2009-2-18 00:45
呵呵,谢谢您的好意,上面的代码我是转的人家的,我是用Pascal写的,不过感觉写驱动的时候Pascal跟C区别不大了,我的理解,能看懂C应该也能看懂Pascal,那个EPROCESS结构的定义可不是好玩的,90个类型信息
PEPROCESS = ^EPROCESS;
EPROCESS = packed record
Pcb: KPROCESS; {000}
ExitStatus: NTSTATUS; {06C}
LockEvent: KEVENT; {070}
LockCount: DWORD; {080}
d084: DWORD; {084}
CreateTime: LARGE_INTEGER; {088}
ExitTime: LARGE_INTEGER; {090}
LockOwner: PVOID; {098}
UniqueProcessId: DWORD; {09C}
ActiveProcessLinks:LIST_ENTRY;{0A0}
QuotaPeakPoolUsage: array [0..1] of DWORD; {NP, P 0A8}
QuotaPoolUsage: array [0..1] of DWORD; {NP, P 0B0}
PagefileUsage: DWORD; {0B8}
CommitCharge: DWORD; {0BC}
PeakPagefileUsage: DWORD; {0C0}
PeakVirtualSize: DWORD; {0C4}
VirtualSize: LARGE_INTEGER; {0C8}
Vm: MMSUPPORT; {0D0}
SessionProcessLinks: LIST_ENTRY; {118}
DebugPort: PVOID; {120}
ExceptionPort: PVOID; {124}
ObjectTable: PVOID; {128}
Token: PVOID; {12C}
WorkingSetLock: FAST_MUTEX; {130}
WorkingSetPage: DWORD; {150}
ProcessOutswapEnabled:BOOLEAN;{154}
ProcessOutswapped: BOOLEAN; {155}
AddressSpaceInitialized: BOOLEAN; {156}
AddressSpaceDeleted: BOOLEAN; {157}
AddressCreationLock: FAST_MUTEX;{158}
HyperSpaceLock: DWORD; {178}
ForkInProgress: PVOID; {17C}
VmOperation: WORD; {180}
ForkWasSuccessful: BOOLEAN; {182}
MmAgressiveWsTrimMask: BYTE; {183}
VmOperationEvent: PVOID; {184}
PaeTop: PVOID; {188}
LastFaultCount: DWORD; {18C}
ModifiedPageCount: DWORD; {190}
VadRoot: PVOID; {194}
VadHint: PVOID; {198}
CloneRoot: PVOID; {19C}
NumberOfPrivatePages: DWORD; {1A0}
NumberOfLockedPages: DWORD; {1A4}
NextPageColor: WORD; {1A8}
ExitProcessCalled: BOOLEAN; {1AA}
CreateProcessReported:BOOLEAN;{1AB}
SectionHandle: PVOID; {1AC}
Peb: PVOID; {1B0}
SectionBaseAddress: PVOID; {1B4}
QuotaBlock: PVOID; {1B8}
LastThreadExitStatus:NTSTATUS;{1BC}
WorkingSetWatch: PVOID; {1C0}
Win32WindowStation: PVOID; {1C4}
InheritedFromUniqueProcessId: PVOID;{1C8}
GrantedAccess: DWORD; {1CC}
DefaultHardErrorProcessing: DWORD;{HEM_* 1D0}
LdtInformation: PVOID; {1D4}
VadFreeHint: PVOID; {1D8}
VdmObjects: PVOID; {1DC}
DeviceMap: PVOID; {1E0}
SessionId: DWORD; {1E4}
PhysicalVadList: LIST_ENTRY; {1E8}
Filter: QWORD;
PaePageDirectoryPage: DWORD; {1F8}
ImageFileName: array [0..15] of char;{1FC}
VmTrimFaultValue: DWORD; {20C}
SetTimerResolution: BYTE; {210}
PriorityClass: BYTE; {211}
SubSystemVersion: WORD; {212}
Win32Process: PVOID; {214}
Job: PVOID; {218 PTR EJOB}
JobStatus: DWORD; {21C}
JobLinks: LIST_ENTRY; {220}
LockedPagesList: PVOID; {228}
SecurityPort: PVOID; {22C}
Wow64Process: PVOID; {230 PTR WOW64_PROCESS}
ReadOperationCount: LARGE_INTEGER;{238}
WriteOperationCount: LARGE_INTEGER;{240}
OtherOperationCount: LARGE_INTEGER;{248}
ReadTransferCount: LARGE_INTEGER;{250}
WriteTransferCount: LARGE_INTEGER;{258}
OtherTransferCount: LARGE_INTEGER;{260}
CommitChargeLimit: DWORD; {268}
CommitChargePeak: DWORD; {26C}
ThreadListHead: LIST_ENTRY; {270}
VadPhysicalPagesBitMap: PVOID;{278 PTR RTL_BITMAP}
VadPhysicalPages: DWORD; {27C}
AweLock: DWORD; {280}
d284h: DWORD; {284 padding}
end;