1 /************************************************************************* 2 * 3 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. 4 * 5 * Copyright 2000, 2010 Oracle and/or its affiliates. 6 * 7 * OpenOffice.org - a multi-platform office productivity suite 8 * 9 * This file is part of OpenOffice.org. 10 * 11 * OpenOffice.org is free software: you can redistribute it and/or modify 12 * it under the terms of the GNU Lesser General Public License version 3 13 * only, as published by the Free Software Foundation. 14 * 15 * OpenOffice.org is distributed in the hope that it will be useful, 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 * GNU Lesser General Public License version 3 for more details 19 * (a copy is included in the LICENSE file that accompanied this code). 20 * 21 * You should have received a copy of the GNU Lesser General Public License 22 * version 3 along with OpenOffice.org. If not, see 23 * <http://www.openoffice.org/license.html> 24 * for a copy of the LGPLv3 License. 25 * 26 ************************************************************************/ 27 28 #include "macros.h" 29 #include "win95sys.h" 30 #include <tlhelp32.h> 31 static FARPROC WINAPI GetRealProcAddress( HMODULE hModule, LPCSTR lpProcName ) 32 { 33 FARPROC lpfn = GetProcAddress( hModule, lpProcName ); 34 35 if ( lpfn ) 36 { 37 if ( 0x68 == *(LPBYTE)lpfn ) 38 { 39 /* 40 82C9F460 68 36 49 F8 BF push 0BFF84936h 41 82C9F465 E9 41 62 2F 3D jmp BFF956AB 42 */ 43 44 lpfn = (FARPROC)*(LPDWORD)((LPBYTE)lpfn + 1); 45 46 /* 47 BFF956AB 9C pushfd 48 BFF956AC FC cld 49 BFF956AD 50 push eax 50 BFF956AE 53 push ebx 51 BFF956AF 52 push edx 52 BFF956B0 64 8B 15 20 00 00 00 mov edx,dword ptr fs:[20h] 53 BFF956B7 0B D2 or edx,edx 54 BFF956B9 74 09 je BFF956C4 55 BFF956BB 8B 42 04 mov eax,dword ptr [edx+4] 56 BFF956BE 0B C0 or eax,eax 57 BFF956C0 74 07 je BFF956C9 58 BFF956C2 EB 42 jmp BFF95706 59 BFF956C4 5A pop edx 60 BFF956C5 5B pop ebx 61 BFF956C6 58 pop eax 62 BFF956C7 9D popfd 63 BFF956C8 C3 ret 64 */ 65 } 66 } 67 68 return lpfn; 69 } 70 71 72 typedef DWORD (WINAPI OBFUSCATE)( DWORD dwPTID ); 73 typedef OBFUSCATE *LPOBFUSCATE; 74 75 static DWORD WINAPI Obfuscate( DWORD dwPTID ) 76 { 77 static LPOBFUSCATE lpfnObfuscate = NULL; 78 79 if ( !lpfnObfuscate ) 80 { 81 LPBYTE lpCode = (LPBYTE)GetRealProcAddress( GetModuleHandleA("KERNEL32"), "GetCurrentThreadId" ); 82 83 if ( lpCode ) 84 { 85 /* 86 GetCurrentThreadId: 87 lpCode + 00 BFF84936 A1 DC 9C FC BF mov eax,[BFFC9CDC] ; This is the real thread id 88 lpcode + 05 BFF8493B FF 30 push dword ptr [eax] 89 lpCode + 07 BFF8493D E8 17 C5 FF FF call BFF80E59 ; call Obfuscate function 90 lpcode + 0C BFF84942 C3 ret 91 */ 92 93 DWORD dwOffset = *(LPDWORD)(lpCode + 0x08); 94 95 lpfnObfuscate = (LPOBFUSCATE)(lpCode + 0x0C + dwOffset); 96 /* 97 Obfuscate: 98 BFF80E59 A1 CC 98 FC BF mov eax,[BFFC98CC] 99 BFF80E5E 85 C0 test eax,eax 100 BFF80E60 75 04 jne BFF80E66 101 BFF80E62 33 C0 xor eax,eax 102 BFF80E64 EB 04 jmp BFF80E6A 103 BFF80E66 33 44 24 04 xor eax,dword ptr [esp+4] 104 BFF80E6A C2 04 00 ret 4 105 */ 106 } 107 108 } 109 110 return lpfnObfuscate ? lpfnObfuscate( dwPTID ) : 0; 111 } 112 113 114 EXTERN_C DWORD WINAPI GetProcessId_WINDOWS( HANDLE hProcess ) 115 { 116 if ( GetCurrentProcess() == hProcess ) 117 return GetCurrentProcessId(); 118 119 DWORD dwProcessId = 0; 120 PPROCESS_DATABASE pPDB = (PPROCESS_DATABASE)Obfuscate( GetCurrentProcessId() ); 121 122 if ( pPDB && K32OBJ_PROCESS == pPDB->Type ) 123 { 124 DWORD dwHandleNumber = (DWORD)hProcess >> 2; 125 126 if ( 0 == ((DWORD)hProcess & 0x03) && dwHandleNumber < pPDB->pHandleTable->cEntries ) 127 { 128 if ( 129 pPDB->pHandleTable->array[dwHandleNumber].pObject && 130 K32OBJ_PROCESS == pPDB->pHandleTable->array[dwHandleNumber].pObject->Type 131 ) 132 dwProcessId = Obfuscate( (DWORD)pPDB->pHandleTable->array[dwHandleNumber].pObject ); 133 } 134 135 SetLastError( ERROR_INVALID_HANDLE ); 136 } 137 138 return dwProcessId; 139 } 140 141 142 EXTERN_C DWORD WINAPI GetProcessId_NT( HANDLE hProcess ) 143 { 144 SetLastError( ERROR_CALL_NOT_IMPLEMENTED ); 145 return 0; 146 } 147 148 149 EXTERN_C void WINAPI ResolveThunk_GetProcessId( FARPROC *lppfn, LPCSTR lpLibFileName, LPCSTR lpFuncName ) 150 { 151 if ( (LONG)GetVersion() < 0 ) 152 *lppfn = (FARPROC)GetProcessId_WINDOWS; 153 else 154 { 155 FARPROC lpfnResult = GetProcAddress( LoadLibraryA( lpLibFileName ), lpFuncName ); 156 if ( !lpfnResult ) 157 lpfnResult = (FARPROC)GetProcessId_NT; 158 159 *lppfn = lpfnResult; 160 } 161 } 162 163 164 DEFINE_CUSTOM_THUNK( kernel32, GetProcessId, DWORD, WINAPI, GetProcessId, ( HANDLE hProcess ) ); 165