- May 20, 2008
After recommending 4UTILS's @MODULE in another thread, I discovered:
It's not really a bug in @MODULE since, indeed, you can OpenProcess() using any of 4 different PIDs. I don't understand it (does anyone?) and asked in an MS newsgroup, showing a simple test in "C". I don't suppose this can be exploited. Shall I add a test to @MODULE to accept only the "base" PID (the visible one, the one which is 0 MOD 4)?
v:\> for /l %pid in (%@eval[%_pid - 1],1,%@eval[%_pid + 4]) echo %@module[%pid] N/A D:\tcmd10\tcc.exe D:\tcmd10\tcc.exe D:\tcmd10\tcc.exe D:\tcmd10\tcc.exe N/A