On Mon Aug 21 11:00:30 2023 +0000, Jacek Caban wrote:
`GetCurrentProcessId()` will return parent process ID at this stage. Should we use something like `peb->ProcessParameters->ProcessGroupId` here instead?
yes, good catch (or even more simply, check for params->ProcessGroupId being 0).
I'll update the MR.