Process Enumeration

The APIs for listing running processes — Toolhelp32, NtQuerySystemInformation, and WMI — what each returns, how rootkits hide from each, and how to detect injected processes through anomaly analysis

Toolhelp32 API

The Toolhelp32 API (tlhelp32.h) is the classic Win32 process enumeration interface. It takes a snapshot of the system state and lets you iterate it.

#include <windows.h>
#include <tlhelp32.h>

void ListProcesses() {
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnap == INVALID_HANDLE_VALUE) return;

    PROCESSENTRY32W pe = { sizeof(pe) };
    if (Process32FirstW(hSnap, &pe)) {
        do {
            wprintf(L"PID=%5lu  PPID=%5lu  %ws\n",
                pe.th32ProcessID, pe.th32ParentProcessID,
                pe.szExeFile);
        } while (Process32NextW(hSnap, &pe));
    }
    CloseHandle(hSnap);
}
// PROCESSENTRY32 gives: PID, parent PID, process name, thread count
// Does NOT give: full image path, command line, image base
// Data source: NtQuerySystemInformation internally

NtQuerySystemInformation

The more powerful, lower-level API is NtQuerySystemInformation with SystemProcessInformation. This returns a linked list of SYSTEM_PROCESS_INFORMATION structures, one per process, with significantly more data than Toolhelp32:

#include <winternl.h>
#pragma comment(lib, "ntdll.lib")

void ListProcessesFull() {
    ULONG bufLen = 1024 * 1024;  // 1MB initial buffer
    PVOID buf = malloc(bufLen);
    NTSTATUS status;

    while ((status = NtQuerySystemInformation(
        SystemProcessInformation, buf, bufLen, &bufLen)) == STATUS_INFO_LENGTH_MISMATCH) {
        buf = realloc(buf, bufLen += 4096);
    }
    if (status != STATUS_SUCCESS) { free(buf); return; }

    SYSTEM_PROCESS_INFORMATION* spi = (SYSTEM_PROCESS_INFORMATION*)buf;
    while (true) {
        wprintf(L"PID=%5llu  Threads=%2lu  %wZ\n",
            (ULONG64)spi->UniqueProcessId,
            spi->NumberOfThreads,
            &spi->ImageName);

        for (ULONG i = 0; i < spi->NumberOfThreads; i++) {
            SYSTEM_THREAD_INFORMATION* sti = &spi->Threads[i];
            wprintf(L"  TID=%5llu  StartAddress=%p\n",
                (ULONG64)sti->ClientId.UniqueThread,
                sti->StartAddress);
        }

        if (!spi->NextEntryOffset) break;
        spi = (SYSTEM_PROCESS_INFORMATION*)((BYTE*)spi + spi->NextEntryOffset);
    }
    free(buf);
}
// Returns: PID, PPID, image name, thread list with start addresses,
// memory stats, handle count, session ID, working set size

The thread start addresses in SYSTEM_THREAD_INFORMATION are particularly valuable for detecting injection — a thread whose start address falls outside any loaded module's address range is highly suspicious.

WMI Process Query

WMI's Win32_Process class provides process information via COM, including the full command line and executable path. Its data ultimately comes from the same kernel source but through an additional layer.

import subprocess, json

def list_processes_wmi():
    # PowerShell is the easiest WMI interface from Python
    cmd = ["powershell", "-NoProfile", "-Command",
           "Get-CimInstance Win32_Process | Select-Object ProcessId,ParentProcessId,Name,CommandLine,ExecutablePath | ConvertTo-Json"]
    result = subprocess.run(cmd, capture_output=True, text=True)
    processes = json.loads(result.stdout)
    for p in processes:
        pid = p.get("ProcessId")
        ppid = p.get("ParentProcessId")
        name = p.get("Name", "")
        cmd_line = p.get("CommandLine", "") or ""
        exe_path = p.get("ExecutablePath", "") or ""
        print(f"{pid:6d} {ppid:6d}  {name:25s}  {cmd_line[:60]}")

WMI also supports event subscriptions: __InstanceCreationEvent with Win32_ProcessStartTrace can fire a notification when any process starts — though with some latency compared to ETW.

OpenProcess and Handle Rights

After enumerating a process by PID, you obtain a handle with OpenProcess. The handle's access rights determine what you can do with it:

Enumerating Modules in a Process

#include <psapi.h>
#pragma comment(lib, "psapi.lib")

void ListModules(DWORD pid) {
    HANDLE hProc = OpenProcess(
        PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pid);
    if (!hProc) return;

    HMODULE mods[1024]; DWORD needed;
    if (EnumProcessModulesEx(hProc, mods, sizeof(mods), &needed, LIST_MODULES_ALL)) {
        DWORD count = needed / sizeof(HMODULE);
        for (DWORD i = 0; i < count; i++) {
            WCHAR path[MAX_PATH];
            GetModuleFileNameExW(hProc, mods[i], path, MAX_PATH);
            MODULEINFO mi;
            GetModuleInformation(hProc, mods[i], &mi, sizeof(mi));
            wprintf(L"  Base=%p  Size=0x%lX  %ws\n",
                mi.lpBaseOfDll, mi.SizeOfImage, path);
        }
    }
    CloseHandle(hProc);
}
// Anomaly: a module base with no path (manually mapped DLL)
// Anomaly: a module at an address outside expected range

Process Anomaly Detection

Combining process enumeration with cross-validation reveals injected and hidden processes:

Q & A