ufrisk / pcileech

Direct Memory Access (DMA) Attack Software
GNU Affero General Public License v3.0
4.58k stars 695 forks source link

Can't find certain proccesses in PIDList #254

Closed MrCoInSanity closed 12 months ago

MrCoInSanity commented 1 year ago

Hello, I've been trying to understand why I can't find the name of this process listed below. I tried two things: getpidfromname and I've also tried enumerating through the entire process list and printing all the names and the corresponding process IDs.

Both couldn't find the process.

Screenshot_1

Also the code I'm using to test:

DWORD dwPIDs[1024] = { 0 };
        ULONG64 cPIDs = 1024;
        ULONG64 currentPID; // Variable to store the current PID
        VMMDLL_PidList(hVMM, dwPIDs, &cPIDs);
        VMMDLL_PROCESS_INFORMATION ProcessInformation;
        SIZE_T cbProcessInformation = sizeof(VMMDLL_PROCESS_INFORMATION);
        ZeroMemory(&ProcessInformation, sizeof(VMMDLL_PROCESS_INFORMATION));
        ProcessInformation.magic = VMMDLL_PROCESS_INFORMATION_MAGIC;
        ProcessInformation.wVersion = VMMDLL_PROCESS_INFORMATION_VERSION;
        // For example, printing the PIDs for demonstration purposes
        for (ULONG64 j = 0; j < cPIDs; j++) {
            currentPID = dwPIDs[j]; // Store the current PID from dwPIDs array

            bool result = VMMDLL_ProcessGetInformation(hVMM, currentPID, &ProcessInformation, &cbProcessInformation);
            if (result) {

                std::cout << ProcessInformation.szNameLong << " Process ID = " << currentPID << std::endl;
            }
        }
MrCoInSanity commented 12 months ago

Realised I was using outdated libary.

ufrisk commented 12 months ago

Super nice to see things turned out well in the end. Thanks for letting me know.