flat assembler
Message board for the users of flat assembler.
![]() |
Author |
|
bzdashek
Where is your
invoke ExitProcess,0 ? |
|||
![]() |
|
Overflowz
as I said, I'm doing it just in testing case, I don't care about ExitProcess for now.
|
|||
![]() |
|
Fockyerdoder
If i remember correctly the SystemInformationLength parameter passed to NtQuerySystemInformation has to be the length needed by the function to return the entire record of all processes, u have to call it once, and use the value returned in ReturnLength parameter to create the right size buffer, and call it again with the needed buffer size.
Check the return value of NtQuereySystemInformation, and check NTStatus.h codes |
|||
![]() |
|
typedef
Where are you getting that struct from. This is what I found on MSDN:
Code: typedef struct _SYSTEM_PROCESS_INFORMATION { ULONG NextEntryOffset; BYTE Reserved1[52]; PVOID Reserved2[3]; HANDLE UniqueProcessId; PVOID Reserved3; ULONG HandleCount; BYTE Reserved4[4]; PVOID Reserved5[11]; SIZE_T PeakPagefileUsage; SIZE_T PrivatePageCount; LARGE_INTEGER Reserved6[6]; } SYSTEM_PROCESS_INFORMATION; http://msdn.microsoft.com/en-us/library/windows/desktop/ms724509%28v=vs.85%29.aspx |
|||
![]() |
|
Overflowz
I was using struct as buffer argument, my bad. I'll try to code better tomorow.
typedef http://undocumented.ntinternals.net/UserMode/Undocumented%20Functions/System%20Information/Structures/SYSTEM_PROCESS_INFORMATION.html works well in C. |
|||
![]() |
|
revolution
Also here:
Code: cinvoke printf,[sysinfo.ProcessName.Buffer] |
|||
![]() |
|
Overflowz
Thank you all, I get it working now
![]() |
|||
![]() |
|
< Last Thread | Next Thread > |
Forum Rules:
|
Copyright © 1999-2020, Tomasz Grysztar. Also on GitHub, YouTube, Twitter.
Website powered by rwasa.