内核/驱动遍历进程 GetProcess/OpenProcess

yangdp345

#include <ntddk.h>


NTKERNELAPI
PVOID
MmGetSystemRoutineAddress (
    __in PUNICODE_STRING SystemRoutineName
);
NTKERNELAPI
NTSTATUS
PsLookupProcessByProcessId(
    __in HANDLE ProcessId,
    __deref_out PEPROCESS *Process
);

NTKERNELAPI
NTSTATUS
NTAPI
ObOpenObjectByPointer(
    IN PVOID   Object,
    IN ULONG   HandleAttributes,
    IN PACCESS_STATE   PassedAccessState   OPTIONAL,
    IN ACCESS_MASK   DesiredAccess   OPTIONAL,
    IN POBJECT_TYPE   ObjectType   OPTIONAL,
    IN KPROCESSOR_MODE   AccessMode,
    OUT PHANDLE   Handle
);
NTKERNELAPI
UCHAR *
PsGetProcessImageFileName(
    __in PEPROCESS Process
);

游客，如果您要查看本帖隐藏内容请回复