So ... I need peg through the "Notepad.xa" process, how can someone make it?
I was trying with the "GetModuleHandle" API, but ... gives me an indicator (every time I give zero) because I have to call the process of that module.
For this reason, I want to know how to get it with "Enpropysted Modules" or "Create Touleau 2 2 Snapshot".
If anyone knows, please tell me, thank you in advance!
Matt Peterkac told how to do this. How to achieve this environmental variable of another process, where the first stage is to get the PEB an indicator. To do this, they say, call it To call fills the structure of PROCESS_BASIC_INFORMATION which contains the base address of the PEB structure. (You will need to use
ReadProcessMemory to read, because the address will be in the context of the address of the external process address, not yours.)
NtQueryInformationProcess , you will need to handle the process if you have started the process yourself (by calling
CreateProcess ), you already have the handle, otherwise you will need to enter the process ID And then call
OpenProcess . To get the process ID, search for the process you want to do with
EnumProcesses or
Process32First /
Process32 Next . (I like later because it provides more information with less work.)
Comments
Post a Comment