 			*/
92 
93 			DWORD	dwOffset = *(LPDWORD)(lpCode + 0x08);
94 
95 			lpfnObfuscate = (LPOBFUSCATE)(lpCode + 0x0C + dwOffset);
96 			/*
97 			Obfuscate:
98 			BFF80E59 A1 CC 98 FC BF       mov         eax,[BFFC98CC]
99 			BFF80E5E 85 C0                test        eax,eax
100 			BFF80E60 75 04                jne         BFF80E66
101 			BFF80E62 33 C0                xor         eax,eax
102 			BFF80E64 EB 04                jmp         BFF80E6A
103 			BFF80E66 33 44 24 04          xor         eax,dword ptr [esp+4]
104 			BFF80E6A C2 04 00             ret         4
105 			*/
106 		}
107 
108 	}
109 
110 	return lpfnObfuscate ? lpfnObfuscate( dwPTID ) : 0;
111 }
112 
113 
114 EXTERN_C DWORD WINAPI GetProcessId_WINDOWS( HANDLE hProcess )
115 {
116 	if ( GetCurrentProcess() == hProcess )
117 		return GetCurrentProcessId();
118 
119 	DWORD	dwProcessId = 0;
120 	PPROCESS_DATABASE	pPDB = (PPROCESS_DATABASE)Obfuscate( GetCurrentProcessId() );
121 
122 	if ( pPDB && K32OBJ_PROCESS == pPDB->Type )
123 	{
124 		DWORD	dwHandleNumber = (DWORD)hProcess >> 2;
125 
126 		if ( 0 == ((DWORD)hProcess & 0x03) && dwHandleNumber < pPDB->pHandleTable->cEntries )
127 		{
128 			if (
129 				pPDB->pHandleTable->array[dwHandleNumber].pObject &&
130 				K32OBJ_PROCESS == pPDB->pHandleTable->array[dwHandleNumber].pObject->Type
131 				)
132 			dwProcessId = Obfuscate( (DWORD)pPDB->pHandleTable->array[dwHandleNumber].pObject );
133 		}
134 
135 		SetLastError( ERROR_INVALID_HANDLE );
136 	}
137 
138 	return dwProcessId;
139 }
140 
141 
142 EXTERN_C DWORD WINAPI GetProcessId_NT( HANDLE hProcess )
143 {
144 	SetLastError( ERROR_CALL_NOT_IMPLEMENTED );
145 	return 0;
146 }
147 
148 
149 EXTERN_C void WINAPI ResolveThunk_GetProcessId( FARPROC *lppfn, LPCSTR lpLibFileName, LPCSTR lpFuncName )
150 {
151 	if ( (LONG)GetVersion() < 0 )
152 		*lppfn = (FARPROC)GetProcessId_WINDOWS;
153 	else
154 	{
155 		FARPROC	lpfnResult = GetProcAddress( LoadLibraryA( lpLibFileName ), lpFuncName );
156 		if ( !lpfnResult )
157 			lpfnResult = (FARPROC)GetProcessId_NT;
158 
159 		*lppfn = lpfnResult;
160 	}
161 }
162 
163 
164 DEFINE_CUSTOM_THUNK( kernel32, GetProcessId, DWORD, WINAPI, GetProcessId, ( HANDLE hProcess ) );
165