help me!HELP!

从system的EPROCESS开始遍历ActiveProcessLink就可以了嘛，进程路径可以从PEB里取，完整代码没时间写…

我自己写了一下代码，怕蓝屏！！请大侠们帮忙检查！！！！！
#include<ntddk.h>

PCWSTR GetCurrentProcessFileName(DWORD dwAddress)

{

      

       if(dwAddress == 0 || dwAddress == 0xFFFFFFFF)

              return NULL;

       dwAddress += 0x1B0;

       if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;

       dwAddress += 0x10;

       if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;

       dwAddress += 0x3C;

       if((dwAddress = *(DWORD*)dwAddress) == 0) return 0;

       KdPrint((“Current Process Full Path Name: %ws\n”,  (PCWSTR)dwAddress));

       return (PCWSTR)dwAddress;

}

VOID CheckProcess()
{
DWORD eprocess;
DWORD activeprocesslink;
DWORD nextlink;
DWORD nexteprocess;

eprocess=(DWORD)PsGetCurrentProcess();
activeprocesslink=eprocess+0x088;
nextlink=*(DWORD*)activeprocesslink;
if(!nextlink)
{
return;
}
while(nextlink!=activeprocesslink)
{
nexteprocess=nextlink-0x088;

GetCurrentProcessFileName(nexteprocess);

nextlink=*(DWORD*)nextlink;

}

}

VOID
  DDKUnload(
    IN PDRIVER_OBJECT  DriverObject
    )
{

DbgPrint("UNloading.....");

}

NTSTATUS
  DriverEntry(
    IN PDRIVER_OBJECT  DriverObject,
    IN PUNICODE_STRING  RegistryPath
    )
{

DbgPrint("registrypath is: %S",RegistryPath->Buffer);
DriverObject->DriverUnload =DDKUnload;
CheckProcess();

return STATUS_SUCCESS;

}

怕蓝屏就弄虚拟机。

不过有一回调试一个驱动，连虚拟机都挂了

你怕蓝屏？这理由…那个别人就不怕了？写驱动就不要怕蓝

驱动是蓝出来的

光看你的代码，应该回蓝屏 ,你可以试试