|
| 1 | +//! Experimental windows hacks to try find what the hecc is holding on to the files that cannot be |
| 2 | +//! deleted. |
| 3 | +
|
| 4 | +// Adapted from <https://stackoverflow.com/questions/67187979/how-to-call-ntopenfile> from |
| 5 | +// Delphi for Rust :3 |
| 6 | +// Also references <https://gist.github.com/antonioCoco/9db236d6089b4b492746f7de31b21d9d>. |
| 7 | + |
| 8 | +// SAFETY: |
| 9 | +// YOLO. |
| 10 | + |
| 11 | +// Windows API naming |
| 12 | +#![allow(nonstandard_style)] |
| 13 | +// Well because CI does deny-warnings :) |
| 14 | +#![deny(unused_imports)] |
| 15 | + |
| 16 | +use std::mem; |
| 17 | +use std::os::windows::ffi::OsStrExt; |
| 18 | +use std::path::Path; |
| 19 | + |
| 20 | +use anyhow::Result; |
| 21 | +use windows::core::PWSTR; |
| 22 | +use windows::Wdk::Foundation::OBJECT_ATTRIBUTES; |
| 23 | +use windows::Wdk::Storage::FileSystem::{ |
| 24 | + NtOpenFile, NtQueryInformationFile, FILE_OPEN_REPARSE_POINT, |
| 25 | +}; |
| 26 | +use windows::Wdk::System::SystemServices::FILE_PROCESS_IDS_USING_FILE_INFORMATION; |
| 27 | +use windows::Win32::Foundation::{ |
| 28 | + CloseHandle, HANDLE, STATUS_INFO_LENGTH_MISMATCH, UNICODE_STRING, |
| 29 | +}; |
| 30 | +use windows::Win32::Storage::FileSystem::{ |
| 31 | + FILE_READ_ATTRIBUTES, FILE_SHARE_DELETE, FILE_SHARE_READ, FILE_SHARE_WRITE, |
| 32 | +}; |
| 33 | +use windows::Win32::System::WindowsProgramming::FILE_INFORMATION_CLASS; |
| 34 | +use windows::Win32::System::IO::IO_STATUS_BLOCK; |
| 35 | + |
| 36 | +/// Wraps a windows API that returns [`NTSTATUS`]: |
| 37 | +/// |
| 38 | +/// - First convert [`NTSTATUS`] to [`HRESULT`]. |
| 39 | +/// - Then convert [`HRESULT`] into a [`WinError`] with or without optional info. |
| 40 | +macro_rules! try_syscall { |
| 41 | + ($syscall: expr) => {{ |
| 42 | + let status = $syscall; |
| 43 | + if status.is_err() { |
| 44 | + ::anyhow::Result::Err(::windows::core::Error::from(status.to_hresult()))?; |
| 45 | + } |
| 46 | + }}; |
| 47 | + ($syscall: expr, $additional_info: expr) => {{ |
| 48 | + let status = $syscall; |
| 49 | + if status.is_err() { |
| 50 | + ::anyhow::Result::Err(::windows::core::Error::new( |
| 51 | + $syscall.into(), |
| 52 | + $additional_info.into(), |
| 53 | + ))?; |
| 54 | + } |
| 55 | + }}; |
| 56 | +} |
| 57 | + |
| 58 | +pub(crate) fn process_ids_using_file(path: &Path) -> Result<Vec<usize>> { |
| 59 | + // Gotta have it in UTF-16LE. |
| 60 | + let mut nt_path = { |
| 61 | + let path = std::path::absolute(path)?; |
| 62 | + r"\??\".encode_utf16().chain(path.as_os_str().encode_wide()).collect::<Vec<u16>>() |
| 63 | + }; |
| 64 | + |
| 65 | + let nt_path_unicode_string = UNICODE_STRING { |
| 66 | + Length: u16::try_from(nt_path.len() * 2)?, |
| 67 | + MaximumLength: u16::try_from(nt_path.len() * 2)?, |
| 68 | + Buffer: PWSTR::from_raw(nt_path.as_mut_ptr()), |
| 69 | + }; |
| 70 | + |
| 71 | + let object_attributes = OBJECT_ATTRIBUTES { |
| 72 | + Length: mem::size_of::<OBJECT_ATTRIBUTES>() as _, |
| 73 | + ObjectName: &nt_path_unicode_string, |
| 74 | + ..Default::default() |
| 75 | + }; |
| 76 | + |
| 77 | + let mut io_status = IO_STATUS_BLOCK::default(); |
| 78 | + let mut handle = HANDLE::default(); |
| 79 | + |
| 80 | + // https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntopenfile |
| 81 | + try_syscall!( |
| 82 | + unsafe { |
| 83 | + NtOpenFile( |
| 84 | + &mut handle as *mut _, |
| 85 | + FILE_READ_ATTRIBUTES.0, |
| 86 | + &object_attributes, |
| 87 | + &mut io_status as *mut _, |
| 88 | + (FILE_SHARE_READ | FILE_SHARE_DELETE | FILE_SHARE_WRITE).0, |
| 89 | + FILE_OPEN_REPARSE_POINT.0, |
| 90 | + ) |
| 91 | + }, |
| 92 | + "tried to open file" |
| 93 | + ); |
| 94 | + |
| 95 | + /// https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/wdm/ne-wdm-_file_information_class |
| 96 | + // Remark: apparently windows 0.52 doesn't have this or something, it appears in at least >= |
| 97 | + // 0.53. |
| 98 | + const FileProcessIdsUsingFileInformation: FILE_INFORMATION_CLASS = FILE_INFORMATION_CLASS(47); |
| 99 | + |
| 100 | + // https://learn.microsoft.com/en-us/windows-hardware/drivers/ddi/ntifs/nf-ntifs-ntqueryinformationfile |
| 101 | + const INCREMENT: usize = 8; |
| 102 | + let mut buf = vec![FILE_PROCESS_IDS_USING_FILE_INFORMATION::default(); INCREMENT as usize]; |
| 103 | + let mut buf_idx = 0; |
| 104 | + let mut status = unsafe { |
| 105 | + NtQueryInformationFile( |
| 106 | + handle, |
| 107 | + &mut io_status as *mut _, |
| 108 | + buf.as_mut_ptr().cast(), |
| 109 | + (INCREMENT * mem::size_of::<FILE_PROCESS_IDS_USING_FILE_INFORMATION>()) as u32, |
| 110 | + FileProcessIdsUsingFileInformation, |
| 111 | + ) |
| 112 | + }; |
| 113 | + while status == STATUS_INFO_LENGTH_MISMATCH { |
| 114 | + buf.resize(buf.len() + INCREMENT, FILE_PROCESS_IDS_USING_FILE_INFORMATION::default()); |
| 115 | + buf_idx += INCREMENT; |
| 116 | + status = unsafe { |
| 117 | + NtQueryInformationFile( |
| 118 | + handle, |
| 119 | + &mut io_status as *mut _, |
| 120 | + buf.as_mut_ptr() |
| 121 | + .offset( |
| 122 | + (buf_idx * mem::size_of::<FILE_PROCESS_IDS_USING_FILE_INFORMATION>()) |
| 123 | + as isize, |
| 124 | + ) |
| 125 | + .cast(), |
| 126 | + (INCREMENT * mem::size_of::<FILE_PROCESS_IDS_USING_FILE_INFORMATION>()) as u32, |
| 127 | + FileProcessIdsUsingFileInformation, |
| 128 | + ) |
| 129 | + }; |
| 130 | + } |
| 131 | + |
| 132 | + let mut process_ids = vec![]; |
| 133 | + |
| 134 | + for FILE_PROCESS_IDS_USING_FILE_INFORMATION { |
| 135 | + NumberOfProcessIdsInList, |
| 136 | + ProcessIdList: [ptr], |
| 137 | + } in buf |
| 138 | + { |
| 139 | + if NumberOfProcessIdsInList >= 1 { |
| 140 | + // only fetch the first one |
| 141 | + process_ids.push(unsafe { |
| 142 | + // This is almost certaintly UB, provenance be damned |
| 143 | + let ptr = ptr as *mut usize; |
| 144 | + *ptr |
| 145 | + }); |
| 146 | + } |
| 147 | + } |
| 148 | + |
| 149 | + try_syscall!(unsafe { CloseHandle(handle) }, "close file handle"); |
| 150 | + |
| 151 | + Ok(process_ids) |
| 152 | +} |
0 commit comments