inline NTSTATUS PsGetProcess(__in const char* lpwstrProcessName, __out PEPROCESS* pPeProcess)
{
const uintptr_t pInitialSystemProcess = reinterpret_cast<uintptr_t>(PsInitialSystemProcess);
auto pListCurrent = reinterpret_cast<uintptr_t*>(pInitialSystemProcess + 0x448 /*ActiveProcessLinks*/);
do {
const uintptr_t pListEntry = reinterpret_cast<uintptr_t>(pListCurrent);
if (!_strcmpi(lpwstrProcessName, reinterpret_cast<char*>(pListEntry + 0x5a8 /*ImageFileName*/))) {
*pPeProcess = reinterpret_cast<PEPROCESS>(pListEntry);
return STATUS_SUCCESS;
}
pListCurrent = reinterpret_cast<uintptr_t*>(*pListCurrent);
} while (pListCurrent != reinterpret_cast<uintptr_t*>(pInitialSystemProcess + 0x448 /*ActiveProcessLinks*/));
return STATUS_UNSUCCESSFUL;
}```
#Is this shitcode?
12 messages · Page 1 of 1 (latest)