in PPLGuard/utils.cpp [174:201]
BOOL ProcessGetProtectionLevel(DWORD dwProcessId, PDWORD pdwProtectionLevel)
{
BOOL bReturnValue = FALSE;
HANDLE hProcess = NULL;
PROCESS_PROTECTION_LEVEL_INFORMATION level = { 0 };
if (!(hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, dwProcessId)))
{
PrintLastError(L"OpenProcess");
goto end;
}
if (!GetProcessInformation(hProcess, ProcessProtectionLevelInfo, &level, sizeof(level)))
{
PrintLastError(L"GetProcessInformation");
goto end;
}
*pdwProtectionLevel = level.ProtectionLevel;
bReturnValue = TRUE;
end:
if (hProcess)
CloseHandle(hProcess);
return bReturnValue;
}