Process Enumeration

Method 2

The second method uses the EnumProcesses, OpenProcess and EnumProcessModules functions. The idea here is to gather all the process IDs that are currently running in the system, store them in PID, and open each process to get the information for that ID. This is a more effective approach since, by accessing the process, it is already clear that there is access to it. This assumption is not true for the previous method, since CreateToolhelp32Snapshot gathers all admin and non-admin processes without any distinction.

1
#include <windows.h>
2
#include <psapi.h>
3
#include <stdio.h>
4

5
#define RET_SUCCESS 0
6
#define RET_ERROR -1
7

8
int main() {
9
    DWORD PID[1024], cbNeeded, cbNeeded2, processCount;
10
    if (EnumProcesses(PID, sizeof(PID), &cbNeeded) == 0) {
11
        printf("cannot execute EnumProcess, error: %lu\n", GetLastError());
12
        return RET_ERROR;
13
    }
14

15
    processCount = cbNeeded / sizeof(DWORD);
16

17
    HANDLE hProcess = NULL;
18
    for (int i = 0; i < processCount; i++) {
19
        hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, PID[i]);
20
        if (hProcess == NULL) {
21
            continue;
22
        }
23
        HMODULE hModule = NULL;
24
        EnumProcessModules(hProcess, &hModule, sizeof(HMODULE), &cbNeeded2);
25
        if (hModule == NULL) {
26
            CloseHandle(hProcess);
27
            continue;
28
        }
29

30
        char baseName[MAX_PATH] = {0};
31
        if (GetModuleBaseNameA(hProcess, hModule, baseName, sizeof(baseName) / sizeof(CHAR)) == 0) {
32
            CloseHandle(hProcess);
33
            continue;
34
        }
35

36
        printf("Process ID: %lu, Executable: %s\n", PID[i], baseName);
37
        if (strcmp(baseName, "notepad.exe") == 0) {
38
            printf("Notepad detected. Exiting\n\n");
39
            break;
40
        }
41
        CloseHandle(hProcess);
42
    }
43

44
    CloseHandle(hProcess);
45
    return RET_SUCCESS;
46
}

Looking at the function definition:

1
BOOL EnumProcesses(
2
  [out] DWORD   *lpidProcess,
3
  [in]  DWORD   cb,
4
  [out] LPDWORD lpcbNeeded
5
);

There are two output variables: lpidProcess, which is a pointer to DWORD that will contain the list of process IDs currently running, and lpcbNeeded, which is the number of bytes in the lpidProcess array. The oddity about lpidProcess is that it needs to be “big enough” for all the PIDs, without knowing in advance how many there will be. So the Microsoft documentation says: “It is a good idea to use a large array, because it is hard to predict how many processes there will be at the time you call EnumProcesses.”

lpcbNeeded is useful to calculate the number of processes, as the documentation suggests: “To determine how many processes were enumerated, divide the lpcbNeeded value by sizeof(DWORD).” This is done at line 15.

Once the number of processes has been determined, the code iterates over each of them to gather more information, specifically the name. Using OpenProcess, the code sets the desired access to both PROCESS_QUERY_INFORMATION and PROCESS_VM_READ. Why these permissions? They are defined in a Microsoft article linked in the appendix 9.

The second parameter checks if the handle needs to be inherited by the process. Since there is no need to use the handle in any of the child processes of the current process, it can be set to 0. Lastly, the process ID to open is provided.

1
HANDLE OpenProcess(
2
  [in] DWORD dwDesiredAccess,
3
  [in] BOOL  bInheritHandle,
4
  [in] DWORD dwProcessId
5
);

The last step is to get the name of the process. To do so, the code first gets all the modules (a module is an executable or DLL loaded in the process 10) and then extracts the name. With EnumProcessModules it gets the handle needed by GetModuleBaseName.

1
BOOL EnumProcessModules(
2
  [in]  HANDLE  hProcess,
3
  [out] HMODULE *lphModule,
4
  [in]  DWORD   cb,
5
  [out] LPDWORD lpcbNeeded
6
);

In this function, the cb is again the size of what is being requested, in this case the HMODULE type, since the goal is to retrieve an HMODULE object, whose pointer is passed as the second argument. In this case lpcbNeeded is not used, however it must still be passed to the function.

Once there is a handle to the process and a handle to the module for that process, the code can then get the name.

1
DWORD GetModuleBaseNameA(
2
  [in]           HANDLE  hProcess,
3
  [in, optional] HMODULE hModule,
4
  [out]          LPSTR   lpBaseName,
5
  [in]           DWORD   nSize
6
);

The name of the module will be stored in lpBaseName, which is a string. Since the size of the name cannot be known in advance, it is necessary to set a high enough value. Windows provides the MAX_PATH macro, which defines the string as a maximum of 260 characters 11.

Once all the information has been collected, the code searches for the process of interest, in this case, notepad.exe. Similarly to the previous example, the output shows the relationship between PID and process name, and the executable stops if Notepad is running.