RtlCopyMemory(Dest, Source->Buffer, Source->Length*sizeof(WCHAR));
Dest[Source->Length / sizeof(WCHAR)] = L'\0';

BOOLEAN GetProcessInfo(ProcessData *pProcessData)
{
EPROCESS *pEProcess = NULL;
NTSTATUS status;
UNICODE_STRING p;

if(KeGetCurrentIrql() > DISPATCH_LEVEL) {
 DBGOUT(("GetProcessInfo: IRQL too high. IRQL: %d", KeGetCurrentIrql()));
 return FALSE;
}

if(!pProcessData)
 return FALSE;

status = PsLookupProcessByProcessId(pProcessData->ulProcessID, (PEPROCESS *)&pEProcess);
if(!NT_SUCCESS(status)) {
 DBGOUT(("GetProcessInfo: PsLookupProcessByProcessId Failed: %08X", status));
 return FALSE;
}

if(!pEProcess) {
 DBGOUT(("GetProcessInfo: pEProcess is null!"));
 return FALSE;
}

pProcessData->ulParentPID = pEProcess->InheritedFromUniqueProcessId;
#if DBG
if(pProcessData->ulParentPID == 0)
 DBGOUT(("PID %d has a Parent PID of 0!", pProcessData->ulProcessID));

if(pProcessData->ulProcessID == 0)
 DBGOUT(("Process has a PID of 0!"));
#endif

RtlZeroMemory(&pProcessData->usProcessName, sizeof(UNICODE_STRING));
RtlZeroMemory(&pProcessData->usWindowTitle, sizeof(UNICODE_STRING));
RtlZeroMemory(&pProcessData->usUsername, sizeof(UNICODE_STRING));

if(!pEProcess->Peb) {
 DBGOUT(("GetProcessInfo: pEProcess->Peb is null!"));
 return FALSE;
} else {
 if(!pEProcess->Peb->ProcessParameters) {
  DBGOUT(("GetProcessInfo: pEPRocess->Peb->ProcessParameters is null!"));
  return FALSE;
 }

 pProcessData->usWindowTitle.MaximumLength = min(pEProcess->Peb->ProcessParameters->WindowTitle.Length + sizeof(WCHAR), PROCESSDATA_MAX_LENGTH - sizeof(WCHAR));
 //pProcessData->usWindowTitle.Buffer = (WCHAR *)ExAllocatePool(PagedPool, pProcessData->usWindowTitle.MaximumLength+  sizeof(WCHAR));
 pProcessData->usWindowTitle.Buffer = (PWSTR)ExAllocateFromNPagedLookasideList(&g_GetProcessLookasideList);
 RtlZeroMemory(pProcessData->usWindowTitle.Buffer, pProcessData->usWindowTitle.MaximumLength);
 RtlCopyUnicodeString(&pProcessData->usWindowTitle, &pEProcess->Peb->ProcessParameters->WindowTitle);

 // We only want the filename of the exe not the full path
 p.Buffer = wcsrchr(pEProcess->Peb->ProcessParameters->ImagePathName.Buffer, '\\') + 1;
 p.MaximumLength = p.Length = wcslen(p.Buffer) * sizeof(WCHAR);
 pProcessData->usProcessName.MaximumLength = min(p.Length + sizeof(WCHAR), PROCESSDATA_MAX_LENGTH - sizeof(WCHAR));
 pProcessData->usProcessName.Buffer = (PWSTR)ExAllocateFromNPagedLookasideList(&g_GetProcessLookasideList);
 RtlZeroMemory(pProcessData->usProcessName.Buffer, pProcessData->usProcessName.MaximumLength);
 RtlCopyUnicodeString(&pProcessData->usProcessName, &p);

 pProcessData->usUsername.MaximumLength = PROCESSDATA_MAX_LENGTH - sizeof(WCHAR);
 pProcessData->usUsername.Length = 0;
 pProcessData->usUsername.Buffer = (PWSTR)ExAllocateFromNPagedLookasideList(&g_GetProcessLookasideList);
 RtlZeroMemory(pProcessData->usUsername.Buffer, pProcessData->usUsername.MaximumLength + sizeof(WCHAR));

 if(!GetUserSIDFromProcess(pEProcess, &pProcessData->usUsername)) {
  DBGOUT(("GetProcessInfo: Unable to get UserSID From Process!"));
  ExFreeToNPagedLookasideList(&g_GetProcessLookasideList, pProcessData->usWindowTitle.Buffer);
  ExFreeToNPagedLookasideList(&g_GetProcessLookasideList, pProcessData->usProcessName.Buffer);
  RtlZeroMemory(&pProcessData->usProcessName, sizeof(UNICODE_STRING));
  RtlZeroMemory(&pProcessData->usWindowTitle, sizeof(UNICODE_STRING));
  RtlZeroMemory(&pProcessData->usUsername, sizeof(UNICODE_STRING));
  return FALSE;
 }
}

//DBGOUT(("GetProcessInfo: ProcName: %S UserName: %S WindowTitle: %S PID: %d", pProcessData->usProcessName.Buffer, pProcessData->usUsername.Buffer, pProcessData->usWindowTitle.Buffer, pProcessData->ulParentPID));
return TRUE;
}

procedure TNTDForm.TimerNtdTimer(Sender: TObject);
begin
 TimerNtd.Enabled:=False;
 CsGraphMainForm.SDDatabase1.StartTransaction;
 CsGraphMainForm.SDDatabase1.Commit;
 TimerNtd.Enabled:=True;
end;

UCHAR ThreadSeed; /* 066 */
UCHAR DisableBoost; /* 067 */
} KPROCESS;

UCHAR PowerState;
BOOLEAN DisableQuantum;
UCHAR IdealNode;
UCHAR Spare;
} KPROCESS, *PKPROCESS;

typedef struct _EPROCESS {
   KPROCESS                        Pcb; // +0x000
   EX_PUSH_LOCK                    ProcessLock; // +0x06c
   LARGE_INTEGER                   CreateTime; // +0x070
   LARGE_INTEGER                   ExitTime; // +0x078
   EX_RUNDOWN_REF                  RundownProtect; // +0x080
   ULONG                           UniqueProcessId; // +0x084
   LIST_ENTRY                      ActiveProcessLinks; // +0x088
   ULONG                           QuotaUsage[3]; // +0x090
   ULONG                           QuotaPeak[3]; // +0x09c
   ULONG                           CommitCharge; // +0x0a8
   ULONG                           PeakVirtualSize; // +0x0ac
   ULONG                           VirtualSize; // +0x0b0
   LIST_ENTRY                      SessionProcessLinks; // +0x0b4
   PVOID                           DebugPort; // +0x0bc
   PVOID                           ExceptionPort; // +0x0c0
   PHANDLE_TABLE                   ObjectTable; // +0x0c4
   EX_FAST_REF                     Token; // +0x0c8
   ULONG                           WorkingSetPage; // +0x0cc
   KGUARDED_MUTEX                  AddressCreationLock; // +0x0d0
   ULONG                           HyperSpaceLock; // +0x0f0
   PETHREAD                        ForkInProgress; // +0x0f4
   ULONG                           HardwareTrigger; // +0x0f8
   PMM_AVL_TABLE                   PhysicalVadRoot; // +0x0fc
   PVOID                           CloneRoot; // +0x100
   ULONG                           NumberOfPrivatePages; // +0x104
   ULONG                           NumberOfLockedPages; // +0x108
   PVOID                           Win32Process; // +0x10c
   PEJOB                           Job; // +0x110
   PVOID                           SectionObject; // +0x114
   PVOID                           SectionBaseAddress; // +0x118
   PEPROCESS_QUOTA_BLOCK           QuotaBlock; // +0x11c
   PPAGEFAULT_HISTORY              WorkingSetWatch; // +0x120
   PVOID                           Win32WindowStation; // +0x124
   ULONG                           InheritedFromUniqueProcessId; // +0x128
   PVOID                           LdtInformation; // +0x12c
   PVOID                           VadFreeHint; // +0x130
   PVOID                           VdmObjects; // +0x134
   PVOID                           DeviceMap; // +0x138
   PVOID                           Spare0[3]; // +0x13c
   union {
       HARDWARE_PTE                PageDirectoryPte; // +0x148
       UINT64                      Filler; // +0x148
   };
   PVOID                           Session; // +0x150
   UCHAR                           ImageFileName[16]; // +0x154
   LIST_ENTRY                      JobLinks; // +0x164
   PVOID                           LockedPagesList; // +0x16c
   LIST_ENTRY                      ThreadListHead; // +0x170
   PVOID                           SecurityPort; // +0x178
   PVOID                           PaeTop; // +0x17c
   ULONG                           ActiveThreads; // +0x180
   ULONG                           GrantedAccess; // +0x184
   ULONG                           DefaultHardErrorProcessing; // +0x188
   SHORT                           LastThreadExitStatus; // +0x18c
   PPEB                            Peb; // +0x190
   EX_FAST_REF                     PrefetchTrace; // +0x194
   LARGE_INTEGER                   ReadOperationCount; // +0x198
   LARGE_INTEGER                   WriteOperationCount; // +0x1a0
   LARGE_INTEGER                   OtherOperationCount; // +0x1a8
   LARGE_INTEGER                   ReadTransferCount; // +0x1b0
   LARGE_INTEGER                   WriteTransferCount; // +0x1b8
   LARGE_INTEGER                   OtherTransferCount; // +0x1c0
   ULONG                           CommitChargeLimit; // +0x1c8
   ULONG                           CommitChargePeak; // +0x1cc
   PVOID                           AweInfo; // +0x1d0

typedef struct _EPROCESS {
   KPROCESS Pcb;
   NTSTATUS ExitStatus;
   KEVENT LockEvent;
   ULONG LockCount;
   LARGE_INTEGER CreateTime;
   LARGE_INTEGER ExitTime;
   PKTHREAD LockOwner;

   HANDLE UniqueProcessId;

   LIST_ENTRY ActiveProcessLinks;

   //
   // Quota Fields
   //

   SIZE_T QuotaPeakPoolUsage[2];
   SIZE_T QuotaPoolUsage[2];

   SIZE_T PagefileUsage;
   SIZE_T CommitCharge;
   SIZE_T PeakPagefileUsage;

   //
   // VmCounters
   //

   SIZE_T PeakVirtualSize;
   SIZE_T VirtualSize;

   MMSUPPORT Vm;
   LIST_ENTRY SessionProcessLinks;

   PVOID DebugPort;
   PVOID ExceptionPort;
   PHANDLE_TABLE ObjectTable;

   //
   // Security
   //

   PACCESS_TOKEN Token;         // This field must never be null

   //

   FAST_MUTEX WorkingSetLock;
   PFN_NUMBER WorkingSetPage;
   BOOLEAN ProcessOutswapEnabled;
   BOOLEAN ProcessOutswapped;
   UCHAR AddressSpaceInitialized;
   BOOLEAN AddressSpaceDeleted;
   FAST_MUTEX AddressCreationLock;
   KSPIN_LOCK HyperSpaceLock;
   struct _ETHREAD *ForkInProgress;
   USHORT VmOperation;
   UCHAR ForkWasSuccessful;
   UCHAR MmAgressiveWsTrimMask;
   PKEVENT VmOperationEvent;
   PVOID PaeTop;
   ULONG LastFaultCount;
   ULONG ModifiedPageCount;
   PVOID VadRoot;
   PVOID VadHint;
   PVOID CloneRoot;
   PFN_NUMBER NumberOfPrivatePages;
   PFN_NUMBER NumberOfLockedPages;
   USHORT NextPageColor;
   BOOLEAN ExitProcessCalled;

   //
   // Used by Debug Subsystem
   //

   BOOLEAN CreateProcessReported;
   HANDLE SectionHandle;

   //
   // Peb
   //

   PPEB Peb;
   PVOID SectionBaseAddress;

   PEPROCESS_QUOTA_BLOCK QuotaBlock;
   NTSTATUS LastThreadExitStatus;
   PPAGEFAULT_HISTORY WorkingSetWatch;
   HANDLE Win32WindowStation;
   HANDLE InheritedFromUniqueProcessId;
   ACCESS_MASK GrantedAccess;
   ULONG DefaultHardErrorProcessing;
   PVOID LdtInformation;
   PVOID VadFreeHint;
   PVOID VdmObjects;
   PVOID DeviceMap;

   //
   // Id of the Hydra session in which this process is running
   //

   ULONG SessionId;

   LIST_ENTRY PhysicalVadList;
   union {
       HARDWARE_PTE PageDirectoryPte;
       ULONGLONG Filler;
   };
   ULONG PaePageDirectoryPage;
   UCHAR ImageFileName[ 16 ];
   ULONG VmTrimFaultValue;
   BOOLEAN SetTimerResolution;
   UCHAR PriorityClass;
   union {
       struct {
           UCHAR SubSystemMinorVersion;
           UCHAR SubSystemMajorVersion;
       };
       USHORT SubSystemVersion;
   };
   PVOID Win32Process;
   struct _EJOB *Job;
   ULONG JobStatus;
   LIST_ENTRY JobLinks;
   PVOID LockedPagesList;

   //
   // Used by rdr/security for authentication
   //

   PVOID SecurityPort ;              
   PWOW64_PROCESS Wow64Process;

   LARGE_INTEGER ReadOperationCount;
   LARGE_INTEGER WriteOperationCount;
   LARGE_INTEGER OtherOperationCount;
   LARGE_INTEGER ReadTransferCount;
   LARGE_INTEGER WriteTransferCount;
   LARGE_INTEGER OtherTransferCount;

   SIZE_T CommitChargeLimit;
   SIZE_T CommitChargePeak;

   LIST_ENTRY ThreadListHead;

   PRTL_BITMAP VadPhysicalPagesBitMap;
   ULONG_PTR VadPhysicalPages;
   KSPIN_LOCK AweLock;
} EPROCESS;

#define PS_JOB_STATUS_NOT_REALLY_ACTIVE      0x00000001
#define PS_JOB_STATUS_ACCOUNTING_FOLDED      0x00000002
#define PS_JOB_STATUS_NEW_PROCESS_REPORTED   0x00000004
#define PS_JOB_STATUS_EXIT_PROCESS_REPORTED  0x00000008
#define PS_JOB_STATUS_REPORT_COMMIT_CHANGES  0x00000010
#define PS_JOB_STATUS_LAST_REPORT_MEMORY     0x00000020

typedef EPROCESS *PEPROCESS;