Advertisement
Guest User

Untitled

a guest
Dec 9th, 2016
72
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 3.96 KB | None | 0 0
  1. #ifdef linux
  2.  
  3. #include <stdio.h>
  4. #include <unistd.h>
  5. #include <linux/unistd.h>
  6.  
  7. int main() {
  8. int pidSyscall = (int) syscall(__NR_gettid);
  9. int pidUsermode = (int) getpid();
  10.  
  11. printf("linux");
  12. // check for invalid return value
  13. if (0 > pidSyscall) {
  14. perror("syscall(__NR_gettid)");
  15. fprintf(stderr, "%d\n", pidSyscall);
  16. return 1;
  17. }
  18.  
  19. // check for invalid return value
  20. // (even if getpid() should not be able to produce an error because it is always succesfull, we are just too careful :P)
  21. if (0 > pidUsermode) {
  22. perror("getpid()");
  23. fprintf(stderr, "%d\n", pidUsermode);
  24. return 1;
  25. }
  26.  
  27. printf("syscall: %d\nusermode-API: %d\n", pidSyscall, pidUsermode);
  28. return 0;
  29. }
  30.  
  31. /* EndIf linux */
  32. #elif _WIN32
  33.  
  34. #include <windows.h>
  35. #include <winternl.h>
  36. #include <stdio.h>
  37.  
  38. #include <process.h>
  39.  
  40. __declspec(noinline)
  41. __declspec(naked)
  42.  
  43. NTSTATUS CallNtQueryInformationProcess(
  44. HANDLE ProcessHandle,
  45. PROCESSINFOCLASS ProcessInformationClass,
  46. PVOID ProcessInformation,
  47. ULONG ProcessInformationLength,
  48. PULONG ReturnLength)
  49. {
  50. __asm {
  51. mov eax, 0x000000a1 // OS: Windows Server 2003 SP1 x86
  52. mov edx, 0x7FFE0300 /* KUSER_SHARED_DATA syscall stub */
  53. call dword ptr [edx] /* call the stub code */
  54. ret
  55. }
  56. }
  57.  
  58. int printError(const char *msg, DWORD err) {
  59. LPSTR lpMsgBuf;
  60. if (FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER|
  61. FORMAT_MESSAGE_FROM_SYSTEM |
  62. FORMAT_MESSAGE_IGNORE_INSERTS,
  63. NULL,
  64. err, // Usually you put in GetLastError() directly here, we just use the parameter err (more flexible in case you would want to get the error from somewhere else)
  65. MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
  66. (LPTSTR) &lpMsgBuf,
  67. 0,
  68. NULL ))
  69. {
  70. fprintf(stderr,"%s : %s\n",msg,lpMsgBuf);
  71. LocalFree(lpMsgBuf);
  72. }
  73. else { // just in case FormatMessage fails with an error
  74. fprintf(stderr,"Error at FormatMessage: %d\n", err=GetLastError());
  75. }
  76. return err;
  77. }
  78.  
  79. int main(int argc, char *argv[])
  80. {
  81. NTSTATUS status;
  82. unsigned long pidSyscall = 0;
  83. unsigned long pidUsermode = 0;
  84. PROCESS_BASIC_INFORMATION outInfo;
  85. PULONG outLength;
  86.  
  87. //GetCurrentProcess() returns a pseudo-handle, which is valid only in the context of the process who creates it
  88. //It's interpreted as the current process handle
  89. //Using DuplicateHandle creates a "real" handle of the current process (which is valid in context of other processes)
  90. HANDLE inHandle;
  91. status = DuplicateHandle(GetCurrentProcess(),
  92. GetCurrentProcess(),
  93. GetCurrentProcess(),
  94. &inHandle,
  95. 0,
  96. FALSE,
  97. DUPLICATE_SAME_ACCESS);
  98. printf("windows");
  99. /* Error handling */
  100. if(!status) {
  101. return printError("DuplicateHandle", GetLastError());
  102. } /* EndOf Error Handling */
  103.  
  104. status = CallNtQueryInformationProcess(inHandle,
  105. 0,
  106. &outInfo,
  107. sizeof(outInfo),
  108. outLength);
  109.  
  110. /* Error handling */
  111. if(status != 0) {
  112. return printError("CallNtQueryInformationProcess", GetLastError());
  113. } /* EndOf Error Handling */
  114.  
  115. pidSyscall = outInfo.UniqueProcessId;
  116. pidUsermode = GetCurrentProcessId(); //User-mode function
  117. //pidUsermode = _getpid(); //also works, but also just calls GetCurrentProcessId()
  118.  
  119. printf("syscall: %lu\n usermode-API: %lu\n", pidSyscall, pidUsermode);
  120. return 0;
  121. }
  122.  
  123. #endif /* _WIN32 */
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement