OpenFileMapping(FILE_MAP_ALL_ACCESS, 0, "calc");

// toolhelp.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"
#include <windows.h>
#include <Tlhelp32.h>
#include <ntdll.h>

#pragma comment (lib,"ntdll.lib");

VOID SetNeededPrivelege(VOID)
{
	HANDLE hndl;
     
	TOKEN_PRIVILEGES newpriv,prevpriv;

	DWORD retl;

	if(OpenProcessToken(GetCurrentProcess(), TOKEN_ALL_ACCESS, &hndl))
	{
	
		if (LookupPrivilegeValue(0, L"SeDebugPrivilege", &newpriv.Privileges[0].Luid))
		{

			newpriv.PrivilegeCount = 1; 

			newpriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; 

			AdjustTokenPrivileges(hndl, 0, &newpriv, sizeof(newpriv), &prevpriv, &retl); 
		} 
      
		CloseHandle(hndl); 
	}
}


int _tmain(int argc, _TCHAR* argv[])
{
	HANDLE hSnap,hFile,hMSnp;
	PROCESSENTRY32 proc32;
	MODULEENTRY32 moduleentry32;
	NTSTATUS status;
	OBJECT_ATTRIBUTES ObjAttr;
	UNICODE_STRING usExeModName;
	IO_STATUS_BLOCK ioStatus;
	WCHAR wcPath[500];
	
	SetNeededPrivelege();

	hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

	 
	if( hSnap != INVALID_HANDLE_VALUE )
  
	{
    
		proc32.dwSize = sizeof(PROCESSENTRY32);
	 
		if( Process32First( hSnap, &proc32 ) )
  
		{
    
			do
			{
				hMSnp = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE,proc32.th32ProcessID); 

				if(hMSnp!=INVALID_HANDLE_VALUE)
				{

					 moduleentry32.dwSize = sizeof( MODULEENTRY32 ); 

					 if(Module32First(hMSnp, &moduleentry32))
					 {
						 do{
							 if(lstrcmp(moduleentry32.szModule,proc32.szExeFile)==0)
							 {
								 
								  memset(wcPath,0,500*2);

								 if(!((_wcsnicmp(moduleentry32.szExePath,
									 L"\\??\\",
									 lstrlen(L"\\??\\")) == 0)||
								 (_wcsnicmp(moduleentry32.szExePath,
									 L"\\SystemRoot\\",
									 lstrlen(L"\\SystemRoot\\")) == 0)
									 ))	
								 {	
									 lstrcpy(wcPath,L"\\??\\");
									 lstrcat(wcPath,moduleentry32.szExePath);

								 }else
								 {

									 lstrcpy(wcPath,moduleentry32.szExePath);

								 }
								 RtlInitUnicodeString(&usExeModName,wcPath);

									
								 InitializeObjectAttributes(&ObjAttr, 
										&usExeModName, 
										OBJ_CASE_INSENSITIVE, 
										NULL, NULL); 
    

								 status = NtCreateFile(&hFile,
														FILE_READ_DATA,
														&ObjAttr,
														&ioStatus,
														0,  
														FILE_ATTRIBUTE_NORMAL,
														FILE_SHARE_WRITE|FILE_SHARE_READ,
														FILE_OPEN,
														FILE_NON_DIRECTORY_FILE,
														NULL,
														0);

									
								 if (NT_SUCCESS(status))
									{
						
										
										wprintf(L"File %ws opened successfully\n",
																			wcPath);
										wprintf(L" file size = %d bytes\n",GetFileSize(hFile,0));
																
										NtClose(hFile);
									
								 }else 
								 {

									 
									 wprintf(L"Cannot open file %ws status = %X\n",
																		wcPath,
																		status);
								 }

								}

							}while( Module32Next(hMSnp, &moduleentry32));

					 }

				}



			}while(Process32Next(hSnap, &proc32));
  
		}	
  
	}

	Sleep(-1);
	
	return 0;
}