CoGetServerPid may fail for high PIDs

[jogerh]

Thank you for a nice contribution with CoGetServerPid.

While investigating the code, I found that if the process ID is greater than what can be represented by an USHORT, an invalid process ID is returned (max USHORT).

If you happen to know about a solution to this problem, it would be highly appreciated.

Best regards,
Jøger

[kimgr]

Thank you for the report, and sorry for the very late response.

I suspect I've misinterpreted the wire layout -- could it be that the PID is not an USHORT in the (made-up) OBJREF struct, but rather a DWORD?

If you could catch this in a debugger, you should be able to look at the stream data and see where the "rest" of the DWORD is (look out for byte-order issues). If you can find a new correct offset, we can update CoGetServerPID to do the right thing.

[forderud]

CoGetServerPid seem to always return 65535 for process IDs above 65k. This therefore doesn't appear to be a straight-forward "wire layout" misinterpretation issue...

[kimgr]

Since the time CoGetServerPID was written, Microsoft appear to have added documentation for the OBJREF format: https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/fe6c5e46-adf8-4e34-a8de-3f756c875f31

Not that it's actually giving away very much (the location of the PID is a mystery to me in this one).

I'm not sure what it can be, besides a wire layout misinterpretation; that's basically all CoGetServerPID does :).

Anyway, patches welcome for this, I don't have access to a Windows environment anymore and my mind is elsewhere.

[forderud]

Just stumbled across a 3 Ways to Get a COM Server Process ID blog post that seem relevant for this particular problem. The proposed OXID Resolver and ALPC port approaches seem a bit convoluted though.

[kimgr]

@forderud Thanks for the link, that covers way more ground than CoGetServerPID ever did. If someone is interested in augmenting CoGetServerPID with a second phase to inspect the OXID resolver that would be cool. But it does look pretty convoluted.

[forderud]

Side note: It's also possible to determine PID from a window handle (HWND) using GetWindowThreadProcessId. This can be used as alternative approach when dealing with OLE controls that expose a window handle.