Print3M-malware-dev/process_enumeration_snapshot.c

#include <Windows.h>
#include <TlHelp32.h>
#include <ctype.h>
#include <stdio.h>

VOID ToLowercaseW(IN PWCHAR pSrc, OUT PWCHAR pDest) {
	for (SIZE_T i = 0; i < wcslen(pSrc); i++) {
		pDest[i] = (WCHAR) tolower(pSrc[i]);
		pDest[i + 1] = '\0';
	}
}

BOOL FindProcess(IN CONST PWSTR pProcName, OUT PHANDLE hProc, OUT PROCESSENTRY32* pProcEntry) {
	/*
		Return:
			TRUE  - if process has been found and opened (:pProcName and :hProc are populated)
			FALSE - if something failed (reading :pProcName and :hProc is undefined behavior)
	*/
	HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hSnap == INVALID_HANDLE_VALUE) {
		printf("[!] CreateToolhelp32Snapshot error: %d \n", GetLastError());
		return FALSE;
	}

	
	if (!Process32First(hSnap, pProcEntry)) {
		printf("[!] Process32First error: %d \n", GetLastError());
		return FALSE;
	}

	// Prepare lowercase process name
	WCHAR ProcessName[MAX_PATH];
	
	do {
		ToLowercaseW(pProcEntry->szExeFile, ProcessName);
		
		printf("Proc: %5d | %ls \n", pProcEntry->th32ProcessID, ProcessName);

		if (wcscmp(ProcessName, pProcName) == 0) {
			*hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pProcEntry->th32ProcessID);
			if (*hProc == NULL) {
				printf("[!] OpenProcess error: %d \n", GetLastError());
				return FALSE;
			}

			return TRUE;
		}
	} while (Process32Next(hSnap, pProcEntry));

	return FALSE;
}

INT main() {
	HANDLE hProc = NULL;
	PROCESSENTRY32 ProcEntry = {
		// According to the documentation, this value must be initialized
		.dwSize = sizeof(PROCESSENTRY32)
	};

	if (!FindProcess(L"msedge.exe", &hProc, &ProcEntry)) {
		printf("[!] FindProcess failed \n");
	} else {
		printf("[+] Process opened: (%d) %ls \n", ProcEntry.th32ProcessID, ProcEntry.szExeFile);
	}

	// Exit
	getchar();
	return 0;
}