test.h File Reference

#include <ntos.h>

Include dependency graph for test.h:

Go to the source code of this file.

Classes
struct	tagFOO
struct	SOUND_DEVICE_INIT

Macros
#define	NTOS_MODE_USER
#define	FAILED_WITH_STATUS   DEFINE_DBG_MSG("%s() failed, status 0x%08X")
#define	DEFINE_DBG_MSG(__str__)   "PSAPI: " __str__ "\n"

Typedefs
typedef struct tagFOO	FOO
typedef struct tagFOO *	PFOO
typedef struct tagFOO *	LPFOO
typedef NTSTATUS NTAPI(*	PPROC_ENUM_ROUTINE) (IN PSYSTEM_PROCESSES CurrentProcess, IN OUT PVOID CallbackContext)
typedef NTSTATUS NTAPI(*	PTHREAD_ENUM_ROUTINE) (IN PSYSTEM_THREADS CurrentThread, IN OUT PVOID CallbackContext)
typedef NTSTATUS NTAPI(*	PSYSMOD_ENUM_ROUTINE) (IN PSYSTEM_MODULE_INFORMATION_ENTRY CurrentModule, IN OUT PVOID CallbackContext)
typedef NTSTATUS NTAPI(*	PPROCMOD_ENUM_ROUTINE) (IN HANDLE ProcessHandle, IN PLDR_DATA_TABLE_ENTRY CurrentModule, IN OUT PVOID CallbackContext)

Functions
void *	_lfind (const void *match, const void *start, unsigned int *array_size, unsigned int elem_size, int(*cf)(const void *, const void *))
static struct _TEB *	NtCurrentTeb (void)
NTSTATUS NTAPI	PsaEnumerateProcessesAndThreads (IN PPROC_ENUM_ROUTINE ProcessCallback, IN OUT PVOID ProcessCallbackContext, IN PTHREAD_ENUM_ROUTINE ThreadCallback, IN OUT PVOID ThreadCallbackContext)
NTSTATUS NTAPI	PsaEnumerateProcesses (IN PPROC_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaEnumerateThreads (IN PTHREAD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaCaptureProcessesAndThreads (OUT PSYSTEM_PROCESSES *ProcessesAndThreads)
NTSTATUS NTAPI	PsaWalkProcessesAndThreads (IN PSYSTEM_PROCESSES ProcessesAndThreads, IN PPROC_ENUM_ROUTINE ProcessCallback, IN OUT PVOID ProcessCallbackContext, IN PTHREAD_ENUM_ROUTINE ThreadCallback, IN OUT PVOID ThreadCallbackContext)
NTSTATUS NTAPI	PsaWalkProcesses (IN PSYSTEM_PROCESSES ProcessesAndThreads, IN PPROC_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaWalkThreads (IN PSYSTEM_PROCESSES ProcessesAndThreads, IN PTHREAD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
PSYSTEM_PROCESSES FASTCALL	PsaWalkFirstProcess (IN PSYSTEM_PROCESSES ProcessesAndThreads)
PSYSTEM_PROCESSES FASTCALL	PsaWalkNextProcess (IN PSYSTEM_PROCESSES CurrentProcess)
PSYSTEM_THREADS FASTCALL	PsaWalkFirstThread (IN PSYSTEM_PROCESSES CurrentProcess)
PSYSTEM_THREADS FASTCALL	PsaWalkNextThread (IN PSYSTEM_THREADS CurrentThread)
NTSTATUS NTAPI	PsaEnumerateSystemModules (IN PSYSMOD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
NTSTATUS NTAPI	PsaCaptureSystemModules (OUT PSYSTEM_MODULE_INFORMATION *SystemModules)
NTSTATUS NTAPI	PsaWalkSystemModules (IN PSYSTEM_MODULE_INFORMATION SystemModules, IN PSYSMOD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
PSYSTEM_MODULE_INFORMATION_ENTRY FASTCALL	PsaWalkFirstSystemModule (IN PSYSTEM_MODULE_INFORMATION SystemModules)
PSYSTEM_MODULE_INFORMATION_ENTRY FASTCALL	PsaWalkNextSystemModule (IN PSYSTEM_MODULE_INFORMATION CurrentSystemModule)
NTSTATUS NTAPI	PsaEnumerateProcessModules (IN HANDLE ProcessHandle, IN PPROCMOD_ENUM_ROUTINE Callback, IN OUT PVOID CallbackContext)
VOID NTAPI	PsaFreeCapture (IN PVOID Capture)
void *	PsaiMalloc (SIZE_T size)
void *	PsaiRealloc (void *ptr, SIZE_T size)
void	PsaiFree (void *ptr)

Macro Definition Documentation

DEFINE_DBG_MSG

#define DEFINE_DBG_MSG

(

__str__

)

"PSAPI: " __str__ "\n"

Definition at line 257 of file test.h.

FAILED_WITH_STATUS

#define FAILED_WITH_STATUS   DEFINE_DBG_MSG("%s() failed, status 0x%08X")

Definition at line 95 of file test.h.

NTOS_MODE_USER

#define NTOS_MODE_USER

Definition at line 47 of file test.h.

Typedef Documentation

FOO

typedef struct tagFOO FOO

LPFOO

typedef struct tagFOO* LPFOO

PFOO

typedef struct tagFOO * PFOO

PPROC_ENUM_ROUTINE

typedef NTSTATUS NTAPI(* PPROC_ENUM_ROUTINE) (IN PSYSTEM_PROCESSES CurrentProcess, IN OUT PVOID CallbackContext)

Definition at line 69 of file test.h.

PPROCMOD_ENUM_ROUTINE

typedef NTSTATUS NTAPI(* PPROCMOD_ENUM_ROUTINE) (IN HANDLE ProcessHandle, IN PLDR_DATA_TABLE_ENTRY CurrentModule, IN OUT PVOID CallbackContext)

Definition at line 87 of file test.h.

PSYSMOD_ENUM_ROUTINE

typedef NTSTATUS NTAPI(* PSYSMOD_ENUM_ROUTINE) (IN PSYSTEM_MODULE_INFORMATION_ENTRY CurrentModule, IN OUT PVOID CallbackContext)

Definition at line 81 of file test.h.

PTHREAD_ENUM_ROUTINE

typedef NTSTATUS NTAPI(* PTHREAD_ENUM_ROUTINE) (IN PSYSTEM_THREADS CurrentThread, IN OUT PVOID CallbackContext)

Definition at line 75 of file test.h.

Function Documentation

_lfind()

void * _lfind	(	const void *	match,
		const void *	start,
		unsigned int *	array_size,
		unsigned int	elem_size,
		int(*)(const void *, const void *)	cf
	)

Referenced by _lsearch().

NtCurrentTeb()

static struct _TEB * NtCurrentTeb ( void  )

inlinestatic

Definition at line 25 of file test.h.

{
 struct _TEB * pTeb;
 
 /* FIXME: instead of hardcoded offsets, use offsetof() - if possible */
 __asm__ __volatile__
 (
  "movl %%fs:0x18, %0\n" /* fs:18h == Teb->Tib.Self */
  : "=r" (pTeb) /* can't have two memory operands */
  : /* no inputs */
 );
 
 return pTeb;
}

PsaCaptureProcessesAndThreads()

NTSTATUS NTAPI PsaCaptureProcessesAndThreads

(

OUT PSYSTEM_PROCESSES *

ProcessesAndThreads

)

Referenced by PerfDataRefresh(), PrintProcess(), and PrintProcessList().

PsaCaptureSystemModules()

NTSTATUS NTAPI PsaCaptureSystemModules

(

OUT PSYSTEM_MODULE_INFORMATION *

SystemModules

)

PsaEnumerateProcesses()

NTSTATUS NTAPI PsaEnumerateProcesses	(	IN PPROC_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 218 of file processes.c.

{
  return PsaEnumerateProcessesAndThreads(Callback,
                                         CallbackContext,
                                         NULL,
                                         NULL);
}

PsaEnumerateProcessesAndThreads()

NTSTATUS NTAPI PsaEnumerateProcessesAndThreads	(	IN PPROC_ENUM_ROUTINE	ProcessCallback,
		IN OUT PVOID	ProcessCallbackContext,
		IN PTHREAD_ENUM_ROUTINE	ThreadCallback,
		IN OUT PVOID	ThreadCallbackContext
	)

Definition at line 153 of file processes.c.

{
  PSYSTEM_PROCESS_INFORMATION pInfoBuffer = NULL;
  NTSTATUS Status;
 
  if(ProcessCallback == NULL && ThreadCallback == NULL)
  {
    return STATUS_INVALID_PARAMETER;
  }
 
  /* get the processes and threads list */
  Status = PsaCaptureProcessesAndThreads(&pInfoBuffer);
 
  if(!NT_SUCCESS(Status))
  {
    goto Bail;
  }
 
  /* walk the processes and threads list */
  Status = PsaWalkProcessesAndThreads(pInfoBuffer,
                                      ProcessCallback,
                                      ProcessCallbackContext,
                                      ThreadCallback,
                                      ThreadCallbackContext);
 
Bail:
  PsaFreeCapture(pInfoBuffer);
 
  return Status;
}

PsaEnumerateProcessModules()

NTSTATUS NTAPI PsaEnumerateProcessModules	(	IN HANDLE	ProcessHandle,
		IN PPROCMOD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 30 of file modules.c.

{
  NTSTATUS Status;
 
  /* current process - use direct memory copy */
  /* FIXME - compare process id instead of a handle */
  if(ProcessHandle == NtCurrentProcess())
  {
    PLIST_ENTRY ListHead, Current;
 
#if 0
    __try
    {
#endif
      ListHead = &(NtCurrentPeb()->Ldr->InLoadOrderModuleList);
      Current = ListHead->Flink;
 
      while(Current != ListHead)
      {
        PLDR_DATA_TABLE_ENTRY LoaderModule = CONTAINING_RECORD(Current, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
 
        /* return the current module to the callback */
        Status = Callback(ProcessHandle, LoaderModule, CallbackContext);
 
        if(!NT_SUCCESS(Status))
        {
          goto Failure;
        }
 
        Current = LoaderModule->InLoadOrderLinks.Flink;
      }
#if 0
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
      return GetExceptionCode();
    }
#endif
  }
  else
  {
    PROCESS_BASIC_INFORMATION BasicInformation;
    PPEB_LDR_DATA LoaderData;
    LDR_DATA_TABLE_ENTRY LoaderModule;
    PLIST_ENTRY ListHead, Current;
 
    /* query the process basic information (includes the PEB address) */
    Status = NtQueryInformationProcess(ProcessHandle,
                                       ProcessBasicInformation,
                                       &BasicInformation,
                                       sizeof(BasicInformation),
                                       NULL);
 
    if(!NT_SUCCESS(Status))
    {
      DPRINT(FAILED_WITH_STATUS, "NtQueryInformationProcess", Status);
      goto Failure;
    }
 
    /* get the address of the PE Loader data */
    Status = NtReadVirtualMemory(ProcessHandle,
                                 &(BasicInformation.PebBaseAddress->Ldr),
                                 &LoaderData,
                                 sizeof(LoaderData),
                                 NULL);
 
    if(!NT_SUCCESS(Status))
    {
      DPRINT(FAILED_WITH_STATUS, "NtReadVirtualMemory", Status);
      goto Failure;
    }
 
    /* head of the module list: the last element in the list will point to this */
    ListHead = &LoaderData->InLoadOrderModuleList;
 
    /* get the address of the first element in the list */
    Status = NtReadVirtualMemory(ProcessHandle,
                                 &(LoaderData->InLoadOrderModuleList.Flink),
                                 &Current,
                                 sizeof(Current),
                                 NULL);
 
    while(Current != ListHead)
    {
      /* read the current module */
      Status = NtReadVirtualMemory(ProcessHandle,
                                   CONTAINING_RECORD(Current, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks),
                                   &LoaderModule,
                                   sizeof(LoaderModule),
                                   NULL);
 
      if(!NT_SUCCESS(Status))
      {
        DPRINT(FAILED_WITH_STATUS, "NtReadVirtualMemory", Status);
        goto Failure;
      }
 
      /* return the current module to the callback */
      Status = Callback(ProcessHandle, &LoaderModule, CallbackContext);
 
      if(!NT_SUCCESS(Status))
      {
        goto Failure;
      }
 
      /* address of the next module in the list */
      Current = LoaderModule.InLoadOrderLinks.Flink;
    }
  }
 
  return STATUS_SUCCESS;
 
Failure:
  return Status;
}

PsaEnumerateSystemModules()

NTSTATUS NTAPI PsaEnumerateSystemModules	(	IN PSYSMOD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 21 of file drivers.c.

{
  PRTL_PROCESS_MODULES psmModules;
  NTSTATUS Status = STATUS_SUCCESS;
 
#if 0
  __try
  {
#else
  do
  {
#endif
  /* capture the system modules */
  Status = PsaCaptureSystemModules(&psmModules);
 
  if(!NT_SUCCESS(Status))
  {
    break;
  }
 
  /* walk the system modules */
  Status = PsaWalkSystemModules(psmModules, Callback, CallbackContext);
#if 0
  }
  __finally
  {
#else
  } while(0);
#endif
  /* free the capture */
  PsaFreeCapture(psmModules);
#if 0
  }
#endif
 
  return Status;
}

PsaEnumerateThreads()

NTSTATUS NTAPI PsaEnumerateThreads	(	IN PTHREAD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

Definition at line 228 of file processes.c.

{
  return PsaEnumerateProcessesAndThreads(NULL,
                                         NULL,
                                         Callback,
                                         CallbackContext);
}

PsaFreeCapture()

VOID NTAPI PsaFreeCapture

(

IN PVOID

Capture

)

Definition at line 188 of file processes.c.

{
  PsaiFree(Capture);
}

Referenced by PerfDataRefresh(), PrintProcess(), PrintProcessList(), and PsaEnumerateSystemModules().

PsaiFree()

void PsaiFree

(

void *

ptr

)

Definition at line 103 of file ctm.c.

{ free(ptr); }

PsaiMalloc()

void * PsaiMalloc

(

SIZE_T

size

)

Definition at line 101 of file ctm.c.

{ return malloc(size); }

PsaiRealloc()

void * PsaiRealloc	(	void *	ptr,
		SIZE_T	size
	)

Definition at line 102 of file ctm.c.

{ return realloc(ptr, size); }

PsaWalkFirstProcess()

PSYSTEM_PROCESSES FASTCALL PsaWalkFirstProcess

(

IN PSYSTEM_PROCESSES

ProcessesAndThreads

)

Referenced by GetProcessInfoPid(), PerfDataRefresh(), and PrintProcessList().

PsaWalkFirstSystemModule()

PSYSTEM_MODULE_INFORMATION_ENTRY FASTCALL PsaWalkFirstSystemModule

(

IN PSYSTEM_MODULE_INFORMATION

SystemModules

)

PsaWalkFirstThread()

PSYSTEM_THREADS FASTCALL PsaWalkFirstThread

(

IN PSYSTEM_PROCESSES

CurrentProcess

)

Referenced by PrintThreads().

PsaWalkNextProcess()

PSYSTEM_PROCESSES FASTCALL PsaWalkNextProcess

(

IN PSYSTEM_PROCESSES

CurrentProcess

)

Referenced by GetProcessInfoPid(), PerfDataRefresh(), and PrintProcessList().

PsaWalkNextSystemModule()

PSYSTEM_MODULE_INFORMATION_ENTRY FASTCALL PsaWalkNextSystemModule

(

IN PSYSTEM_MODULE_INFORMATION

CurrentSystemModule

)

PsaWalkNextThread()

PSYSTEM_THREADS FASTCALL PsaWalkNextThread

(

IN PSYSTEM_THREADS

CurrentThread

)

Referenced by PrintThreads().

PsaWalkProcesses()

NTSTATUS NTAPI PsaWalkProcesses	(	IN PSYSTEM_PROCESSES	ProcessesAndThreads,
		IN PPROC_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

PsaWalkProcessesAndThreads()

NTSTATUS NTAPI PsaWalkProcessesAndThreads	(	IN PSYSTEM_PROCESSES	ProcessesAndThreads,
		IN PPROC_ENUM_ROUTINE	ProcessCallback,
		IN OUT PVOID	ProcessCallbackContext,
		IN PTHREAD_ENUM_ROUTINE	ThreadCallback,
		IN OUT PVOID	ThreadCallbackContext
	)

PsaWalkSystemModules()

NTSTATUS NTAPI PsaWalkSystemModules	(	IN PSYSTEM_MODULE_INFORMATION	SystemModules,
		IN PSYSMOD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)

PsaWalkThreads()

NTSTATUS NTAPI PsaWalkThreads	(	IN PSYSTEM_PROCESSES	ProcessesAndThreads,
		IN PTHREAD_ENUM_ROUTINE	Callback,
		IN OUT PVOID	CallbackContext
	)