예제 #1
0
        // Token: 0x060000C2 RID: 194 RVA: 0x0000BB84 File Offset: 0x00009D84
        public static bool InjectionIsRunning()
        {
            IntPtr intPtr = Injection.OpenMutex(2031617u, false, "83729184726481");

            Injection.CloseHandle(intPtr);
            return(!(intPtr == IntPtr.Zero));
        }
예제 #2
0
        // Token: 0x060000C1 RID: 193 RVA: 0x0000BAFC File Offset: 0x00009CFC
        public static string GetCurrentProcessOwner(IntPtr processHandle)
        {
            IntPtr zero = IntPtr.Zero;

            string result;

            try
            {
                Injection.OpenProcessToken(processHandle, Injection.TOKEN_QUERY, ref zero);
                WindowsIdentity windowsIdentity = new WindowsIdentity(zero);
                result = windowsIdentity.Name.Substring(windowsIdentity.Name.IndexOf("\\") + 1);
            }
            catch (Exception ex)
            {
                Exception ex2 = ex;
                throw ex2;
            }
            finally
            {
                if (zero != IntPtr.Zero)
                {
                    Injection.CloseHandle(zero);
                }
            }
            return(result);
        }