NTSTATUS
NtOpenProcess (
__out PHANDLE ProcessHandle,
__in ACCESS_MASK DesiredAccess,
__in POBJECT_ATTRIBUTES ObjectAttributes,
__in_opt PCLIENT_ID ClientId
)
/*++
Routine Description:
This function opens a handle to a process object with the specified
desired access.
The object is located either by name, or by locating a thread whose
Client ID matches the specified Client ID and then opening that thread's
process.
Arguments:
ProcessHandle - Supplies a pointer to a variable that will receive
the process object handle.
DesiredAccess - Supplies the desired types of access for the process
object.
ObjectAttributes - Supplies a pointer to an object attributes structure.
If the ObjectName field is specified, then ClientId must not be
specified.
ClientId - Supplies a pointer to a ClientId that if supplied
specifies the thread whose process is to be opened. If this
argument is specified, then ObjectName field of the ObjectAttributes
structure must not be specified.
Return Value:
NTSTATUS - Status of call
--*/
{
HANDLE Handle;
KPROCESSOR_MODE PreviousMode;
NTSTATUS Status;
PEPROCESS Process;
PETHREAD Thread;
CLIENT_ID CapturedCid={0};
BOOLEAN ObjectNamePresent;
BOOLEAN ClientIdPresent;
ACCESS_STATE AccessState;
AUX_ACCESS_DATA AuxData;
ULONG Attributes;
PAGED_CODE();
//
// Make sure that only one of either ClientId or ObjectName is
// present.
//
PreviousMode = KeGetPreviousMode();
if (PreviousMode != KernelMode) {
//
// Since we need to look at the ObjectName field, probe
// ObjectAttributes and capture object name present indicator.
//
try {
ProbeForWriteHandle (ProcessHandle);
ProbeForReadSmallStructure (ObjectAttributes,
sizeof(OBJECT_ATTRIBUTES),
sizeof(ULONG));
ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT (ObjectAttributes->ObjectName);
Attributes = ObSanitizeHandleAttributes (ObjectAttributes->Attributes, UserMode);
if (ARGUMENT_PRESENT (ClientId)) {
ProbeForReadSmallStructure (ClientId, sizeof (CLIENT_ID), sizeof (ULONG));
CapturedCid = *ClientId;
ClientIdPresent = TRUE;
} else {
ClientIdPresent = FALSE;
}
} except (EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode();
}
} else {
ObjectNamePresent = (BOOLEAN)ARGUMENT_PRESENT (ObjectAttributes->ObjectName);
Attributes = ObSanitizeHandleAttributes (ObjectAttributes->Attributes, KernelMode);
if (ARGUMENT_PRESENT (ClientId)) {
CapturedCid = *ClientId;
ClientIdPresent = TRUE;
} else {
ClientIdPresent = FALSE;
}
}
if (ObjectNamePresent && ClientIdPresent) {
return STATUS_INVALID_PARAMETER_MIX;
}
//
// Create an AccessState here, because the caller may have
// DebugPrivilege, which requires us to make special adjustments
// to his desired access mask. We do this by modifying the
// internal fields in the AccessState to achieve the effect
// we desire.
//
Status = SeCreateAccessState(
&AccessState,
&AuxData,
DesiredAccess,
&PsProcessType->TypeInfo.GenericMapping
);
if ( !NT_SUCCESS(Status) ) {
return Status;
}
//
// Check here to see if the caller has SeDebugPrivilege. If
// he does, we will allow him any access he wants to the process.
// We do this by clearing the DesiredAccess in the AccessState
// and recording what we want him to have in the PreviouslyGrantedAccess
// field.
//
// Note that this routine performs auditing as appropriate.
//
if (SeSinglePrivilegeCheck( SeDebugPrivilege, PreviousMode )) {
if ( AccessState.RemainingDesiredAccess & MAXIMUM_ALLOWED ) {
AccessState.PreviouslyGrantedAccess |= PROCESS_ALL_ACCESS;
} else {
AccessState.PreviouslyGrantedAccess |= ( AccessState.RemainingDesiredAccess );
}
AccessState.RemainingDesiredAccess = 0;
}
if (ObjectNamePresent) {
//
// Open handle to the process object with the specified desired access,
// set process handle value, and return service completion status.
//
Status = ObOpenObjectByName(
ObjectAttributes,
PsProcessType,
PreviousMode,
&AccessState,
0,
NULL,
&Handle
);
SeDeleteAccessState( &AccessState );
if ( NT_SUCCESS(Status) ) {
try {
*ProcessHandle = Handle;
} except (EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode ();
}
}
return Status;
}
if ( ClientIdPresent ) {
Thread = NULL;
if (CapturedCid.UniqueThread) {
Status = PsLookupProcessThreadByCid(
&CapturedCid,
&Process,
&Thread
);
if (!NT_SUCCESS(Status)) {
SeDeleteAccessState( &AccessState );
return Status;
}
} else {
Status = PsLookupProcessByProcessId(
CapturedCid.UniqueProcess,
&Process
);
if ( !NT_SUCCESS(Status) ) {
SeDeleteAccessState( &AccessState );
return Status;
}
}
//
// OpenObjectByAddress
//
Status = ObOpenObjectByPointer(
Process,
Attributes,
&AccessState,
0,
PsProcessType,
PreviousMode,
&Handle
);
SeDeleteAccessState( &AccessState );
if (Thread) {
ObDereferenceObject(Thread);
}
ObDereferenceObject(Process);
if (NT_SUCCESS (Status)) {
try {
*ProcessHandle = Handle;
} except (EXCEPTION_EXECUTE_HANDLER) {
return GetExceptionCode ();
}
}
return Status;
}
return STATUS_INVALID_PARAMETER_MIX;
}
NTSTATUS
NtTerminateProcess(
__in_opt HANDLE ProcessHandle,
__in NTSTATUS ExitStatus
)
/*++
Routine Description:
This function causes the specified process and all of
its threads to terminate.
Arguments:
ProcessHandle - Supplies a handle to the process to terminate.
ExitStatus - Supplies the exit status associated with the process.
Return Value:
NTSTATUS - Status of operation
--*/
{
PETHREAD Thread, Self;
PEPROCESS Process;
PEPROCESS CurrentProcess;
NTSTATUS st;
BOOLEAN ProcessHandleSpecified;
PAGED_CODE();
Self = PsGetCurrentThread();
CurrentProcess = PsGetCurrentProcessByThread (Self);
if (ARGUMENT_PRESENT (ProcessHandle)) {
ProcessHandleSpecified = TRUE;
} else {
ProcessHandleSpecified = FALSE;
ProcessHandle = NtCurrentProcess();
}
st = ObReferenceObjectByHandle (ProcessHandle,
PROCESS_TERMINATE,
PsProcessType,
KeGetPreviousModeByThread(&Self->Tcb),
&Process,
NULL);
if (!NT_SUCCESS (st)) {
return(st);
}
if (Process->Flags & PS_PROCESS_FLAGS_BREAK_ON_TERMINATION) {
PspCatchCriticalBreak ("Terminating critical process 0x%p (%s)\n",
Process,
Process->ImageFileName);
}
//
// Acquire rundown protection just so we can give the right errors
//
if (!ExAcquireRundownProtection (&Process->RundownProtect)) {
ObDereferenceObject (Process);
return STATUS_PROCESS_IS_TERMINATING;
}
//
// Mark process as deleting except for the obscure delete self case.
//
if (ProcessHandleSpecified) {
PS_SET_BITS (&Process->Flags, PS_PROCESS_FLAGS_PROCESS_DELETE);
}
st = STATUS_NOTHING_TO_TERMINATE;
for (Thread = PsGetNextProcessThread (Process, NULL);
Thread != NULL;
Thread = PsGetNextProcessThread (Process, Thread)) {
st = STATUS_SUCCESS;
if (Thread != Self) {
PspTerminateThreadByPointer (Thread, ExitStatus, FALSE);
}
}
ExReleaseRundownProtection (&Process->RundownProtect);
if (Process == CurrentProcess) {
if (ProcessHandleSpecified) {
ObDereferenceObject (Process);
//
// Never Returns
//
PspTerminateThreadByPointer (Self, ExitStatus, TRUE);
}
} else if (ExitStatus == DBG_TERMINATE_PROCESS) {
DbgkClearProcessDebugObject (Process, NULL);
}
//
// If there are no threads in this process then clear out its handle table.
// Do the same for processes being debugged. This is so a process can never lock itself into the system
// by debugging itself or have a handle open to itself.
//
if (st == STATUS_NOTHING_TO_TERMINATE || (Process->DebugPort != NULL && ProcessHandleSpecified)) {
ObClearProcessHandleTable (Process);
st = STATUS_SUCCESS;
}
ObDereferenceObject(Process);
return st;
}
