wineggdrop

Results 16 comments of wineggdrop

the exception is printer service is unavariable ---Original--- From: "Clément Labro"

windows server 2012 R2,unpatched machine

I wish I know since the same problem has bothered me for years. I wonder if it uses pdh counter data coz taskmgr loads pdh.dll,need to test it.

LONG GetCPUUsage() { HQUERY hQuery; char CPUUsage[] = "\\Processor(_Total)\\% Processor Time"; HCOUNTER hCounter; PDH_FMT_COUNTERVALUE fmtValue; DWORD ctrType; if (PdhOpenQuery(0,0,&hQuery) == ERROR_SUCCESS) { if (PdhAddCounter(hQuery,CPUUsage,0,&hCounter) == ERROR_SUCCESS) { if (PdhCollectQueryData(hQuery) ==...

![image](https://github.com/bytecode77/r77-rootkit/assets/12421939/efa4a2df-07c9-4aa6-be84-0b01aee58584) look like pdh getting the gpu stuff,but not cpu usage

the tool is dbgview,just showing the debug output taskmgr calls pdh api,but the query is all about gpu stuff PdhGetFormattedCounterArrayW will handle the "\\GPU Engine(*)\\Utilization Percentage" query value.If you hook...

chatgpt is very certain taskmgr using WMI to get the cpu usage,but I still doubt it.I hooked PdhGetFormattedCounterValue PdhGetRawCounterValue PdhGetFormattedCounterArrayA PdhGetFormattedCounterArrayW PdhGetRawCounterArrayA PdhGetRawCounterArrayW doesn't find any query about cpu usage...

I tested GetSystemTimes(),doesn't use this API to get cpu usage as well.

pretty much like the gpu stuff,and good luck