| 1143 | } |
| 1144 | } |
| 1145 | static BOOL GetIsHiddenFromPdhString(LPCWSTR str) |
| 1146 | { |
| 1147 | // Parses a process ID from this type of string: |
| 1148 | // "pid_1234_luid_0x00000000_0x0000C9DE_phys_0_eng_0_engtype_3D" |
| 1149 | // ... and determines whether the PID is hidden |
| 1150 | |
| 1151 | DWORD processId = GetProcessIdFromPdhString(str); |
| 1152 | if (processId) |
| 1153 | { |
| 1154 | BOOL hidden = FALSE; |
| 1155 | |
| 1156 | if (IsProcessIdHidden(processId)) |
| 1157 | { |
| 1158 | return TRUE; |
| 1159 | } |
| 1160 | else |
| 1161 | { |
| 1162 | WCHAR processName[MAX_PATH + 1]; |
| 1163 | if (GetProcessFileName(processId, processName, MAX_PATH)) |
| 1164 | { |
| 1165 | if (HasPrefix(processName) || IsProcessNameHidden(processName)) |
| 1166 | { |
| 1167 | return TRUE; |
| 1168 | } |
| 1169 | } |
| 1170 | } |
| 1171 | } |
| 1172 | |
| 1173 | return FALSE; |
| 1174 | } |
| 1175 | static DWORD GetProcessIdFromPdhString(LPCWSTR str) |
| 1176 | { |
| 1177 | // Parses a process ID from this type of string: |
no test coverage detected