From:	SMTP%"gavron@ACES.COM" 12-JUN-1993 11:51:31.68
To:	EVERHART
CC:	
Subj:	Re: Finding a particular process name

From: gavron@spades.aces.com (Ehud Gavron)
X-Newsgroups: comp.os.vms
Subject: Re: Finding a particular process name
Date: 7 Jun 1993 14:27 MST
Organization: ACES Research Inc.
Lines: 315
Distribution: world
Message-Id: <7JUN199314275712@spades.aces.com>
Reply-To: gavron@ACES.COM
Nntp-Posting-Host: alpha.sunquest.com
Keywords: process,daemon
News-Software: VAX/VMS VNEWS 1.41    
To: Info-VAX@kl.sri.com
X-Gateway-Source-Info: USENET

In article <C89LuL.DpK@micrognosis.co.uk>, nreadwin@micrognosis.co.uk (Neil Readwin) writes...
#robinson@stout.geo.brown.edu (Darrin Robinson) writes:
#|> Note that $ SHOW PROC [process_name] requires that you have GROUP privileges
#|> to show other processes in your same GROUP and WORLD privileges to do the
#|> same for processes not in your GROUP.
# 
#TILT! No amount of privilege will make make
# 
#		SHOW PROC [process_name]
# 
#work for processes that are not in your group since process names are
#implicitly qualified by the group. Two processes in the same group cannot
#normally[%] have the same name, but two processes in different groups can.

	Not if you apply the patch below.

# Phone: +44 71 815 5283  E-mail: nreadwin@micrognosis.co.uk
# Anything is a cause for sorrow that my mind or body has made

	Ehud

--
Ehud Gavron        (EG76)     
gavron@aces.com
Yow!  Are we laid back yet?

	.TITLE	FIXUP_PRCNAM	Make process names ignore UIC groups
	.IDENT	/V2.1.0-20feb92/

;++
;
; FIXUP_PRCNAM.MAR            02-Feb-1992	Ehud Gavron
;
; For those times you want process control functionality to be independent
; of UIC groups, this image patches the executive routines EXE$NAMPID and
; EXE$SETPRN to ignore the group UIC check.
;
; Although no merchantability is expressed or implied, this
; code was developed for and will work under V5.4-2.
;
;       Ehud Gavron             gavron@Spades.ACES.COM
;
;--
; V1.0.0        Created because I'm not getting enough interesting
;               kernel-coding to do in my regular job.
;
;
; V2.0.0	Modified to have FIND_VECTOR be a generalized routine
;		I can call from anywhere.  Do EXE$NAMPID.  Fix page-
;		protection bug which caused JOB_CONTROL to accvio.
;		
; V2.0.1	Added macros to create the command definitions, and
;		other things...
;
; V2.1.0 	Nick De Smith pointed out I wasn't catching the fourth
;		type of executive vector.  Corrected.  According to Nick's
;		MWAIT program (good stuff!) the four types are:
;			1. Base image vectored system routine:
;				jmp @#address
;			2. Base vectored system service:
;				.entry ^m<...>
;				jmp	@#address
;			3. Chamge mode kernel system service:
;				.entry ^m<...>
;				chmk	#nnnn
;			4. Change mode executive system service
;				.entry ^m<...>
;				chme	#nnnn	
;		Modified code to use built in opcodes where appropriate.
;		The only place this is not modified is where I use the
;		cmd_store macro to create a descriptor; this is to make
;		future changes easy to do - just grab listings code and
;		plug in.
;
;		20-feb-1992	Ehud Gavron	Gavron@ACES.COM
;
; Definitions
;
        .library        "sys$Library:lib.mlb"                   ; find $xxxdefs
        .link           "sys$system:sys.stb"/selective_search   ; find xxx$x_xs

	$opdef		; Opcode definitions (for op$_jmp...)
	$pcbdef		; Process Control Block offsets (to get PCB$W_GRP)
	$prtdef		; Page Protection definitions (for PRT$C_URKW)
	$ptedef		; Page Table Entry definitions (to get PTE$x_PROT)
        $ssdef          ; System Service status values (for normal status)

;
; Offsets I stole from the VAX Architecture manual:
;
SCB_L_CMKRNL	=	^X40
SCB_L_CMEXEC	=	^X44

;
; Location of vector symbol and addresses:
;
fv_symbol:	.blkl	1	; The global symbol to find the code for
fv_vector:	.blkl	1	; The address of the code
;
; Argument list to pass it to FIND_VECTOR:
;
fv_arglst:	.long	2
		.address fv_symbol
		.address fv_vector
;
; Macros:
;
	.macro	cmd_store	cmd,cmdargs	; Store a command as a string
'cmd'_inst: 'cmd' 'cmdargs'			; Descriptor.  Eventually this
'cmd'_len = . - 'cmd'_inst			; will lead to a generic patch-
'cmd'_desc:	.long	'cmd'_len		; in-memory routine.
		.address 'cmd'_inst
	.endm

	.macro	FIND_AND_DESTROY symb		; A temporary macro to avoid
	movl	#symb,fv_symbol			; Having repetitious-looking
	$cmkrnl_s	routin=find_vector,-	; source-code.  This one will
			arglst=fv_arglst	; find a symbol, and call the
	$cmkrnl_s	routin=fixup_k,-	; fixup routine.
			arglst=fv_arglst
	.endm

;
; Start of user-mode code:
;
	.Entry	Fixup,^m<>
	find_and_destroy exe$nampid		; Patch exe$nampid
	find_and_destroy exe$setprn		; Patch exe$setprn
	Ret					; End!

;
; Start of kernel-mode code:
;
	.entry	FIND_VECTOR,^m<r2,r3,r4,r5,r6,r7,r8,r9,r10,r11>
;
; Find out which system service or jump vector it is today...
;
	movl	@4(ap),r7		; Address of vector requested
	cmpw	(r7),#op$_jmp!<^x9f00>	; Check for JMP @#
	beql	10$			; It is, go use it
	addl	#2,r7			; Move past the entry mask
	cmpw	(r7),#op$_jmp!<^x9f00>	; Is it a JMP @#
	beql	10$			; Yup, go deal with it
	movl	#SCB_l_cmkrnl,r10	; Prepare for it being a CHMK
	cmpb	(r7),#op$_chmk		; Is it a CHMK #n
	beql	20$			; Yup, go deal with it
	movl	#SCB_l_cmexec,r10	; Prepare for it being a CHME
	cmpb	(r7),#op$_chme		; Is it a CHME #n
	beql	20$			; Yup, go deal with it
	movl	#ss$_unsupported,-	; Eeek, don't know what it is...
		r0			; So tell user it's unsupported
	ret				; and go back to user mode!

;
; So now we extract the address from the JMP instruction:
;
10$:
	addl2	#2,r7			; Get nn from JMP @#nn
	movl	(r7),@8(ap)
	movl	#ss$_normal,r0
	ret
;
; So now we get the number of the exception...
;
20$:
	addl2	#2,r7			; Get address of #nn from CHMx #nn
	movzbl	(r7),r8			; Get nn into R8
;
; So now we find the dispatcher address
;
	movl	@#exe$gl_scb,r1		; Get address of System Control Block
	addl2	r10,r1			; Get address of correct dispatcher
	movl	(r1),r1			; Get address of exe$cmodxxxx where
					; xxxx is either krnl or exec
;
; We look in its code for the dispatch vector table
;
	movab	movaq_inst,r2		; Address of our MOVAQ instruction	
	movzwl	(r2),r5
	addl3	#^xff,r1,r3		; Address past MOVAQ fer shure
30$:
	movzwl	(r1),r6
	cmpw	r6,r5			; Have we found a MOVAQ?
	beql	40$			; Yup!
	aobleq	r3,r1,30$
	movl	#ss$_nodata,r0		; Whoops, couldn't find it...
	ret				; So go back to user mode... sigh

;
; Ok, here R1 points to the start of a MOVAQ instruction that looks like:
; 	MOVAQ CMOD$AR_mode_DISPATCH_VECTOR[R1],R1
; which translates to bytes:	51hhllCF417E with hhll being the offset
; from the last byte (51).  We first save this current R1
;
40$:
	movl	r1,r9			; Address of MOVAQ
	movl	r1,r7			; Saved
;
; Then we find the offset
;
	addl2	#3,r9			; Address of hhll (word)
	movzwl	(r9),r3			; R3 = offset
;
; Then we add get the address of the end of the instruction
;
	addl2	#5,r7			; Address of last byte of instruction
;
; Then we add the offset
;
	addl2	r3,r7			; R7 = CMOD$AR_mode_DISPATCH_VECTOR
;
; Then we take our CHMn code and multiply by 8 (quadword vectors) and add
;
	ashl	#3,r8,r6		; Vector offset
	addl2	r6,r7			; Our vector
	addl2	#4,r7			; The address [2nd longword of vector]
	movl	(r7),@8(ap)		; Return this address
	movl	#ss$_normal,r0
	ret


	.entry FIXUP_K,^m<r2,r3,r4,r5,r6,r7,r8,r9,r10,r11>
;++
; Make EXE$SETPRN ignore UIC groups
;--
	movl	@8(ap),r1		; Get address of code
;
; Now we need to search this code for the instructions:
;	CMPW	PCB$W_GRP(R4),PCB$W_GRP(R7)
;	BNEQ	offset
;
; and change them to NOPs...
;
	movab	cmpw_inst,r2		; Address of our CMPW instruction
	movzbl	(r2),r5			; Address of CMPW (1B)
	addl3	#^x64,r1,r3		; Address past CMPW fer shure
10$:
	movzbl	(r1),r6			; Current instruction
	cmpl	r6,r5			; Have we found a CMPW?
	beql	20$			; Yup!
15$:
	aobleq	r3,r1,10$
	movl	#ss$_nodata,r0		; Whoops, couldn't find it...
	ret				; So go back to user mode... sigh
;
; Here we make sure we got the right CMPW.  The way we do that is twofold.
; First we make sure that the offset to the register is C6 (PCB$W_GRP).
; Then we make sure there is a BNEQ afterwards.
20$:
	addl3	#2,r1,r2		; Address of PCB$W_GRP
	cmpw	#pcb$w_grp,(r2)
	cmpl	r5,r6
	bneq	15$			; Nope, keep looking
	addl3	#7,r1,r2
	movzbl	(r2),r3
	movab	bneq_inst,r4
	movzbl	(r4),r4
	cmpl	r3,r4
	beql	30$			; passed sanity check
	brw	15$			; go find another CMPW...
;
; Set page for URKW protection:
;
30$:
	movl	r1,r2			; Get start address
	movl	#prt$c_urkw,r9			; Set for URKW
	moval	nop_inst,r7		; Put address of NOP in R7
	movzbl	(r7),r7			; Put NOP instruction in R7
	addl3	#9,r1,r8		; Get end address
	lock	lockname=MMG,-		; Raise IPL, acquire spinlock
		lockipl=#IPL$_MMG,-
		preserve=NO
	jsb	g^mmg$svaptechk		; Get SVAPTE in R3
	extzv	#pte$v_prot,-		; Get old page protection in R10
		#pte$s_prot,-
		(r3),r10
;
; Now we NOP out the bytes...
;
	insv 	r9,#pte$v_prot,-	; Make page kernel writeable
	     	#pte$s_prot,(r3)
	invalidate_tb			; Translation Buffer Invalidate All
40$:
	movb	r7,(r1)
	aoblss	r8,r1,40$
	invalidate_tb			; Translation Buffer Invalidate All
	unlock	lockname = MMG,-	; Release spinlock, lower IPL
		condition = RESTORE,-
		newipl = #0,-
		preserve = NO
	movl	#ss$_normal,r0
	ret				; and return

;
; Note: We use the CMD_STORE macro and actually store instructions
;	as opposed to using the OP$_xxx method of using them because
;	we cannot be sure that these will remain constant.  As they
;	may change from time to time, it is easier to leave them in
;	this format, and then vary it from the listings.
;
;	At least that much was true for MOVAQ.
;
;	We leave the CMPW and BNEQ and NOP instructions in this
;	format (and even create descriptors for them) in anticipation
;	of the day I write a generic patch-in-memory routine that
;	will expect descriptors of what-to-look-for and what-to-
;	replace-it-with.  This is easier in a descriptor format
;	than an OP$_xxx format.
;
	cmd_store	movaq	<w^10[r1],r1>
	cmd_store	cmpw	<pcb$w_grp(r4),pcb$w_grp(r7)>
	cmd_store	bneq	<bneq_inst+1>
	cmd_store	nop	<>
	.end	Fixup


