Print3M-malware-dev/process_enumeration_snapshot.c

#include <Windows.h>
#include <TlHelp32.h>
#include <ctype.h>
#include <stdio.h>
#include <stdbool.h>

void to_lowercase(IN wchar_t src[], OUT wchar_t dest[]) {
	for (size_t i = 0; i < wcslen(src); i++) {
		dest[i] = (wchar_t) tolower(src[i]);
		dest[i + 1] = '\0';
	}
}

bool find_process(IN const wchar_t proc_name[], OUT HANDLE* proc, OUT PROCESSENTRY32* proc_entry) {
	/*
		Return:
			TRUE  - if process has been found and opened (:pProcName and :hProc are populated)
			FALSE - if something failed (reading :pProcName and :hProc is undefined behavior)
	*/
	HANDLE snap= CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (snap == INVALID_HANDLE_VALUE) {
		printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError());
		return FALSE;
	}

	
	if (!Process32First(snap, proc_entry)) {
		printf("[!] Process32First error: %d \n", GetLastError());
		return FALSE;
	}

	// Prepare lowercase process name
	wchar_t process_name[MAX_PATH];
	
	do {
		to_lowercase(proc_entry->szExeFile, process_name);
		
		printf("Proc: %5d | %ls \n", proc_entry->th32ProcessID, process_name);

		if (wcscmp(process_name, proc_name) == 0) {
			*proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, proc_entry->th32ProcessID);
			if (*proc == NULL) {
				printf("[!] OpenProcess error: %d \n", GetLastError());
				return FALSE;
			}

			return TRUE;
		}
	} while (Process32Next(snap, proc_entry));

	return FALSE;
}

INT main() {
	HANDLE proc = NULL;
	PROCESSENTRY32 proc_entry = {
		// According to the documentation, this value must be initialized
		.dwSize = sizeof(PROCESSENTRY32)
	};

	if (!find_process(L"msedge.exe", &proc, &proc_entry)) {
		printf("[!] FindProcess failed \n");
	} else {
		printf("[+] Process opened: (%d) %ls \n", proc_entry.th32ProcessID, proc_entry.szExeFile);
	}

	// Exit
	getchar();
	return 0;
}