1

I am trying to get a process handle without success, I have read a lot about that but don't know why I cannot achieve it.

This is what I am doing:

enter image description here

$handle = $Kernel32::OpenProcess(PROCESS_ALL_ACCESS, FALSE, 4548)

I am doing it with admin rights, it seems like it doesn't like the PROCESS_ALL_ACCESS parameter. Any idea?

Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328
aDoN
  • 1,877
  • 4
  • 39
  • 55

1 Answers1

4

PowerShell doesn't recognize the symbolic constants you're trying to use there. Use the numeric values instead. For PROCESS_ALL_ACCESS that should be 1056763 or 0x00101ffb (and you also need $false instead of FALSE). However, you probably shouldn't be using PROCESS_ALL_ACCESS in the first place.

Try with PROCESS_QUERY_LIMITED_INFORMATION (numeric value 4096 or 0x1000):

$handle = $Kernel32::OpenProcess(0x1000, $false, 4548)
Ansgar Wiechers
  • 193,178
  • 25
  • 254
  • 328