能力值：
( LV2，RANK：10 )
|
-
-
2 楼
eprocess
|
能力值：
( LV2，RANK：10 )
|
-
-
3 楼
NTSTATUS
PsLookupProcessByProcessId(
IN HANDLE ProcessId,
OUT PEPROCESS *Process
);
NTKERNELAPI
UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);
|
能力值：
( LV2，RANK：10 )
|
-
-
4 楼
//获取进程路径
PUNICODE_STRING GetProcessImagePath(HANDLE ProcessId)
{
//定义变量
NTSTATUS status = STATUS_UNSUCCESSFUL;
HANDLE ProcessHandle = NULL;
ULONG ulen = 0;
PVOID pImagePath = NULL;
do
{
ProcessHandle = MyOpenQueryInfoProcess(ProcessId);
if (ProcessHandle == NULL)break;
status = ZwQueryInformationProcess(ProcessHandle, ProcessImageFileName, NULL,0, &ulen);
if (status != STATUS_INFO_LENGTH_MISMATCH || ulen <= 0)break;
ulen += sizeof(UNICODE_STRING);
pImagePath = ExAllocatePool(NonPagedPool, ulen);
RtlZeroMemory(pImagePath, ulen);
status = ZwQueryInformationProcess(ProcessHandle, ProcessImageFileName, pImagePath, ulen, &ulen);
} while (FALSE);
SafeCloseHandle(ProcessHandle);
if (!NT_SUCCESS(status))
{
ASSERT(FALSE);
SafeFreeDelete(pImagePath);
}
return pImagePath;
}
|
能力值：
( LV2，RANK：10 )
|
-
-
5 楼
//获取进程路径
PUNICODE_STRING GetCurrentProcessImagePath()
{
//定义变量
NTSTATUS status = STATUS_UNSUCCESSFUL;
ULONG ulen = 0;
PVOID pImagePath = NULL;
do
{
//打开进程
status = ZwQueryInformationProcess(NtCurrentProcess(), ProcessImageFileName, NULL, 0, &ulen);
if (status != STATUS_INFO_LENGTH_MISMATCH || ulen <= 0)break;
ulen += sizeof(UNICODE_STRING);
pImagePath = ExAllocatePool(NonPagedPool, ulen);
RtlZeroMemory(pImagePath, ulen);
status = ZwQueryInformationProcess(NtCurrentProcess(), ProcessImageFileName, pImagePath, ulen, &ulen);
} while (FALSE);
if (!NT_SUCCESS(status))
{
ASSERT(FALSE);
SafeFreeDelete(pImagePath);
}
return pImagePath;
}
|
能力值：
( LV2，RANK：10 )
|
-
-
6 楼
谢谢楼上各位大爷
|
|
|
|
