Discussion:
CE 5.0 Service: Owner Process and Authorization
(too old to reply)
Jeffrey Walton
2010-06-04 05:09:24 UTC
Permalink
Hi All,

[Sorry about the cross-post - microsoft.public.windowsce.embedded did
not generate any responses. Also, if there's a better forum, please
point me in the right direction. I grew up on Usenet, and its my
preferred.]

I'm working on a CE 5.0 project that offers services to other
applications in the suite via DeviceIoControl. Since *only* other
programs in the suite are authorized, DEVFLAGS_TRUSTEDCALLERS is too
weak. Because of the requirements, there is a need to differentiate
between CallerProcess versus OwnerProcess. As I understand caller and
owner, caller should always be services.exe but owner is what I am
interested in.

Once we know the owner process, we'd like to determine the full
executable path name, hash the image, and then compare the hash to a
list of known hashes [authorized callers] .

I believe I can determine the actual caller using GetOwnerProcess().
However, I need a PID rather than a handle to move on to the next
step
(ToolHelp API enumeration), so I'm looking for GetCurrentOwnerId()
(GetCurrentProcessId() returns the caller, which should be
services.exe).

What's the recommended way to convert a process handle returned by
GetOwnerProcess() to a process pid? Windows CE 5.0 seems to have
ommitted the desktop'sGetProcessId(HANDLE), which might indicate I
don't need it (but I can't seem to see the forest through the trees).
Also, suggestions for a portable way to side step the ToolHelp API
would be appreciated.

Thanks,
Jeffrey Walton

GetProcessId [Desktop], http://msdn.microsoft.com/en-us/library/ms683215(VS.85).aspx
GetOwnerProcess, http://msdn.microsoft.com/en-us/library/ms885633.aspx
GetCallerProcess, http://msdn.microsoft.com/en-us/library/ms885604.aspx
GetCurrentProcessId, http://msdn.microsoft.com/en-us/library/ms885614(v=MSDN.10).aspx
KMOS
2010-06-04 08:49:14 UTC
Permalink
In CE, you should be good to use GetOwnerProcess as parameter for APIs that
require process ID.
Post by Jeffrey Walton
Hi All,
[Sorry about the cross-post - microsoft.public.windowsce.embedded did
not generate any responses. Also, if there's a better forum, please
point me in the right direction. I grew up on Usenet, and its my
preferred.]
I'm working on a CE 5.0 project that offers services to other
applications in the suite via DeviceIoControl. Since *only* other
programs in the suite are authorized, DEVFLAGS_TRUSTEDCALLERS is too
weak. Because of the requirements, there is a need to differentiate
between CallerProcess versus OwnerProcess. As I understand caller and
owner, caller should always be services.exe but owner is what I am
interested in.
Once we know the owner process, we'd like to determine the full
executable path name, hash the image, and then compare the hash to a
list of known hashes [authorized callers] .
I believe I can determine the actual caller using GetOwnerProcess().
However, I need a PID rather than a handle to move on to the next
step
(ToolHelp API enumeration), so I'm looking for GetCurrentOwnerId()
(GetCurrentProcessId() returns the caller, which should be
services.exe).
What's the recommended way to convert a process handle returned by
GetOwnerProcess() to a process pid? Windows CE 5.0 seems to have
ommitted the desktop'sGetProcessId(HANDLE), which might indicate I
don't need it (but I can't seem to see the forest through the trees).
Also, suggestions for a portable way to side step the ToolHelp API
would be appreciated.
Thanks,
Jeffrey Walton
GetProcessId [Desktop], http://msdn.microsoft.com/en-us/library/ms683215(VS.85).aspx
GetOwnerProcess, http://msdn.microsoft.com/en-us/library/ms885633.aspx
GetCallerProcess, http://msdn.microsoft.com/en-us/library/ms885604.aspx
GetCurrentProcessId, http://msdn.microsoft.com/en-us/library/ms885614(v=MSDN.10).aspx
.
Jeffrey Walton
2010-06-04 11:46:19 UTC
Permalink
Hi KMOS,
Post by KMOS
In CE, you should be good to use GetOwnerProcess as parameter for APIs that
require process ID.
Thanks.

Last question: does the HANDLE from GetOwnerProcess have to be closed?

Jeff
Post by KMOS
In CE, you should be good to use GetOwnerProcess as parameter for APIs that
require process ID.
Post by Jeffrey Walton
Hi All,
[Sorry about the cross-post - microsoft.public.windowsce.embedded did
not generate any responses. Also, if there's a better forum, please
point me in the right direction. I grew up on Usenet, and its my
preferred.]
I'm working on a CE 5.0 project that offers services to other
applications in the suite via DeviceIoControl. Since *only* other
programs in the suite are authorized, DEVFLAGS_TRUSTEDCALLERS is too
weak. Because of the requirements, there is a need to differentiate
between CallerProcess versus OwnerProcess. As I understand caller and
owner, caller should always be services.exe but owner is what I am
interested in.
Once we know the owner process, we'd like to determine the full
executable path name, hash the image, and then compare the hash to a
list of known hashes [authorized callers] .
I believe I can determine the actual caller using GetOwnerProcess().
However, I need a PID rather than a handle to move on to the next
step
(ToolHelp API enumeration), so I'm looking for GetCurrentOwnerId()
(GetCurrentProcessId() returns the caller, which should be
services.exe).
What's the recommended way to convert a process handle returned by
GetOwnerProcess() to a process pid? Windows CE 5.0 seems to have
ommitted the desktop'sGetProcessId(HANDLE), which might indicate I
don't need it (but I can't seem to see the forest through the trees).
Also, suggestions for a portable way to side step the ToolHelp API
would be appreciated.
Thanks,
Jeffrey Walton
GetProcessId [Desktop],http://msdn.microsoft.com/en-us/library/ms683215(VS.85).aspx
GetOwnerProcess,http://msdn.microsoft.com/en-us/library/ms885633.aspx
GetCallerProcess,http://msdn.microsoft.com/en-us/library/ms885604.aspx
GetCurrentProcessId,http://msdn.microsoft.com/en-us/library/ms885614(v=MSDN.10).aspx
.- Hide quoted text -
- Show quoted text -
KMOS
2010-06-04 17:51:02 UTC
Permalink
You don't need to close the handle.
And for detail of the relationship between current/owner/caller process,
http://msdn.microsoft.com/en-us/library/ms885604.aspx
Another way to get caller process id is to use GetThreadCallStack with
STACKSNAP_EXTENDED_INFO
http://msdn.microsoft.com/en-us/library/ms885641.aspx

"Jeffrey Walton" <***@gmail.com> wrote in message news:d6fd0433-3032-4fd3-aabc-***@a30g2000yqn.googlegroups.com...
Hi KMOS,
Post by KMOS
In CE, you should be good to use GetOwnerProcess as parameter for APIs that
require process ID.
Thanks.

Last question: does the HANDLE from GetOwnerProcess have to be closed?

Jeff
Post by KMOS
In CE, you should be good to use GetOwnerProcess as parameter for APIs that
require process ID.
Post by Jeffrey Walton
Hi All,
[Sorry about the cross-post - microsoft.public.windowsce.embedded did
not generate any responses. Also, if there's a better forum, please
point me in the right direction. I grew up on Usenet, and its my
preferred.]
I'm working on a CE 5.0 project that offers services to other
applications in the suite via DeviceIoControl. Since *only* other
programs in the suite are authorized, DEVFLAGS_TRUSTEDCALLERS is too
weak. Because of the requirements, there is a need to differentiate
between CallerProcess versus OwnerProcess. As I understand caller and
owner, caller should always be services.exe but owner is what I am
interested in.
Once we know the owner process, we'd like to determine the full
executable path name, hash the image, and then compare the hash to a
list of known hashes [authorized callers] .
I believe I can determine the actual caller using GetOwnerProcess().
However, I need a PID rather than a handle to move on to the next
step
(ToolHelp API enumeration), so I'm looking for GetCurrentOwnerId()
(GetCurrentProcessId() returns the caller, which should be
services.exe).
What's the recommended way to convert a process handle returned by
GetOwnerProcess() to a process pid? Windows CE 5.0 seems to have
ommitted the desktop'sGetProcessId(HANDLE), which might indicate I
don't need it (but I can't seem to see the forest through the trees).
Also, suggestions for a portable way to side step the ToolHelp API
would be appreciated.
Thanks,
Jeffrey Walton
GetProcessId
[Desktop],http://msdn.microsoft.com/en-us/library/ms683215(VS.85).aspx
GetOwnerProcess,http://msdn.microsoft.com/en-us/library/ms885633.aspx
GetCallerProcess,http://msdn.microsoft.com/en-us/library/ms885604.aspx
GetCurrentProcessId,http://msdn.microsoft.com/en-us/library/ms885614(v=MSDN.10).aspx
.- Hide quoted text -
- Show quoted text -
Jeffrey Walton
2010-06-04 19:18:06 UTC
Permalink
Hi KMOS,
Another way to get callerprocessid is to use GetThreadCallStack with
STACKSNAP_EXTENDED_INFOhttp://msdn.microsoft.com/en-us/library/ms885641.aspx
I recall thumbing through the docs on this function, but I was not
aware. Thank you very much.

Jeff
You don't need to close the handle.
And for detail of the relationship between current/owner/callerprocess,http://msdn.microsoft.com/en-us/library/ms885604.aspx
Another way to get callerprocessid is to use GetThreadCallStack with
STACKSNAP_EXTENDED_INFOhttp://msdn.microsoft.com/en-us/library/ms885641.aspx
Hi KMOS,
InCE, you should be good to use GetOwnerProcess as parameter for APIs
that
requireprocessID.
Thanks.
Last question: does the HANDLE from GetOwnerProcess have to be closed?
Jeff
InCE, you should be good to use GetOwnerProcess as parameter for APIs
that
requireprocessID.
Post by Jeffrey Walton
Hi All,
[Sorry about the cross-post - microsoft.public.windowsce.embedded did
not generate any responses. Also, if there's a better forum, please
point me in the right direction. I grew up on Usenet, and its my
preferred.]
I'm working on aCE5.0project that offers services to other
applications in the suite via DeviceIoControl. Since *only* other
programs in the suite are authorized, DEVFLAGS_TRUSTEDCALLERS is too
weak. Because of the requirements, there is a need to differentiate
between CallerProcess versus OwnerProcess. As I understand caller and
owner, caller should always be services.exe butowneris what I am
interested in.
Once we know theownerprocess, we'd like to determine the full
executable path name, hash the image, and then compare the hash to a
list of known hashes [authorized callers] .
I believe I can determine the actual caller using GetOwnerProcess().
However, I need a PID rather than a handle to move on to the next
step
(ToolHelp API enumeration), so I'm looking for GetCurrentOwnerId()
(GetCurrentProcessId() returns the caller, which should be
services.exe).
What's the recommended way to convert aprocesshandle returned by
GetOwnerProcess() to aprocesspid? WindowsCE5.0seems to have
ommitted the desktop'sGetProcessId(HANDLE), which might indicate I
don't need it (but I can't seem to see the forest through the trees).
Also, suggestions for a portable way to side step the ToolHelp API
would be appreciated.
Thanks,
Jeffrey Walton
GetProcessId
[Desktop],http://msdn.microsoft.com/en-us/library/ms683215(VS.85).aspx
GetOwnerProcess,http://msdn.microsoft.com/en-us/library/ms885633.aspx
GetCallerProcess,http://msdn.microsoft.com/en-us/library/ms885604.aspx
GetCurrentProcessId,http://msdn.microsoft.com/en-us/library/ms885614(v=MSDN.10).aspx
.- Hide quoted text -
- Show quoted text -- Hide quoted text -
- Show quoted text -
Loading...