| 178 | } |
| 179 | |
| 180 | BOOL FindProcessPID(LPCWSTR processName, DWORD* pid, HANDLE* hProcess, AppMode mode) |
| 181 | { |
| 182 | HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); |
| 183 | if (hProcessSnap == INVALID_HANDLE_VALUE) |
| 184 | { |
| 185 | PRINT("Create SnapShot Failed!\n"); |
| 186 | return FALSE; |
| 187 | } |
| 188 | |
| 189 | PROCESSENTRY32 pe32; |
| 190 | pe32.dwSize = sizeof(PROCESSENTRY32); |
| 191 | |
| 192 | if (!Process32First(hProcessSnap, &pe32)) |
| 193 | { |
| 194 | PRINT("GET First Process Failed!\n"); |
| 195 | CloseHandle(hProcessSnap); |
| 196 | return FALSE; |
| 197 | } |
| 198 | const WCHAR* flags = TEXT("--utility-sub-type=network.mojom.NetworkService"); |
| 199 | if (processName == L"ToDesk.exe") { |
| 200 | flags = TEXT("--localPort"); |
| 201 | } |
| 202 | |
| 203 | do { |
| 204 | if (wcscmp(pe32.szExeFile, processName) == 0) { |
| 205 | PEB peb = { 0 }; |
| 206 | HANDLE hHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pe32.th32ProcessID); |
| 207 | if (ReadRemoteProcessPEB(hHandle, &peb)) |
| 208 | { |
| 209 | WCHAR* commandLine{ 0 }; |
| 210 | if (ReadPEBProcessParameters(hHandle, &peb, &commandLine) && commandLine != 0) |
| 211 | { |
| 212 | if (processName == L"chrome.exe" || (processName == L"msedge.exe" && mode != Pass) || processName == L"ToDesk.exe") { |
| 213 | if (wcsstr(commandLine, flags) != 0) { |
| 214 | PRINT("[+] Fund AppLication process: %d\n", pe32.th32ProcessID); |
| 215 | PRINT(" Process owner: "); |
| 216 | GetTokenUser(hHandle); |
| 217 | PRINTW(L"\n\n"); |
| 218 | |
| 219 | *pid = pe32.th32ProcessID; |
| 220 | *hProcess = hHandle; |
| 221 | free(commandLine); |
| 222 | CloseHandle(hProcessSnap); |
| 223 | return TRUE; |
| 224 | } |
| 225 | } |
| 226 | else |
| 227 | { |
| 228 | PRINT("[+] Fund AppLication process: %d\n", pe32.th32ProcessID); |
| 229 | PRINT(" Process owner: "); |
| 230 | GetTokenUser(hHandle); |
| 231 | PRINTW(L"\n\n"); |
| 232 | |
| 233 | *pid = pe32.th32ProcessID; |
| 234 | *hProcess = hHandle; |
| 235 | free(commandLine); |
| 236 | CloseHandle(hProcessSnap); |
| 237 |
no test coverage detected