new

process_enumeration_snapshot.c

@@ -0,0 +1,69 @@
+#include <Windows.h>
+#include <TlHelp32.h>
+#include <ctype.h>
+#include <stdio.h>
+
+VOID ToLowercaseW(IN PWCHAR pSrc, OUT PWCHAR pDest) {
+	for (SIZE_T i = 0; i < wcslen(pSrc); i++) {
+		pDest[i] = (WCHAR) tolower(pSrc[i]);
+		pDest[i + 1] = '\0';
+	}
+}
+
+BOOL FindProcess(IN CONST PWSTR pProcName, OUT PHANDLE hProc, OUT PROCESSENTRY32* pProcEntry) {
+	/*
+		Return:
+			TRUE  - if process has been found and opened (:pProcName and :hProc are populated)
+			FALSE - if something failed (reading :pProcName and :hProc is undefined behavior)
+	*/
+	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
+	if (hSnap == INVALID_HANDLE_VALUE) {
+		printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError());
+		return FALSE;
+	}
+
+	
+	if (!Process32First(hSnap, pProcEntry)) {
+		printf("[!] Process32First error: %d \n", GetLastError());
+		return FALSE;
+	}
+
+	// Prepare lowercase process name
+	WCHAR ProcessName[MAX_PATH];
+	
+	do {
+		ToLowercaseW(pProcEntry->szExeFile, ProcessName);
+		
+		printf("Proc: %5d | %ls \n", pProcEntry->th32ProcessID, ProcessName);
+
+		if (wcscmp(ProcessName, pProcName) == 0) {
+			*hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pProcEntry->th32ProcessID);
+			if (*hProc == NULL) {
+				printf("[!] OpenProcess error: %d \n", GetLastError());
+				return FALSE;
+			}
+
+			return TRUE;
+		}
+	} while (Process32Next(hSnap, pProcEntry));
+
+	return FALSE;
+}
+
+INT main() {
+	HANDLE hProc = NULL;
+	PROCESSENTRY32 ProcEntry = {
+		// According to the documentation, this value must be initialized
+		.dwSize = sizeof(PROCESSENTRY32)
+	};
+
+	if (!FindProcess(L"msedge.exe", &hProc, &ProcEntry)) {
+		printf("[!] FindProcess failed \n");
+	} else {
+		printf("[+] Process opened: (%d) %ls \n", ProcEntry.th32ProcessID, ProcEntry.szExeFile);
+	}
+
+	// Exit
+	getchar();
+	return 0;
+}