驱动编程，通过进程名获取进程结构

//功能:进程名,进程结构
VOID PsLookupProcessByProcessName(IN char* ProcessName, OUT PEPROCESS* Process)
{
	PLIST_ENTRY list = NULL;
	PLIST_ENTRY entry = NULL;
	PEPROCESS_S SystemProcess;
	PsLookupProcessByProcessId((HANDLE)4, (PEPROCESS*)&SystemProcess);
	list = entry = &SystemProcess->ActiveProcessLinks;

	do
	{
		list = list->Flink;

		*Process = (PEPROCESS_S)((PBYTE)list - 0x188);
		if (_stricmp(PsGetProcessImageFileName(*Process), ProcessName) == 0)
		{
			break;
		}
	} while (entry != list);

}