遍历_EPROCESS->Vm->WorkingSetExpansionLinks链表枚举进程

#include <ntifs.h>
#include <ntddk.h>  

UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);
HANDLE PsGetProcessInheritedFromUniqueProcessId(__in PEPROCESS Process);

VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)
{

}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
	pDriverObject->DriverUnload = HelloDDKUnload;


	DbgBreakPoint();

	PUCHAR pCurrentProcessName;
	HANDLE InheritedFromUniqueProcessId;
	HANDLE UniqueProcessId;
	PEPROCESS CurrentProcess;
	PLIST_ENTRY ListEntry;
	static int VmOffset = 0x1f8;													//测试用(这里是XP系统)  
	static int WorkingSetExpansionLinksOffset = 0x024;              //测试用(这里是XP系统)  

	static int pEprocessVmWorkingSetExpansionLinksOffset = 0x21C; //测试用(这里是XP系统) (上面两个相加的结果VmOffset+WorkingSetExpansionLinksOffset) 


	ULONG_PTR pEprocessVm = 0;
	PLIST_ENTRY pEprocessWorkingSetExpansionLinksOffset = NULL;


	CurrentProcess = PsGetCurrentProcess();
	pEprocessVm = (PULONG_PTR)((ULONG_PTR)CurrentProcess + VmOffset);
	pEprocessWorkingSetExpansionLinksOffset = (PLIST_ENTRY)((ULONG_PTR)pEprocessVm + WorkingSetExpansionLinksOffset);

	pEprocessWorkingSetExpansionLinksOffset= (PLIST_ENTRY)((ULONG_PTR)CurrentProcess + pEprocessVmWorkingSetExpansionLinksOffset);

	for (ListEntry = pEprocessWorkingSetExpansionLinksOffset->Flink; ListEntry != pEprocessWorkingSetExpansionLinksOffset; ListEntry = ListEntry->Flink)
	{
		//CurrentProcess = (PEPROCESS)(*(ULONG_PTR*)((ULONG_PTR)CurrentProcess + VmOffset+ WorkingSetExpansionLinksOffset) - VmOffset- WorkingSetExpansionLinksOffset);
		CurrentProcess = (PEPROCESS)(*(ULONG_PTR*)((ULONG_PTR)CurrentProcess + pEprocessVmWorkingSetExpansionLinksOffset) - pEprocessVmWorkingSetExpansionLinksOffset);
		if (MmIsAddressValid(CurrentProcess)==FALSE)
		{
			continue;
		}
		UniqueProcessId = PsGetProcessId(CurrentProcess);
		pCurrentProcessName = PsGetProcessImageFileName(CurrentProcess);
		InheritedFromUniqueProcessId = PsGetProcessInheritedFromUniqueProcessId(CurrentProcess);
		KdPrint(("%d %d %s\n", UniqueProcessId, InheritedFromUniqueProcessId, pCurrentProcessName));
	}


	return STATUS_SUCCESS;
}