x64通过PspCidTable遍历进程

PspCidTable可以在PsLookupProcessByProcessId下寻找

我这硬编码了 只适用于win7 x64 其它版本需要自己改下特征码

#include <ntddk.h>


extern "C" NTKERNELAPI PVOID NTAPI  
ObGetObjectType(  
      IN PVOID pObject  
      ); 

extern "C" NTKERNELAPI UCHAR* 
PsGetProcessImageFileName(
	  IN PEPROCESS Process
	  );

#define   MAX_ENTRY_COUNT (0x1000/16)  //一级表中的 HANDLE_TABLE_ENTRY个数
#define   MAX_ADDR_COUNT   (0x1000/8) //二级表和 三级表中的地址个数

ULONG g_ProcessCount = 0;

typedef struct _EX_PUSH_LOCK                 // 7 elements, 0x8 bytes (sizeof) 
{                                                                              
              union                                    // 3 elements, 0x8 bytes (sizeof) 
              {                                                                          
                  struct                               // 5 elements, 0x8 bytes (sizeof) 
                  {                                                                      
/*0x000*/             UINT64       Locked : 1;         // 0 BitPosition                  
/*0x000*/             UINT64       Waiting : 1;        // 1 BitPosition                  
/*0x000*/             UINT64       Waking : 1;         // 2 BitPosition                  
/*0x000*/             UINT64       MultipleShared : 1; // 3 BitPosition                  
/*0x000*/             UINT64       Shared : 60;        // 4 BitPosition                  
                  };                                                                     
/*0x000*/         UINT64       Value;                                                    
/*0x000*/         VOID*        Ptr;                                                      
              };                                                                         
}EX_PUSH_LOCK, *PEX_PUSH_LOCK;                                                 
                
typedef struct _HANDLE_TRACE_DB_ENTRY // 4 elements, 0xA0 bytes (sizeof) 
          {                                                                        
/*0x000*/     struct _CLIENT_ID ClientId;       // 2 elements, 0x10 bytes (sizeof) 
/*0x010*/     VOID*        Handle;                                                 
/*0x018*/     ULONG32      Type;                                                   
/*0x01C*/     UINT8        _PADDING0_[0x4];