枚举进程（1）——遍历通过EPROCESS结构的ActiveProcessLinks链表

#define EPROCESS_SIZE		1
#define PEB_OFFSET			2
#define FILE_NAME_OFFSET		3
#define PROCESS_LINK_OFFSET		4
#define PROCESS_ID_OFFSET		5
#define EXIT_TIME_OFFSET		6

typedef ULONG	DWORD ;

typedef struct _PROCESS_INFO {
	DWORD	dwProcessId ;
	PUCHAR	pImageFileName ;
} PROCESS_INFO, *PPROCESS_INFO ;

DWORD GetPlantformDependentInfo ( DWORD dwFlag )
{ 
	DWORD current_build; 
	DWORD ans = 0; 

	PsGetVersion(NULL, NULL, ¤t_build, NULL); 

	switch ( dwFlag )
	{ 
	case EPROCESS_SIZE: 
		if (current_build == 2195) ans = 0 ;		// 2000，当前不支持2000，下同
		if (current_build == 2600) ans = 0x25C;		// xp
		if (current_build == 3790) ans = 0x270;		// 2003
		break; 
	case PEB_OFFSET: 
		if (current_build == 2195)	ans = 0; 
		if (current_build == 2600)	ans = 0x1b0; 
		if (current_build == 37