pid/process.h
// Capture all running processes and all their threads.
// returns an API or NTSTATUS Error code or zero if successfull
Capture all running processes and all their threads.
returns an API or NTSTATUS Error code or zero if successfull
Capture all running processes and all their threads . returns an API or NTSTATUS Error code or zero if successfull
DWORD Capture()
	{
		if (!mf_NtQueryInfo)
		{
			mf_NtQueryInfo = (t_NtQueryInfo)GetProcAddress(GetModuleHandleA("NtDll.dll"), "NtQuerySystemInformation");
			if (!mf_NtQueryInfo)
				return GetLastError();
		}
		while (true)
		{
			if (!mp_Data)
			{
				mp_Data = (BYTE*)LocalAlloc(LMEM_FIXED, mu32_DataSize);
				if (!mp_Data)
					return GetLastError();
			}
			ULONG u32_Needed = 0;
			NTSTATUS s32_Status = mf_NtQueryInfo(SystemProcessInformation, mp_Data, mu32_DataSize, &u32_Needed);
			if (s32_Status == STATUS_INFO_LENGTH_MISMATCH) 
			{
				mu32_DataSize = u32_Needed + 4000;
				LocalFree(mp_Data);
				mp_Data = NULL;
				continue;
			}
			return s32_Status;
		}
	}
DWORD Capture ( ) { if ( ! mf_NtQueryInfo ) { mf_NtQueryInfo = ( t_NtQueryInfo ) GetProcAddress ( GetModuleHandleA ( " " ) , " " ) ; if ( ! mf_NtQueryInfo ) return GetLastError ( ) ; } while ( true ) { if ( ! mp_Data ) { mp_Data = ( BYTE * ) LocalAlloc ( LMEM_FIXED , mu32_DataSize ) ; if ( ! mp_Data ) return GetLastError ( ) ; } ULONG u32_Needed = 0 ; NTSTATUS s32_Status = mf_NtQueryInfo ( SystemProcessInformation , mp_Data , mu32_DataSize , & u32_Needed ) ; if ( s32_Status == STATUS_INFO_LENGTH_MISMATCH ) { mu32_DataSize = u32_Needed + 4000 ; LocalFree ( mp_Data ) ; mp_Data = NULL ; continue ; } return s32_Status ; } }
Capture all running processes and all their threads.
Capture all running processes and all their threads .
// This must run in a loop because in the mean time a new process may have started  // and we need more buffer than u32_Needed !! // The buffer was too small