常用工具函数记录---(Kernel) PID-HANDLE-EPROCESS-PATH 转换

最新推荐文章于 2025-05-08 19:54:50 发布

沧海一浮萍_

最新推荐文章于 2025-05-08 19:54:50 发布

阅读量150

点赞数

分类专栏： Windows驱动开发文章标签： windows c++

本文链接：https://blog.youkuaiyun.com/wangmin1944/article/details/131289347

版权

Windows驱动开发专栏收录该内容

6 篇文章

订阅专栏

根据PID获取进程句柄：

HANDLE GetHandleByPid(ULONG iPid)
    {
        HANDLE  handle = 0;
        OBJECT_ATTRIBUTES ObjectAttributes;
        CLIENT_ID clientid;
        InitializeObjectAttributes(&ObjectAttributes, 0, OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
        clientid.UniqueProcess = (HANDLE)iPid;
        clientid.UniqueThread = 0;
        ZwOpenProcess(&handle, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientid);
        return handle;
    }

根据句柄获取进程PID:

    ULONG GetPidByHandle(HANDLE ProcessHandle)
    {
        ULONG pid = 0;
        PROCESS_BASIC_INFORMATION pbi;
        auto st = ZwQueryInformationProcess(ProcessHandle, ProcessBasicInformation, (PVOID)&pbi, sizeof(PROCESS_BASIC_INFORMATION), NULL);
        if(NT_SUCCESS(st))
        {
            pid = (ULONG)pbi.UniqueProcessId;
        }
        return pid;
    }

根据PID获取进程EPROCESS:

   PEPROCESS  GetPepByPid(ULONG iPid)
    {
        PEPROCESS pEProc=0;
        auto st =PsLookupProcessByProcessId((HANDLE)iPid, &pEProc);
        if(NT_SUCCESS(st))
        {
            ObDereferenceObject(pEProc);
        }
       
        return pEProc;
    }

根据PID获取进程全路径：


BOOLEAN  GetProcPathByPid(HANDLE hdPid, char* cPath)
{
	BOOLEAN bOk = FALSE;
	PEPROCESS pEpro = 0;
	PFILE_OBJECT FileObject=0;
	PUNICODE_STRING ImageName;
	char parname[512] = { 0 };
	if ((int)hdPid == 4)
	{
		char system[] = "System";
		strcpy(cPath, system);
		bOk = TRUE;
	}
	else
	{
		auto spath = GetProcPathByPid((ULONG)hdPid);
		if (spath.length() > 0)
		{
			strcpy(cPath, spath.c_str());
			bOk = TRUE;
		}
		else
		{
			if (NT_SUCCESS(PsLookupProcessByProcessId(hdPid, &pEpro)))
			{
				if (NT_SUCCESS(PsReferenceProcessFilePointer(pEpro, &FileObject)))
				{
					if (NT_SUCCESS(SeLocateProcessImageName((PEPROCESS)pEpro, &ImageName)))
					{
						StringUnicodeToAnsi(ImageName, parname, ImageName->Length);
						StringToLower(parname);
						strcpy(cPath, parname);
						bOk = TRUE;
					}
				}
				if (FileObject)
					ObDereferenceObject(FileObject);
			}
			if (pEpro)
				ObDereferenceObject(pEpro);
		}
		
	}

	return bOk;
}