内核获取进程名KeGetProcName

内核获取进程名，使用EPROCESS中的ImageFileName只能显示15个字节，如下：    +0x174 ImageFileName    : [16]  "aaaaaaaaaaaaaaa" 问了mo哥后发现SeAuditProcessCreationInfo中有ImageFileName 字段，类型为_OBJECT_NAME_INFORMATION，可以从该字段获取全路径和进程名。

一些使用日志记录如下

!process 0 0 ... PROCESS 85a51020  SessionId: 0  Cid: 0218    Peb: 7ffd5000  ParentCid: 0560     DirBase: 25951000  ObjectTable: e20a0738  HandleCount:  35.     Image: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaNOTEPADaaaaaaaaaaaaaaaaaaaaa.EXE ...

lkd> dt nt!_EPROCESS SeAuditProcessCreationInfo.ImageFileName 85a51020    +0x1f4 SeAuditProcessCreationInfo               :       +0x000 ImageFileName                            : 0x85a2de88 _OBJECT_NAME_INFORMATION lkd>  dt nt!_OBJECT_NAME_INFORMATION 0x85a2de88 -b    +0x000 Name             : _UNICODE_STRING "/Device/HarddiskVolume1/Documents and Settings/.../桌面/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaNOTEPADaaaaaaaaaaaaaaaaaaaaa.EXE"       +0x000 Length           : 0x106       +0x002 MaximumLength    : 0x108       +0x004 Buffer           : 0x85a2de90  "/Device/HarddiskVolume1/Documents and Settings/.../桌面/aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaNOTEPADaaaaaaaaaaaaaaaaaaaaa.EXE"

代码片断：

 

DWORD GetProcessNameOffset()
{
    DWORD ProcessNameOffset = 0;
    PEPROCESS curproc = PsGetCurrentProcess();
    int i;
    for( i = 0; i < 3*PAGE_SIZE; i++ ) 
    {
       if( !strncmp( "System", (PCHAR) curproc + i, strlen("System") ))
        {
            if (i<3*PAGE_SIZE)
            {
                ProcessNameOffset = i;
                DbgMsg("ProcessNameOffset: %.8X",ProcessNameOffset);
                break;
            }
        }
    }
    return ProcessNameOffset;
}



// Length of process name (rounded up to next DWORD)
#define PROCNAMELEN         20

/* Maximum length of NT process name */
#define NT_PROCNAMELEN      16

/* =================================================================================================

    复制进程名到指定的缓冲区：ImageFileName

 =================================================================================================== */

BOOL GetProcessName(PCHAR ImageFileName, DWORD dwProcessNameOffset)
{
    PEPROCESS   curproc;
    char        *nameptr;

    if(dwProcessNameOffset)
    {
        curproc = PsGetCurrentProcess();
        nameptr = (PCHAR) curproc + dwProcessNameOffset;
        strncpy(ImageFileName, nameptr, NT_PROCNAMELEN);
        ImageFileName[NT_PROCNAMELEN] = 0;    /* NULL at end */
        return TRUE;
    }

    return FALSE;
}

但是获取全名字还是需要修改，不同系统SeAuditProcessCreationInfo.ImageFileName位置不一样。