From be698bd806d1064e4bea65752a16c897977c61a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <carter.li@eoitek.com>
Date: Fri, 2 Dec 2022 01:01:48 +0800
Subject: [PATCH] Processes: don't hard code magic numbers (Windows)

---
 src/detection/processes/processes_windows.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/detection/processes/processes_windows.cpp b/src/detection/processes/processes_windows.cpp
index 2b267c4a5..860ee8998 100644
--- a/src/detection/processes/processes_windows.cpp
+++ b/src/detection/processes/processes_windows.cpp
@@ -5,6 +5,7 @@ extern "C" {
 
 #ifdef FF_USE_WIN_NTAPI
 
+#include <ntstatus.h>
 #include <winternl.h>
 
 uint32_t ffDetectProcesses(FFinstance* instance, FFstrbuf* error)
@@ -12,7 +13,7 @@ uint32_t ffDetectProcesses(FFinstance* instance, FFstrbuf* error)
     FF_UNUSED(instance);
 
     ULONG size = 0;
-    if(NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &size) != (NTSTATUS)0xC0000004 /*STATUS_INFO_LENGTH_MISMATCH*/)
+    if(NtQuerySystemInformation(SystemProcessInformation, nullptr, 0, &size) != STATUS_INFO_LENGTH_MISMATCH)
     {
         ffStrbufAppendS(error, "NtQuerySystemInformation(SystemProcessInformation, NULL) failed");
         return 0;