遍历_EPROCESS->ObjectTable->HandleTableList链表枚举进程

#include <ntifs.h>
#include <ntddk.h>  

UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);
HANDLE PsGetProcessInheritedFromUniqueProcessId(__in PEPROCESS Process);

VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)
{

}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
	pDriverObject->DriverUnload = HelloDDKUnload;


	DbgBreakPoint();

	PUCHAR pCurrentProcessName;
	HANDLE InheritedFromUniqueProcessId;
	HANDLE UniqueProcessId;
	PEPROCESS CurrentProcess;
	PLIST_ENTRY ListEntry;
	static int ObjectTableOffset = 0x0c4;						//测试用(这里是XP系统)  
	static int HandleTableListOffset = 0x01c;              //测试用(这里是XP系统)  
	static intQuotaProcessOffset = 0x04;						//测试用(这里是XP系统)  

//	+0x0c4 ObjectTable      : Ptr32 _HANDLE_TABLE

	//nt!_HANDLE_TABLE
	//	+ 0x000 TableCode        : 0xe239b000
	//	+ 0x004 QuotaProcess : 0x85fa4d08 _EPROCESS
	//	+ 0x008 UniqueProcessId : 0x00000218
	//	+ 0x00c HandleTableLock : [4] _EX_PUSH_LOCK
	//	+ 0x01c HandleTableList : _LIST_ENTRY[0xe21cf654 - 0xe221135c]
	//	+ 0x024 HandleContentionEvent : _EX_PUSH_LOCK
	//	+ 0x028 DebugInfo : (null)
	//	+0x02c ExtraInfoPages : 0
	//	+ 0x030 FirstFree : 0x360
	//	+ 0x034 LastFree : 0
	//	+ 0x038 NextHandleNeedingPool : 0x800
	//	+ 0x03c HandleCount : 213
	//	+ 0x040 Flags : 0
	//	+ 0x040 StrictFIFO : 0y0


	PLIST_ENTRY HandleTableList = 0;
	PULONG_PTR pEprocessObjectTable = NULL;


	CurrentProcess = PsGetCurrentProcess();
	pEprocessObjectTable = *(PULONG_PTR*)((ULONG_PTR)CurrentProcess + ObjectTableOffset);
	HandleTableList= (PLIST_ENTRY)((ULONG_PTR)pEprocessObjectTable + HandleTableListOffset);

	for (ListEntry = HandleTableList->Flink; ListEntry != HandleTableList; ListEntry = ListEntry->Flink)
	{
		CurrentProcess = *(PEPROCESS *)((PUCHAR)ListEntry - HandleTableListOffset + intQuotaProcessOffset);
		if (MmIsAddressValid(CurrentProcess)==FALSE)
		{
			continue;
		}
		UniqueProcessId = PsGetProcessId(CurrentProcess);
		pCurrentProcessName = PsGetProcessImageFileName(CurrentProcess);
		InheritedFromUniqueProcessId = PsGetProcessInheritedFromUniqueProcessId(CurrentProcess);
		KdPrint(("%d %d %s\n", UniqueProcessId, InheritedFromUniqueProcessId, pCurrentProcessName));
	}


	return STATUS_SUCCESS;
}