Advertisement
keybode

get process id

May 14th, 2014
377
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.21 KB | None | 0 0
  1. ULONG ProcessNameOffset = 0;
  2.  
  3. void GetProcessNameOffset ( void )
  4. {
  5.     PEPROCESS PeProcess = PsGetCurrentProcess ();
  6.    
  7.     ULONG Index;
  8.  
  9.     if ( !PeProcess )
  10.     {
  11.         DbgPrint ( "ERROR! GetProcessNameOffset failed! [#1]\n" );
  12.         return;
  13.     }
  14.    
  15.     for ( Index = 0; Index < PAGE_SIZE * 3; Index++ )
  16.     {
  17.         if ( !strncmp ( "System", (PCCHAR)PeProcess + Index, strlen ( "System" ) ) )
  18.         {
  19.             ProcessNameOffset = Index;
  20.  
  21.             DbgPrint ( "ProcessNameOffset = 0x%X\n", ProcessNameOffset );
  22.  
  23.             break;
  24.         }
  25.     }
  26. }
  27.  
  28. HANDLE GetProcessId ( const char* Name )
  29. {
  30.     PEPROCESS PeProcess = PsGetCurrentProcess ();
  31.  
  32.     ULONG Index = 0;
  33.  
  34.     HANDLE ProcessId = (HANDLE)-1;
  35.  
  36.     NTSTATUS Status = STATUS_SUCCESS;
  37.  
  38.     PCHAR ProcessName = 0;
  39.  
  40.     if ( PeProcess != 0 )
  41.     {
  42.         for ( Index = 0 ; Index < PAGE_SIZE * 3; Index++ )
  43.         {
  44.             Status = PsLookupProcessByProcessId ( (HANDLE)Index, &PeProcess );
  45.  
  46.             if ( Status != STATUS_SUCCESS )
  47.                 continue;
  48.  
  49.             if ( PeProcess <= 0 )
  50.                 continue;
  51.  
  52.             ProcessName = (PCHAR)( (PUCHAR)PeProcess + ProcessNameOffset );
  53.  
  54.             if ( ProcessName )
  55.             {
  56.                 if ( !strncmp ( Name, ProcessName, strlen ( Name ) ) )
  57.                 {
  58.                     ProcessId = (HANDLE)Index;
  59.                     break;
  60.                 }
  61.             }
  62.         }
  63.     }
  64.  
  65.     return ProcessId;
  66. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement