#include "xrbx/process.h" HANDLE Process::openProcess() { if (pid == 0) { return nullptr; } CLIENT_ID cid{}; cid.UniqueProcess = (HANDLE)pid; cid.UniqueThread = nullptr; OBJECT_ATTRIBUTES oa{}; oa.Length = sizeof oa; HANDLE proc; if(Nt::resolve("NtOpenProcess")(&proc, PROCESS_ALL_ACCESS, &oa, &cid) < 0) { throw std::runtime_error("Failed to open process"); } HANDLE duplicate; if(Nt::resolve("NtDuplicateObject")(GetCurrentProcess(), proc, GetCurrentProcess(), &duplicate, PROCESS_ALL_ACCESS, 0, 0) < 0) { Nt::resolve("NtClose")(proc); throw std::runtime_error("Failed to duplicate process"); } Nt::resolve("NtClose")(proc); return duplicate; } BYTE *Process::getImageBase(void) { Nt::PROCESS_BASIC_INFORMATION pbi{}; if (Nt::resolve("NtQueryInformationProcess")(proc, ProcessBasicInformation, &pbi, sizeof(pbi), nullptr) < 0) { throw std::runtime_error("Failed to get process information"); } return (BYTE *)read((BYTE *)pbi.PebBaseAddress).ImageBaseAddress; } DWORD Process::findProcessByName(const std::wstring &name) { auto NtQuerySystemInformation = Nt::resolve("NtQuerySystemInformation"); ULONG size = 0; NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &size); std::vector buffer(size); NTSTATUS status = NtQuerySystemInformation(SystemProcessInformation, buffer.data(), size, &size); if (status < 0) return 0; auto entry = reinterpret_cast(buffer.data()); while (true) { if (entry->ImageName.Buffer) { if (_wcsicmp(entry->ImageName.Buffer, name.c_str()) == 0) { return DWORD(ULONG_PTR(entry->UniqueProcessId)); } } if (entry->NextEntryOffset == 0) break; entry = reinterpret_cast( reinterpret_cast(entry) + entry->NextEntryOffset ); } return 0; }