@@ -96,12 +96,17 @@ std::string Auth::MakeRiotHeader(const ClientInfo& info)
9696
9797DWORD Auth::GetProcessId (const std::wstring& processName)
9898{
99- const HANDLE snapshot = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, NULL );
99+ static HMODULE kernel32 = GetModuleHandleA (" kernel32" );
100+ static auto pCreateToolhelp32Snapshot = (decltype (&CreateToolhelp32Snapshot))GetProcAddress (kernel32, " CreateToolhelp32Snapshot" );
101+ static auto pProcess32FirstW = (decltype (&Process32FirstW))GetProcAddress (kernel32, " Process32FirstW" );
102+ static auto pProcess32NextW = (decltype (&Process32NextW))GetProcAddress (kernel32, " Process32NextW" );
103+
104+ const HANDLE snapshot = pCreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, NULL );
100105 if (snapshot != INVALID_HANDLE_VALUE)
101106 {
102107 PROCESSENTRY32W entry;
103108 entry.dwSize = sizeof (PROCESSENTRY32W);
104- if (Process32FirstW (snapshot, &entry))
109+ if (pProcess32FirstW (snapshot, &entry))
105110 {
106111 do
107112 {
@@ -110,7 +115,7 @@ DWORD Auth::GetProcessId(const std::wstring& processName)
110115 CloseHandle (snapshot);
111116 return entry.th32ProcessID ;
112117 }
113- } while (Process32NextW (snapshot, &entry));
118+ } while (pProcess32NextW (snapshot, &entry));
114119 }
115120 }
116121 CloseHandle (snapshot);
@@ -119,21 +124,26 @@ DWORD Auth::GetProcessId(const std::wstring& processName)
119124
120125std::vector<DWORD> Auth::GetAllProcessIds (const std::wstring& processName)
121126{
127+ static HMODULE kernel32 = GetModuleHandleA (" kernel32" );
128+ static auto pCreateToolhelp32Snapshot = (decltype (&CreateToolhelp32Snapshot))GetProcAddress (kernel32, " CreateToolhelp32Snapshot" );
129+ static auto pProcess32FirstW = (decltype (&Process32FirstW))GetProcAddress (kernel32, " Process32FirstW" );
130+ static auto pProcess32NextW = (decltype (&Process32NextW))GetProcAddress (kernel32, " Process32NextW" );
131+
122132 std::vector<DWORD> pids;
123- const HANDLE snapshot = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, NULL );
133+ const HANDLE snapshot = pCreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, NULL );
124134 if (snapshot != INVALID_HANDLE_VALUE)
125135 {
126136 PROCESSENTRY32W entry;
127137 entry.dwSize = sizeof (PROCESSENTRY32W);
128- if (Process32FirstW (snapshot, &entry))
138+ if (pProcess32FirstW (snapshot, &entry))
129139 {
130140 do
131141 {
132142 if (std::wstring (entry.szExeFile ) == processName)
133143 {
134144 pids.emplace_back (entry.th32ProcessID );
135145 }
136- } while (Process32NextW (snapshot, &entry));
146+ } while (pProcess32NextW (snapshot, &entry));
137147 }
138148 }
139149 CloseHandle (snapshot);
@@ -151,14 +161,20 @@ std::wstring Auth::GetProcessCommandLine(const DWORD& processId)
151161 PULONG ReturnLength
152162 );
153163
164+ static HMODULE kernel32 = GetModuleHandleA (" kernel32" );
165+
166+ static auto pOpenProcess = (decltype (&OpenProcess))GetProcAddress (kernel32, " OpenProcess" );
154167 std::wstring result;
155- const HANDLE processHandle = OpenProcess (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0 , processId);
168+ const HANDLE processHandle = pOpenProcess (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0 , processId);
156169
170+ static auto pGetNativeSystemInfo = (decltype (&GetNativeSystemInfo))GetProcAddress (kernel32, " GetNativeSystemInfo" );
157171 SYSTEM_INFO si;
158- GetNativeSystemInfo (&si);
172+ pGetNativeSystemInfo (&si);
159173
174+ static auto pIsWow64Process = (decltype (&IsWow64Process))GetProcAddress (kernel32, " IsWow64Process" );
175+ static auto pGetCurrentProcess = (decltype (&GetCurrentProcess))GetProcAddress (kernel32, " GetCurrentProcess" );
160176 BOOL wow;
161- IsWow64Process ( GetCurrentProcess (), &wow);
177+ pIsWow64Process ( pGetCurrentProcess (), &wow);
162178
163179 const DWORD ProcessParametersOffset = si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ? 0x20 : 0x10 ;
164180 const DWORD CommandLineOffset = si.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64 ? 0x70 : 0x40 ;
@@ -270,14 +286,15 @@ std::wstring Auth::GetProcessCommandLine(const DWORD& processId)
270286 return {};
271287 }
272288
273- if (!ReadProcessMemory (processHandle, pbi.PebBaseAddress , peb, pebSize, nullptr ))
289+ static auto pReadProcessMemory = (decltype (&ReadProcessMemory))GetProcAddress (kernel32, " ReadProcessMemory" );
290+ if (!pReadProcessMemory (processHandle, pbi.PebBaseAddress , peb, pebSize, nullptr ))
274291 {
275292 MessageBoxA (nullptr , " PEB ReadProcessMemory failed" , nullptr , 0 );
276293 CloseHandle (processHandle);
277294 return {};
278295 }
279296
280- if (const PBYTE* parameters = static_cast <PBYTE*>(*reinterpret_cast <LPVOID*>(peb + ProcessParametersOffset)); !ReadProcessMemory (
297+ if (const PBYTE* parameters = static_cast <PBYTE*>(*reinterpret_cast <LPVOID*>(peb + ProcessParametersOffset)); !pReadProcessMemory (
281298 processHandle, parameters, processParameters, processParametersSize, nullptr ))
282299 {
283300 MessageBoxA (nullptr , " processParameters ReadProcessMemory failed" , nullptr , 0 );
@@ -287,7 +304,7 @@ std::wstring Auth::GetProcessCommandLine(const DWORD& processId)
287304
288305 const UNICODE_STRING* pCommandLine = reinterpret_cast <UNICODE_STRING*>(processParameters + CommandLineOffset);
289306 const auto commandLineCopy = static_cast <PWSTR>(malloc (pCommandLine->MaximumLength ));
290- if (!ReadProcessMemory (processHandle, pCommandLine->Buffer , commandLineCopy, pCommandLine->MaximumLength , nullptr ))
307+ if (!pReadProcessMemory (processHandle, pCommandLine->Buffer , commandLineCopy, pCommandLine->MaximumLength , nullptr ))
291308 {
292309 MessageBoxA (nullptr , " pCommandLine ReadProcessMemory failed" , nullptr , 0 );
293310 CloseHandle (processHandle);
@@ -303,9 +320,13 @@ std::wstring Auth::GetProcessCommandLine(const DWORD& processId)
303320
304321std::wstring Auth::GetProcessPath (const DWORD& processId)
305322{
306- if (const HANDLE processHandle = OpenProcess (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0 , processId))
323+ static HMODULE kernel32 = GetModuleHandleA (" kernel32" );
324+ static auto pOpenProcess = (decltype (&OpenProcess))GetProcAddress (kernel32, " OpenProcess" );
325+
326+ if (const HANDLE processHandle = pOpenProcess (PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0 , processId))
307327 {
308- if (WCHAR result[MAX_PATH]; GetModuleFileNameExW (processHandle, nullptr , result, MAX_PATH))
328+ static auto pK32GetModuleFileNameExW = (decltype (&K32GetModuleFileNameExW))GetProcAddress (kernel32, " K32GetModuleFileNameExW" );
329+ if (WCHAR result[MAX_PATH]; pK32GetModuleFileNameExW (processHandle, nullptr , result, MAX_PATH))
309330 {
310331 CloseHandle (processHandle);
311332 return { result };
0 commit comments