WRK列出进程和线程的详情

typedef struct _MyThread{
	int sid;
	char*name;
	int cidp[100][100];
	int cidt[100][100];
	int pid[100];
	char fileName[100][16];
	int count[100];
	int numberOfProcess;
}MyThread;

typedef MyThread* PMyThread;

NTSTATUS
NtWWHListThreadCall(
   __inout PVOID args
)
{
    NTSTATUS Status;
	PEPROCESS Process;
    PEPROCESS NextProcess;
	HANDLE hProcess;
	CLIENT_ID clientID;
	int numberOfThread;
	PMyThread pro = (PMyThread)args;
	PETHREAD CurrentThread;
    PETHREAD LockThread;
		
    PLIST_ENTRY firstPLIST_ENTRY;
	PLIST_ENTRY nextPLIST_ENTRY;

    PLIST_ENTRY firstThreadPLIST_ENTRY;
	PLIST_ENTRY nextThreadPLIST_ENTRY;
	
	int i = 0;
	int j = 0;
	int k = 0;
	OBJECT_ATTRIBUTES attr = {sizeof(OBJECT_ATTRIBUTES),0,0,0,NULL,NULL};
	PAGED_CODE();
	/*赋初值*/
	Status = STATUS_SUCCESS;
	Process = NULL;
	hProcess = NULL;
	LockThread = PsGetCurrentThread();
	clientID.UniqueProcess = (HANDLE)(pro->pid[0]);
    clientID.UniqueThread = (HANDLE)0;
    Status = ZwOpenProcess(&hProcess,PROCESS_DUP_HANDLE, &attr, &clientID);
    Status = ObReferenceObjectByHandle(hProcess,(ACCESS_MASK)0x400,0,KernelMode,&Process,NULL);
	PspLockProcessList (LockThread);
	if(ObReferenceObjectSafe(Process)){
		firstPLIST_ENTRY = Process->ActiveProcessLinks.Flink;
	    nextPLIST_ENTRY = Process->ActiveProcessLinks.Flink;
	/*第一个进程*/
	DbgPrint("your id is %d,name is %s",pro->sid,pro->name);
	pro->count[i] = Process->ActiveThreads;
	DbgPrint("number of thread is %d",pro->count[i]);
	for(j = 0;j < 16;j++)
		pro->fileName[i][j]=Process->ImageFileName[j];
	DbgPrint("filename is %s",pro->fileName[i]);

    firstThreadPLIST_ENTRY = Process->ThreadListHead.Flink;
	nextThreadPLIST_ENTRY = Process->ThreadListHead.Flink;
		}
	k = 0;
	while(nextThreadPLIST_ENTRY != NULL){
		CurrentThread = CONTAINING_RECORD(nextThreadPLIST_ENTRY, ETHREAD, ThreadListEntry);
		pro->cidp[i][k] = (int)CurrentThread->Cid.UniqueProcess;
		pro->cidt[i][k] = (int)CurrentThread->Cid.UniqueThread;
		DbgPrint("pid:%d,cid:%d",pro->cidp[i][k],pro->cidt[i][k]);
		nextThreadPLIST_ENTRY = nextThreadPLIST_ENTRY->Flink;
		k++;
		if(nextThreadPLIST_ENTRY == firstThreadPLIST_ENTRY)
			break;
		};
	i++;
	/*剩下的进程*/
	do{
		NextProcess = CONTAINING_RECORD(nextPLIST_ENTRY,EPROCESS, ActiveProcessLinks);
		if(ObReferenceObjectSafe(NextProcess)){
		firstThreadPLIST_ENTRY = NextProcess->ThreadListHead.Flink;
		nextThreadPLIST_ENTRY = NextProcess->ThreadListHead.Flink;
		k = 0;
		while(nextThreadPLIST_ENTRY != NULL){
			//DbgPrint("Reach there1");
			CurrentThread = CONTAINING_RECORD(nextThreadPLIST_ENTRY, ETHREAD, ThreadListEntry);
		    pro->cidp[i][k] = (int)CurrentThread->Cid.UniqueProcess;
		    pro->cidt[i][k] = (int)CurrentThread->Cid.UniqueThread;
			DbgPrint("pid:%d,cid:%d",pro->cidp[i][k],pro->cidt[i][k]);
			nextThreadPLIST_ENTRY = nextThreadPLIST_ENTRY->Flink;
			k++;
			if(nextThreadPLIST_ENTRY == firstThreadPLIST_ENTRY)
				break;
			}
	    pro->pid[i] = (int)NextProcess->UniqueProcessId;
	    pro->count[i] = NextProcess->ActiveThreads;
	    for(j = 0;j < 16;j++)
			pro->fileName[i][j] = NextProcess->ImageFileName[j];
			}
	    DbgPrint("pid is %d,number of thread is %d,filename is %s",pro->pid[i],pro->count[i],pro->fileName[i]);
	    //nextPLIST_ENTRY = NextProcess->ActiveProcessLinks.Flink;
	    nextPLIST_ENTRY = nextPLIST_ENTRY->Flink;
	    i++;
	}while(nextPLIST_ENTRY!= NULL && nextPLIST_ENTRY!= firstPLIST_ENTRY && i < 100 );
	
	pro->numberOfProcess = i;
	PspUnlockProcessList(LockThread);
	return Status;
	
}

 
C++:
#include "stdafx.h"

typedef struct _MyThread{
	int sid;
	char*name;
	int cidp[100][100];
	int cidt[100][100];
	int pid[100];
	char fileName[100][16];
	int count[100];
	int numberOfProcess;
}MyThread;

typedef MyThread* PMyThread;

void CallNtWWHListThreadCall(PMyThread cmd){
void* stackFrame = (void*)(&cmd);
__asm {
mov eax, 0x012A  system service num
mov edx, stackFrame
int 0x2E
}
}

int main(int argc, char* argv[])
{
	MyThread mc;
	int i,j;
	PMyThread pmc = &mc;
	pmc->sid = 1212603;
	pmc->name = "WWH";
	pmc->pid[0] = 3984;
    CallNtWWHListThreadCall(pmc);
	printf("********************\n学号：%d\t\t姓名：%s\t\t\n********************\n",pmc->sid,pmc->name);
	printf("pid\t\tfilename\t\tnumberOfThreads\t\t\n");
	for(i = 0;i < pmc->numberOfProcess;i++){
		printf("%d\t\t%s\t\t%d\t\t \n",pmc->pid[i],pmc->fileName[i],pmc->count[i]);
		for(j = 0;j < pmc->count[i];j++)
			printf("pid:%d\tcid:%d\t\t\n",pmc->cidp[i][j],pmc->cidt[i][j]);
		getchar();
	}
	return 0;
}