通过进程句柄获取进程PID和获取进程结构

DWORD HandleToPid(IN HANDLE hProcess)
{
	PROCESS_BASIC_INFORMATION pbi;
	if (NT_SUCCESS(NtQueryInformationProcess(hProcess, ProcessBasicInformation, &pbi, sizeof(PROCESS_BASIC_INFORMATION), 0)))
	{
		return (DWORD)pbi.UniqueProcessId;
	}
	return 0;
}
PETHREAD HandleToThread(IN HANDLE hThread)
{
	NTSTATUS status;
	PETHREAD Thread = NULL;

	status = ObReferenceObjectByHandle(
		hThread,
		NULL,
		(PVOID)* PsThreadType,
		KernelMode,
		&Thread,
		NULL);

	if (NT_SUCCESS(status))
	{
		ObDereferenceObject(Thread);
		return Thread;
	}
	else
	{
		return NULL;
	}
}
PEPROCESS HandleToProcess(IN HANDLE hProcess)
{
	NTSTATUS status;
	PEPROCESS Process = NULL;

	status = ObReferenceObjectByHandle(
		hProcess,
		NULL,
		*PsProcessType,
		KernelMode,
		&Process,
		NULL);

	if (NT_SUCCESS(status))
	{
		return Process;
	}
	else
	{
		return NULL;
	}
}