Windows 驱动：获取当前进程名

 这是一个比较简单的问题，在 REGON 的源码中可以找到实现的相关代码，我只是把它们整理封装了一下。

//
// Process name max length: by bytes
// (This value is 16 bytes in RegMon)
//
#define MAX_PROC_NAME_LEN 256
//
// This is the offset into a KPEB of the current process name. This is determined
// dynamically by scanning the process block belonging to the GUI for its name.
//
ULONG                   ProcessNameOffset = 0;

//----------------------------------------------------------------------
//
// GetProcessNameOffset
//
// In an effort to remain version-independent, rather than using a
// hard-coded into the KPEB (Kernel Process Environment Block), we
// scan the KPEB looking for the name, which should match that
// of the GUI process
//
//----------------------------------------------------------------------