Windows 10 x64 Ring0 遍历进程

原理：进程PID都为4的整数倍

#include<ntifs.h>
#include <ntddk.h>
#include <stdio.h>
#include <stdlib.h>
#include<windef.h>
#include <winapifamily.h> 
#include <ntimage.h>
#include<wdm.h>
NTKERNELAPI NTSTATUS PsLookupProcessByProcessId(HANDLE ProcessId, PEPROCESS *Process);
NTKERNELAPI PCHAR PsGetProcessImageFileName(PEPROCESS Process);
VOID TraverseProcess() {
	NTSTATUS s = 0;
	PEPROCESS pe = NULL;
	for (size_t i = 0; i < 100000; i+=4)
	{
		s = PsLookupProcessByProcessId((HANDLE)i, &pe);
		if (NT_SUCCESS(s)){
		DbgPrint("ProcessName:%s,PID:",PsGetProcessImageFileName(pe),s)
		}
		pe = NULL;
		}
	}
}