MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / GetProcessUserName

Function GetProcessUserName

r77api/r77win.c:262–291  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

260 return result;
261}
262BOOL GetProcessUserName(HANDLE process, PWCHAR name, DWORD nameLength)
263{
264 BOOL result = FALSE;
265
266 HANDLE token;
267 if (OpenProcessToken(process, TOKEN_QUERY, &token))
268 {
269 DWORD tokenSize = 0;
270 if (!GetTokenInformation(token, TokenUser, NULL, 0, &tokenSize) && GetLastError() == ERROR_INSUFFICIENT_BUFFER)
271 {
272 PTOKEN_USER tokenUser = (PTOKEN_USER)LocalAlloc(0, tokenSize);
273 if (tokenUser)
274 {
275 if (GetTokenInformation(token, TokenUser, tokenUser, tokenSize, &tokenSize))
276 {
277 WCHAR domain[256];
278 DWORD domainLength = 256;
279 SID_NAME_USE sidType;
280 result = LookupAccountSidW(NULL, tokenUser->User.Sid, name, &nameLength, domain, &domainLength, &sidType);
281 }
282
283 LocalFree(tokenUser);
284 }
285 }
286
287 CloseHandle(token);
288 }
289
290 return result;
291}
292BOOL GetRegistryKeyName(HANDLE key, PWCHAR name, DWORD nameLength)
293{
294 BYTE buffer[1000];

Callers 1

GetProcessListFunction · 0.85

Calls

no outgoing calls

Tested by

no test coverage detected