Process Enumeration

Method 3

The last method relies on NtQuerySystemInformation. Note that this function is part of an internal Windows library. It is partially undocumented, especially with respect to the structures returned, and usage is discouraged by Microsoft.

1
#include <windows.h>
2
#include <winternl.h>
3
#include <winnt.h>
4

5
#include <stdio.h>
6
#include <wchar.h>
7

8
#define RET_SUCCESS 0
9
#define RET_ERROR -1
10

11
int main() {
12
    ULONG retLen, sysInfoLen = 0;
13
    PSYSTEM_PROCESS_INFORMATION procInfo = {0};
14
    NTSTATUS STATUS = 0;
15

16
    NtQuerySystemInformation(SystemProcessInformation, NULL, 0, &retLen);
17
    procInfo =
18
        (PSYSTEM_PROCESS_INFORMATION)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, (SIZE_T)retLen);
19
    if (procInfo == NULL) {
20
        printf("HeapAlloc failed, error %lu\n", GetLastError());
21
        return RET_ERROR;
22
    }
23

24
    STATUS = NtQuerySystemInformation(SystemProcessInformation, procInfo, retLen, &sysInfoLen);
25
    if (STATUS != 0x0) {
26
        printf("NtQuerySystemInformation failed, error 0x%0.8lX\n", STATUS);
27
        return RET_ERROR;
28
    }
29

30
    while (procInfo->NextEntryOffset) {
31
        const UNICODE_STRING* name = &procInfo->ImageName;
32
        if (name->Buffer) {
33
            printf(
34
                "Process ID: %.*ls, Executable: %lu\n",
35
                name->MaximumLength,
36
                name->Buffer,
37
                (unsigned long)(ULONG_PTR)procInfo->UniqueProcessId
38
            );
39
            if (wcscmp(name->Buffer, L"notepad.exe") == 0) {
40
                printf("Notepad detected. Exiting\n\n");
41
                break;
42
            }
43
        }
44

45
        procInfo = (PSYSTEM_PROCESS_INFORMATION)((ULONG_PTR)procInfo + procInfo->NextEntryOffset);
46
    }
47

48
    return RET_SUCCESS;
49
}

The function signature is:

1
__kernel_entry NTSTATUS NtQuerySystemInformation(
2
  [in]            SYSTEM_INFORMATION_CLASS SystemInformationClass,
3
  [in, out]       PVOID                    SystemInformation,
4
  [in]            ULONG                    SystemInformationLength,
5
  [out, optional] PULONG                   ReturnLength
6
);

The first parameter indicates the information that is going to be returned. The type of argument needed is SYSTEM_INFORMATION_CLASS. Since the goal is to retrieve the list of processes, SystemProcessInformation is used, as described by Microsoft: “Returns an array of SYSTEM_PROCESS_INFORMATION structures, one for each process running in the system.

These structures contain information about the resource usage of each process, including the number of threads and handles used by the process, the peak page-file usage, and the number of memory pages that the process has allocated.”

The SYSTEM_INFORMATION_CLASS is partially documented in the appendix 12, however a more complete resource is appendix 13.

NtQuerySystemInformation is a function that needs to be called twice, the first time to populate the size of the information requested and store it in ReturnLength, and the second time to populate the SystemInformation argument.

Once the first call is completed, the heap can be reserved for an object of size ReturnLength. The second call will populate the memory space and the code can then loop over the list of structures.

Within the loop, it prints the usual PID and name string and stops if Notepad is detected. The last line of the loop is only used to move to the next structure, since it is a linked list where each structure is linked to the next one with an address stored in NextEntryOffset.