/*
* Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License version 2 only, as
* published by the Free Software Foundation. Oracle designates this
* particular file as subject to the "Classpath" exception as provided
* by Oracle in the LICENSE file that accompanied this code.
*
* This code is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* version 2 for more details (a copy is included in the LICENSE file that
* accompanied this code).
*
* You should have received a copy of the GNU General Public License version
* 2 along with this work; if not, write to the Free Software Foundation,
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
*
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
* or visit www.oracle.com if you need additional information or have any
* questions.
*/
#include "jni_util.h"
#include <windows.h>
#include <Sddl.h>
#include <string.h>
#include "sun_tools_attach_VirtualMachineImpl.h"
/* kernel32 */
typedef HINSTANCE (WINAPI* GetModuleHandleFunc) (LPCTSTR);
typedef FARPROC (WINAPI* GetProcAddressFunc)(HMODULE, LPCSTR);
/* only on Windows 64-bit or 32-bit application running under WOW64 */
typedef BOOL (WINAPI *IsWow64ProcessFunc) (HANDLE, PBOOL);
static GetModuleHandleFunc _GetModuleHandle;
static GetProcAddressFunc _GetProcAddress;
static IsWow64ProcessFunc _IsWow64Process;
/* psapi */
typedef BOOL (WINAPI *EnumProcessModulesFunc) (HANDLE, HMODULE *, DWORD, LPDWORD );
typedef DWORD (WINAPI *GetModuleFileNameExFunc) ( HANDLE, HMODULE, LPTSTR, DWORD );
/* exported function in target VM */
typedef jint (WINAPI* EnqueueOperationFunc)
(const char* cmd, const char* arg1, const char* arg2, const char* arg3, const char* pipename);
/* OpenProcess with SE_DEBUG_NAME privilege */
static HANDLE
doPrivilegedOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);
/* convert jstring to C string */
static void jstring_to_cstring(JNIEnv* env, jstring jstr, char* cstr, int len);
/*
* Data copied to target process
*/
#define MAX_LIBNAME_LENGTH 16
#define MAX_FUNC_LENGTH 32
#define MAX_CMD_LENGTH 16
#define MAX_ARG_LENGTH 1024
#define MAX_ARGS 3
#define MAX_PIPE_NAME_LENGTH 256
typedef struct {
GetModuleHandleFunc _GetModuleHandle;
GetProcAddressFunc _GetProcAddress;
char jvmLib[MAX_LIBNAME_LENGTH]; /* "jvm.dll" */
char func1[MAX_FUNC_LENGTH];
char func2[MAX_FUNC_LENGTH];
char cmd[MAX_CMD_LENGTH]; /* "load", "dump", ... */
char arg[MAX_ARGS][MAX_ARG_LENGTH]; /* arguments to command */
char pipename[MAX_PIPE_NAME_LENGTH];
} DataBlock;
/*
* Return codes from enqueue function executed in target VM
*/
#define ERR_OPEN_JVM_FAIL 200
#define ERR_GET_ENQUEUE_FUNC_FAIL 201
/*
* Declare library specific JNI_Onload entry if static build
*/
DEF_STATIC_JNI_OnLoad
/*
* Code copied to target process
*/
#pragma check_stack (off)
/* Switch off all runtime checks (checks caused by /RTC<x>). They cause the
* generated code to contain relative jumps to check functions which make
* the code position dependent. */
#pragma runtime_checks ("scu", off)
DWORD WINAPI jvm_attach_thread_func(DataBlock *pData)
{
HINSTANCE h;
EnqueueOperationFunc addr;
h = pData->_GetModuleHandle(pData->jvmLib);
if (h == NULL) {
return ERR_OPEN_JVM_FAIL;
}
addr = (EnqueueOperationFunc)(pData->_GetProcAddress(h, pData->func1));
if (addr == NULL) {
addr = (EnqueueOperationFunc)(pData->_GetProcAddress(h, pData->func2));
}
if (addr == NULL) {
return ERR_GET_ENQUEUE_FUNC_FAIL;
}
/* "null" command - does nothing in the target VM */
if (pData->cmd[0] == '\0') {
return 0;
} else {
return (*addr)(pData->cmd, pData->arg[0], pData->arg[1], pData->arg[2], pData->pipename);
}
}
/* This function marks the end of jvm_attach_thread_func. */
void jvm_attach_thread_func_end (void) {
}
#pragma check_stack
#pragma runtime_checks ("scu", restore)
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: init
* Signature: ()V
*/
JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_init
(JNIEnv *env, jclass cls)
{
// All following APIs exist on Windows XP with SP2/Windows Server 2008
_GetModuleHandle = (GetModuleHandleFunc)GetModuleHandle;
_GetProcAddress = (GetProcAddressFunc)GetProcAddress;
_IsWow64Process = (IsWow64ProcessFunc)IsWow64Process;
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: generateStub
* Signature: ()[B
*/
JNIEXPORT jbyteArray JNICALL Java_sun_tools_attach_VirtualMachineImpl_generateStub
(JNIEnv *env, jclass cls)
{
/*
* We should replace this with a real stub generator at some point
*/
DWORD len;
jbyteArray array;
len = (DWORD)((LPBYTE) jvm_attach_thread_func_end - (LPBYTE) jvm_attach_thread_func);
array= (*env)->NewByteArray(env, (jsize)len);
if (array != NULL) {
(*env)->SetByteArrayRegion(env, array, 0, (jint)len, (jbyte*)&jvm_attach_thread_func);
}
return array;
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: openProcess
* Signature: (I)J
*/
JNIEXPORT jlong JNICALL Java_sun_tools_attach_VirtualMachineImpl_openProcess
(JNIEnv *env, jclass cls, jint pid)
{
HANDLE hProcess = NULL;
if (pid == (jint) GetCurrentProcessId()) {
/* process is attaching to itself; get a pseudo handle instead */
hProcess = GetCurrentProcess();
/* duplicate the pseudo handle so it can be used in more contexts */
if (DuplicateHandle(hProcess, hProcess, hProcess, &hProcess,
PROCESS_ALL_ACCESS, FALSE, 0) == 0) {
/*
* Could not duplicate the handle which isn't a good sign,
* but we'll try again with OpenProcess() below.
*/
hProcess = NULL;
}
}
if (hProcess == NULL) {
/*
* Attempt to open process. If it fails then we try to enable the
* SE_DEBUG_NAME privilege and retry.
*/
hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)pid);
if (hProcess == NULL && GetLastError() == ERROR_ACCESS_DENIED) {
hProcess = doPrivilegedOpenProcess(PROCESS_ALL_ACCESS, FALSE,
(DWORD)pid);
}
if (hProcess == NULL) {
if (GetLastError() == ERROR_INVALID_PARAMETER) {
JNU_ThrowIOException(env, "no such process");
} else {
char err_mesg[255];
/* include the last error in the default detail message */
sprintf(err_mesg, "OpenProcess(pid=%d) failed; LastError=0x%x",
(int)pid, (int)GetLastError());
JNU_ThrowIOExceptionWithLastError(env, err_mesg);
}
return (jlong)0;
}
}
/*
* On Windows 64-bit we need to handle 32-bit tools trying to attach to 64-bit
* processes (and visa versa). X-architecture attaching is currently not supported
* by this implementation.
*/
if (_IsWow64Process != NULL) {
BOOL isCurrent32bit, isTarget32bit;
(*_IsWow64Process)(GetCurrentProcess(), &isCurrent32bit);
(*_IsWow64Process)(hProcess, &isTarget32bit);
if (isCurrent32bit != isTarget32bit) {
CloseHandle(hProcess);
#ifdef _WIN64
JNU_ThrowByName(env, "com/sun/tools/attach/AttachNotSupportedException",
"Unable to attach to 32-bit process running under WOW64");
#else
JNU_ThrowByName(env, "com/sun/tools/attach/AttachNotSupportedException",
"Unable to attach to 64-bit process");
#endif
}
}
return (jlong)hProcess;
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: closeProcess
* Signature: (J)V
*/
JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_closeProcess
(JNIEnv *env, jclass cls, jlong hProcess)
{
CloseHandle((HANDLE)hProcess);
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: createPipe
* Signature: (Ljava/lang/String;)J
*/
JNIEXPORT jlong JNICALL Java_sun_tools_attach_VirtualMachineImpl_createPipe
(JNIEnv *env, jclass cls, jstring pipename)
{
HANDLE hPipe;
char name[MAX_PIPE_NAME_LENGTH];
SECURITY_ATTRIBUTES sa;
LPSECURITY_ATTRIBUTES lpSA = NULL;
// Custom Security Descriptor is required here to "get" Medium Integrity Level.
// In order to allow Medium Integrity Level clients to open
// and use a NamedPipe created by an High Integrity Level process.
TCHAR *szSD = TEXT("D:") // Discretionary ACL
TEXT("(A;OICI;GRGW;;;WD)") // Allow read/write to Everybody
TEXT("(A;OICI;GA;;;SY)") // Allow full control to System
TEXT("(A;OICI;GA;;;BA)"); // Allow full control to Administrators
sa.nLength = sizeof(SECURITY_ATTRIBUTES);
sa.bInheritHandle = FALSE;
sa.lpSecurityDescriptor = NULL;
if (ConvertStringSecurityDescriptorToSecurityDescriptor
(szSD, SDDL_REVISION_1, &(sa.lpSecurityDescriptor), NULL)) {
lpSA = &sa;
}
jstring_to_cstring(env, pipename, name, MAX_PIPE_NAME_LENGTH);
hPipe = CreateNamedPipe(
name, // pipe name
PIPE_ACCESS_INBOUND, // read access
PIPE_TYPE_BYTE | // byte mode
PIPE_READMODE_BYTE |
PIPE_WAIT, // blocking mode
1, // max. instances
128, // output buffer size
8192, // input buffer size
NMPWAIT_USE_DEFAULT_WAIT, // client time-out
lpSA); // security attributes
LocalFree(sa.lpSecurityDescriptor);
if (hPipe == INVALID_HANDLE_VALUE) {
JNU_ThrowIOExceptionWithLastError(env, "CreateNamedPipe failed");
}
return (jlong)hPipe;
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: closePipe
* Signature: (J)V
*/
JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_closePipe
(JNIEnv *env, jclass cls, jlong hPipe)
{
CloseHandle((HANDLE)hPipe);
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: connectPipe
* Signature: (J)V
*/
JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_connectPipe
(JNIEnv *env, jclass cls, jlong hPipe)
{
BOOL fConnected;
fConnected = ConnectNamedPipe((HANDLE)hPipe, NULL) ?
TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);
if (!fConnected) {
JNU_ThrowIOExceptionWithLastError(env, "ConnectNamedPipe failed");
}
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: readPipe
* Signature: (J[BII)I
*/
JNIEXPORT jint JNICALL Java_sun_tools_attach_VirtualMachineImpl_readPipe
(JNIEnv *env, jclass cls, jlong hPipe, jbyteArray ba, jint off, jint baLen)
{
unsigned char buf[128];
DWORD len, nread, remaining;
BOOL fSuccess;
len = sizeof(buf);
remaining = (DWORD)(baLen - off);
if (len > remaining) {
len = remaining;
}
fSuccess = ReadFile(
(HANDLE)hPipe, // handle to pipe
buf, // buffer to receive data
len, // size of buffer
&nread, // number of bytes read
NULL); // not overlapped I/O
if (!fSuccess) {
if (GetLastError() == ERROR_BROKEN_PIPE) {
return (jint)-1;
} else {
JNU_ThrowIOExceptionWithLastError(env, "ReadFile");
}
} else {
if (nread == 0) {
return (jint)-1; // EOF
} else {
(*env)->SetByteArrayRegion(env, ba, off, (jint)nread, (jbyte *)(buf));
}
}
return (jint)nread;
}
/*
* Class: sun_tools_attach_VirtualMachineImpl
* Method: enqueue
* Signature: (JZLjava/lang/String;[Ljava/lang/Object;)V
*/
JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_enqueue
(JNIEnv *env, jclass cls, jlong handle, jbyteArray stub, jstring cmd,
jstring pipename, jobjectArray args)
{
DataBlock data;
DataBlock* pData;
DWORD* pCode;
DWORD stubLen;
HANDLE hProcess, hThread;
jint argsLen, i;
jbyte* stubCode;
jboolean isCopy;
/*
* Setup data to copy to target process
*/
data._GetModuleHandle = _GetModuleHandle;
data._GetProcAddress = _GetProcAddress;
strcpy(data.jvmLib, "jvm");
strcpy(data.func1, "JVM_EnqueueOperation");
strcpy(data.func2, "_JVM_EnqueueOperation@20");
/*
* Command and arguments
*/
jstring_to_cstring(env, cmd, data.cmd, MAX_CMD_LENGTH);
argsLen = (*env)->GetArrayLength(env, args);
if (argsLen > 0) {
if (argsLen > MAX_ARGS) {
JNU_ThrowInternalError(env, "Too many arguments");
return;
}
for (i=0; i<argsLen; i++) {
jobject obj = (*env)->GetObjectArrayElement(env, args, i);
if (obj == NULL) {
data.arg[i][0] = '\0';
} else {
jstring_to_cstring(env, obj, data.arg[i], MAX_ARG_LENGTH);
}
if ((*env)->ExceptionOccurred(env)) return;
}
}
for (i = argsLen; i < MAX_ARGS; i++) {
data.arg[i][0] = '\0';
}
/* pipe name */
jstring_to_cstring(env, pipename, data.pipename, MAX_PIPE_NAME_LENGTH);
/*
* Allocate memory in target process for data and code stub
* (assumed aligned and matches architecture of target process)
*/
hProcess = (HANDLE)handle;
pData = (DataBlock*) VirtualAllocEx( hProcess, 0, sizeof(DataBlock), MEM_COMMIT, PAGE_READWRITE );
if (pData == NULL) {
JNU_ThrowIOExceptionWithLastError(env, "VirtualAllocEx failed");
return;
}
WriteProcessMemory( hProcess, (LPVOID)pData, (LPCVOID)&data, (SIZE_T)sizeof(DataBlock), NULL );
stubLen = (DWORD)(*env)->GetArrayLength(env, stub);
stubCode = (*env)->GetByteArrayElements(env, stub, &isCopy);
if ((*env)->ExceptionOccurred(env)) return;
pCode = (PDWORD) VirtualAllocEx( hProcess, 0, stubLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE );
if (pCode == NULL) {
JNU_ThrowIOExceptionWithLastError(env, "VirtualAllocEx failed");
VirtualFreeEx(hProcess, pData, 0, MEM_RELEASE);
(*env)->ReleaseByteArrayElements(env, stub, stubCode, JNI_ABORT);
return;
}
WriteProcessMemory( hProcess, (LPVOID)pCode, (LPCVOID)stubCode, (SIZE_T)stubLen, NULL );
(*env)->ReleaseByteArrayElements(env, stub, stubCode, JNI_ABORT);
/*
* Create thread in target process to execute code
*/
hThread = CreateRemoteThread( hProcess,
NULL,
0,
(LPTHREAD_START_ROUTINE) pCode,
pData,
0,
NULL );
if (hThread != NULL) {
if (WaitForSingleObject(hThread, INFINITE) != WAIT_OBJECT_0) {
JNU_ThrowIOExceptionWithLastError(env, "WaitForSingleObject failed");
} else {
DWORD exitCode;
GetExitCodeThread(hThread, &exitCode);
if (exitCode) {
switch (exitCode) {
case ERR_OPEN_JVM_FAIL :
JNU_ThrowIOException(env,
"jvm.dll not loaded by target process");
break;
case ERR_GET_ENQUEUE_FUNC_FAIL :
JNU_ThrowIOException(env,
"Unable to enqueue operation: the target VM does not support attach mechanism");
break;
default : {
char errmsg[128];
sprintf(errmsg, "Remote thread failed for unknown reason (%d)", exitCode);
JNU_ThrowInternalError(env, errmsg);
}
}
}
}
CloseHandle(hThread);
} else {
if (GetLastError() == ERROR_NOT_ENOUGH_MEMORY) {
//
// This error will occur when attaching to a process belonging to
// another terminal session. See "Remarks":
// http://msdn.microsoft.com/en-us/library/ms682437%28VS.85%29.aspx
//
JNU_ThrowIOException(env,
"Insufficient memory or insufficient privileges to attach");
} else {
JNU_ThrowIOExceptionWithLastError(env, "CreateRemoteThread failed");
}
}
VirtualFreeEx(hProcess, pCode, 0, MEM_RELEASE);
VirtualFreeEx(hProcess, pData, 0, MEM_RELEASE);
}
/*
* Attempts to enable the SE_DEBUG_NAME privilege and open the given process.
*/
static HANDLE
doPrivilegedOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId) {
HANDLE hToken;
HANDLE hProcess = NULL;
LUID luid;
TOKEN_PRIVILEGES tp, tpPrevious;
DWORD retLength, error;
/*
* Get the access token
*/
if (!OpenThreadToken(GetCurrentThread(),
TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
FALSE,
&hToken)) {
if (GetLastError() != ERROR_NO_TOKEN) {
return (HANDLE)NULL;
}
/*
* No access token for the thread so impersonate the security context
* of the process.
*/
if (!ImpersonateSelf(SecurityImpersonation)) {
return (HANDLE)NULL;
}
if (!OpenThreadToken(GetCurrentThread(),
TOKEN_ADJUST_PRIVILEGES|TOKEN_QUERY,
FALSE,
&hToken)) {
return (HANDLE)NULL;
}
}
/*
/**代码未完, 请加载全部代码(NowJava.com).**/