NtOpenProcess

include w2k\ntdll.inc
include w2k\ntddk.inc
include w2k\native.inc

includelib \lib\w2k\ntdll.lib

EXPLORERPID equ 3E0h

.data
cid CLIENT_ID <EXPLORERPID,0>
oa OBJECT_ATTRIBUTES <sizeof OBJECT_ATTRIBUTES>

.data?
hExplorer dd ?

.code

    invoke NtOpenProcess,offset hExplorer,PROCESS_ALL_ACCESS,offset oa,offset cid

#include <windows.h>
#include <stdio.h>

typedef struct
{
    ULONG UniqueProcessId;
    ULONG UniqueThreadId;
}CLIENT_ID,*PCLIENT_ID;

typedef struct _UNICODE_STRING {
  USHORT  Length;
  USHORT  MaximumLength;
  PWSTR  Buffer;
} UNICODE_STRING,*PUNICODE_STRING;

typedef struct
{
    ULONG Length;
    HANDLE RootDirectory;
    PUNICODE_STRING ObjectName;
    DWORD Attributes;
    PVOID SecurityDescriptor;
    PVOID SecurityQualityOfService;
}OBJECT_ATTRIBUTES,*POBJECT_ATTRIBUTES;

#define STATUS_SUCCESS 0
#define EXPLORERPID 0x404

HANDLE hExplorer;
typedef int (__stdcall *PNTOPENPROCESS)(HANDLE*,DWORD,POBJECT_ATTRIBUTES,PCLIENT_ID);
PNTOPENPROCESS NtOpenProcess;
int main(int argc, char *argv[])
{
    OBJECT_ATTRIBUTES oa={sizeof(OBJECT_ATTRIBUTES)};
    CLIENT_ID cid={EXPLORERPID,0};

    NtOpenProcess=(PNTOPENPROCESS)GetProcAddress(\
        GetModuleHandle("ntdll"),\
        "NtOpenProcess");
    printf("NtOpenProcess for Explorer %s and %#x received for handle\n",\
        (STATUS_SUCCESS==NtOpenProcess(&hExplorer,PROCESS_ALL_ACCESS,&oa,&cid))\
        ? "succeeded" : "failed",hExplorer);

    return 0;
}