Posted on 2009-10-25 00:43
S.l.e!ep.￠% 閱讀(259)
評論(1) 編輯 收藏 引用 所屬分類:
RootKit
DWORD WINAPI GetPidByHandle(HANDLE hProcess)
{
??? NTSTATUS nStatus = STATUS_UNSUCCESSFUL;
??? DWORD????? dwRel = 0;
??? PROCESS_BASIC_INFORMATION ProcessInfo;
??? RtlZeroMemory(&ProcessInfo, sizeof(ProcessInfo));
??? nStatus?= NtQueryInfomationProcess(hProcess, ProcessBasicInformation, &ProcessInfo,
????sizeof(PROCESS_BASIC_INFORMATION), NULL);
??? if(NT_SUCCESS(nStatus))
??? {
??????? dwRel= (DWORD)ProcessInfo.uUniqueProcessId;
??? }
?? return dwRel;
??? }
}