Advertisement
Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- bool Process::Attach ( const std::string& Name )
- {
- PROCESSENTRY32 pe32 = { 0 };
- pe32.dwSize = sizeof(PROCESSENTRY32);
- HANDLE hSnapshot = CreateToolhelp32Snapshot ( TH32CS_SNAPPROCESS, 0 );
- if ( hSnapshot == INVALID_HANDLE_VALUE )
- {
- Util::DbgPrint ( "CreateToolhelp32Snapshot failed! (Invalid handle value) [Process::Attach] %i", GetLastError () );
- return false;
- }
- if ( !Process32First ( hSnapshot, &pe32 ) )
- {
- CloseHandle ( hSnapshot );
- Util::DbgPrint ( "Process32First failed! (Return value is false) [Process::Attach] %i", GetLastError () );
- return false;
- }
- do
- {
- if ( Name.compare ( pe32.szExeFile ) == 0 )
- {
- m_dwProcessId = pe32.th32ProcessID;
- break;
- }
- }
- while ( Process32Next ( hSnapshot, &pe32 ) );
- CloseHandle ( hSnapshot );
- NTSTATUS Status;
- OBJECT_ATTRIBUTES ObjectAttributes;
- CLIENT_ID ClientId;
- ClientId.UniqueProcess = UlongToHandle(m_dwProcessId);
- ClientId.UniqueThread = 0;
- ObjectAttributes.Length = sizeof(OBJECT_ATTRIBUTES);
- ObjectAttributes.Attributes = 0;
- ObjectAttributes.RootDirectory = 0;
- ObjectAttributes.ObjectName = 0;
- ObjectAttributes.SecurityDescriptor = 0;
- ObjectAttributes.SecurityQualityOfService = 0;
- Status = Import::NtOpenProcess ( &m_hProcessHandle, DEFAULT_ACCESS_P, &ObjectAttributes, &ClientId );
- if ( !NT_SUCCESS(Status) )
- {
- Util::DbgPrint ( "NtOpenProcess failed! (Invalid return value) [Process::Attach] %i", Status );
- return false;
- }
- DWORD_PTR dwPointer = 0;
- Status = Import::NtQueryInformationProcess ( m_hProcessHandle, ProcessWow64Information, &dwPointer, sizeof(DWORD_PTR), 0 );
- if ( !NT_SUCCESS(Status) )
- {
- CloseHandle ( m_hProcessHandle );
- Util::DbgPrint ( "NtQueryInformationProcess failed! (Invalid return value) [Process::Attach] %i", Status );
- return false;
- }
- Status = Import::NtReadVirtualMemory ( m_hProcessHandle, (PVOID)dwPointer, &m_PEB, sizeof(PEB), 0 );
- if ( !NT_SUCCESS(Status) )
- {
- CloseHandle ( m_hProcessHandle );
- Util::DbgPrint ( "NtReadVirtualMemory failed! (Invalid return value) [Process::Attach] %i", Status );
- return false;
- }
- hSnapshot = INVALID_HANDLE_VALUE;
- MODULEENTRY32 me32 = { 0 };
- me32.dwSize = sizeof(MODULEENTRY32);
- hSnapshot = CreateToolhelp32Snapshot ( TH32CS_SNAPMODULE, m_dwProcessId );
- if ( hSnapshot == INVALID_HANDLE_VALUE )
- {
- CloseHandle ( m_hProcessHandle );
- Util::DbgPrint ( "CreateToolhelp32Snapshot failed! (Invalid handle value) [Process::Attach] %i", GetLastError () );
- return false;
- }
- if ( !Module32First ( hSnapshot, &me32 ) )
- {
- CloseHandle ( hSnapshot );
- CloseHandle ( m_hProcessHandle );
- return false;
- }
- do
- {
- m_ModuleArray.push_back ( Module ( (DWORD_PTR)me32.modBaseAddr, (DWORD_PTR)me32.modBaseSize, me32.szModule ) );
- }
- while ( Module32Next ( hSnapshot, &me32 ) );
- CloseHandle ( hSnapshot );
- }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement