ProcessBasicInformation vs. New Flags

//http://waleedassar.blogspot.com
//http://www.twitter.com/waleedassar

//With the "ProcessBasicInformation" class of the "ZwQueryInformationProcess" function, you
//can now query certain flags of the "_EPROCESS" structure e.g.
//1) The state of whether the process is protected or not (see. audiodg.exe).
//2) The state of whether the process is Wow64 or Native64.
//3) The state of whether the process is self-delete or not.
//N.B. Self-Delete means that the process can only be terminated by self.

#include "stdafx.h"
#include "windows.h"
#include "stdio.h"




extern "C"
{
    int __stdcall ZwQueryInformationProcess(HANDLE,unsigned long,void*,unsigned long,unsigned long*);
    int __stdcall ZwSetInformationProcess(HANDLE,unsigned long,unsigned long*,unsigned long);
}




#define ProcessBasicInformation 0x0

#define ProcessIsProtected 0x1
#define ProcessIsWow64     0x2
#define ProcessDeleteOrSelfDelete 0x4
#define ProcessCrossSectionCreate 0x8

struct PROCESS_BASIC_INFORMATION_EXT
{
    unsigned long Size;
    unsigned long ExitStatus;
    unsigned long PebAddress;
    unsigned long AffinityMask;
    unsigned long BasePriority;
    unsigned long UniqueProcessId;
    unsigned long ParentProcessId;
    unsigned long MiscFlags;
};

#define PROCESS_QUERY_LIMITED_INFORMATION 0x1000

void main()
{
    unsigned long pid=0;
    printf("Enter Process Id ");
    scanf("%d",&pid);
    if(!pid) ExitProcess(0);

    HANDLE hProcess=OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION,TRUE,pid);
    if(!hProcess) ExitProcess(0);



    PROCESS_BASIC_INFORMATION_EXT B={sizeof(B)};
    unsigned long retLength=0;
    int ret=ZwQueryInformationProcess(hProcess,ProcessBasicInformation,&B,sizeof(B),&retLength);
    if(ret<0) printf("Error: %x\r\n",ret);
    else
    {
        printf("ExitStatus is %x\r\n",B.ExitStatus);
        printf("PEB Address is %x\r\n",B.PebAddress);
        printf("Process Affinity mask is %x\r\n",B.AffinityMask);
        printf("Process Base Priority is %x\r\n",B.BasePriority);
        printf("Process Id is %x\r\n",B.UniqueProcessId);
        printf("Parent Process Id is %x\r\n",B.ParentProcessId);
        if(B.MiscFlags&ProcessIsProtected) printf("Protected: TRUE\r\n");
        else                               printf("Protected: FALSE\r\n");

        if(B.MiscFlags&ProcessIsWow64)   printf("Wow64: TRUE\r\n");
        else                             printf("Wow64: FALSE\r\n");

        if(B.MiscFlags&ProcessDeleteOrSelfDelete) printf("Self-Delete: TRUE\r\n");
        else                                      printf("Self-Delete: FALSE\r\n");

        if(B.MiscFlags&ProcessCrossSectionCreate) printf("CrossSectionCreate: TRUE\r\n");
        else                                      printf("CrossSectionCreate: FALSE\r\n");

    }
    CloseHandle(hProcess);
    ExitProcess(1);
}