-
-
[分享]一个小小的内核遍历程序
-
发表于:
2014-2-17 14:40
5617
-
#include <ntddk.h>
VOID DriverUnload(PDRIVER_OBJECT pDriverObject)
{
}
NTSTATUS DriverEntry(
PDRIVER_OBJECT pDriverObject,
PUNICODE_STRING pRegistryPath)
{
PEPROCESS pEprocess = NULL;
PEPROCESS pFirstEprocess = NULL;
ULONG ulProcessName = 0;
ULONG ulProcessId = 0;
pDriverObject->DriverUnload = DriverUnload;
pEprocess = PsGetCurrentProcess();
if ( pEprocess == 0 )
{
KdPrint(("PsGetcurrentProcess Error ! \r\n"));
return STATUS_SUCCESS;
}
pFirstEprocess = pEprocess;
while ( pEprocess != NULL )
{
ulProcessName = (ULONG)pEprocess + 0x174;
ulProcessId = *(ULONG *)((ULONG)pEprocess + 0x84);
KdPrint(("ProcessName = %s, ProcessId = %d \r\n", ulProcessName, ulProcessId));
pEprocess = (PEPROCESS)(*(ULONG *)((ULONG)pEprocess + 0x88) - 0x88);
}
return STATUS_SUCCESS;
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
