klezVirus-DriverJack/DriverJack/FindPID.cpp

#include "common.h"

DWORD FindPID(_In_ std::wstring imageName)
{

	// create snapshot of processes using RAII classes
	RAII::Handle snapshot(
		CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL)
	);

	if (!snapshot.GetHandle())
	{
		Error(::GetLastError());
		return ERROR_FILE_NOT_FOUND;
	}

	PROCESSENTRY32W processEntry;
	processEntry.dwSize = sizeof(PROCESSENTRY32W);
	auto status = Process32FirstW(snapshot.GetHandle(), &processEntry); // start enumerating from the first process
	if (!status)
	{
		Error(::GetLastError());
		return ERROR_FILE_NOT_FOUND;
	}

	std::transform(imageName.begin(), imageName.end(), imageName.begin(), towlower);
	do
	{
		std::wstring processImage = processEntry.szExeFile;
		std::transform(processImage.begin(), processImage.end(), processImage.begin(), towlower);

		if (processImage == imageName)
		{
			std::wcout << L"(+) Found process " << processEntry.szExeFile << " with PID " << processEntry.th32ProcessID << std::endl; // when lsass is found return its PID to the caller
			return processEntry.th32ProcessID;
		}
	} while (Process32NextW(snapshot.GetHandle(), &processEntry));

	return ERROR_FILE_NOT_FOUND;
}