Merge pull request #965 from shyoshyo/fix_ntqueryinfoprocess_returnvalue

[*] fix NtQueryInformationProcess ZwQueryInformationProcess return value

Author: wtdcode

qiling/os/windows/dlls/ntdll.py

@@ -93,7 +93,7 @@ def _QueryInformationProcess(ql: Qiling, address: int, params):
 def hook_ZwQueryInformationProcess(ql: Qiling, address: int, params):
     # TODO have no idea if is cdecl or stdcall
 
-    _QueryInformationProcess(ql, address, params)
+    return _QueryInformationProcess(ql, address, params)
 
 # __kernel_entry NTSTATUS NtQueryInformationProcess(
 #   IN HANDLE           ProcessHandle,
@@ -112,7 +112,7 @@ def hook_ZwQueryInformationProcess(ql: Qiling, address: int, params):
 def hook_NtQueryInformationProcess(ql: Qiling, address: int, params):
     # TODO have no idea if is cdecl or stdcall
 
-    _QueryInformationProcess(ql, address, params)
+    return _QueryInformationProcess(ql, address, params)
 
 def _QuerySystemInformation(ql: Qiling, address: int, params):
     siClass = params["SystemInformationClass"]