FAIL: VMMDLL_PidGetFromName about memprocfs HOT 4 CLOSED

target pc:

pcileech dump:

VMMDLL_PidGetFromName fails with both "FortniteClient-Win64-Shipping.exe" and "FortniteClient.exe"

from memprocfs.

Yes, it's a limitation at the moment. It's on the todo-list, but will probably take some time to fix due to me being busy with another thing that I hope to announce next week.

Currently only the 15 first characters of the process name is used (it's only 15 characters directly in the EPROCESS structure which I gather the information from).

Problem with VMMDLL_PidGetFromName is that it may return the wrong PID if there are multiple processes which have the same name (in the first 15 characters).

The workaround would be to walk the PID list calling VMMDLL_ProcessGetInformation for each PID, check for the name and some other telltale signs of the right process.

from memprocfs.

thanks - that works

from memprocfs.

Closing this issue since support for "Long Name" (full name) was added some time ago.

from memprocfs.