Process ID help.

[KyleMiles]

Hello, I'm trying to get the process ID of a process... I know how to get the ID of a window, but is it not possible to get it of a process? This is for the function ReadProcessMemory() and WriteProcessMemory()... Thank you for any help that you can give!

- Kyle

[fdxuwei]

First, you call EnumPrecesses() to get all pids of running process.
Second , for each pid use OpenProcess to get the handle to the process.
Last, call GetModuleFileNameEx() to get the name of the process by the handle, if it matchs the name of your process, return the related pid。

[Clearner1]

declare like this:

PROCESS_INFORMATION M; //M is an object
M.hProcess=GetModuleHandle(L"place here the name of process you want to read")

use it in the function like this:

if(!ReadProcessMemory(M.hProcess,lpBaseAddress,lpBuffer,nsize,*lpNumberOfBytesRead))    //define the rest of parameters by yourself
{//TODO: error code
return 0;}

try this

[Clearner1]

complete example:

#include <Windows.h>
PROCESS_INFORMATION pci;STARTUPINFO sinfo;LPVOID r="403465";LPCVOID f=L"0X78";//DATA TO WRITE
int WINAPI wWinMain(HINSTANCE hInstance,HINSTANCE hPrevInstance,LPWSTR lpCmdLine,int nShowCmd)
{
if(CreateProcess(L"C:\\simple dos calculator.exe",//this is a program name
0,0,0,0,CREATE_SUSPENDED,0,0,&sinfo,&pci)!=0){
	if (!WriteProcessMemory(pci.hProcess,r,f,3,0))
		MessageBoxA(0,"no",0,0);}
else 
	MessageBoxA(0,"not working",0,0);
TerminateProcess(pci.hProcess,0);
ResumeThread(pci.hThread);return 0;}

this is better

[KyleMiles]

Thank you for your time, however, I've gotten around that: tasklist in the CMD is good enough for what I'm doing... I'll remember this though. I'm now having a different problem I need help with. It's in the access rights to read/write the data... I have read up on access tokens, and they make sense to me. However, how do you get permission to edit the tokens? I know I can launch the program as administrator and do anything I want, but I need to be able to get around this... I get system error 5 (access denied) when I OpenProcessToken() with TOKEN_ADJUST_ACCESS, but I get system error 1300 when I OpenProcessToken() with TOKEN_ALL_ACCESS... Which doesn't make sense to me! Does TOKEN_ALL_ACCESS not have COMPLETE permission to do whatever it wants to a token? Or is 1300 a more serious error message? Whatever the case, it causes system error 299 (Only part of ReadProcessMemory() or WriteProcessMemory() request was complete). So my final question is can I incrementally give myself more and more permission until I have all process?

Here is my code:

#include <windows.h>
#include <stdlib.h>
#include <iostream>
using namespace std;

//TOKEN_ALL_ACCESS
//TOKEN_ADJUST_PRIVILEGES
DWORD Reset = 0;

void enableDebugPrivileges()
{
	HANDLE cHandle = GetCurrentProcess();
	
	HANDLE tHandle;
	SetLastError(Reset);
	BOOL bret = OpenProcessToken(cHandle, TOKEN_ALL_ACCESS, &tHandle);
	cout<<"In OpenProcessToken, Error: "<<GetLastError()<<endl;
	
	LUID luid;
	SetLastError(Reset);
	bret = LookupPrivilegeValue(NULL, "SeDebugPrivilege", &luid);
	cout<<"In LookupPrivilegeValue, Error: "<<GetLastError()<<endl;
	
	TOKEN_PRIVILEGES NewState;
	TOKEN_PRIVILEGES PreviousState;
	DWORD ReturnLength;
	
	NewState.PrivilegeCount = 1;
	NewState.Privileges[0].Luid = luid;
	NewState.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	
	SetLastError(Reset);
	AdjustTokenPrivileges(tHandle, false, &NewState, 28, &PreviousState, &ReturnLength);
	cout<<"In AdjustTokenPrivileges, Error: "<<GetLastError()<<endl;
	return;
}

int main()
{
	enableDebugPrivileges();
	DWORD pid;
	HANDLE hProcess;
	LONG address = 0x1F0579C; //Only made for Minesweeper, for now...
	int output = 0;
	
	do
	{
		cout<<"PID: ";
		cin>>pid;
		
		SetLastError(Reset);
		hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
		cout<<"In OpenProcess, Error: "<<GetLastError()<<endl;
	} while (!hProcess);
	
	SetLastError(Reset);
	ReadProcessMemory(hProcess, (LPVOID)address, (LPVOID)&output, sizeof(output), NULL);
	cout<<"In ReadProcessMemory, Error: "<<GetLastError()<<endl;
	
	cout<<output<<endl;
	
	system("PAUSE");
	return 0;
}

- Kyle

[modoran]

The only way is to run your application elevated or disable UAC.

There are tricks like using a windows service to do the job for you, but that requires administrator privileges to install it for the first time.

You then communicate with the service using some sort of IPC, like named pipes or shared memory.

[KyleMiles]

And what would those tricks at installation be?

- Kyle

[modoran]

To install a windows service ? There is no trick - just do it from your application unstaller - it requires administrator privileges anyway and the user must accept it.

It is just after that you will not nned any UAC prompts to do administrative tasks like ReadProcessMemory.

Btw, it is this a malware application ? It looks that way .........