Enumeration on 0xGently

Process Enumeration-1

Sat, 17 Oct 2026 00:00:00 +0000

In this article, I will explain how to gather information about processes or threads using the CreateToolhelp32Snapshot function.

If we want to interact with a target process in the tools we develop or the malware we write, we first need to pinpoint exactly where that process resides in the system.

We will divide our operation into two main stages. First, starting with plain text (such as a process name like notepad.exe), we will scan all the processes on the system and extract our target’s unique identification number, namely its PID. In the second stage, using this PID we obtained, we will dive into the target process and capture a valid thread that we can manipulate or hijack.

Process Enumeration-2

Thu, 08 Oct 2026 00:00:00 +0000

Process Enumeration

Finding the Target’s PID Value (EnumProcesses)

When developing malware, we often need a legitimate running process (e.g., notepad.exe or explorer.exe) on the system to execute techniques like hiding or running our payload. We need to speak Windows’ language and find the PID (Process ID) value of that process.

This process of listing the active processes on the system to find our target’s PID or gather similar information about processes is generally called Process Enumeration. In this article, we will look step-by-step at how to do this from scratch using the standard Windows EnumProcesses API.

Process Enumeration-3

Mon, 05 Oct 2026 00:00:00 +0000

Process Enumeration

Finding the Target’s PID Value (NtQuerySystemInformation)

During malware development ,we generally need a legitimate process that already exists on the system (such as notepad.exe, explorer.exe, or svchost.exe) to hide our payload in memory or to execute various techniques in a stable manner.

This is exactly where we refer to the practice of listing the currently active processes on the system to extract our target’s PID value or to collect telemetry about processes, generally known as Process Enumeration. In our previous article, we looked step-by-step at how to perform this operation from scratch using Windows’ standard EnumProcesses API. However, in the cybersecurity world, there are always more complex and harder-to-learn ways…