MCPcopy Index your code
hub / github.com/bytecode77/r77-rootkit / Is64BitProcess

Function Is64BitProcess

r77api/r77win.c:148–174  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

146 return FALSE;
147}
148BOOL Is64BitProcess(DWORD processId, LPBOOL is64Bit)
149{
150 BOOL result = FALSE;
151
152 if (Is64BitOperatingSystem())
153 {
154 HANDLE process = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processId);
155 if (process)
156 {
157 BOOL wow64;
158 if (IsWow64Process(process, &wow64))
159 {
160 *is64Bit = wow64 ? FALSE : TRUE;
161 result = TRUE;
162 }
163
164 CloseHandle(process);
165 }
166 }
167 else
168 {
169 *is64Bit = FALSE;
170 result = TRUE;
171 }
172
173 return result;
174}
175LPVOID GetFunction(LPCSTR dll, LPCSTR function)
176{
177 HMODULE module = GetModuleHandleA(dll);

Callers 3

InjectDllFunction · 0.85
HookedNtResumeThreadFunction · 0.85
GetProcessListFunction · 0.85

Calls 1

Is64BitOperatingSystemFunction · 0.85

Tested by

no test coverage detected