[PATCH 0/1] MR11283: ntoskrnl: implement PsGetProcessImageFileName

[Deep Agrawal (＠de-ep)]

Wine Bug: https://bugs.winehq.org/show_bug.cgi?id=59411

Let me know if this needs any improvement!

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11283

[PATCH 1/1] ntoskrnl: implement PsGetProcessImageFileName

[Deep Agrawal]

From: Deep Agrawal <[e-mail]>

Wine Bug: https://bugs.winehq.org/show_bug.cgi?id=59411
---
 dlls/ntoskrnl.exe/ntoskrnl.c        | 14 ++++++++++++++
 dlls/ntoskrnl.exe/ntoskrnl.exe.spec |  2 +-
 include/ddk/ntddk.h                 |  1 +
 3 files changed, 16 insertions(+), 1 deletion(-)

diff --git a/dlls/ntoskrnl.exe/ntoskrnl.c b/dlls/ntoskrnl.exe/ntoskrnl.c
index bf6554debe1..6e9abf060e6 100644
--- a/dlls/ntoskrnl.exe/ntoskrnl.c
+++ b/dlls/ntoskrnl.exe/ntoskrnl.c
@@ -2566,6 +2566,20 @@ HANDLE WINAPI PsGetProcessId(PEPROCESS process)
     return (HANDLE)process->info.UniqueProcessId;
 }
 
+/*********************************************************************
+ *           PsGetProcessImageFileName    (NTOSKRNL.@)
+ */
+CHAR * WINAPI PsGetProcessImageFileName(PEPROCESS Process)
+{
+    UNICODE_STRING *image_path_name = &Process->info.PebBaseAddress->ProcessParameters->ImagePathName;
+    
+    STRING str;
+    if (!NT_SUCCESS(RtlUnicodeStringToAnsiString(&str, image_path_name, TRUE)))
+        return NULL;
+
+    return str.Buffer;
+}
+
 /*********************************************************************
  *           PsGetProcessInheritedFromUniqueProcessId  (NTOSKRNL.@)
  */
diff --git a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec
index 85e530e5546..49dd6b619d0 100644
--- a/dlls/ntoskrnl.exe/ntoskrnl.exe.spec
+++ b/dlls/ntoskrnl.exe/ntoskrnl.exe.spec
@@ -928,7 +928,7 @@
 @ stub PsGetProcessExitStatus
 @ stub PsGetProcessExitTime
 @ stdcall PsGetProcessId(ptr)
-@ stub PsGetProcessImageFileName
+@ stdcall PsGetProcessImageFileName(ptr)
 @ stdcall PsGetProcessInheritedFromUniqueProcessId(ptr)
 @ stub PsGetProcessJob
 @ stub PsGetProcessPeb
diff --git a/include/ddk/ntddk.h b/include/ddk/ntddk.h
index 887d1749662..338fad5d4ce 100644
--- a/include/ddk/ntddk.h
+++ b/include/ddk/ntddk.h
@@ -289,6 +289,7 @@ NTSTATUS  WINAPI KeExpandKernelStackAndCallout(PEXPAND_STACK_CALLOUT,void*,SIZE_
 void      WINAPI KeSetTargetProcessorDpc(PRKDPC,CCHAR);
 BOOLEAN   WINAPI MmIsAddressValid(void *);
 HANDLE    WINAPI PsGetProcessId(PEPROCESS);
+CHAR *    WINAPI PsGetProcessImageFileName(PEPROCESS Process);
 void *    WINAPI PsGetProcessSectionBaseAddress(PEPROCESS);
 HANDLE    WINAPI PsGetThreadId(PETHREAD);
 HANDLE    WINAPI PsGetThreadProcessId(PETHREAD);
-- 
GitLab

https://gitlab.winehq.org/wine/wine/-/merge_requests/11283

[Elizabeth Figura (＠zfigura)]

> +    UNICODE_STRING *image_path_name = &Process->info.PebBaseAddress->ProcessParameters->ImagePathName;

That's not going to work. It probably would in the real Windows kernel, but we don't have access to the process's address space. I note that you may have copied from PsGetCurrentProcessSessionId(), which is also broken. You'll need to emulate PsGetProcessSectionBaseAddress() instead.

This should also have a test, in dlls/ntoskrnl.exe/tests/driver.c.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11283#note_144450

[Alfred Agrell (＠Alcaro)]

Googling that function suggests that it returns a field of struct EPROCESS, meaning that RtlUnicodeStringToAnsiString(x, y, TRUE) is a memory leak.

-- 
https://gitlab.winehq.org/wine/wine/-/merge_requests/11283#note_144451