diff --git a/main.cpp b/main.cpp index 4b3c7f4..429fe48 100644 --- a/main.cpp +++ b/main.cpp @@ -2006,12 +2006,27 @@ ProcInfos findMyProc(const char *procname) { // info about first process encountered in a system snapshot hResult = Process32First(hSnapshot, &pe); - + std::string procstr = procname; // retrieve information about the processes // and exit if unsuccessful + // if we find the process: return process ID + + + std::transform(procstr.begin(), procstr.end(), procstr.begin(), [](unsigned char c){ return std::tolower(c); });// same lowercasing as the otther + std::string ex = procstr; + if (!procstr.ends_with(".exe")) {// no joke i almost typed endsWith here, the J*vaScript mind virus is spreading + ex += ".exe"; + } while (hResult) { - // if we find the process: return process ID - if (strcmp(procname, WideToString(pe.szExeFile).c_str()) == 0) { + + + std::string exeName = WideToString(pe.szExeFile); + std::transform(exeName.begin(), exeName.end(), exeName.begin(), [](unsigned char c){ return std::tolower(c); }); + // for the comparison make it lowercase so that it does the thingy mammombbers insensitiviityness case + // this is only for the compariason either way + + + if (exeName == ex || exeName == procstr) { result.names.push_back(WideToString(pe.szExeFile)); // let me cook // while you might think its less performant to waste all this // on storing related names for no reason @@ -2027,7 +2042,7 @@ ProcInfos findMyProc(const char *procname) { CloseHandle(hSnapshot); return result; } -// The above function is taken from https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html , modified simply to use WideToString for the process name comparison among other things. +// The above function is taken from https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html, modified simply to use WideToString for the process name comparison among other things. // Thanks! diff --git a/tests/process/process.ps1 b/tests/process/process.ps1 index d92c4d7..2b9849f 100644 --- a/tests/process/process.ps1 +++ b/tests/process/process.ps1 @@ -1,71 +1,71 @@ -$time = Measure-Command { win-witr winlogon.exe | Out-Default } +$time = Measure-Command { win-witr winlogon | Out-Default } "winlogon.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr lsass.exe | Out-Default } +$time = Measure-Command { win-witr lsass | Out-Default } "lsass.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr win-witr.exe | Out-Default } +$time = Measure-Command { win-witr win-witr | Out-Default } "win-witr.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr wininit.exe | Out-Default } +$time = Measure-Command { win-witr wininit | Out-Default } "wininit.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr explorer.exe | Out-Default } +$time = Measure-Command { win-witr explorer | Out-Default } "explorer.exe check took {0} ms" -f $time.TotalMilliseconds $time = Measure-Command { win-witr Registry | Out-Default } "Registry check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr csrss.exe | Out-Default } +$time = Measure-Command { win-witr csrss | Out-Default } "csrss.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr fontdrvhost.exe | Out-Default } +$time = Measure-Command { win-witr fontdrvhost | Out-Default } "fontdrvhost.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr svchost.exe | Out-Default } +$time = Measure-Command { win-witr svchost | Out-Default } "svchost.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr smss.exe | Out-Default } +$time = Measure-Command { win-witr smss | Out-Default } "smss.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr services.exe | Out-Default } +$time = Measure-Command { win-witr services | Out-Default } "services.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr powershell.exe | Out-Default } +$time = Measure-Command { win-witr powershell | Out-Default } "powershell.exe check took {0} ms" -f $time.TotalMilliseconds $time = Measure-Command { win-witr Runner.Listener.exe | Out-Default } "Runner.Listener.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr cmd.exe | Out-Default } +$time = Measure-Command { win-witr cmd | Out-Default } "cmd.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr pwsh.exe | Out-Default } +$time = Measure-Command { win-witr pwsh | Out-Default } "pwsh.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr Runner.Worker.exe | Out-Default } +$time = Measure-Command { win-witr Runner.Worker | Out-Default } "Runner.Worker.exe check took {0} ms" -f $time.TotalMilliseconds $time = Measure-Command { win-witr hosted-compute-agent | Out-Default } "hosted-compute-agent check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr conhost.exe | Out-Default } +$time = Measure-Command { win-witr conhost | Out-Default } "conhost.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr dwm.exe | Out-Default } +$time = Measure-Command { win-witr dwm | Out-Default } "dwm.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr RuntimeBroker.exe | Out-Default } +$time = Measure-Command { win-witr RuntimeBroker | Out-Default } "RuntimeBroker.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr SearchIndexer.exe | Out-Default } +$time = Measure-Command { win-witr SearchIndexer | Out-Default } "SearchIndexer.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr spoolsv.exe | Out-Default } +$time = Measure-Command { win-witr spoolsv | Out-Default } "spoolsv.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr taskhostw.exe | Out-Default } +$time = Measure-Command { win-witr taskhostw | Out-Default } "taskhostw.exe check took {0} ms" -f $time.TotalMilliseconds -$time = Measure-Command { win-witr dllhost.exe | Out-Default } -"dllhost.exe check took {0} ms" -f $time.TotalMilliseconds + +