CODEWITHSUNDEEP
windowswinapi
Bruce
Bruce

Reputation: 35233

How to find out caller info?

This will require some background. I am using Detours to intercept system calls. For those of who don't know what Detours is - it is a tool which redirects call to system functions to a detour function which allows us to do whatever we want to do before and after the actual system call is made. What I want to know is that if it is possible to find out somehow any info about the dll/module which has made this system call? Does any win32 api function help me do this?

Lets say traceapi.dll makes a system call to GetModuleFileNameW() inside kernel32.dll. Detour will intercept this call and redirect control to a detour function (say Mine_GetModuleFileNameW()). Now inside Mine_GetModuleFileNameW(), is it possible to find out that this call originated from traceapi?

Upvotes: 2

Views: 705

Answers (2)

Vikram.exe
Vikram.exe

Reputation: 4585

call ZwQuerySystemInformation with first argument SystemProcessesAndThreadsInformation. once you have the returned buf, typecast it to PSYTSTEM+PROCESS_INFORMATION and use its field to extract your info.

status = ZwQuerySystemInformation (
        SystemProcessesAndThreadsInformation, buf, bufsize, NULL);

PSYSTEM_PROCESS_INFORMATION proc_info = (PSYSTEM_PROCESS_INFORMATION) buf;

proc_info->ProcessName, which is a UNICODE_STRING will give you the calling process name.

Please note that the structure and field I am talking about is not documented and might change in future release of windows. However, I am using it and it works fine on WIN XP and above.

Upvotes: 1

Hans Passant
Hans Passant

Reputation: 941397

I don't know how many stack frames will be on the stack that are owned by Detours code. Easy to find out in the debugger, the odds are good that there are none. That makes it easy, use the _ReturnAddress intrinsic to get the caller's address. VirtualQuery() to get the base address, cast it to HMODULE and use GetModuleFileName(). Well, the non-detoured one :)

If there are Detours stack frames then it gets a lot harder. StackWalk64() to skip them, perilous if there are FPO frames present.

Upvotes: 1

Related Questions