Needing help with a NtQueryInformationProcess

[giangnguyen]

How can I use NtQueryInformationProcess? The return value is the status but how do I get the output in autoit? With DllCreateStruct? I am trying to get the PEB base address here.
 

 

[Danyfirex]

Hello. What have you done so far?

 

Saludos

[giangnguyen]

$hProcess = Run("testfile.exe")
$tag_PROCESS_BASIC_INFORMATION = "int ExitStatus;ptr PebBaseAddress;ptr AffinityMask;ptr BasePriority;ulong UniqueProcessId;ulong InheritedFromUniqueProcessId;"
    Local $SpecialStruct = DllStructCreate($tag_PROCESS_BASIC_INFORMATION)
    DllCall("ntdll.dll", "int", "NtQueryInformationProcess", "handle", $hProcess, "dword", 0, "ptr", DllStructGetPtr($SpecialStruct),  "dword", DllStructGetSize($SpecialStruct), "dword*", 0)
    $ProcessBasicInfo = DllStructGetData($SpecialStruct,2)
    $dw=DllStructCreate("ptr")
    DllCall("kernel32.dll", "int", "ReadProcessMemory", "hwnd", $ret1[0], _
                            "ptr", DllStructGetData($SpecialStruct,2)+0x10, _ ; PebBaseAddress+16 bytes <-- ptr _PROCESS_PARAMETERS
                            "ptr", DllStructGetPtr($dw), "int", 4, "ptr", 0)
    MsgBox(1,"",$ProcessBasicInfo)

But I always get 0x0000000 in the MsgBox and I don't really get how I can select which element to read

[Danyfirex]

This is the correct way for handle it.

http://www.codeproject.com/Articles/19685/Get-Process-Info-with-NtQueryInformationProcess

 

Saludos

 

[argumentum]

1 hour ago, Danyfirex said:

http://www.codeproject.com/Articles/19685/Get-Process-Info-with-NtQueryInformationProcess

Nice link, thanks.  

@giangnguyen , google like this https://www.google.com/search?q=NtQueryInformationProcess+site%3Awww.autoitscript.com and you're likely to find what you're looking for.

[giangnguyen]

Googled it and found nothing.

@Dannyfirex thanks for the link, I read it before already. I think I figured out most of the stuff, but how do you select which element from the struct to read? Using the second parameter of DllStructGetData?
 

[giangnguyen]

$tag_PROCESS_BASIC_INFORMATION = "ptr Reserved1;" & _
                                     "ptr PebBaseAddress;" & _
                                     "ptr Reserved[2];" & _
                                     "ulong UniqueProcessId;" & _
                                     "ptr Reserved3;"
    Local $SpecialStruct = DllStructCreate($tag_PROCESS_BASIC_INFORMATION)
    DllCall("ntdll.dll", "int", "NtQueryInformationProcess", "handle", $hProcess, "dword", 0, "ptr", DllStructGetPtr($SpecialStruct),  "dword", DllStructGetSize($SpecialStruct), "dword*", 0)
    $ProcessBasicInfo = DllStructGetData($SpecialStruct, "PebBaseAddress")
    MsgBox(1,"",$ProcessBasicInfo)

 

 

My code atm, always getting 0x000000. I have full access to the process.

[giangnguyen]

Getting 0 for everything, even UniqueProcessID.

[Danyfirex]

I think you're not reading my answers...

 

#include <ProcessConstants.au3>
#include <WinAPIProc.au3>
#include <WinAPISys.au3>


Global Const $sTag_PROCESS_BASIC_INFORMATION = "int ExitStatus;ptr PebBaseAddress;ptr AffinityMask;ptr BasePriority;ulong UniqueProcessId;ulong InheritedFromUniqueProcessId;"


Local $iPID = Run("Danyfirex.exe") ;Get process PID
ConsoleWrite("PID: " & $iPID & @CRLF)

Local $hProcess = _WinAPI_OpenProcess($PROCESS_ALL_ACCESS, 0, $iPID) ;Open process
ConsoleWrite("hProcess: " & $hProcess & @CRLF)

Local $tPBI = DllStructCreate($sTag_PROCESS_BASIC_INFORMATION)
Local $aRet = DllCall('ntdll.dll', 'int', 'NtQueryInformationProcess', 'handle', $hProcess, 'dword', 0, 'ptr', DllStructGetPtr($tPBI), 'ulong', DllStructGetSize($tPBI), 'ulong*', 0)

ConsoleWrite($tPBI.UniqueProcessId & @CRLF)
ConsoleWrite($tPBI.PebBaseAddress & @CRLF)


_WinAPI_CloseHandle($hProcess)

Saludos

[giangnguyen]

I am using DllStructGetData which I think works as well. 

Anyway thanks for your help, I found where things went wrong. I forgot that using ShellExecute returns the PID and not the handle to the process and forgot to open the process. Thanks guys

Staff please lock this, problem solved. Thanks guys.

Edited August 30, 2016 by giangnguyen