在PowerShell中获取流程句柄

Question

I am trying to get a process handle without success, I have read a lot about that but don't know why I cannot achieve it.

This is what I am doing:

$handle = $Kernel32::OpenProcess(PROCESS_ALL_ACCESS, FALSE, 4548)

I am doing it with admin rights, it seems like it doesn't like the PROCESS_ALL_ACCESS parameter. Any idea?

Answer 1

PowerShell doesn't recognize the symbolic constants you're trying to use there. Use the numeric values instead. For PROCESS_ALL_ACCESS that should be 1056763 or 0x00101ffb (and you also need $false instead of FALSE ). However, you probably shouldn't be using PROCESS_ALL_ACCESS in the first place.

Try with PROCESS_QUERY_LIMITED_INFORMATION (numeric value 4096 or 0x1000):

$handle = $Kernel32::OpenProcess(0x1000, $false, 4548)