Enumerating process id in kernel mode with EPROCESS structure

Question

0.00/5 (No votes)

See more:

I want to enumerate all of the process id running on my system by using EPROCESS structure but the problem here is, I do not know how to access to the UniqueProcessId field in EPROCESS structure. Now, I've got the pointer to EPROCESS structure by this function

PEPROCESS Process;
PsLookupProcessByProcessId(_ProcessID,&Process);

and calculated the offset of UniqueProcessId field which is 0x0b4. I attempted this code "*(Process+0x0b4(UniqueProcessId offset))" to get the value of UniqueProcessId field but always it brought wrong and invalid value/data. Could anyone help me know how to access to the UniqueProcessId field? My system is Windows7/x86. Thanks in advance!

What I have tried:

-------------------------------------------------------------------------

Posted 1-Aug-17 1:42am

MinYoung Lee

Updated 1-Aug-17 2:40am

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Jochen Arndt · Accepted Answer · 2017-08-01T02:40:00

Solution 1

How is PEPROCESS defined?

If you have the full structure just access the member:

C++

PVOID UniqueProcessId = Process->UniqueProcessId;

If you know the offset and the type, cast Process to a byte or char pointer, add the offset, cast the result as pointer to the field type, and get the value:

C++

LPBYTE pUpi = ((LPBYTE)Process) + 0xb4;
// EDIT: Added missing *
//PVOID UniqueProcessId = *((PVOID)pUpi);
PVOID UniqueProcessId = *((PVOID*)pUpi);

Posted 1-Aug-17 2:40am

Jochen Arndt

Updated 1-Aug-17 2:48am

v3

Comments

MinYoung Lee 1-Aug-17 10:59am

It works well. Due to the lack of knowledge of 'pointer', I was struggling. Thank you so much, Jochen Arndt!!

Jochen Arndt 2-Aug-17 3:37am

As you might have noted even I made a mistake initially.

You can also put it all into one instruction line but that makes it harder to understand:
PVOID UniqueProcessId = *((PVOID*)((LPBYTE)Process + 0xb4));

Thank you for your feedback and accepting my solution.