遍历_EPROCESS->SessionProcessLinks链表枚举进程

最新推荐文章于 2025-02-21 09:29:42 发布

125096

最新推荐文章于 2025-02-21 09:29:42 发布

阅读量781

点赞数

CC 4.0 BY-SA版权

分类专栏：驱动编程

本文链接：https://blog.youkuaiyun.com/qq125096885/article/details/73468995

驱动编程专栏收录该内容

78 篇文章

订阅专栏

本文通过具体的代码示例，展示了如何使用Windows内核API进行进程信息获取与操作。包括利用PsGetProcessImageFileName等函数来读取进程名称，以及遍历进程链接列表来收集进程ID及其继承关系。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

#include <ntifs.h>
#include <ntddk.h>  

UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);
HANDLE PsGetProcessInheritedFromUniqueProcessId(__in PEPROCESS Process);

VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject)
{

}


NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath)
{
	pDriverObject->DriverUnload = HelloDDKUnload;


	DbgBreakPoint();

	PUCHAR pCurrentProcessName;
	HANDLE InheritedFromUniqueProcessId;
	HANDLE UniqueProcessId;
	PEPROCESS pEprocess;
	PEPROCESS CurrentProcess;
	PLIST_ENTRY ListEntry;
	NTSTATUS ntstatus;
	static int SessionProcessLinks = 0x0b4;              //测试用(这里是XP系统)  
	PLIST_ENTRY pProcessSessionProcessLinks = 0;

	//1.附加到一个用户进程
	//2.或者寻找一个有SessionProcessLinks的
	for (int i=4;i<=PAGE_SIZE;i+=4)
	{
		ntstatus = PsLookupProcessByProcessId((HANDLE)i, &pEprocess);
		if (NT_SUCCESS(ntstatus))
		{
			ObfDereferenceObject(pEprocess);
			pProcessSessionProcessLinks = (PLIST_ENTRY)((ULONG_PTR)pEprocess + SessionProcessLinks);

			if (pProcessSessionProcessLinks && pProcessSessionProcessLinks->Blink && pProcessSessionProcessLinks->Flink)
			{
				break;
			}
		}
	}



	CurrentProcess = pEprocess;
	for (ListEntry = pProcessSessionProcessLinks->Flink; ListEntry != pProcessSessionProcessLinks; ListEntry = ListEntry->Flink)
	{
		CurrentProcess = (PEPROCESS)(*(ULONG_PTR*)((ULONG_PTR)CurrentProcess + SessionProcessLinks) - SessionProcessLinks);
		if (MmIsAddressValid(CurrentProcess)==FALSE)
		{
			continue;
		}
		UniqueProcessId = PsGetProcessId(CurrentProcess);
		pCurrentProcessName = PsGetProcessImageFileName(CurrentProcess);
		InheritedFromUniqueProcessId = PsGetProcessInheritedFromUniqueProcessId(CurrentProcess);
		KdPrint(("%d %d %s\n", UniqueProcessId, InheritedFromUniqueProcessId, pCurrentProcessName));
	}


	return STATUS_SUCCESS;
}