g
lazarus / 67-Windows

----------------------------------------------------------------------
mcland · 2017-10-09 10:02

No

----------------------------------------------------------------------
Thaddy · 2017-10-09 10:05

For your own process it is simply:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i program
program1;begin  writeln(paramstr(0));  // paramstr(0) contains the
full path x-platform.  end.
For other processes it is way more complex
- They may be hidden
- They may be symlinked
- They maybe only exist in memory, so you need the launching
application.

What do you exactly want? It is more a hackers technique than useful
in a normal context.

----------------------------------------------------------------------
marcov · 2017-10-09 10:09

Note that "ExtractFileName" strips the path, so maybe your way shows
the path too, but you strip it before writeln()ing.

----------------------------------------------------------------------
balazsszekely · 2017-10-09 11:24

Try something like this:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i uses
JwaPsApi; function GetProcessFileName(PID : DWORD) : string;var 
Handle : THandle;begin   Result := '-';   Handle :=
OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False,
PID);   if Handle <> 0 then    try      SetLength(Result, MAX_PATH); 
   if GetModuleFileNameEx(Handle, 0, Pchar(Result), MAX_PATH) > 0
then      begin         SetLength(Result, StrLen(PChar(Result)));    
   if not FileExists(Result) then           Result := '-';      end  
  else        Result := '-';    finally      CloseHandle(Handle);   
end;end; //....Writeln(GetProcessFileName(pe.th32ProcessID));
To open a process you need elevated privileges, so for some processes
might not work.

----------------------------------------------------------------------
Thaddy · 2017-10-09 13:39

Quote from: mcland on October 09, 2017, 03:26:47 pmthere is no way to
do with windows api as Process32First?
with taskmanager you can see the full path of a process and there is
no need to be administrator...
That's because they are in-memory processes: you will need to do more
to see from where a process is launched.
Why do you really need it?


As usual you can find those things on http://www.delphibasics.info/
btw.
The best source available for anyone dabbling with hacker things in
Object Pascal....
You will find it is full of useful snippets for the idiots, malware
writers and "system protectors".

Why do you need such techniques?

It would also help if you are able to translate C code into Object
Pascal and examine anything sysinternals...

----------------------------------------------------------------------
balazsszekely · 2017-10-09 16:15

@mcland
Quotei'm building my own antivirus for my company.
OMG this is a good one! Thaddy will help you with this project. 
Now seriously listing processes won't help you detecting
viruses/trojans/rootkits. A malware can take many form, it can be a
driver, a dll injected in another process, a hijecked dll, exe
injected inside another exe(PE injection) etc. By the way that Aphex
code won't work with vista+, since services are isolate in session0.
The only method which will work with services is a WMI query, using
win32_process(https://msdn.microsoft.com/en-
us/library/windows/desktop/aa394372(v=VS.85).aspx). AFAIK the same
method is used by Process Explorer, Process Hacker etc...

----------------------------------------------------------------------
Thaddy · 2017-10-09 17:32

Quote from: GetMem on October 09, 2017, 06:15:25 pmOMG this is a good
one! Thaddy will help you with this project. 
Well, can't hurt too much if he can't find the sourcecode on the
website I pointed him to anyway... Can it? And these techniques are
all covered nowadays... 

(For noobs and scriptkiddies, I forgot those two...the sourcecode is
there....)

----------------------------------------------------------------------
Remy Lebeau · 2017-10-09 19:15

Quote from: GetMem on October 09, 2017, 01:24:04 pmTry something like
this:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i    Handle
:= OpenProcess(PROCESS_QUERY_INFORMATION or PROCESS_VM_READ, False,
PID);   ...   if GetModuleFileNameEx(Handle, 0, Pchar(Result),
MAX_PATH) > 0 then 
To open a process you need elevated privileges, so for some processes
might not work.

You should be using GetProcessImageFileName() or
QueryFullProcessImageName() instead.  Even the documentation for
GetModuleFileNameEx() says so:

QuoteTo retrieve the name of the main executable module for a remote
process, use the GetProcessImageFileName or QueryFullProcessImageName
function. This is more efficient and more reliable than calling the
GetModuleFileNameEx function with a NULL module handle.

The upside is that they both work with
PROCESS_QUERY_LIMITED_INFORMATION access, and do not require
PROCESS_VM_READ access, so a non-elevated process can get the
path+filename of an external process.

----------------------------------------------------------------------
RAW · 2017-10-09 19:38

My recommendation...

----------------------------------------------------------------------
Remy Lebeau · 2017-10-10 18:49

Quote from: mcland on October 10, 2017, 01:15:40 pmCode: [Select]    
s2 := OpenProcess(PROCESS_QUERY_INFORMATION, False, PID);
      GetModuleFileName(s2, path, sizeof(path));
You can't use GetModuleFileName() to query the filename of a module
that is outside of your own process.  The first parameter is a module
handle relative to your own process, but you are passing it a process
handle instead.  You must use GetModuleFileNameEx() (or
GetProcessImageFileName() or QueryFullProcessImageName()) to query the
filename of a module in another process.

Quote from: mcland on October 10, 2017, 01:15:40 pmif change
GetModuleFileName for GetModuleFileNameEx then the first letter of the
path is unreadable (and the path is always the same)

Then you are using it wrong.

----------------------------------------------------------------------
Remy Lebeau · 2017-10-10 19:13

Quote from: mcland on October 10, 2017, 11:09:23 amSorry, i don't know
how to use this part of the windows api.

There are plenty of online examples readily available.  You are just
guessing instead of actually researching.

Quote from: mcland on October 10, 2017, 11:09:23 amThis code only
prints process name

That is because 1) you are using ExtractFileName() to strip off any
possible path information, and 2) pe.szExeFile doesn't contain path
information to begin with.  Even the documentation says so:

QuoteszExeFile

The name of the executable file for the process. To retrieve the full
path to the executable file, call the Module32First function and check
the szExePath member of the MODULEENTRY32 structure that is returned.
However, if the calling process is a 32-bit process, you must call the
QueryFullProcessImageName function to retrieve the full path of the
executable file for a 64-bit process.

Try something more like this instead:

Code: [Select]program myprocess;

uses
  crt, sysutils, dos, jwatlhelp32, windows, process, JwaWindows;

var
  S, proc: HANDLE;
  PE: TProcessEntry32;
  buffer: array[0..MAX_PATH-1] of Char;
  OK: Boolean;
  size: DWORD;
begin
  S := CreateToolHelp32Snapshot(TH32CS_SNAPPROCESS, 0); // Create
snapshot
  if S = INVALID_HANDLE_VALUE then
  begin
    // handle error as needed...
  end else
  try
    PE.dwSize := SizeOf(PE); // Set size before use
    OK := Process32First(S, PE);
    while OK do
    begin
      writeln('proceso: ', PE.szExeFile);
      proc := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False,
PE.th32ProcessID);
      if proc = 0 then
      begin
        // handle error as needed...
      end else
      try
        size := MAX_PATH;
        if not QueryFullProcessImageName(proc, 0, buffer, @size) then
        begin
          // handle error as needed...
        end else
          writeln('path: ', buffer);
      finally
        CloseHandle(proc);
      end;
      readkey;
      OK := Process32Next(S, PE);
    end;
    if GetLastError() <>  ERROR_NO_MORE_FILES then
    begin
      // handle error as needed...
    end;
  finally
    CloseHandle(S);
  end;
end.

----------------------------------------------------------------------
balazsszekely · 2017-10-10 19:52

@Remy Lebeau

QuoteYou should be using GetProcessImageFileName() or
QueryFullProcessImageName() instead.  Even the documentation for
GetModuleFileNameEx() says so:Thanks.

I did not find PROCESS_QUERY_LIMITED_INFORMATION declared in FPC. The
same is true for QueryFullProcessImageName, so I modified the code a
little bit. It works fine now with Lazarus trunk/FPC 3.0.2:
Code: Pascal  [Select][+][-]window.onload = function(){var x1 =
document.getElementById("main_content_section"); if (x1) { var x =
document.getElementsByClassName("geshi");for (var i = 0; i {$mode
objfpc}{$H+} uses  {$IFDEF UNIX}{$IFDEF UseCThreads}  cthreads, 
{$ENDIF}{$ENDIF}  Classes,  JwaWindows;  const 
PROCESS_QUERY_LIMITED_INFORMATION = $1000; var  S, proc: HANDLE;  PE:
TProcessEntry32;  us: UnicodeString;  OK: Boolean;  size: DWORD;  
function QueryFullProcessImageName(hProcess:HANDLE; dwFlags: DWord;
lpExeName:LPWSTR;    var lpdwSize:DWORD):BOOL; stdcall; external
'kernel32' name 'QueryFullProcessImageNameW'; begin  S :=
CreateToolHelp32Snapshot(TH32CS_SNAPPROCESS, 0); // Create snapshot 
if S = INVALID_HANDLE_VALUE then  begin    // handle error as
needed...  end else  try    PE.dwSize := SizeOf(PE); // Set size
before use    OK := Process32First(S, PE);    while OK do    begin   
 writeln('Image name: ', PE.szExeFile);      proc :=
OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False,
PE.th32ProcessID);      if proc = 0 then      begin        // handle
error as needed...        writeln('Image path: -');      end else    
try        size := MAX_PATH;        SetLength(us, size);        if not
QueryFullProcessImageName(proc, 0, @us[1], size) then        begin   
     // handle error as needed...          writeln('Image path: -'); 
     end else        begin          SetLength(us, size);         
writeln('Image path: ', us);        end;      finally       
CloseHandle(proc);      end;      Readln;      OK := Process32Next(S,
PE);    end;    if GetLastError() <>  ERROR_NO_MORE_FILES then   
begin      // handle error as needed...    end;  finally   
CloseHandle(S);  end;end.

----------------------------------------------------------------------
ASerge · 2017-10-10 23:11

The same with the discussion : Get list of process