#include <Windows.h>
#include <stdio.h>
#include <Psapi.h>
#pragma comment(lib, "psapi.lib")
#include <varargs.h>
#define LOGON 1
#if LOGON
#define Log log
#else
#define Log //
#endif
void log(const char* format, ...)
{
char Buf[1024];
va_list vList;
va_start(vList, format);
vsprintf(Buf, format, vList);
va_end(vList);
OutputDebugString(Buf);
}
#define MAX_PROCESS 200
bool EnableDebugPrivilege() ;
void WalkAllProcess();
int main()
{
WalkAllProcess();
return 0;
}
void WalkAllProcess()
{
DWORD dwProcessIDs[MAX_PROCESS];
DWORD dwBytesReturn = 0;
EnumProcesses( dwProcessIDs
, sizeof(DWORD) * MAX_PROCESS
, &dwBytesReturn);
DWORD dwProcessCount = dwBytesReturn / sizeof(DWORD) ; //number of process
for(int nIndex = 0; nIndex < dwProcessCount; ++nIndex)
{
CHAR szProcName[MAX_PATH] = {0};
CHAR szProcPath[MAX_PATH] = {0};
HMODULE hModule[1024];
DWORD dwByteNeed;
DWORD dwModules;
//EnableDebugPrivilege();
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, dwProcessIDs[nIndex]);
if(hProcess == 0 && GetLastError)
{
SetLastError(0);
//continue;
}
SetLastError(0);
EnumProcessModules(hProcess, hModule, sizeof(hModule), &dwByteNeed);
dwModules = dwByteNeed / sizeof(DWORD);
for(int i = 0; i< dwModules; ++i)
{
GetModuleBaseName(hProcess, hModule[i], szProcName, MAX_PATH);
log("MODULE: %s\n", szProcName);
}
GetModuleBaseName(hProcess, hModule[0], szProcName, MAX_PATH);
GetModuleFileNameEx(hProcess, hModule[0], szProcPath, MAX_PATH);
log("ID: %-6d\t NAME: %-15s Path:%s\n", dwProcessIDs[nIndex]
, szProcName
,szProcPath);
}
}
bool EnableDebugPrivilege()
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
return FALSE;
}
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
{
CloseHandle(hToken);
return false;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
{
CloseHandle(hToken);
return false;
}
return true;
typedef int (* type_RtlAdjustPrivilege)(int, bool, bool, int*);
type_RtlAdjustPrivilege RtlAdjustPrivilege = (type_RtlAdjustPrivilege)GetProcAddress(::GetModuleHandle("ntdll.dll"), "RtlAdjustPrivilege");
int nOld;
RtlAdjustPrivilege(0x20, true, true, &nOld);
return true;
}