在内核态通过PID获取进程名!!

最新推荐文章于 2024-08-15 09:36:34 发布

「已注销」

最新推荐文章于 2024-08-15 09:36:34 发布

阅读量3k

点赞数

分类专栏：内核编程

内核编程专栏收录该内容

5 篇文章 0 订阅

订阅专栏

毛毛虫的原作：

VOID GetProcessNameByPid(IN ULONG ulPid, OUT PUNICODE_STRING ustrProcessName)
{
	NTSTATUS status = STATUS_SUCCESS;
	ULONG ulNeed = 0;
	PSYSTEM_PROCESSES pSystemProcess = NULL;
	PVOID pBuf = NULL;

	status = ZwQuerySystemInformation(SystemProcessInformation, pSystemProcess, 0, &ulNeed);
	if (!NT_SUCCESS(status) && ulNeed)
	{
		pBuf = ExAllocatePool(NonPagedPool, ulNeed);
		pSystemProcess = (PSYSTEM_PROCESSES)pBuf;
		if (pSystemProcess)
		{
			status = ZwQuerySystemInformation(SystemProcessInformation, pSystemProcess, ulNeed, &ulNeed);
			if (NT_SUCCESS(status))
			{
				//遍历进程
				while (pSystemProcess->NextEntryDelta)
				{
					if (ulPid == pSystemProcess->ProcessId)
					{
						RtlCopyUnicodeString(ustrProcessName, &pSystemProcess->ProcessName);
						break;
					}

					pSystemProcess = (PSYSTEM_PROCESSES)((ULONG)pSystemProcess + pSystemProcess->NextEntryDelta);
				}
			}

			if (pBuf)
			{
				ExFreePool(pBuf);
			}
		}
	}

	return;
}