Posted on 2009-10-25 00:43
S.l.e!ep.￠% 阅读(249)
评论(1) 编辑 收藏 引用 所属分类:
RootKit
DWORD WINAPI GetPidByHandle(HANDLE hProcess)
{
NTSTATUS nStatus = STATUS_UNSUCCESSFUL;
DWORD dwRel = 0;
PROCESS_BASIC_INFORMATION ProcessInfo;
RtlZeroMemory(&ProcessInfo, sizeof(ProcessInfo));
nStatus = NtQueryInfomationProcess(hProcess, ProcessBasicInformation, &ProcessInfo,
sizeof(PROCESS_BASIC_INFORMATION), NULL);
if(NT_SUCCESS(nStatus))
{
dwRel= (DWORD)ProcessInfo.uUniqueProcessId;
}
return dwRel;
}
}