All pastes #471081 Raw Edit

Mine

public text v1 · immutable
·published 2007-05-04 18:28 UTC
rendered paste body
bx_bool win_proc_get_by_cr3( bx_phy_address cr3) {
   bx_bool result;
   bx_address laddr;

   result = logical2linear( 0x30, 0, &laddr, cr3);

   KPCR tmp_kpcr;
   result ? result = vmem_read( laddr, sizeof( tmp_kpcr), (Bit8u*) &tmp_kpcr, cr3) : retun result;

   KPRCB tmp_kprcb;
   result ? result = vmem_read( tmp_kpcr.Prcb, sizeof( tmp_kprcb), (Bit8u*) &tmp_kprcb, cr3) : return result;

   KTHREAD tmp_kthread;
   result ? result = vmem_read( tmp_kprcb.CurrentThread, sizeof( tmp_kthread), (Bit8u*) &tmp_kthread, cr3) : return result;

   // KTHREAD contains a KAPC_STATE struct in the ApcState field.
   // That in turn contains a pointer to the KPROCESS struct (contained in an EPROCESS struct)

   EPROCESS tmp_eprocess;
   result ? result = vmem_read( tmp_kthread.ApcState.Process, sizeof( tmp_eprocess), (Bit8u*) &tmp_eprocess, cr3) : return result;

   return result;

}