在内核态通过PID获取进程名!!

毛毛虫的原作：

 

VOID GetProcessNameByPid(IN ULONG ulPid, OUT PUNICODE_STRING ustrProcessName)
{
	NTSTATUS status = STATUS_SUCCESS;
	ULONG ulNeed = 0;
	PSYSTEM_PROCESSES pSystemProcess = NULL;
	PVOID pBuf = NULL;

	status = ZwQuerySystemInformation(SystemProcessInformation, pSystemProcess, 0, &ulNeed);
	if (!NT_SUCCESS(status) && ulNeed)
	{
		pBuf = ExAllocatePool(NonPagedPool, ulNeed);
		pSystemProcess = (PSYSTEM_PROCESSES)pBuf;
		if (pSystemProcess)
		{
			status = ZwQuerySystemInformation(SystemProcessInformation, pSystemProcess, ulNeed, &ulNeed);
			if (NT_SUCCESS(status))
			{
				//遍历进程
				while (pSystemProcess->NextEntryDelta)
				{
					if (ulPid == pSystemProcess->ProcessId)
					{
						RtlCopyUnicodeString(ustrProcessName, &pSystemProcess->ProcessName);
						break;
					}

					pSystemProcess = (PSYSTEM_PROCESSES)((ULONG)pSystemProcess + pSystemProcess->NextEntryDelta);
				}
			}

			if (pBuf)
			{
				ExFreePool(pBuf);
			}
		}
	}

	return;
}