Skip to content

Commit bbd2919

Browse files
supervoidcodersupervoidcoder
authored
Merge pull request #81 from supervoidcoder/better-name-parsing
Now win-witr can find processes even if you don't type the `.exe` or type the process name exactly as is! It's also case insensitive now, so if you type notepad, it stilll finds Notepad.exe (which is the modern name for the new stupid clankerified bloated win11 notepad, the old one is still lowercase if I remember right) yay
2 parents e4a066f + 13fd625 commit bbd2919

2 files changed

Lines changed: 41 additions & 26 deletions

File tree

‎main.cpp‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2006,12 +2006,27 @@ ProcInfos findMyProc(const char *procname) {
20062006

20072007
// info about first process encountered in a system snapshot
20082008
hResult = Process32First(hSnapshot, &pe);
2009-
2009+
std::string procstr = procname;
20102010
// retrieve information about the processes
20112011
// and exit if unsuccessful
2012+
// if we find the process: return process ID
2013+
2014+
2015+
std::transform(procstr.begin(), procstr.end(), procstr.begin(), [](unsigned char c){ return std::tolower(c); });// same lowercasing as the otther
2016+
std::string ex = procstr;
2017+
if (!procstr.ends_with(".exe")) {// no joke i almost typed endsWith here, the J*vaScript mind virus is spreading
2018+
ex += ".exe";
2019+
}
20122020
while (hResult) {
2013-
// if we find the process: return process ID
2014-
if (strcmp(procname, WideToString(pe.szExeFile).c_str()) == 0) {
2021+
2022+
2023+
std::string exeName = WideToString(pe.szExeFile);
2024+
std::transform(exeName.begin(), exeName.end(), exeName.begin(), [](unsigned char c){ return std::tolower(c); });
2025+
// for the comparison make it lowercase so that it does the thingy mammombbers insensitiviityness case
2026+
// this is only for the compariason either way
2027+
2028+
2029+
if (exeName == ex || exeName == procstr) {
20152030
result.names.push_back(WideToString(pe.szExeFile)); // let me cook
20162031
// while you might think its less performant to waste all this
20172032
// on storing related names for no reason
@@ -2027,7 +2042,7 @@ ProcInfos findMyProc(const char *procname) {
20272042
CloseHandle(hSnapshot);
20282043
return result;
20292044
}
2030-
// The above function is taken from https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html , modified simply to use WideToString for the process name comparison among other things.
2045+
// The above function is taken from https://cocomelonc.github.io/pentest/2021/09/29/findmyprocess.html, modified simply to use WideToString for the process name comparison among other things.
20312046
// Thanks!
20322047

20332048

‎tests/process/process.ps1‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,71 +1,71 @@
1-
$time = Measure-Command { win-witr winlogon.exe | Out-Default }
1+
$time = Measure-Command { win-witr winlogon | Out-Default }
22
"winlogon.exe check took {0} ms" -f $time.TotalMilliseconds
33

4-
$time = Measure-Command { win-witr lsass.exe | Out-Default }
4+
$time = Measure-Command { win-witr lsass | Out-Default }
55
"lsass.exe check took {0} ms" -f $time.TotalMilliseconds
66

7-
$time = Measure-Command { win-witr win-witr.exe | Out-Default }
7+
$time = Measure-Command { win-witr win-witr | Out-Default }
88
"win-witr.exe check took {0} ms" -f $time.TotalMilliseconds
99

10-
$time = Measure-Command { win-witr wininit.exe | Out-Default }
10+
$time = Measure-Command { win-witr wininit | Out-Default }
1111
"wininit.exe check took {0} ms" -f $time.TotalMilliseconds
1212

13-
$time = Measure-Command { win-witr explorer.exe | Out-Default }
13+
$time = Measure-Command { win-witr explorer | Out-Default }
1414
"explorer.exe check took {0} ms" -f $time.TotalMilliseconds
1515

1616
$time = Measure-Command { win-witr Registry | Out-Default }
1717
"Registry check took {0} ms" -f $time.TotalMilliseconds
1818

19-
$time = Measure-Command { win-witr csrss.exe | Out-Default }
19+
$time = Measure-Command { win-witr csrss | Out-Default }
2020
"csrss.exe check took {0} ms" -f $time.TotalMilliseconds
2121

22-
$time = Measure-Command { win-witr fontdrvhost.exe | Out-Default }
22+
$time = Measure-Command { win-witr fontdrvhost | Out-Default }
2323
"fontdrvhost.exe check took {0} ms" -f $time.TotalMilliseconds
2424

25-
$time = Measure-Command { win-witr svchost.exe | Out-Default }
25+
$time = Measure-Command { win-witr svchost | Out-Default }
2626
"svchost.exe check took {0} ms" -f $time.TotalMilliseconds
2727

28-
$time = Measure-Command { win-witr smss.exe | Out-Default }
28+
$time = Measure-Command { win-witr smss | Out-Default }
2929
"smss.exe check took {0} ms" -f $time.TotalMilliseconds
3030

31-
$time = Measure-Command { win-witr services.exe | Out-Default }
31+
$time = Measure-Command { win-witr services | Out-Default }
3232
"services.exe check took {0} ms" -f $time.TotalMilliseconds
3333

34-
$time = Measure-Command { win-witr powershell.exe | Out-Default }
34+
$time = Measure-Command { win-witr powershell | Out-Default }
3535
"powershell.exe check took {0} ms" -f $time.TotalMilliseconds
3636

3737
$time = Measure-Command { win-witr Runner.Listener.exe | Out-Default }
3838
"Runner.Listener.exe check took {0} ms" -f $time.TotalMilliseconds
3939

40-
$time = Measure-Command { win-witr cmd.exe | Out-Default }
40+
$time = Measure-Command { win-witr cmd | Out-Default }
4141
"cmd.exe check took {0} ms" -f $time.TotalMilliseconds
4242

43-
$time = Measure-Command { win-witr pwsh.exe | Out-Default }
43+
$time = Measure-Command { win-witr pwsh | Out-Default }
4444
"pwsh.exe check took {0} ms" -f $time.TotalMilliseconds
4545

46-
$time = Measure-Command { win-witr Runner.Worker.exe | Out-Default }
46+
$time = Measure-Command { win-witr Runner.Worker | Out-Default }
4747
"Runner.Worker.exe check took {0} ms" -f $time.TotalMilliseconds
4848

4949
$time = Measure-Command { win-witr hosted-compute-agent | Out-Default }
5050
"hosted-compute-agent check took {0} ms" -f $time.TotalMilliseconds
5151

52-
$time = Measure-Command { win-witr conhost.exe | Out-Default }
52+
$time = Measure-Command { win-witr conhost | Out-Default }
5353
"conhost.exe check took {0} ms" -f $time.TotalMilliseconds
5454

55-
$time = Measure-Command { win-witr dwm.exe | Out-Default }
55+
$time = Measure-Command { win-witr dwm | Out-Default }
5656
"dwm.exe check took {0} ms" -f $time.TotalMilliseconds
5757

58-
$time = Measure-Command { win-witr RuntimeBroker.exe | Out-Default }
58+
$time = Measure-Command { win-witr RuntimeBroker | Out-Default }
5959
"RuntimeBroker.exe check took {0} ms" -f $time.TotalMilliseconds
6060

61-
$time = Measure-Command { win-witr SearchIndexer.exe | Out-Default }
61+
$time = Measure-Command { win-witr SearchIndexer | Out-Default }
6262
"SearchIndexer.exe check took {0} ms" -f $time.TotalMilliseconds
6363

64-
$time = Measure-Command { win-witr spoolsv.exe | Out-Default }
64+
$time = Measure-Command { win-witr spoolsv | Out-Default }
6565
"spoolsv.exe check took {0} ms" -f $time.TotalMilliseconds
6666

67-
$time = Measure-Command { win-witr taskhostw.exe | Out-Default }
67+
$time = Measure-Command { win-witr taskhostw | Out-Default }
6868
"taskhostw.exe check took {0} ms" -f $time.TotalMilliseconds
6969

70-
$time = Measure-Command { win-witr dllhost.exe | Out-Default }
71-
"dllhost.exe check took {0} ms" -f $time.TotalMilliseconds
70+
71+

0 commit comments

Comments
 (0)