crashpad/util/win/process_structs.h

// Copyright 2015 The Crashpad Authors. All rights reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

#ifndef CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_
#define CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_

#include <windows.h>

namespace crashpad {
namespace process_types {

namespace internal {

struct Traits32 {
  using Pad = DWORD;
  using UnsignedIntegral = DWORD;
  using Pointer = DWORD;
};

struct Traits64 {
  using Pad = DWORD64;
  using UnsignedIntegral = DWORD64;
  using Pointer = DWORD64;
};

}  // namespace internal

//! \{

//! \brief Selected structures from winternl.h, ntddk.h, and `dt ntdll!xxx`,
//!     customized to have both x86 and x64 sizes available.
//!
//! The structure and field names follow the Windows names for clarity. We do,
//! however, use plain integral types rather than pointer types. This is both
//! easier to define, and avoids accidentally treating them as pointers into the
//! current address space.
//!
//! The templates below should be instantiated with either internal::Traits32
//! for structures targeting x86, or internal::Traits64 for x64.

// We set packing to 1 so that we can explicitly control the layout to make it
// match the OS defined structures.
#pragma pack(push, 1)

template <class Traits>
struct PROCESS_BASIC_INFORMATION {
  union {
    DWORD ExitStatus;
    typename Traits::Pad padding_for_x64_0;
  };
  typename Traits::Pointer PebBaseAddress;
  typename Traits::UnsignedIntegral AffinityMask;
  union {
    DWORD BasePriority;
    typename Traits::Pad padding_for_x64_1;
  };
  typename Traits::UnsignedIntegral UniqueProcessId;
  typename Traits::UnsignedIntegral InheritedFromUniqueProcessId;
};

template <class Traits>
struct LIST_ENTRY {
  typename Traits::Pointer Flink;
  typename Traits::Pointer Blink;
};

template <class Traits>
struct UNICODE_STRING {
  union {
    struct {
      USHORT Length;
      USHORT MaximumLength;
    };
    typename Traits::Pad padding_for_x64;
  };
  typename Traits::Pointer Buffer;
};

template <class Traits>
struct PEB_LDR_DATA {
  ULONG Length;
  DWORD Initialized;
  typename Traits::Pointer SsHandle;
  LIST_ENTRY<Traits> InLoadOrderModuleList;
  LIST_ENTRY<Traits> InMemoryOrderModuleList;
  LIST_ENTRY<Traits> InInitializationOrderModuleList;
};

template <class Traits>
struct LDR_DATA_TABLE_ENTRY {
  LIST_ENTRY<Traits> InLoadOrderLinks;
  LIST_ENTRY<Traits> InMemoryOrderLinks;
  LIST_ENTRY<Traits> InInitializationOrderLinks;
  typename Traits::Pointer DllBase;
  typename Traits::Pointer EntryPoint;
  union {
    ULONG SizeOfImage;
    typename Traits::Pad padding_for_x64;
  };
  UNICODE_STRING<Traits> FullDllName;
  UNICODE_STRING<Traits> BaseDllName;
  ULONG Flags;
  USHORT ObsoleteLoadCount;
  USHORT TlsIndex;
  LIST_ENTRY<Traits> HashLinks;
  ULONG TimeDateStamp;
};

template <class Traits>
struct CURDIR {
  UNICODE_STRING<Traits> DosPath;
  typename Traits::Pointer Handle;
};

template <class Traits>
struct STRING {
  union {
    struct {
      USHORT Length;
      USHORT MaximumLength;
    };
    typename Traits::Pad padding_for_x64;
  };
  typename Traits::Pointer Buffer;
};

template <class Traits>
struct RTL_DRIVE_LETTER_CURDIR {
  WORD Flags;
  WORD Length;
  DWORD TimeStamp;
  STRING<Traits> DosPath;
};

template <class Traits>
struct RTL_USER_PROCESS_PARAMETERS {
  DWORD MaximumLength;
  DWORD Length;
  DWORD Flags;
  DWORD DebugFlags;
  typename Traits::Pointer ConsoleHandle;
  union {
    DWORD ConsoleFlags;
    typename Traits::Pad padding_for_x64_0;
  };
  typename Traits::Pointer StandardInput;
  typename Traits::Pointer StandardOutput;
  typename Traits::Pointer StandardError;
  CURDIR<Traits> CurrentDirectory;
  UNICODE_STRING<Traits> DllPath;
  UNICODE_STRING<Traits> ImagePathName;
  UNICODE_STRING<Traits> CommandLine;
  typename Traits::Pointer Environment;
  DWORD StartingX;
  DWORD StartingY;
  DWORD CountX;
  DWORD CountY;
  DWORD CountCharsX;
  DWORD CountCharsY;
  DWORD FillAttribute;
  DWORD WindowFlags;
  union {
    DWORD ShowWindowFlags;
    typename Traits::Pad padding_for_x64_1;
  };
  UNICODE_STRING<Traits> WindowTitle;
  UNICODE_STRING<Traits> DesktopInfo;
  UNICODE_STRING<Traits> ShellInfo;
  UNICODE_STRING<Traits> RuntimeData;
  RTL_DRIVE_LETTER_CURDIR<Traits> CurrentDirectores[32];  // sic.
  ULONG EnvironmentSize;
};

template <class T>
struct GdiHandleBufferCountForBitness;

template <>
struct GdiHandleBufferCountForBitness<internal::Traits32> {
  enum { value = 34 };
};
template <>
struct GdiHandleBufferCountForBitness<internal::Traits64> {
  enum { value = 60 };
};

template <class Traits>
struct PEB {
  union {
    struct {
      BYTE InheritedAddressSpace;
      BYTE ReadImageFileExecOptions;
      BYTE BeingDebugged;
      BYTE BitField;
    };
    typename Traits::Pad padding_for_x64_0;
  };
  typename Traits::Pointer Mutant;
  typename Traits::Pointer ImageBaseAddress;
  typename Traits::Pointer Ldr;
  typename Traits::Pointer ProcessParameters;
  typename Traits::Pointer SubSystemData;
  typename Traits::Pointer ProcessHeap;
  typename Traits::Pointer FastPebLock;
  typename Traits::Pointer AtlThunkSListPtr;
  typename Traits::Pointer IFEOKey;
  union {
    DWORD CrossProcessFlags;
    typename Traits::Pad padding_for_x64_1;
  };
  typename Traits::Pointer KernelCallbackTable;
  DWORD SystemReserved;
  DWORD AtlThunkSListPtr32;
  typename Traits::Pointer ApiSetMap;
  union {
    DWORD TlsExpansionCounter;
    typename Traits::Pad padding_for_x64_2;
  };
  typename Traits::Pointer TlsBitmap;
  DWORD TlsBitmapBits[2];
  typename Traits::Pointer ReadOnlySharedMemoryBase;
  typename Traits::Pointer SparePvoid0;
  typename Traits::Pointer ReadOnlyStaticServerData;
  typename Traits::Pointer AnsiCodePageData;
  typename Traits::Pointer OemCodePageData;
  typename Traits::Pointer UnicodeCaseTableData;
  DWORD NumberOfProcessors;
  DWORD NtGlobalFlag;
  DWORD alignment_for_x86;
  LARGE_INTEGER CriticalSectionTimeout;
  typename Traits::UnsignedIntegral HeapSegmentReserve;
  typename Traits::UnsignedIntegral HeapSegmentCommit;
  typename Traits::UnsignedIntegral HeapDeCommitTotalFreeThreshold;
  typename Traits::UnsignedIntegral HeapDeCommitFreeBlockThreshold;
  DWORD NumberOfHeaps;
  DWORD MaximumNumberOfHeaps;
  typename Traits::Pointer ProcessHeaps;
  typename Traits::Pointer GdiSharedHandleTable;
  typename Traits::Pointer ProcessStarterHelper;
  DWORD GdiDCAttributeList;
  typename Traits::Pointer LoaderLock;
  DWORD OSMajorVersion;
  DWORD OSMinorVersion;
  WORD OSBuildNumber;
  WORD OSCSDVersion;
  DWORD OSPlatformId;
  DWORD ImageSubsystem;
  DWORD ImageSubsystemMajorVersion;
  union {
    DWORD ImageSubsystemMinorVersion;
    typename Traits::Pad padding_for_x64_3;
  };
  typename Traits::UnsignedIntegral ActiveProcessAffinityMask;
  DWORD GdiHandleBuffer[GdiHandleBufferCountForBitness<Traits>::value];
  typename Traits::Pointer PostProcessInitRoutine;
  typename Traits::Pointer TlsExpansionBitmap;
  DWORD TlsExpansionBitmapBits[32];
  union {
    DWORD SessionId;
    typename Traits::Pad padding_for_x64_4;
  };
  ULARGE_INTEGER AppCompatFlags;
  ULARGE_INTEGER AppCompatFlagsUser;
  typename Traits::Pointer pShimData;
  typename Traits::Pointer AppCompatInfo;
  UNICODE_STRING<Traits> CSDVersion;
  typename Traits::Pointer ActivationContextData;
  typename Traits::Pointer ProcessAssemblyStorageMap;
  typename Traits::Pointer SystemDefaultActivationContextData;
  typename Traits::Pointer SystemAssemblyStorageMap;
  typename Traits::UnsignedIntegral MinimumStackCommit;
  typename Traits::Pointer FlsCallback;
  LIST_ENTRY<Traits> FlsListHead;
  typename Traits::Pointer FlsBitmap;
  DWORD FlsBitmapBits[4];
  DWORD FlsHighIndex;
};

template <class Traits>
struct NT_TIB {
  union {
    // See https://msdn.microsoft.com/library/dn424783.aspx.
    typename Traits::Pointer Wow64Teb;
    struct {
      typename Traits::Pointer ExceptionList;
      typename Traits::Pointer StackBase;
      typename Traits::Pointer StackLimit;
      typename Traits::Pointer SubSystemTib;
      union {
        typename Traits::Pointer FiberData;
        BYTE Version[4];
      };
      typename Traits::Pointer ArbitraryUserPointer;
      typename Traits::Pointer Self;
    };
  };
};

// See https://msdn.microsoft.com/library/gg750647.aspx.
template <class Traits>
struct CLIENT_ID {
  typename Traits::Pointer UniqueProcess;
  typename Traits::Pointer UniqueThread;
};

// This is a partial definition of the TEB, as we do not currently use many
// fields of it. See https://nirsoft.net/kernel_struct/vista/TEB.html, and the
// (arch-specific) definition of _TEB in winternl.h.
template <class Traits>
struct TEB {
  NT_TIB<Traits> NtTib;
  typename Traits::Pointer EnvironmentPointer;
  CLIENT_ID<Traits> ClientId;
  typename Traits::Pointer ActiveRpcHandle;
  typename Traits::Pointer ThreadLocalStoragePointer;
  typename Traits::Pointer ProcessEnvironmentBlock;
  typename Traits::Pointer RemainderOfReserved2[399];
  BYTE Reserved3[1952];
  typename Traits::Pointer TlsSlots[64];
  BYTE Reserved4[8];
  typename Traits::Pointer Reserved5[26];
  typename Traits::Pointer ReservedForOle;
  typename Traits::Pointer Reserved6[4];
  typename Traits::Pointer TlsExpansionSlots;
};

// See https://msdn.microsoft.com/library/gg750724.aspx.
template <class Traits>
struct SYSTEM_THREAD_INFORMATION {
  union {
    struct {
      LARGE_INTEGER KernelTime;
      LARGE_INTEGER UserTime;
      LARGE_INTEGER CreateTime;
      union {
        ULONG WaitTime;
        typename Traits::Pad padding_for_x64_0;
      };
      typename Traits::Pointer StartAddress;
      CLIENT_ID<Traits> ClientId;
      LONG Priority;
      LONG BasePriority;
      ULONG ContextSwitches;
      ULONG ThreadState;
      union {
        ULONG WaitReason;
        typename Traits::Pad padding_for_x64_1;
      };
    };
    LARGE_INTEGER alignment_for_x86[8];
  };
};

// There's an extra field in the x64 VM_COUNTERS (or maybe it's VM_COUNTERS_EX,
// it's not clear), so we just make separate specializations for 32/64.
template <class Traits>
struct VM_COUNTERS {};

template <>
struct VM_COUNTERS<internal::Traits32> {
  SIZE_T PeakVirtualSize;
  SIZE_T VirtualSize;
  ULONG PageFaultCount;
  SIZE_T PeakWorkingSetSize;
  SIZE_T WorkingSetSize;
  SIZE_T QuotaPeakPagedPoolUsage;
  SIZE_T QuotaPagedPoolUsage;
  SIZE_T QuotaPeakNonPagedPoolUsage;
  SIZE_T QuotaNonPagedPoolUsage;
  SIZE_T PagefileUsage;
  SIZE_T PeakPagefileUsage;
};

template <>
struct VM_COUNTERS<internal::Traits64> {
  SIZE_T PeakVirtualSize;
  SIZE_T VirtualSize;
  union {
    ULONG PageFaultCount;
    internal::Traits64::Pad padding_for_x64;
  };
  SIZE_T PeakWorkingSetSize;
  SIZE_T WorkingSetSize;
  SIZE_T QuotaPeakPagedPoolUsage;
  SIZE_T QuotaPagedPoolUsage;
  SIZE_T QuotaPeakNonPagedPoolUsage;
  SIZE_T QuotaNonPagedPoolUsage;
  SIZE_T PagefileUsage;
  SIZE_T PeakPagefileUsage;
  SIZE_T PrivateUsage;
};

// https://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/System%20Information/Structures/SYSTEM_PROCESS_INFORMATION.html
template <class Traits>
struct SYSTEM_PROCESS_INFORMATION {
  ULONG NextEntryOffset;
  ULONG NumberOfThreads;
  LARGE_INTEGER WorkingSetPrivateSize;
  ULONG HardFaultCount;
  ULONG NumberOfThreadsHighWatermark;
  ULONGLONG CycleTime;
  LARGE_INTEGER CreateTime;
  LARGE_INTEGER UserTime;
  LARGE_INTEGER KernelTime;
  UNICODE_STRING<Traits> ImageName;
  union {
    LONG BasePriority;
    typename Traits::Pad padding_for_x64_0;
  };
  union {
    DWORD UniqueProcessId;
    typename Traits::Pad padding_for_x64_1;
  };
  union {
    DWORD InheritedFromUniqueProcessId;
    typename Traits::Pad padding_for_x64_2;
  };
  ULONG HandleCount;
  ULONG SessionId;
  typename Traits::Pointer UniqueProcessKey;
  union {
    VM_COUNTERS<Traits> VirtualMemoryCounters;
    LARGE_INTEGER alignment_for_x86[6];
  };
  IO_COUNTERS IoCounters;
  SYSTEM_THREAD_INFORMATION<Traits> Threads[1];
};

// https://undocumented.ntinternals.net/source/usermode/structures/THREAD_BASIC_INFORMATION.html
template <class Traits>
struct THREAD_BASIC_INFORMATION {
  union {
    LONG ExitStatus;
    typename Traits::Pad padding_for_x64_0;
  };
  typename Traits::Pointer TebBaseAddress;
  CLIENT_ID<Traits> ClientId;
  typename Traits::Pointer AffinityMask;
  ULONG Priority;
  LONG BasePriority;
};

template <class Traits>
struct EXCEPTION_POINTERS {
  typename Traits::Pointer ExceptionRecord;
  typename Traits::Pointer ContextRecord;
};

using EXCEPTION_POINTERS32 = EXCEPTION_POINTERS<internal::Traits32>;
using EXCEPTION_POINTERS64 = EXCEPTION_POINTERS<internal::Traits64>;

// This is defined in winnt.h, but not for cross-bitness.
template <class Traits>
struct RTL_CRITICAL_SECTION {
  typename Traits::Pointer DebugInfo;
  LONG LockCount;
  LONG RecursionCount;
  typename Traits::Pointer OwningThread;
  typename Traits::Pointer LockSemaphore;
  typename Traits::UnsignedIntegral SpinCount;
};

template <class Traits>
struct RTL_CRITICAL_SECTION_DEBUG {
  union {
    struct {
      WORD Type;
      WORD CreatorBackTraceIndex;
    };
    typename Traits::Pad alignment_for_x64;
  };
  typename Traits::Pointer CriticalSection;
  LIST_ENTRY<Traits> ProcessLocksList;
  DWORD EntryCount;
  DWORD ContentionCount;
  DWORD Flags;
  WORD CreatorBackTraceIndexHigh;
  WORD SpareWORD;
};

struct SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX {
  void* Object;
  ULONG_PTR UniqueProcessId;
  HANDLE HandleValue;
  ULONG GrantedAccess;
  USHORT CreatorBackTraceIndex;
  USHORT ObjectTypeIndex;
  ULONG HandleAttributes;
  ULONG Reserved;
};

struct SYSTEM_HANDLE_INFORMATION_EX {
  ULONG_PTR NumberOfHandles;
  ULONG_PTR Reserved;
  SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX Handles[1];
};

#pragma pack(pop)

//! \}

}  // namespace process_types
}  // namespace crashpad

#endif  // CRASHPAD_UTIL_WIN_PROCESS_STRUCTS_H_