[fsdhook]

Hi, everyone. I have a strange question.
I try to change process name in TASKMGR. How can I do that?
I try to change information in:
1.EPROCESS->ImageFileName
2.EPROCESS->SeAuditProcessCreationInfo->ImageFileName
3.EPROCESS->SectionObject->Segment->ControlArea->FilePointer->FileName
4.EPROCESS->PEB->ProcessParameters->ImagePathName
5.EPROCESS->PEB->ProcessParameters->CommandLine
6.EPROCESS->PEB->ProcessParameters->WindowTitle
7.EPROCESS->PEB->Ldr->InLoadOrderLinks->FullDllName
8.EPROCESS->PEB->Ldr->InMemoryOrderLinks->FullDllName
But it doesn't work.

[EP_X0FF]

It uses NtQuerySystemInformation.

[TETYYSs]

It uses NtQuerySystemInformation.

And what does NtQuerySystemInformation use to get it?

[EP_X0FF]

It uses NtQuerySystemInformation.

And what does NtQuerySystemInformation use to get it?

It uses EPROCESS->ImageFileName (limited to 16 chars) and for long filename (if available) from EPROCESS->SeAuditProcessCreationInfo->ImageFileName (full path to process as UNICODE_STRING).

[fsdhook]

It uses NtQuerySystemInformation.

And what does NtQuerySystemInformation use to get it?

It uses EPROCESS->ImageFileName (limited to 16 chars) and for long filename (if available) from EPROCESS->SeAuditProcessCreationInfo->ImageFileName (full path to process as UNICODE_STRING).

Hi, EP_X0FF, I want to change process name in TASKMGR.
Example: my process name is ABCD.EXE, but I want TASKMGR show my process name is QWER.EXE
How to do it? Do not use hook.
I change name info in this structure, but it doesn't useful.
1.EPROCESS->ImageFileName
2.EPROCESS->SeAuditProcessCreationInfo->ImageFileName
3.EPROCESS->SectionObject->Segment->ControlArea->FilePointer->FileName
4.EPROCESS->PEB->ProcessParameters->ImagePathName
5.EPROCESS->PEB->ProcessParameters->CommandLine
6.EPROCESS->PEB->ProcessParameters->WindowTitle
7.EPROCESS->PEB->Ldr->InLoadOrderLinks->FullDllName
8.EPROCESS->PEB->Ldr->InMemoryOrderLinks->FullDllName

[EP_X0FF]

Show your code, telepaths are not here. You either coded bugged stuff or XP taskmanager magically reads information from non existed fields.