不用浮点实现pid_驱动编程中如何由已知的进程PID获得进程名，不用路径

2009-2-18 00:45

呵呵，谢谢您的好意，上面的代码我是转的人家的，我是用Pascal写的，不过感觉写驱动的时候Pascal跟C区别不大了，我的理解，能看懂C应该也能看懂Pascal,那个EPROCESS结构的定义可不是好玩的，90个类型信息

PEPROCESS = ^EPROCESS;

EPROCESS = packed record

Pcb: KPROCESS;                {000}

ExitStatus: NTSTATUS;         {06C}

LockEvent: KEVENT;            {070}

LockCount: DWORD;             {080}

d084: DWORD;                  {084}

CreateTime: LARGE_INTEGER;    {088}

ExitTime: LARGE_INTEGER;      {090}

LockOwner: PVOID;             {098}

UniqueProcessId: DWORD;       {09C}

ActiveProcessLinks:LIST_ENTRY;{0A0}

QuotaPeakPoolUsage: array [0..1] of DWORD; {NP, P 0A8}

QuotaPoolUsage: array [0..1] of DWORD; {NP, P 0B0}

PagefileUsage: DWORD;         {0B8}

CommitCharge: DWORD;          {0BC}

PeakPagefileUsage: DWORD;     {0C0}

PeakVirtualSize: DWORD;       {0C4}

VirtualSize: LARGE_INTEGER;   {0C8}

Vm: MMSUPPORT;                {0D0}

SessionProcessLinks: LIST_ENTRY; {118}

DebugPort: PVOID;             {120}

ExceptionPort: PVOID;         {124}

ObjectTable: PVOID;           {128}

Token: PVOID;                 {12C}

WorkingSetLock: FAST_MUTEX;   {130}

WorkingSetPage: DWORD;        {150}

ProcessOutswapEnabled:BOOLEAN;{154}

ProcessOutswapped: BOOLEAN;   {155}

AddressSpaceInitialized: BOOLEAN; {156}

AddressSpaceDeleted: BOOLEAN; {157}

AddressCreationLock: FAST_MUTEX;{158}

HyperSpaceLock: DWORD;        {178}

ForkInProgress: PVOID;        {17C}

VmOperation: WORD;            {180}

ForkWasSuccessful: BOOLEAN;   {182}

MmAgressiveWsTrimMask: BYTE;  {183}

VmOperationEvent: PVOID;      {184}

PaeTop: PVOID;                {188}

LastFaultCount: DWORD;        {18C}

ModifiedPageCount: DWORD;     {190}

VadRoot: PVOID;               {194}

VadHint: PVOID;               {198}

CloneRoot: PVOID;             {19C}

NumberOfPrivatePages: DWORD;  {1A0}

NumberOfLockedPages: DWORD;   {1A4}

NextPageColor: WORD;          {1A8}

ExitProcessCalled: BOOLEAN;   {1AA}

CreateProcessReported:BOOLEAN;{1AB}

SectionHandle: PVOID;         {1AC}

Peb: PVOID;                   {1B0}

SectionBaseAddress: PVOID;    {1B4}

QuotaBlock: PVOID;            {1B8}

LastThreadExitStatus:NTSTATUS;{1BC}

WorkingSetWatch: PVOID;       {1C0}

Win32WindowStation: PVOID;    {1C4}

InheritedFromUniqueProcessId: PVOID;{1C8}

GrantedAccess: DWORD;         {1CC}

DefaultHardErrorProcessing: DWORD;{HEM_* 1D0}

LdtInformation: PVOID;        {1D4}

VadFreeHint: PVOID;           {1D8}

VdmObjects: PVOID;            {1DC}

DeviceMap: PVOID;             {1E0}

SessionId: DWORD;             {1E4}

PhysicalVadList: LIST_ENTRY;  {1E8}

Filter: QWORD;

PaePageDirectoryPage: DWORD;  {1F8}

ImageFileName: array [0..15] of char;{1FC}

VmTrimFaultValue: DWORD;      {20C}

SetTimerResolution: BYTE;     {210}

PriorityClass: BYTE;          {211}

SubSystemVersion: WORD; {212}

Win32Process: PVOID;          {214}

Job: PVOID;                   {218 PTR EJOB}

JobStatus: DWORD;             {21C}

JobLinks: LIST_ENTRY;         {220}

LockedPagesList: PVOID;       {228}

SecurityPort: PVOID;          {22C}

Wow64Process: PVOID;          {230 PTR WOW64_PROCESS}

ReadOperationCount: LARGE_INTEGER;{238}

WriteOperationCount: LARGE_INTEGER;{240}

OtherOperationCount: LARGE_INTEGER;{248}

ReadTransferCount: LARGE_INTEGER;{250}

WriteTransferCount: LARGE_INTEGER;{258}

OtherTransferCount: LARGE_INTEGER;{260}

CommitChargeLimit: DWORD;     {268}

CommitChargePeak: DWORD;      {26C}

ThreadListHead: LIST_ENTRY;   {270}

VadPhysicalPagesBitMap: PVOID;{278 PTR RTL_BITMAP}

VadPhysicalPages: DWORD;      {27C}

AweLock: DWORD;               {280}

d284h: DWORD;                 {284 padding}

end;