Two methods for obtaining the explorer process ID

Obtain
Explorer

Process
ID

Two Methods

Processes
ID

Use
OpenProcess

Function obtaining handle

 

1.



By using the desktop class and name

. Data?

Szw.topclass
DB
'Signature', 0
;

Desktop window

Szw.topwindow
DB
'Program Manager', 0
;

Desktop window name

Dwprocessid
Dd
?
;

Save Process
ID

Dwthreadid
Dd
?
;

Save thread
ID

. Code

Invoke
Findwindow, ADDR sz1_topclass, ADDR sz1_topwindow
;

Obtain the desktop window handle

Invoke
Getwindowthreadprocessid, eax, offset dwprocessid
;

Obtain Process
ID

MoV

Dwthreadid, eax
;

Thread
ID

2.



Process snapshot method, compare executable file names

. Data?

Szexplorer
DB
'Explorer. EXE ', 0
;

Executable File Name

Dwexplorerid
Dd
?
;

Retained
Explorer

Process
ID

. Code

_ Proctest
Proc

Local
@ Stprocess: processentry32
;

Information about each process

Local
@ Hsnapshot
;

Snapshot handle

Pushad

Invoke
Rtlzeromemory, ADDR @ stprocess, sizeof @ stprocess
; 0

Initialize Process Structure

MoV
@ Stprocess. dwsize, sizeof @ stprocess
;

Manually enter

Structure Size

Invoke
Createconlhelp32snapshot, th32cs_snapprocess, 0
;

Obtain process snapshots

MoV
@ Hsnapshot, eax
;

Snapshot handle

Invoke
Process32first, @ hsnapshot, ADDR @ stprocess
;

First Process

. While
Eax

Invoke
Lstrcmp, ADDR @ stprocess. szexefile, ADDR szexplorer;

Compare file names

. If
Eax = 0
;

Is
0

, Indicating that the process name is the same

MoV eax, @ stprocess. th32processid

MoV dwexplorerid, eax

. Endif

Invoke
Process32next, @ hsnapshot, ADDR @ stprocess;

Next Process

. Endw

Invoke
Closehandle, @ hsnapshot
;

Disable snapshots

Popad

_ Proctest endp