windows_win/raw/
process.rs

1//! Provides functions to interact with processes.
2
3use core::{ptr, mem};
4use core::ffi::c_void;
5
6use crate::sys::*;
7use crate::utils::{self, Result};
8
9///Opens process by pid.
10///
11///# Note:
12///See information about access rights:
13///https://msdn.microsoft.com/en-us/library/windows/desktop/ms684880%28v=vs.85%29.aspx
14///
15///# Parameters
16///
17///* ```pid``` - Pid of the process.
18///* ```access_rights``` - Bit mask that specifies desired access rights.
19///
20///# Return
21///
22///* ```Ok``` - Handle to opened process.
23///* ```Err``` - Error reason.
24pub fn open(pid: u32, access_rights: u32) -> Result<HANDLE> {
25    let result = unsafe {OpenProcess(access_rights, 0, pid) };
26
27    if result.is_null() {
28        return Err(utils::get_last_error());
29    }
30
31    Ok(result)
32}
33
34///Closes opened process.
35///
36///# Parameters
37///
38///* ```process``` - pointer to a opened process.
39///
40///# Return
41///
42///* ```Ok``` - Success.
43///* ```Err``` - Error reason.
44pub fn close(process: HANDLE) -> Result<()> {
45    let result = unsafe {CloseHandle(process) };
46
47    if result == 0 {
48        return Err(utils::get_last_error());
49    }
50
51    Ok(())
52}
53
54///Reads process memory.
55///
56///# Parameters
57///
58///* ```process``` - Pointer to a opened process.
59///* ```base_addr``` - Address from where to start reading.
60///* ```storage``` - Storage to hold memory. Its `len` determines amount of bytes to read.
61///
62///# Return
63///
64///* ```Ok``` - Vector with data.
65///* ```Err``` - Error reason.
66pub fn read_memory(process: HANDLE, base_addr: usize, storage: &mut [u8]) -> Result<()> {
67    let read_size = storage.len();
68    let ret_val = unsafe {ReadProcessMemory(process,
69                                            base_addr as *const c_void,
70                                            storage.as_mut_ptr() as *mut c_void,
71                                            read_size as SIZE_T,
72                                            ptr::null_mut())};
73
74    if ret_val == 0 {
75        Err(utils::get_last_error())
76    }
77    else {
78        Ok(())
79    }
80}
81
82///Writes into process memory.
83///
84///# Parameters
85///
86///* ```process``` - Pointer to a opened process.
87///* ```base_addr``` - Address from where to start writing.
88///* ```data``` - Slice with write data.
89///
90///# Return
91///
92///* ```Ok``` - Success.
93///* ```Err``` - Error reason.
94pub fn write_memory(process: HANDLE, base_addr: usize, data: &[u8]) -> Result<()> {
95    let ret_val = unsafe {WriteProcessMemory(process,
96                                             base_addr as *mut c_void,
97                                             data.as_ptr() as *const c_void,
98                                             data.len() as SIZE_T,
99                                             ptr::null_mut())};
100    if ret_val == 0 {
101        return Err(utils::get_last_error());
102    }
103
104    Ok(())
105}
106
107///Gets full path to process's exectuable.
108///
109///# Note
110///
111/// The process MUST be opened with either PROCESS_QUERY_INFORMATION or PROCESS_QUERY_LIMITED_INFORMATION flag.
112///
113///# Parameters
114///
115///* ```process``` - Pointer to a opened process.
116///
117///# Return
118///
119///* ```Ok``` - Success.
120///* ```Err``` - Error reason.
121pub fn get_exe_path(process: HANDLE) -> Result<String> {
122    let mut buf_len = MAX_PATH as u32;
123    let mut result: Vec<u16> = vec![0; buf_len as usize];
124    let text_ptr = result.as_mut_ptr() as LPWSTR;
125
126    unsafe {
127        if QueryFullProcessImageNameW(process, 0, text_ptr, &mut buf_len as *mut u32) == 0 {
128            return Err(utils::get_last_error());
129        }
130    }
131
132    Ok(String::from_utf16_lossy(&result[..buf_len as usize]))
133}
134
135#[inline]
136///Retrieves process ID of Handle.
137pub fn get_id(process: HANDLE) -> c_ulong {
138    unsafe { GetProcessId(process) }
139}
140
141#[inline]
142///Retrieves pseudo-handler of the calling process.
143pub fn get_current_handle() -> HANDLE {
144    unsafe { GetCurrentProcess() }
145}
146
147///Terminates process.
148///
149///# Parameters
150///
151///* ```process``` - Pointer to a opened process.
152///* ```code``` - Exit code that shall be used by affected process.
153///
154///# Note:
155///
156///It prevents process from running any clean-up.
157pub fn terminate(process: HANDLE, code: c_uint) -> Result<()> {
158    if unsafe { TerminateProcess(process, code) } != 0 {
159        Ok(())
160    }
161    else {
162        Err(utils::get_last_error())
163    }
164}
165
166///Checks whether current process is elevated.
167pub fn is_self_elevated() -> bool {
168    is_elevated(unsafe { GetCurrentProcess() })
169}
170
171///Determines whether the current process is elevated.
172///
173///# Parameters
174///
175///* ```process``` - Pointer to a opened process.
176pub fn is_elevated(process: HANDLE) -> bool {
177    let mut token: HANDLE = ptr::null_mut();
178
179    unsafe {
180        if OpenProcessToken(process, TOKEN_QUERY, &mut token as *mut HANDLE) == 0 {
181            //Most likely no access rights
182            return false;
183        }
184    }
185
186    let mut evalutation: TOKEN_ELEVATION = unsafe { mem::zeroed() };
187    let eval_ptr = &mut evalutation as *mut TOKEN_ELEVATION as *mut c_void;
188    let mut len = mem::size_of::<TOKEN_ELEVATION>() as DWORD;
189
190    let result = match unsafe { GetTokenInformation(token, TOKEN_INFORMATION_CLASS::TokenElevation, eval_ptr, len, &mut len as *mut _) } {
191        0 => false,
192        _ => evalutation.TokenIsElevated != 0,
193    };
194
195    unsafe {
196        CloseHandle(token);
197    }
198
199    result
200}
windows_win/raw/process.rs

windows_win/raw/
process.rs
