| 79 | } |
| 80 | |
| 81 | __forceinline auto get_peprocess(std::uint32_t pid) -> PEPROCESS |
| 82 | { |
| 83 | static const auto ps_lookup_peproc = |
| 84 | util::get_kmodule_export( |
| 85 | "ntoskrnl.exe", |
| 86 | "PsLookupProcessByProcessId"); |
| 87 | |
| 88 | PEPROCESS peproc = nullptr; |
| 89 | this->syscall<PsLookupProcessByProcessId>( |
| 90 | ps_lookup_peproc, |
| 91 | (HANDLE)pid, |
| 92 | &peproc |
| 93 | ); |
| 94 | return peproc; |
| 95 | } |
| 96 | private: |
| 97 | void locate_syscall(std::uintptr_t begin, std::uintptr_t end) const; |
| 98 | bool valid_syscall(void* syscall_addr) const; |
nothing calls this directly
no test coverage detected