From cc3595c3a4151fefa0363c56f49ed58935397d6a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E6=9D=8E=E9=80=9A=E6=B4=B2?= <zhangsongcui3371@sina.com>
Date: Mon, 16 Mar 2026 14:41:52 +0800
Subject: [PATCH] Processing (Windows): prefers NT APIs

---
 src/common/impl/processing_windows.c | 14 ++++++++------
 src/common/windows/nt.h              |  7 +++++++
 src/detection/wm/wm_windows.c        |  6 ++++--
 3 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/src/common/impl/processing_windows.c b/src/common/impl/processing_windows.c
index 4811031d9..11425ca32 100644
--- a/src/common/impl/processing_windows.c
+++ b/src/common/impl/processing_windows.c
@@ -216,12 +216,14 @@ exit:
 
 bool ffProcessGetInfoWindows(uint32_t pid, uint32_t* ppid, FFstrbuf* pname, FFstrbuf* exe, const char** exeName, FFstrbuf* exePath, bool* gui)
 {
-    FF_AUTO_CLOSE_FD HANDLE hProcess = pid == 0
-        ? NtCurrentProcess()
-        : OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
-
-    if (hProcess == NULL)
-        return false;
+    FF_AUTO_CLOSE_FD HANDLE hProcess = NtCurrentProcess();
+    if(pid != 0)
+    {
+        if (!NT_SUCCESS(NtOpenProcess(&hProcess, PROCESS_QUERY_LIMITED_INFORMATION, &(OBJECT_ATTRIBUTES) {
+            .Length = sizeof(OBJECT_ATTRIBUTES),
+        }, &(CLIENT_ID) { .UniqueProcess = (HANDLE)(uintptr_t) pid })))
+            return false;
+    }
 
     if(ppid)
     {
diff --git a/src/common/windows/nt.h b/src/common/windows/nt.h
index 1709e0b6f..f35e45db6 100644
--- a/src/common/windows/nt.h
+++ b/src/common/windows/nt.h
@@ -1098,3 +1098,10 @@ NTSYSAPI NTSTATUS NTAPI NtQueryKey(
     _In_ ULONG Length,
     _Out_ PULONG ResultLength
 );
+
+NTSYSAPI NTSTATUS NTAPI NtOpenProcess(
+    _Out_ PHANDLE ProcessHandle,
+    _In_ ACCESS_MASK DesiredAccess,
+    _In_ PCOBJECT_ATTRIBUTES ObjectAttributes,
+    _In_opt_ PCLIENT_ID ClientId
+);
diff --git a/src/detection/wm/wm_windows.c b/src/detection/wm/wm_windows.c
index b1b6268c9..a2bc1852f 100644
--- a/src/detection/wm/wm_windows.c
+++ b/src/detection/wm/wm_windows.c
@@ -52,8 +52,10 @@ static bool verifySignature(const wchar_t* filePath)
 
 static bool isProcessTrusted(DWORD processId, FFProcessType processType, UNICODE_STRING* buffer, size_t bufSize)
 {
-    FF_AUTO_CLOSE_FD HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processId);
-    if (!hProcess)
+    FF_AUTO_CLOSE_FD HANDLE hProcess = NULL;
+    if (!NT_SUCCESS(NtOpenProcess(&hProcess, PROCESS_QUERY_LIMITED_INFORMATION, &(OBJECT_ATTRIBUTES) {
+        .Length = sizeof(OBJECT_ATTRIBUTES),
+    }, &(CLIENT_ID) { .UniqueProcess = (HANDLE)(uintptr_t) processId })))
         return false;
 
     ULONG size;