r0调用ntOpenprocess函数枚举进程

需要先把Kthread中的PreviousMode的值置成KernelMode

因为调用CqEnumProcessInfoByMyOpenProcess这个函数的时候，是由应用层的程序调用DeviceIoControl进入内核的，所以要经过

Kifastcallentry，Kifastcallentry在执行中会把当前要进入内核的这个线程的PreviousMode设置成UserMode，所以当我调用NtOpenProcess时，NtOpenprocess在执行中会判断当前的调用模式，如果不改Kthread中的PreviousMode，NtOpenprocess发现是UserMode,所以要判断clientId则个参数的地址是不是用户层地址，当它发现这个地址是内核地址的时候，执行就是败了，所以要把当前线程的Ktrhead的PerviousMode这个值置成KernelMode，欺骗NtOpenProcess,，这样NtOpenProcess判断的时候就认为这个调用是内核的调用，所以就可以执行成功。

NTSTATUS  CqEnumProcessInfoByMyOpenProcess(PPROCESS_INFO pProcessInfo)
{
 NTSTATUS Status = STATUS_UNSUCCESSFUL;
 CLIENT_ID ClientId = {0};
 ULONG i = 0;
 HANDLE ProcessHandle = 0;
 PEPROCESS Process = NULL;
 PKTHREAD Kthread = NULL;
 OBJECT_ATTRIBUTES ProcAttr = {0};

 InitializeObjectAttributes(&ProcAttr, 0, 0, 0, 0);
 Kthread = (PKTHREAD)PsGetCurrentThread();
 *((PUCHAR)Kthread + CqGetOffset(enumPreviousModeOffsetByKthread)) = KernelMode;
 for(i = 0; i < 65535; i++)
 {
  ClientId.UniqueProcess = (HANDLE)i;
  Status = MyNtOpenProcess(&ProcessHandle, PROCESS_ALL_ACCESS , &ProcAttr, &ClientId);
  if( STATUS_SUCCESS == Status )
  {
   Status = PsLookupProcessByProcessId(i, &Process);
   if( STATUS_SUCCESS != Status )
   {
    goto Exit0;
   }
   Status = CqSetProcessInfoByEProcess(pProcessInfo, Process);
   if( NULL != Process )
   {
    ObDereferenceObject(Process);
   }
   if( NULL != ProcessHandle )
   {
    ZwClose(ProcessHandle);
   }
   ProcessHandle = 0;
   Process = 0;
   i+=3;
  }
  else
  {
   continue;
  }

 }

 *((PUCHAR)Kthread + CqGetOffset(enumPreviousModeOffsetByKthread)) = UserMode;

 Status = STATUS_SUCCESS;
Exit0:
 return Status;
}