I am hooking the SSDT of Windows 7 x64 (I already hooked it correctly and such - that's not the problem.) to bypass a certain Anti-Cheat for a game.
The problem: Trying to get the exe name is of no use since it always outputs svchost.exe for Windows services, and since the anticheat is doing it's work in a service I can't correctly "guess" which svchost.exe is the Anti-Cheat.
The (pseudo-)code:
NTSTATUS newOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId)
{
if(ClientId points to our game) // checks name of process to be opened
DbgPrint("%s", PsGetProcessImageFileName(PsGetCurrentProcess())); // svchost.exe - NEED THE SERVICE NAME
return oldOpenProcess(ProcessHandle, DesiredAccess, ObjectAttributes, ClientId);
}
Please note: THIS IS NOT FOR ANYTHING BUT LEARNING PURPOSES. This is not for malware or anything of the such; it is not illegal!