windows驱动里通过进程ID获得进程名和所属用户

 在windows驱动中，通过 进程ID，可以获得进程完整路径和进程名，

也可以获得进程所属的用户名。

以下代码是整理出来完成这些功能的 两个实现函数。

// By fanxiushu 2013-07-02

///获得进程名

NTSTATUS get_process_name(int pid, PWCHAR* out_fullpath, PWCHAR* out_name )
{
    typedef NTSTATUS (*xxQUERY_INFO_PROCESS) (
    __in HANDLE ProcessHandle,
    __in PROCESSINFOCLASS ProcessInformationClass,
    __out_bcount(ProcessInformationLength) PVOID ProcessInformation,
    __in ULONG ProcessInformationLength,
    __out_opt PULONG ReturnLength
    );

    static xxQUERY_INFO_PROCESS ZwQueryInformationProcess = NULL ;
    NTSTATUS     status = STATUS_UNSUCCESSFUL;
    ULONG        returnedLength;
    ULONG        bufferLength;
    PVOID        buffer;
    PUNICODE_STRING imageName;
    HANDLE       handle;
   
    *out_name = NULL; *out_fullpath = 0;

    if( KeGetCurrentIrql() != PASSIVE_LEVEL ){
        DPT("IRQL Must PASSIVE_LEVEL.\n");
        return status;
    }

    if (NULL == ZwQueryInformationProcess) {

        UNICODE_STRING routineName;

        RtlInitUnicodeString(&routineName, L"ZwQueryInformationProcess");

        ZwQueryInformationProcess =
               (xxQUERY_INFO_PROCESS) MmGetSystemRoutineAddress(&routineName);

        if (NULL == ZwQueryInformationProcess) {
            DPT("Cannot resolve ZwQueryInformationProcess\n");
            return status ;
        }
    }
    ///get process handle;
    OBJECT_ATTRIBUTES ObjectAttributes;
    CLIENT_ID clientid;
    InitializeObjectAttributes(&ObjectAttributes, 0 ,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
    clientid.UniqueProcess = (HANDLE)pid;
    clientid.UniqueThread=0;
    status = ZwOpenProcess(&handle, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientid);
    if( !NT_SUCCESS(status)){
        return status;
    }
    //
    status = ZwQueryInformationProcess( handle,
        ProcessImageFileName,
        NULL, // buffer
                                        0, // buffer size
                                        &returnedLength);
    if (STATUS_INFO_LENGTH_MISMATCH != status) {

        ZwClose(handle);
        return status;
    }

    bufferLength = returnedLength - sizeof(UNICODE_STRING);
 
    buffer = ExAllocatePoolWithTag(NonPagedPool, returnedLength, 'FXSD');
    if (NULL == buffer) {

        ZwClose(handle);
        return STATUS_NO_MEMORY ;       
    }

    __try
    {

        status = ZwQueryInformationProcess( handle,
            ProcessImageFileName,
            buffer,
            returnedLength,
            &returnedLength);

        if (NT_SUCCESS(status)) {

            imageName = (PUNICODE_STRING) buffer;
            
            USHORT len = imageName->Length;
            RtlMoveMemory( buffer, imageName->Buffer, imageName->Length );
            RtlZeroMemory( ((PUCHAR)buffer) + len, sizeof(WCHAR) );

            *out_fullpath = (PWCHAR)buffer;

            PWCHAR ptr = wcsrchr( (PWCHAR)buffer, L'\\');
            if( ptr ){
                *out_name = ptr + 1;  
            }else{
                *out_name = (PWCHAR)buffer;
            }

            ZwClose(handle);
            return STATUS_SUCCESS;
        }
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        status = GetExceptionCode();
        DPT("get_process_name: Exception!!\n");
    }

    ZwClose(handle);
    ExFreePool(buffer);

    return status;    
}

///以上是获得进程名，函数用完，需要手动释放内存 ExFreePool( out_fullpath ); 

/

//获得进程所在用户,函数使用完，需要手动释放内存 ExFreePool( out_name);

//要能成功编译，需要 包含 ntifs.h头文件和添加 ksecdd.lib 库

static NTSTATUS get_procees_user( int pid, PWCHAR* out_name )
{
    NTSTATUS status = STATUS_UNSUCCESSFUL;
    *out_name = NULL;
    PEPROCESS pProcess = NULL;  
    PACCESS_TOKEN Token;
    LUID luid;
    PSecurityUserData userInformation = NULL;
    PWCHAR name = NULL;
    ///
    if( KeGetCurrentIrql() != PASSIVE_LEVEL ){
        DPT("IRQL Must PASSIVE_LEVEL.\n");
        return status;
    }
    
    status = PsLookupProcessByProcessId((HANDLE)pid, &pProcess );
    if(!NT_SUCCESS(status)){
        DPT("Not Find PID=%d\n", pid);
        return status;
    }

    Token = PsReferencePrimaryToken(pProcess);

    status = SeQueryAuthenticationIdToken(Token, &luid);
    if( !NT_SUCCESS(status)){
        DPT("SeQueryAuthenticationIdToken Error<%u>\n",status );
        goto E;
    }

    status = GetSecurityUserInfo(&luid, UNDERSTANDS_LONG_NAMES, &userInformation);
    if(!NT_SUCCESS(status) ){
        DPT("GetSecurityUserInfo Error<%u>\n",status );
        goto E;
    }

    name = (PWCHAR)ExAllocatePool(NonPagedPool, userInformation->UserName.Length +sizeof(WCHAR) );
    if(!name){
        status = STATUS_NO_MEMORY;
        goto E;
    }
    RtlZeroMemory( name, userInformation->UserName.Length +sizeof(WCHAR) );
    RtlCopyMemory( name, userInformation->UserName.Buffer, userInformation->UserName.Length );
    *out_name = name ;

E:
    ObDereferenceObject( pProcess );
    ObDereferenceObject( Token );
    if( userInformation )
        LsaFreeReturnBuffer( userInformation );
    return status;
}