android 枚举运行进程,用ZwQuerySystemInformation枚举进程

#include

#define SystemProcessesAndThreadsInformation 5

NTKERNELAPI NTSTATUS ZwQuerySystemInformation(

IN ULONG SystemInformationClass, // SYSTEM_INFORMATION_CLASS

IN OUT PVOID SystemInformation, //需要_SYSTEM_PROCESSES

IN ULONG SystemInformationLength,

OUT PULONG ReturnLength OPTIONAL);

typedef struct _SYSTEM_PROCESSES

{

ULONG NextEntryDelta;

ULONG ThreadCount;

ULONG Reserved[6];

LARGE_INTEGER CreateTime;

LARGE_INTEGER UserTime;

LARGE_INTEGER KernelTime;

UNICODE_STRING ProcessName;

KPRIORITY BasePriority;

ULONG ProcessId;

ULONG InheritedFromProcessId;

ULONG HandleCount;

ULONG Reserved2[2];

VM_COUNTERS VmCounters;

IO_COUNTERS IoCounters;

} _SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

BOOLEAN EnumProcessList()

{

ULONG cbBuffer = 0x8000; //等下开辟缓冲区的长度，先设为0x8000字节

PVOID pBuffer = NULL; //用来执行缓冲区

NTSTATUS rc; //返回值，等下获取信息的返回值放这里面

LPWSTR pszProcessName; //进程名

PSYSTEM_PROCESSES pInfo; //指向SYSTEM_PROCESSES的指针

do

{

pBuffer = ExAllocatePool (NonPagedPool, cbBuffer); //开辟内存，这里需要非分页内存

if (pBuffer == NULL)

return FALSE; //申请不成功，直接返回失败，不继续了

rc = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation, pBuffer, cbBuffer, NULL);

//获取

if ( rc == STATUS_INFO_LENGTH_MISMATCH) //缓冲区不足

{

ExFreePool(pBuffer);

//缓冲区不足，则先把申请好的删掉，再把申请内存的大小扩大一倍，等下再申请

cbBuffer *= 2;

}

else if (!NT_SUCCESS(rc))

{

ExFreePool(pBuffer);

//其它错误，直接返回失败，不继续

return FALSE;

}

}while (rc == STATUS_INFO_LENGTH_MISMATCH);//直到有充足的缓冲区

//如果没有足够的缓冲区，就会接着循环，直到足够，然后获得了信息

pInfo = (PSYSTEM_PROCESSES)pBuffer;

//这时，缓冲区里就是返回来的进程信息了

while (1)

{

pszProcessName = pInfo->ProcessName.Buffer;

//获取进程名

if (pszProcessName == NULL)

{

pszProcessName = L"NULL";

//为空 则输出时也显示NULL

}

if (pInfo->ProcessId == 0)

{

DbgPrint("PID %5d System Idle Process", pInfo->ProcessId);

//PID是0，系统的

}

else

{

DbgPrint("PID %5d %ws", pInfo->ProcessId, pInfo->ProcessName.Buffer);

//输出PID和进程名

}

if (pInfo->NextEntryDelta == 0)

{

break;

//如果没有下一个就结束

}

pInfo = (PSYSTEM_PROCESSES)(((PUCHAR)pInfo) + pInfo->NextEntryDelta);

//指向下一个

}

ExFreePool(pBuffer);

//全部结束，释放内存

}

void unload(PDRIVER_OBJECT pO)

{

KdPrint(("unload\n"));

}

NTSTATUS DriverEntry( PDRIVER_OBJECT pObj , PUNICODE_STRING path)

{

pObj->DriverUnload = unload;

DbgPrint("load\n");

EnumProcessList();

//功能都在这个函数里

return 0;

}