InitializeListHead
InsertHeadList
RemoveTailList
InitializeListHead
KeInitializeSpinLock
ExInterlockedInsertHeadListExInterlockedRemoveHeadList
KeInitializeSpinLock
KeAcquireSpinLock
KeReleaseSpinLock
KeRaiseIrqlToDpcLevel
KeLowerIrql
// 通过进程ID获取进程EPROCESS
PsLookupProcessByProcessId
//通过EPROCESS获取进程的句柄
ObOpenObjectByPointer