Skip to content

Instantly share code, notes, and snippets.

@blaquee

blaquee/processlist.cpp

Created May 20, 2020 16:23
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save blaquee/c13cae04d427e70fabe6e0e8aef475b4 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save blaquee/c13cae04d427e70fabe6e0e8aef475b4 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. blaquee created this gist May 20, 2020.
    26 changes: 26 additions & 0 deletions processlist.cpp
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,26 @@
    HANDLE curHandle = nullptr;
    NTSTATUS status;
    ULONG dwLen = 0;
    UNICODE_STRING strProcNameBuffer = { 0 };
    PUNICODE_STRING ucBuffer = nullptr;
    //enumerate next processes, use flag 1 to enumerate the processlist backwards
    while (NtGetNextProcess(curHandle, MAXIMUM_ALLOWED, 0, 0, &curHandle) == STATUS_SUCCESS)
    {

    status = NtQueryInformationProcess(curHandle, ProcessImageFileName, 0, 0, &dwLen);
    if (status != STATUS_INFO_LENGTH_MISMATCH)
    break;

    if (dwLen)
    {
    ucBuffer = (PUNICODE_STRING)malloc(dwLen);
    if (ucBuffer)
    {
    status = NtQueryInformationProcess(curHandle, ProcessImageFileName, ucBuffer, dwLen, &dwLen);
    printf("procname len: %d\n", ucBuffer->Length);
    printf("Process Name: %wZ\n", ucBuffer);
    }
    }
    if(ucBuffer)
    free(ucBuffer);
    }