Click here to Skip to main content
15,790,267 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
I want to enumerate all of the process id running on my system by using EPROCESS structure but the problem here is, I do not know how to access to the UniqueProcessId field in EPROCESS structure. Now, I've got the pointer to EPROCESS structure by this function


and calculated the offset of UniqueProcessId field which is 0x0b4. I attempted this code "*(Process+0x0b4(UniqueProcessId offset))" to get the value of UniqueProcessId field but always it brought wrong and invalid value/data. Could anyone help me know how to access to the UniqueProcessId field? My system is Windows7/x86. Thanks in advance!

What I have tried:

Updated 1-Aug-17 3:40am

1 solution

How is PEPROCESS defined?

If you have the full structure just access the member:
PVOID UniqueProcessId = Process->UniqueProcessId;

If you know the offset and the type, cast Process to a byte or char pointer, add the offset, cast the result as pointer to the field type, and get the value:
LPBYTE pUpi = ((LPBYTE)Process) + 0xb4;
// EDIT: Added missing *
//PVOID UniqueProcessId = *((PVOID)pUpi);
PVOID UniqueProcessId = *((PVOID*)pUpi);
Share this answer
MinYoung Lee 1-Aug-17 10:59am    
It works well. Due to the lack of knowledge of 'pointer', I was struggling. Thank you so much, Jochen Arndt!!
Jochen Arndt 2-Aug-17 3:37am    
As you might have noted even I made a mistake initially.

You can also put it all into one instruction line but that makes it harder to understand:
PVOID UniqueProcessId = *((PVOID*)((LPBYTE)Process + 0xb4));

Thank you for your feedback and accepting my solution.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900