From db0da50216dfe3603227319dfb9089ec9bb7865a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E6=B8=9F=E9=9B=B2?= Date: Wed, 14 May 2025 01:15:38 +0800 Subject: [PATCH] use native api instead of standard winapi to OpenProcess --- memory-external/memory/memory.cpp | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/memory-external/memory/memory.cpp b/memory-external/memory/memory.cpp index 97eed5e..ba2c183 100644 --- a/memory-external/memory/memory.cpp +++ b/memory-external/memory/memory.cpp @@ -58,7 +58,20 @@ HWND pProcess::GetWindowHandleFromProcessId(DWORD ProcessId) { return NULL; // No main window found for the given process ID } -bool pProcess::AttachProcess(const char* ProcessName) +HANDLE OpenProcessNt(DWORD dwDesiredAccess, BOOL bInheritHandle, + DWORD dwProcessId) { + // At last is same with "OpenProcess", but we call NativeAPI instead of WindowsAPI directly. + HANDLE hProcess = 0; + _NtOpenProcess NtOpenProcess = (_NtOpenProcess)GetProcAddress( + GetModuleHandleA("ntdll.dll"), "NtOpenProcess"); + CLIENT_ID clientId = {(HANDLE)dwProcessId, NULL}; + OBJECT_ATTRIBUTES objAttr = hj::InitObjectAttributes(NULL, 0, NULL, NULL); + NtOpenProcess(&hProcess, dwDesiredAccess, + &objAttr, &clientId); + return hProcess; +} + + bool pProcess::AttachProcess(const char* ProcessName) { this->pid_ = this->FindProcessIdByProcessName(ProcessName); @@ -68,7 +81,7 @@ bool pProcess::AttachProcess(const char* ProcessName) MODULEINFO module_info; DWORD _; - handle_ = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid_); + handle_ = OpenProcessNt(PROCESS_ALL_ACCESS, FALSE, pid_); EnumProcessModulesEx(this->handle_, modules, sizeof(modules), &_, LIST_MODULES_64BIT); base_client_.base = (uintptr_t)modules[0];