cwindows64-bitwindows-nt

NtQueryInformationProcess ProcessConsoleHostProcess returns wrong Process ID


I am using NtQueryInformationProcess : ProcessConsoleHostProcess to query the process ID of the conhost.exe process that is associated with a console application in Windows 10 x64. The function returns a success status code, but I always get an odd number, which is always one more than the actual PID. See the screenshot. My code is complied for x64.

Is there anything wrong with this?


Solution

  • From memory, process ids are a multiple of 4. It wouldn't surprise me that the low two bits are being borrowed for some reason.