#include <windows.h>
#include <winternl.h>
#include <stdio.h>
typedef DWORD (__stdcall *ptrNtQueryInformationProcess)(HANDLE, PROCESSINFOCLASS, PVOID, ULONG, PULONG);
static DWORD getProcessPid(char* procName)
{
//todo
return 0xD60;
}
int main()
{
HANDLE h;
DWORD len, pid;
SIZE_T tmp;
PUNICODE_STRING pus;
PPROCESS_BASIC_INFORMATION pbi;
PRTL_USER_PROCESS_PARAMETERS upp;
ptrNtQueryInformationProcess NtQueryInformationProcess;
PPEB peb;
unsigned char buf[0x400];
if((pid = getProcessPid("notepad.exe")))
{
if((h = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_TERMINATE, FALSE, pid)))
{
tmp = sizeof(buf);
NtQueryInformationProcess = (ptrNtQueryInformationProcess)GetProcAddress(GetModuleHandle("ntdll"), "NtQueryInformationProcess");
NtQueryInformationProcess(h, ProcessBasicInformation, buf, sizeof(PROCESS_BASIC_INFORMATION), &len);
tmp = sizeof(buf);
pbi = (PPROCESS_BASIC_INFORMATION)buf;
ReadProcessMemory(h, pbi->PebBaseAddress, buf, sizeof(PEB), &tmp);
tmp = sizeof(buf);
peb = (PPEB)buf;
ReadProcessMemory(h, peb->ProcessParameters, buf, sizeof(RTL_USER_PROCESS_PARAMETERS), &tmp);
tmp = sizeof(buf);
upp = (PRTL_USER_PROCESS_PARAMETERS)buf;
ReadProcessMemory(h, upp->ImagePathName.Buffer, buf, upp->ImagePathName.MaximumLength, &tmp);
printf("%ls\n", buf);
tmp = sizeof(buf);
ReadProcessMemory(h, upp->CommandLine.Buffer, buf, upp->CommandLine.MaximumLength, &tmp);
printf("%ls\n", buf);
}
}
return 0;
}
|
Кто-нибудь может объяснить разницу в реализации Common Controls 6.0 в WinXP и Win 7/8/10? 
