Process Enumeration

Method 1

The following code illustrates how the combination of CreateToolhelp32Snapshot, Process32First and Process32Next can be used to enumerate the active processes running in the system.

This method is quick and easy to implement; however, it is not very stealthy and is easy to analyze.

1
#include <windows.h>
2
#include <tlhelp32.h>
3

4
#include <stdio.h>
5
#include <string.h>
6

7
#define RET_SUCCESS 0
8
#define RET_ERROR -1
9

10
int main() {
11
    HANDLE hSnapshot = NULL;
12

13
    hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
14
    if (hSnapshot == INVALID_HANDLE_VALUE) {
15
        printf("cannot get handle from CreateToolhelp32Snapshot, error: %lu\n", GetLastError());
16
        return RET_ERROR;
17
    }
18

19
    PROCESSENTRY32 process_s = {.dwSize = sizeof(PROCESSENTRY32)};
20
    if (Process32First(hSnapshot, &process_s) == FALSE) {
21
        printf("cannot get process from Process32First, error: %lu", GetLastError());
22
        CloseHandle(hSnapshot);
23
        return RET_ERROR;
24
    }
25

26
    do {
27

28
        printf("Process ID: %lu, Executable: %s\n", process_s.th32ProcessID, process_s.szExeFile);
29
        if (strcmp(process_s.szExeFile, "notepad.exe") == 0) {
30
            printf("Notepad detected. Exiting\n\n");
31
            break;
32
        }
33

34
    } while (Process32Next(hSnapshot, &process_s));
35

36
    CloseHandle(hSnapshot);
37
    return RET_SUCCESS;
38
}

The first function, windows.CreateToolhelp32Snapshot, is called with the arguments 2 and 0. Based on the Microsoft documentation, this is the signature of the function:

1
HANDLE CreateToolhelp32Snapshot(
2
  [in] DWORD dwFlags,
3
  [in] DWORD th32ProcessID
4
);

The first value, dwFlags, indicates which portions of the system to include in the snapshot. Here 2 is equal to TH32CS_SNAPPROCESS, which means, quoting the documentation: “Includes all processes in the system in the snapshot. To enumerate the processes, see Process32First.”

The second value, th32ProcessID, indicates which process to take a snapshot of. However, since with dwFlags the snapshot is requested for all the processes, the th32ProcessID argument is ignored, and 0 is passed.

The return value is a handle to the snapshot if successful.

After the execution of this call, the result is a snapshot of the system’s running processes at the moment of the snapshot. To start iterating over the processes, the code calls Process32First, which starts the “cursor” over the list of processes, and continues the iteration by calling Process32Next.

Both Process32First and Process32Next have the same signature:

1
BOOL Process32First(
2
  [in]      HANDLE           hSnapshot,
3
  [in, out] LPPROCESSENTRY32 lppe
4
);

The first parameter is the snapshot and the second is a structure containing information about a single process. In the first iteration, the structure is empty and gets filled in when Process32First and Process32Next are called.

The code then prints the names of the processes and checks them. As an example, it checks if notepad.exe is open. If it is, a message is printed: Notepad detected. Exiting, otherwise no such message appears.

After executing the binary derived from the compilation of the above code, the output will be similar to the following:

1
Process ID: 5768, Executable: svchost.exe
2
Process ID: 6992, Executable: dllhost.exe
3
Process ID: 7276, Executable: svchost.exe
4
Process ID: 7432, Executable: cmd.exe
5
Process ID: 7440, Executable: conhost.exe
6
Process ID: 7680, Executable: myapp.exe

If Notepad is open, the executable recognizes it and stops as soon as it is found:

1
Process ID: 7276, Executable: svchost.exe
2
Process ID: 7432, Executable: cmd.exe
3
Process ID: 7440, Executable: conhost.exe
4
Process ID: 7844, Executable: notepad.exe
5
Notepad detected. Exiting