| 80 | public: |
| 81 | |
| 82 | Process(__in const unsigned int nProgramSections) //we manually set number of program sections in order to spoof it at runtime to 0 or 1, and not have the program be confused |
| 83 | { |
| 84 | _PEB = new _MYPEB(); |
| 85 | |
| 86 | if (!FillModuleList()) |
| 87 | { |
| 88 | Logger::logf(Err, "Unable to traverse loaded modules @ ::Process() .\n"); |
| 89 | } |
| 90 | |
| 91 | DWORD parentPid = GetParentProcessId(); |
| 92 | |
| 93 | if (parentPid != 0) |
| 94 | { |
| 95 | SetParentName(GetProcessName(parentPid)); |
| 96 | SetParentId(parentPid); |
| 97 | } |
| 98 | else |
| 99 | { |
| 100 | Logger::logf(Warning, "Could not fetch parent process ID"); |
| 101 | } |
| 102 | |
| 103 | Process::SetNumSections(nProgramSections); //save original # of program sections so that we can modify NumberOfSections in the NT headers and still achieve program functionality |
| 104 | } |
| 105 | |
| 106 | ~Process() |
| 107 | { |
nothing calls this directly
no outgoing calls
no test coverage detected