void enum_DPC()
{
	ULONG KPRCB;

	PKTIMER_TABLE_ENTRY ktime_table_addr;
	_asm
	{
		push eax;
		mov eax, fs:[0x20];//KPCR地址
		mov KPRCB, eax;
		pop eax;
	}
	__try
	{
		PKTIMER pTimer;
		PLIST_ENTRY pList;
		ktime_table_addr = (PKTIMER_TABLE_ENTRY)(KPRCB + 0x1960 + 0x40);
		DbgPrint("KPRCB=%08X,KPRCB=%08x,ktime_table_addr=%08X\r\n", KPRCB, KPRCB, ktime_table_addr);
		PKTIMER_TABLE_ENTRY table = ktime_table_addr;
		for (int i = 0; i < 256; i++, table++)
		{
			if (!MmIsAddressValid((PVOID)table))
			{
				return;
			}
			if (table->Time.HighPart == 0xFFFFFFFF)
				continue;          //为空的数组高位双字为FFFFFFFF
			if (!MmIsAddressValid((PVOID)table->Entry.Blink))
				continue;
			if (!MmIsAddressValid((PVOID)table->Entry.Flink))
				continue;
			for (pList = table->Entry.Blink;
				pList != &table->Entry;
				pList = pList->Blink)
			{
				pTimer = (PKTIMER)((ULONG)pList - 0x18);        //取得timer对象

				if (!MmIsAddressValid((PVOID)pTimer) ||
					!MmIsAddressValid((PVOID)pTimer->Dpc) ||
					!MmIsAddressValid((PVOID)pTimer->Dpc->DeferredRoutine))
				{
					if (!MmIsAddressValid((PVOID)pList->Blink)) break;
					continue;
				}
				if (!MmIsAddressValid((PVOID)pList->Blink))
					break;


				DbgPrint("%d= TIMER=%X,DPC=%X,FUN=%X\r\n", i, pTimer, pTimer->Dpc, pTimer->Dpc->DeferredRoutine);
			}
		}
	}
	__except (EXCEPTION_EXECUTE_HANDLER)
	{
		return;
	}
}