//功能:进程名,进程结构
VOID PsLookupProcessByProcessName(IN char* ProcessName, OUT PEPROCESS* Process)
{
PLIST_ENTRY list = NULL;
PLIST_ENTRY entry = NULL;
PEPROCESS_S SystemProcess;
PsLookupProcessByProcessId((HANDLE)4, (PEPROCESS*)&SystemProcess);
list = entry = &SystemProcess->ActiveProcessLinks;
do
{
list = list->Flink;
*Process = (PEPROCESS_S)((PBYTE)list - 0x188);
if (_stricmp(PsGetProcessImageFileName(*Process), ProcessName) == 0)
{
break;
}
} while (entry != list);
}
驱动编程,通过进程名获取进程结构
最新推荐文章于 2023-11-24 18:32:11 发布
关键词由CSDN通过智能技术生成