/*

 * Copyright (c) 2005, 2018, Oracle and/or its affiliates. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.  Oracle designates this

 * particular file as subject to the "Classpath" exception as provided

 * by Oracle in the LICENSE file that accompanied this code.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 */

#include "jni_util.h"

#include <windows.h>

#include <Sddl.h>

#include <string.h>

#include "sun_tools_attach_VirtualMachineImpl.h"

/* kernel32 */

typedef HINSTANCE (WINAPI* GetModuleHandleFunc) (LPCTSTR);

typedef FARPROC (WINAPI* GetProcAddressFunc)(HMODULE, LPCSTR);

/* only on Windows 64-bit or 32-bit application running under WOW64 */

typedef BOOL (WINAPI *IsWow64ProcessFunc) (HANDLE, PBOOL);

static GetModuleHandleFunc _GetModuleHandle;

static GetProcAddressFunc _GetProcAddress;

static IsWow64ProcessFunc _IsWow64Process;

/* psapi */

typedef BOOL  (WINAPI *EnumProcessModulesFunc)  (HANDLE, HMODULE *, DWORD, LPDWORD );

typedef DWORD (WINAPI *GetModuleFileNameExFunc) ( HANDLE, HMODULE, LPTSTR, DWORD );

/* exported function in target VM */

typedef jint (WINAPI* EnqueueOperationFunc)

    (const char* cmd, const char* arg1, const char* arg2, const char* arg3, const char* pipename);

/* OpenProcess with SE_DEBUG_NAME privilege */

static HANDLE

doPrivilegedOpenProcess(DWORD dwDesiredAccess, BOOL bInheritHandle, DWORD dwProcessId);

/* convert jstring to C string */

static void jstring_to_cstring(JNIEnv* env, jstring jstr, char* cstr, int len);

/*

 * Data copied to target process

 */

#define MAX_LIBNAME_LENGTH      16

#define MAX_FUNC_LENGTH         32

#define MAX_CMD_LENGTH          16

#define MAX_ARG_LENGTH          1024

#define MAX_ARGS                3

#define MAX_PIPE_NAME_LENGTH    256

typedef struct {

   GetModuleHandleFunc _GetModuleHandle;

   GetProcAddressFunc _GetProcAddress;

   char jvmLib[MAX_LIBNAME_LENGTH];         /* "jvm.dll" */

   char func1[MAX_FUNC_LENGTH];

   char func2[MAX_FUNC_LENGTH];

   char cmd[MAX_CMD_LENGTH];                /* "load", "dump", ...      */

   char arg[MAX_ARGS][MAX_ARG_LENGTH];      /* arguments to command     */

   char pipename[MAX_PIPE_NAME_LENGTH];

} DataBlock;

/*

 * Return codes from enqueue function executed in target VM

 */

#define ERR_OPEN_JVM_FAIL           200

#define ERR_GET_ENQUEUE_FUNC_FAIL   201

/*

 * Declare library specific JNI_Onload entry if static build

 */

DEF_STATIC_JNI_OnLoad

/*

 * Code copied to target process

 */

#pragma check_stack (off)

/* Switch off all runtime checks (checks caused by /RTC<x>). They cause the

 * generated code to contain relative jumps to check functions which make

 * the code position dependent. */

#pragma runtime_checks ("scu", off)

DWORD WINAPI jvm_attach_thread_func(DataBlock *pData)

{

    HINSTANCE h;

    EnqueueOperationFunc addr;

    h = pData->_GetModuleHandle(pData->jvmLib);

    if (h == NULL) {

        return ERR_OPEN_JVM_FAIL;

    }

    addr = (EnqueueOperationFunc)(pData->_GetProcAddress(h, pData->func1));

    if (addr == NULL) {

        addr = (EnqueueOperationFunc)(pData->_GetProcAddress(h, pData->func2));

    }

    if (addr == NULL) {

        return ERR_GET_ENQUEUE_FUNC_FAIL;

    }

    /* "null" command - does nothing in the target VM */

    if (pData->cmd[0] == '\0') {

        return 0;

    } else {

        return (*addr)(pData->cmd, pData->arg[0], pData->arg[1], pData->arg[2], pData->pipename);

    }

}

/* This function marks the end of jvm_attach_thread_func. */

void jvm_attach_thread_func_end (void) {

}

#pragma check_stack

#pragma runtime_checks ("scu", restore)

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    init

 * Signature: ()V

 */

JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_init

  (JNIEnv *env, jclass cls)

{

    // All following APIs exist on Windows XP with SP2/Windows Server 2008

    _GetModuleHandle = (GetModuleHandleFunc)GetModuleHandle;

    _GetProcAddress = (GetProcAddressFunc)GetProcAddress;

    _IsWow64Process = (IsWow64ProcessFunc)IsWow64Process;

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    generateStub

 * Signature: ()[B

 */

JNIEXPORT jbyteArray JNICALL Java_sun_tools_attach_VirtualMachineImpl_generateStub

  (JNIEnv *env, jclass cls)

{

    /*

     * We should replace this with a real stub generator at some point

     */

    DWORD len;

    jbyteArray array;

    len = (DWORD)((LPBYTE) jvm_attach_thread_func_end - (LPBYTE) jvm_attach_thread_func);

    array= (*env)->NewByteArray(env, (jsize)len);

    if (array != NULL) {

        (*env)->SetByteArrayRegion(env, array, 0, (jint)len, (jbyte*)&jvm_attach_thread_func);

    }

    return array;

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    openProcess

 * Signature: (I)J

 */

JNIEXPORT jlong JNICALL Java_sun_tools_attach_VirtualMachineImpl_openProcess

  (JNIEnv *env, jclass cls, jint pid)

{

    HANDLE hProcess = NULL;

    if (pid == (jint) GetCurrentProcessId()) {

        /* process is attaching to itself; get a pseudo handle instead */

        hProcess = GetCurrentProcess();

        /* duplicate the pseudo handle so it can be used in more contexts */

        if (DuplicateHandle(hProcess, hProcess, hProcess, &hProcess,

                PROCESS_ALL_ACCESS, FALSE, 0) == 0) {

            /*

             * Could not duplicate the handle which isn't a good sign,

             * but we'll try again with OpenProcess() below.

             */

            hProcess = NULL;

        }

    }

    if (hProcess == NULL) {

        /*

         * Attempt to open process. If it fails then we try to enable the

         * SE_DEBUG_NAME privilege and retry.

         */

        hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, (DWORD)pid);

        if (hProcess == NULL && GetLastError() == ERROR_ACCESS_DENIED) {

            hProcess = doPrivilegedOpenProcess(PROCESS_ALL_ACCESS, FALSE,

                           (DWORD)pid);

        }

        if (hProcess == NULL) {

            if (GetLastError() == ERROR_INVALID_PARAMETER) {

                JNU_ThrowIOException(env, "no such process");

            } else {

                char err_mesg[255];

                /* include the last error in the default detail message */

                sprintf(err_mesg, "OpenProcess(pid=%d) failed; LastError=0x%x",

                    (int)pid, (int)GetLastError());

                JNU_ThrowIOExceptionWithLastError(env, err_mesg);

            }

            return (jlong)0;

        }

    }

    /*

     * On Windows 64-bit we need to handle 32-bit tools trying to attach to 64-bit

     * processes (and visa versa). X-architecture attaching is currently not supported

     * by this implementation.

     */

    if (_IsWow64Process != NULL) {

        BOOL isCurrent32bit, isTarget32bit;

        (*_IsWow64Process)(GetCurrentProcess(), &isCurrent32bit);

        (*_IsWow64Process)(hProcess, &isTarget32bit);

        if (isCurrent32bit != isTarget32bit) {

            CloseHandle(hProcess);

            #ifdef _WIN64

              JNU_ThrowByName(env, "com/sun/tools/attach/AttachNotSupportedException",

                  "Unable to attach to 32-bit process running under WOW64");

            #else

              JNU_ThrowByName(env, "com/sun/tools/attach/AttachNotSupportedException",

                  "Unable to attach to 64-bit process");

            #endif

        }

    }

    return (jlong)hProcess;

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    closeProcess

 * Signature: (J)V

 */

JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_closeProcess

  (JNIEnv *env, jclass cls, jlong hProcess)

{

    CloseHandle((HANDLE)hProcess);

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    createPipe

 * Signature: (Ljava/lang/String;)J

 */

JNIEXPORT jlong JNICALL Java_sun_tools_attach_VirtualMachineImpl_createPipe

  (JNIEnv *env, jclass cls, jstring pipename)

{

    HANDLE hPipe;

    char name[MAX_PIPE_NAME_LENGTH];

    SECURITY_ATTRIBUTES sa;

    LPSECURITY_ATTRIBUTES lpSA = NULL;

    // Custom Security Descriptor is required here to "get" Medium Integrity Level.

    // In order to allow Medium Integrity Level clients to open

    // and use a NamedPipe created by an High Integrity Level process.

    TCHAR *szSD = TEXT("D:")                  // Discretionary ACL

                  TEXT("(A;OICI;GRGW;;;WD)")  // Allow read/write to Everybody

                  TEXT("(A;OICI;GA;;;SY)")    // Allow full control to System

                  TEXT("(A;OICI;GA;;;BA)");   // Allow full control to Administrators

    sa.nLength = sizeof(SECURITY_ATTRIBUTES);

    sa.bInheritHandle = FALSE;

    sa.lpSecurityDescriptor = NULL;

    if (ConvertStringSecurityDescriptorToSecurityDescriptor

          (szSD, SDDL_REVISION_1, &(sa.lpSecurityDescriptor), NULL)) {

        lpSA = &sa;

    }

    jstring_to_cstring(env, pipename, name, MAX_PIPE_NAME_LENGTH);

    hPipe = CreateNamedPipe(

          name,                         // pipe name

          PIPE_ACCESS_INBOUND,          // read access

          PIPE_TYPE_BYTE |              // byte mode

            PIPE_READMODE_BYTE |

            PIPE_WAIT,                  // blocking mode

          1,                            // max. instances

          128,                          // output buffer size

          8192,                         // input buffer size

          NMPWAIT_USE_DEFAULT_WAIT,     // client time-out

          lpSA);        // security attributes

    LocalFree(sa.lpSecurityDescriptor);

    if (hPipe == INVALID_HANDLE_VALUE) {

        JNU_ThrowIOExceptionWithLastError(env, "CreateNamedPipe failed");

    }

    return (jlong)hPipe;

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    closePipe

 * Signature: (J)V

 */

JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_closePipe

  (JNIEnv *env, jclass cls, jlong hPipe)

{

    CloseHandle((HANDLE)hPipe);

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    connectPipe

 * Signature: (J)V

 */

JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_connectPipe

  (JNIEnv *env, jclass cls, jlong hPipe)

{

    BOOL fConnected;

    fConnected = ConnectNamedPipe((HANDLE)hPipe, NULL) ?

        TRUE : (GetLastError() == ERROR_PIPE_CONNECTED);

    if (!fConnected) {

        JNU_ThrowIOExceptionWithLastError(env, "ConnectNamedPipe failed");

    }

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    readPipe

 * Signature: (J[BII)I

 */

JNIEXPORT jint JNICALL Java_sun_tools_attach_VirtualMachineImpl_readPipe

  (JNIEnv *env, jclass cls, jlong hPipe, jbyteArray ba, jint off, jint baLen)

{

    unsigned char buf[128];

    DWORD len, nread, remaining;

    BOOL fSuccess;

    len = sizeof(buf);

    remaining = (DWORD)(baLen - off);

    if (len > remaining) {

        len = remaining;

    }

    fSuccess = ReadFile(

         (HANDLE)hPipe,         // handle to pipe

         buf,                   // buffer to receive data

         len,                   // size of buffer

         &nread,                // number of bytes read

         NULL);                 // not overlapped I/O

    if (!fSuccess) {

        if (GetLastError() == ERROR_BROKEN_PIPE) {

            return (jint)-1;

        } else {

            JNU_ThrowIOExceptionWithLastError(env, "ReadFile");

        }

    } else {

        if (nread == 0) {

            return (jint)-1;        // EOF

        } else {

            (*env)->SetByteArrayRegion(env, ba, off, (jint)nread, (jbyte *)(buf));

        }

    }

    return (jint)nread;

}

/*

 * Class:     sun_tools_attach_VirtualMachineImpl

 * Method:    enqueue

 * Signature: (JZLjava/lang/String;[Ljava/lang/Object;)V

 */

JNIEXPORT void JNICALL Java_sun_tools_attach_VirtualMachineImpl_enqueue

  (JNIEnv *env, jclass cls, jlong handle, jbyteArray stub, jstring cmd,

   jstring pipename, jobjectArray args)

{

    DataBlock data;

    DataBlock* pData;

    DWORD* pCode;

    DWORD stubLen;

    HANDLE hProcess, hThread;

    jint argsLen, i;

    jbyte* stubCode;

    jboolean isCopy;

    /*

     * Setup data to copy to target process

     */

    data._GetModuleHandle = _GetModuleHandle;

    data._GetProcAddress = _GetProcAddress;

    strcpy(data.jvmLib, "jvm");

    strcpy(data.func1, "JVM_EnqueueOperation");

    strcpy(data.func2, "_JVM_EnqueueOperation@20");

    /*

     * Command and arguments

     */

    jstring_to_cstring(env, cmd, data.cmd, MAX_CMD_LENGTH);

    argsLen = (*env)->GetArrayLength(env, args);

    if (argsLen > 0) {

        if (argsLen > MAX_ARGS) {

            JNU_ThrowInternalError(env, "Too many arguments");

            return;

        }

        for (i=0; i<argsLen; i++) {

            jobject obj = (*env)->GetObjectArrayElement(env, args, i);

            if (obj == NULL) {

                data.arg[i][0] = '\0';

            } else {

                jstring_to_cstring(env, obj, data.arg[i], MAX_ARG_LENGTH);

            }

            if ((*env)->ExceptionOccurred(env)) return;

        }

    }

    for (i = argsLen; i < MAX_ARGS; i++) {

        data.arg[i][0] = '\0';

    }

    /* pipe name */

    jstring_to_cstring(env, pipename, data.pipename, MAX_PIPE_NAME_LENGTH);

    /*

     * Allocate memory in target process for data and code stub

     * (assumed aligned and matches architecture of target process)

     */

    hProcess = (HANDLE)handle;

    pData = (DataBlock*) VirtualAllocEx( hProcess, 0, sizeof(DataBlock), MEM_COMMIT, PAGE_READWRITE );

    if (pData == NULL) {

        JNU_ThrowIOExceptionWithLastError(env, "VirtualAllocEx failed");

        return;

    }

    WriteProcessMemory( hProcess, (LPVOID)pData, (LPCVOID)&data, (SIZE_T)sizeof(DataBlock), NULL );

    stubLen = (DWORD)(*env)->GetArrayLength(env, stub);

    stubCode = (*env)->GetByteArrayElements(env, stub, &isCopy);

    if ((*env)->ExceptionOccurred(env)) return;

    pCode = (PDWORD) VirtualAllocEx( hProcess, 0, stubLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE );

    if (pCode == NULL) {

        JNU_ThrowIOExceptionWithLastError(env, "VirtualAllocEx failed");

        VirtualFreeEx(hProcess, pData, 0, MEM_RELEASE);

        (*env)->ReleaseByteArrayElements(env, stub, stubCode, JNI_ABORT);

        return;

    }

    WriteProcessMemory( hProcess, (LPVOID)pCode, (LPCVOID)stubCode, (SIZE_T)stubLen, NULL );

    (*env)->ReleaseByteArrayElements(env, stub, stubCode, JNI_ABORT);

    /*

     * Create thread in target process to execute code

     */

    hThread = CreateRemoteThread( hProcess,

                                  NULL,

                                  0,

                                  (LPTHREAD_START_ROUTINE) pCode,

                                  pData,

                                  0,

                                  NULL );

    if (hThread != NULL) {

        if (WaitForSingleObject(hThread, INFINITE) != WAIT_OBJECT_0) {

            JNU_ThrowIOExceptionWithLastError(env, "WaitForSingleObject failed");

        } else {

            DWORD exitCode;

            GetExitCodeThread(hThread, &exitCode);

            if (exitCode) {

                switch (exitCode) {

                    case ERR_OPEN_JVM_FAIL :

                        JNU_ThrowIOException(env,

                            "jvm.dll not loaded by target process");

                        break;

                    case ERR_GET_ENQUEUE_FUNC_FAIL :

                        JNU_ThrowIOException(env,

                            "Unable to enqueue operation: the target VM does not support attach mechanism");

                        break;

                    default : {

                        char errmsg[128];

                        sprintf(errmsg, "Remote thread failed for unknown reason (%d)", exitCode);

                        JNU_ThrowInternalError(env, errmsg);

                    }

                }

            }

        }

        CloseHandle(hThread);

    } else {

        if (GetLastError() == ERROR_NOT_ENOUGH_MEMORY) {

            //

            // This error will occur when attaching to a process belonging to

            // another terminal session. See "Remarks":

            // http://msdn.microsoft.com/en-us/library/ms682437%28VS.85%29.aspx

            //

            JNU_ThrowIOException(env,

                "Insufficient memory or insufficient privileges to attach");

        } else {

            JNU_ThrowIOExceptionWithLastError(env, "CreateRemoteThread failed");

        }