System-Wide Injection Portable-Executable (SwiPE)

IsProtectedProcess()

Example Code

function IsProtectedProcess(const dwProcessId: DWORD): BOOL; stdcall;

// Determines whether a process is "Protected" or not
// Vista introduced this type of process and it offers very few process and thread handle rights
// Injection will always fail due to the design of these processes. Protected processes validate any to-be-loaded DLLs by hashing the contents
// and checking this hash against an internal catalog of "signed" modules to be loaded. This API simply exists to check for this type of process
// OpenProcess() fails in all cases with the exception of SYNCHRONIZE, PROCESS_QUERY_LIMITED_INFORMATION (0x1000) and PROCESS_TERMINATE access by design

var
  hProcess: THandle;
  bIsProtected: BOOL;
  lpFileName: Array [0..MAX_PATH] of WChar;
  sPID: String;
  dwProcessId: DWORD;
begin
  sPID := InputBox('Enter Process Id', 'Process Id (PID)', '');
  Val(sPID, dwProcessId, dwProcessId);
  hProcess := OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, False, dwProcessId);
  if (hProcess <> 0) then
  begin
  bIsProtected := IsProtectedProcess(dwProcessId);
  ZeroMemory(@lpFileName, sizeof(lpFileName));
  GetProcessFileNameW(hProcess, @lpFileName);
  ShowMessage(Format('Process Name: %s'#13'Is Protected: %s', [lpFileName, BoolToStr(bIsProtected, True)]));
  CloseHandle(hProcess);
  end
else
  ShowMessage('Failed to Open Process');
end;