遍历_EPROCESS->ActiveProcessLinks链表枚举进程

最新推荐文章于 2023-06-23 17:07:34 发布

125096

最新推荐文章于 2023-06-23 17:07:34 发布

阅读量1k

点赞数

分类专栏：驱动编程

本文链接：https://blog.csdn.net/qq125096885/article/details/73436724

版权

驱动编程专栏收录该内容

78 篇文章 6 订阅

订阅专栏

#include <ntddk.h>

UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);
HANDLE PsGetProcessInheritedFromUniqueProcessId(__in PEPROCESS Process);

VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)
{

}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
	pDriverObject->DriverUnload = HelloDDKUnload;


	DbgBreakPoint();

	PUCHAR pCurrentProcessName;
	HANDLE InheritedFromUniqueProcessId;
	HANDLE UniqueProcessId;
	PEPROCESS CurrentProcess;
	PLIST_ENTRY ListEntry;

	static int ActiveProcessLinks = 0x088;				//测试用(这里是XP系统)
	PLIST_ENTRY pProcessActiveProcessLinks = 0;

	CurrentProcess=PsGetCurrentProcess();
	pProcessActiveProcessLinks = (PLIST_ENTRY)((ULONG_PTR)CurrentProcess + ActiveProcessLinks);

	for (ListEntry = pProcessActiveProcessLinks->Flink;ListEntry != pProcessActiveProcessLinks;ListEntry = ListEntry->Flink)
	{
		CurrentProcess = (PEPROCESS)(*(ULONG_PTR*)((ULONG_PTR)CurrentProcess + ActiveProcessLinks) - ActiveProcessLinks);
		UniqueProcessId=PsGetProcessId(CurrentProcess);
		pCurrentProcessName=PsGetProcessImageFileName(CurrentProcess);
		InheritedFromUniqueProcessId=PsGetProcessInheritedFromUniqueProcessId(CurrentProcess);
		KdPrint(("%d %d %s\n", UniqueProcessId, InheritedFromUniqueProcessId, pCurrentProcessName));
	}
	

	return STATUS_SUCCESS;
}