Jump to content
Tuts 4 You



Recommended Posts

PROCESS_ID equ 1.code
align 16
FindProcessByName proc uses ebx ecx edx esi edi _exename:dword,_returntype:dword
LOCAL Process :PROCESSENTRY32 lea esi,Process
assume esi:ptr PROCESSENTRY32 mov [esi].dwSize, sizeof PROCESSENTRY32 invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,0
mov edi,eax invoke Process32First,edi,esi .while eax!=FALSE lea eax,[esi].szExeFile invoke lstrcmpi,eax,_exename .if eax==0
;---found process---
mov eax,[esi].th32ProcessID
jmp @return
.endif invoke Process32Next,edi,esi
.endw @return:
assume esi:nothing push eax
invoke CloseHandle,edi
pop eax .if _returntype==PROCESS_HANDLE
invoke OpenProcess,PROCESS_ALL_ACCESS,0,eax;return hProcess
.endif ret
FindProcessByName endp
Link to comment

Do you know pupe tool? It comes in a zip file with sources in asm, and of course that function appears there...

Get it here:



Link to comment

Thanks much guys.

I also found a nice example on winasm forum called EzProcess. Very nicely done small tool. Check it out. =)

Link to comment

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Create New...