Skip to content

Commit e4a066f

Browse files
supervoidcodersupervoidcoder
authored
Merge pull request #80 from supervoidcoder/name-check-improvements
feat: show related processes, essentially deduplicating processes like witr but being more helpful
2 parents a42c0da + aa03023 commit e4a066f

2 files changed

Lines changed: 117 additions & 58 deletions

File tree

‎main.cpp‎

Lines changed: 48 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1727,7 +1727,8 @@ void FindProcessPorts(DWORD targetPid) {
17271727

17281728

17291729

1730-
void PIDinspect(DWORD pid) { // ooh guys look i'm in the void
1730+
void PIDinspect(const std::vector<DWORD>& pids, const std::vector<std::string>& names) { // ooh guys look i'm in the void
1731+
DWORD pid = pids[0];
17311732
std::string procName = GetProcessNameFromPid(pid);
17321733
if (IsVirtualTerminalModeEnabled()) {
17331734
if (procName == ""){
@@ -1937,6 +1938,24 @@ std::string FRAM = ""; // fram means formatted ram, i'm so creative at var namin
19371938
} else {
19381939
std::cout << "\nStarted: " << GetReadableFileTime(pid) << std::endl;
19391940
}
1941+
1942+
if (pids.size() > 1) {
1943+
if (IsVirtualTerminalModeEnabled()) {
1944+
std::cout << "\033[1;35mRelated Processes:\033[0m\n";
1945+
} else {
1946+
std::cout << "Related Processes:\n";
1947+
}
1948+
1949+
for (size_t i = 1; i < pids.size(); i++) {
1950+
std::string relatedProcName = names[i];
1951+
if (IsVirtualTerminalModeEnabled()) {
1952+
std::cout << "\t\033[36m" << relatedProcName << "\033[90m (PID " << pids[i] << ")\033[0m\n";
1953+
} else {
1954+
std::cout << "\t" << relatedProcName << " (PID " << pids[i] << ")\n";
1955+
}
1956+
1957+
}
1958+
}
19401959
/*
19411960
TODO:
19421961
This definitely needs a lot more details to be complete like witr. Unfortunately, windows needs even more shenanigans and a whole
@@ -1962,18 +1981,25 @@ std::string FRAM = ""; // fram means formatted ram, i'm so creative at var namin
19621981
*/
19631982

19641983
CloseHandle(hProcess);
1984+
19651985
}
19661986

1967-
int findMyProc(const char *procname) {
1987+
struct ProcInfos {
1988+
std::vector<std::string> names;
1989+
std::vector<int> pids;
1990+
};
1991+
1992+
ProcInfos findMyProc(const char *procname) {
19681993

19691994
HANDLE hSnapshot;
19701995
PROCESSENTRY32 pe;
1971-
int pid = 0;
1996+
ProcInfos result;
19721997
BOOL hResult;
1998+
19731999

19742000
// snapshot of all processes in the system
19752001
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
1976-
if (INVALID_HANDLE_VALUE == hSnapshot) return 0;
2002+
if (INVALID_HANDLE_VALUE == hSnapshot) return {};
19772003

19782004
// initializing size: needed for using Process32First
19792005
pe.dwSize = sizeof(PROCESSENTRY32);
@@ -1986,15 +2012,20 @@ int findMyProc(const char *procname) {
19862012
while (hResult) {
19872013
// if we find the process: return process ID
19882014
if (strcmp(procname, WideToString(pe.szExeFile).c_str()) == 0) {
1989-
pid = pe.th32ProcessID;
1990-
break;
2015+
result.names.push_back(WideToString(pe.szExeFile)); // let me cook
2016+
// while you might think its less performant to waste all this
2017+
// on storing related names for no reason
2018+
// its crucial for the related processes since
2019+
// otherwise we'd have to call the get process name for every related process
2020+
// and slow us down significantly so storing it on the fly is better
2021+
result.pids.push_back(pe.th32ProcessID);
19912022
}
19922023
hResult = Process32Next(hSnapshot, &pe);
19932024
}
19942025

19952026
// closes an open handle (CreateToolhelp32Snapshot)
19962027
CloseHandle(hSnapshot);
1997-
return pid;
2028+
return result;
19982029
}
19992030
// The above function is taken from https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html , modified simply to use WideToString for the process name comparison among other things.
20002031
// Thanks!
@@ -2092,8 +2123,12 @@ int main(int argc, char* argv[]) {
20922123
}
20932124

20942125

2095-
2096-
PIDinspect(static_cast<DWORD>(pid));
2126+
std::vector<DWORD> pids;
2127+
std::vector<std::string> trash;
2128+
trash.push_back("");
2129+
pids.push_back(static_cast<DWORD>(pid));// function requires it to be a list even if only 1 is passed
2130+
2131+
PIDinspect(pids, trash);
20972132
} else {
20982133
if (IsVirtualTerminalModeEnabled()) { // ugh i have to do this EVERY SINGLE TIME
20992134
std::cerr << "\033[1;31mError:\033[0m --pid option requires an argument." << std::endl;
@@ -2111,10 +2146,10 @@ int main(int argc, char* argv[]) {
21112146
// check for process name if no recognized flags
21122147
else if (arg[0] != '-') { // if it doesn't start with -- or -
21132148
std::string procName = arg;
2114-
int pid = findMyProc(procName.c_str());
2115-
if (pid != 0) {
2116-
2117-
PIDinspect(static_cast<DWORD>(pid));
2149+
ProcInfos r = findMyProc(procName.c_str());
2150+
if (!r.pids.empty()) {
2151+
std::vector<DWORD> dwPids(r.pids.begin(), r.pids.end());
2152+
PIDinspect(dwPids, r.names);
21182153
} else {
21192154
if (IsVirtualTerminalModeEnabled()) {
21202155
std::cerr << "\033[1;31mError:\033[0m Could not find process with name " << procName << "." << std::endl;

‎tests/process/process.ps1‎

Lines changed: 69 additions & 45 deletions
Original file line numberDiff line numberDiff line change
@@ -1,47 +1,71 @@
1-
REM Test system processes that should always be running
2-
Measure-Command { win-witr winlogon.exe | Out-Default}
3-
Measure-Command { win-witr lsass.exe | Out-Default}
4-
Measure-Command { win-witr win-witr.exe | Out-Default}
5-
Measure-Command { win-witr wininit.exe | Out-Default}
6-
Measure-Command { win-witr explorer.exe | Out-Default}
7-
Measure-Command { win-witr Registry| Out-Default}
8-
Measure-Command { win-witr csrss.exe| Out-Default}
9-
Measure-Command { win-witr fontdrvhost.exe | Out-Default}
10-
Measure-Command { win-witr svchost.exe | Out-Default}
11-
Measure-Command { win-witr smss.exe | Out-Default}
12-
Measure-Command { win-witr services.exe | Out-Default}
13-
Measure-Command { win-witr powershell.exe | Out-Default }
14-
Measure-Command { win-witr Runner.Listener.exe | Out-Default}
15-
Measure-Command { win-witr cmd.exe | Out-Default}
16-
Measure-Command { win-witr pwsh.exe | Out-Default}
17-
Measure-Command { win-witr Runner.Worker.exe | Out-Default}
18-
Measure-Command { win-witr hosted-compute-agent | Out-Default}
19-
Measure-Command { win-witr conhost.exe | Out-Default}
20-
Measure-Command { win-witr dwm.exe | Out-Default}
21-
Measure-Command { win-witr RuntimeBroker.exe | Out-Default}
22-
Measure-Command { win-witr SearchIndexer.exe | Out-Default}
23-
Measure-Command { win-witr spoolsv.exe | Out-Default}
24-
Measure-Command { win-witr taskhostw.exe | Out-Default}
25-
Measure-Command { win-witr dllhost.exe | Out-Default}
26-
27-
start /B notepad.exe
28-
timeout /t 1 /nobreak >nul
29-
Measure-Command { win-witr notepad.exe | Out-Default}
30-
taskkill /F /IM notepad.exe >nul 2>&1
31-
32-
REM Start calc and test it, then close
33-
start /B calc.exe
34-
timeout /t 1 /nobreak >nul
35-
Measure-Command { win-witr calc.exe | Out-Default}
36-
taskkill /F /IM calc.exe >nul 2>&1
37-
38-
REM Start mspaint and test it, then close
39-
start /B mspaint.exe
40-
timeout /t 1 /nobreak >nul
41-
Measure-Command { win-witr mspaint.exe | Out-Default}
42-
taskkill /F /IM mspaint.exe >nul 2>&1
43-
44-
45-
Measure-Command { win-witr powershell.exe | Out-Default}
1+
$time = Measure-Command { win-witr winlogon.exe | Out-Default }
2+
"winlogon.exe check took {0} ms" -f $time.TotalMilliseconds
463

4+
$time = Measure-Command { win-witr lsass.exe | Out-Default }
5+
"lsass.exe check took {0} ms" -f $time.TotalMilliseconds
476

7+
$time = Measure-Command { win-witr win-witr.exe | Out-Default }
8+
"win-witr.exe check took {0} ms" -f $time.TotalMilliseconds
9+
10+
$time = Measure-Command { win-witr wininit.exe | Out-Default }
11+
"wininit.exe check took {0} ms" -f $time.TotalMilliseconds
12+
13+
$time = Measure-Command { win-witr explorer.exe | Out-Default }
14+
"explorer.exe check took {0} ms" -f $time.TotalMilliseconds
15+
16+
$time = Measure-Command { win-witr Registry | Out-Default }
17+
"Registry check took {0} ms" -f $time.TotalMilliseconds
18+
19+
$time = Measure-Command { win-witr csrss.exe | Out-Default }
20+
"csrss.exe check took {0} ms" -f $time.TotalMilliseconds
21+
22+
$time = Measure-Command { win-witr fontdrvhost.exe | Out-Default }
23+
"fontdrvhost.exe check took {0} ms" -f $time.TotalMilliseconds
24+
25+
$time = Measure-Command { win-witr svchost.exe | Out-Default }
26+
"svchost.exe check took {0} ms" -f $time.TotalMilliseconds
27+
28+
$time = Measure-Command { win-witr smss.exe | Out-Default }
29+
"smss.exe check took {0} ms" -f $time.TotalMilliseconds
30+
31+
$time = Measure-Command { win-witr services.exe | Out-Default }
32+
"services.exe check took {0} ms" -f $time.TotalMilliseconds
33+
34+
$time = Measure-Command { win-witr powershell.exe | Out-Default }
35+
"powershell.exe check took {0} ms" -f $time.TotalMilliseconds
36+
37+
$time = Measure-Command { win-witr Runner.Listener.exe | Out-Default }
38+
"Runner.Listener.exe check took {0} ms" -f $time.TotalMilliseconds
39+
40+
$time = Measure-Command { win-witr cmd.exe | Out-Default }
41+
"cmd.exe check took {0} ms" -f $time.TotalMilliseconds
42+
43+
$time = Measure-Command { win-witr pwsh.exe | Out-Default }
44+
"pwsh.exe check took {0} ms" -f $time.TotalMilliseconds
45+
46+
$time = Measure-Command { win-witr Runner.Worker.exe | Out-Default }
47+
"Runner.Worker.exe check took {0} ms" -f $time.TotalMilliseconds
48+
49+
$time = Measure-Command { win-witr hosted-compute-agent | Out-Default }
50+
"hosted-compute-agent check took {0} ms" -f $time.TotalMilliseconds
51+
52+
$time = Measure-Command { win-witr conhost.exe | Out-Default }
53+
"conhost.exe check took {0} ms" -f $time.TotalMilliseconds
54+
55+
$time = Measure-Command { win-witr dwm.exe | Out-Default }
56+
"dwm.exe check took {0} ms" -f $time.TotalMilliseconds
57+
58+
$time = Measure-Command { win-witr RuntimeBroker.exe | Out-Default }
59+
"RuntimeBroker.exe check took {0} ms" -f $time.TotalMilliseconds
60+
61+
$time = Measure-Command { win-witr SearchIndexer.exe | Out-Default }
62+
"SearchIndexer.exe check took {0} ms" -f $time.TotalMilliseconds
63+
64+
$time = Measure-Command { win-witr spoolsv.exe | Out-Default }
65+
"spoolsv.exe check took {0} ms" -f $time.TotalMilliseconds
66+
67+
$time = Measure-Command { win-witr taskhostw.exe | Out-Default }
68+
"taskhostw.exe check took {0} ms" -f $time.TotalMilliseconds
69+
70+
$time = Measure-Command { win-witr dllhost.exe | Out-Default }
71+
"dllhost.exe check took {0} ms" -f $time.TotalMilliseconds

0 commit comments

Comments
 (0)