通过读取KiWaitInListHead列出隐藏的进程

/*
有些ROOTKIT通过更改PsActiveProcess链表或相关Native API来隐藏进程.下面这个程序通过直接读取
KiWaitInListHead和KiWaitOutListHead(windows的dispatcher所使用的内核链表),来列出隐藏的进程.
技术细节请参照Jan K. Rutkowski的原文
http://www.blackhat.com/presentations/bh-usa-03/bh-us-03-rutkowski/rutkowski-antirootkit.zip.
原文的示范代码使用驱动来实现,这里使用了/Device/PhysicalMemory.代码很乱,勉强可以工作.这里感谢pjf的代码.
如果有错误的地方请斧正，如果你有更好的idea，与我分享？谢谢！
*/

/* code token from Jan K. Rutkowski(jkrutkowski<a>elka.pw.edu.pl) */
/*    and pjf (jfpan20000@sina.com)'s article */
/* compile under cygwin> gcc -o kps kps.c -I/usr/include/w32api/ddk -lntdll -lntoskrnl */
/* see Jan K. Rutkowski's article for more info. */

/* This tool will list all the procs include those hiden by some rootkit. 2003/10, fantas1a*/

#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
#include <ntddk.h>

typedef struct _KLISTER_PROCINFO {
    int pid;
    char name [18];
} KLISTER_PROCINFO, *PKLISTER_PROCINFO;

PLIST_ENTRY pKiWaitInListHead ;
PLIST_ENTRY pKiWaitOutListHead ;
PLIST_ENTRY pKiDispatcherReadyListHead ;
#define WAITLIST_OFFSET 0x5c    // in _KTHREAD

PVOID     g_pMapPhysicalMemory = NULL;
HANDLE     g_hMPM     = NULL;

#define MAX_PROCS 1000
KLISTER_PROCINFO procs[MAX_PROCS];
int nprocs = 0;

PVOID LinearToPhys(PULONG BaseAddress,PVOID addr)
{
    ULONG VAddr=(ULONG)addr,PGDE,PTE,PAddr;
    PGDE=BaseAddress[VAddr>>22];
    if ((PGDE&1)!=0)