Find process ID by NtGetNextProcess

Enumeration/Processes/NtGetNextProcess.cpp

@@ -0,0 +1,48 @@
+/*
+ * Find process ID by NtGetNextProcess. C++ implementation
+ * author: @cocomelonc
+ * based on https://cocomelonc.github.io/malware/2023/05/26/malware-tricks-30.html
+*/
+#include <windows.h>
+#include <stdio.h>
+#include <winternl.h>
+#include <psapi.h>
+#include <shlwapi.h>
+
+#pragma comment(lib, "ntdll.lib")
+#pragma comment(lib, "shlwapi.lib")
+
+typedef NTSTATUS (NTAPI * fNtGetNextProcess)(
+  _In_ HANDLE ProcessHandle,
+  _In_ ACCESS_MASK DesiredAccess,
+  _In_ ULONG HandleAttributes,
+  _In_ ULONG Flags,
+  _Out_ PHANDLE NewProcessHandle
+);
+
+int findMyProc(const char * procname) {
+  int pid = 0;
+  HANDLE current = NULL;
+  char procName[MAX_PATH];
+
+  // resolve function address
+  fNtGetNextProcess myNtGetNextProcess = (fNtGetNextProcess) GetProcAddress(GetModuleHandle("ntdll.dll"), "NtGetNextProcess");
+
+  // loop through all processes
+  while (!myNtGetNextProcess(current, MAXIMUM_ALLOWED, 0, 0, &current)) {
+    GetProcessImageFileNameA(current, procName, MAX_PATH);
+    if (lstrcmpiA(procname, PathFindFileName((LPCSTR) procName)) == 0) {
+      pid = GetProcessId(current);
+      break;
+    }
+  }
+
+  return pid;
+}
+
+int main(int argc, char* argv[]) {
+  int pid = 0; // process ID
+  pid = findMyProc(argv[1]);
+  printf("%s%d\n", pid > 0 ? "process found at pid = " : "process not found. pid = ", pid);
+  return 0;
+}