用ZwQuerySystemInformation枚举进程

zapline

很基础的一个驱动代码

#include <ntddk.h>
#define SystemProcessesAndThreadsInformation 5

NTKERNELAPI NTSTATUS ZwQuerySystemInformation(
IN ULONG SystemInformationClass, // SYSTEM_INFORMATION_CLASS
IN OUT PVOID SystemInformation, //需要_SYSTEM_PROCESSES
IN ULONG SystemInformationLength,
OUT PULONG ReturnLength OPTIONAL);

typedef struct _SYSTEM_PROCESSES
{
ULONG NextEntryDelta;
ULONG ThreadCount;
ULONG Reserved[6];
LARGE_INTEGER CreateTime;
LARGE_INTEGER UserTime;
LARGE_INTEGER KernelTime;
UNICODE_STRING ProcessName;
KPRIORITY BasePriority;
ULONG ProcessId;
ULONG InheritedFromProcessId;
ULONG HandleCount;
ULONG Reserved2[2];
VM_COUNTERS VmCounters;
IO_COUNTERS IoCounters;
} _SYSTEM_PROCESSES,*PSYSTEM_PROCESSES;

BOOLEAN EnumProcessList()
{
ULONG cbBuffer = 0x8000; //等下开辟缓冲区的长度，先设为0x8000字节
PVOID pBuffer = NULL; //用来执行缓冲区
NTSTATUS rc; //返回值，等下获取信息的返回值放这里面
LPWSTR pszProcessName; //进程名
PSYSTEM_PROCESSES pInfo; //指向SYSTEM_PROCESSES的指针

do
{
pBuffer = ExAllocatePool (NonPagedPool, cbBuffer); //开辟内存，这里需要非分页内存

if (pBuffer == NULL) 
return FALSE; //申请不成功，直接返回失败，不继续了
rc = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation, pBuffer, cbBuffer, NULL);
//获取

if ( rc == STATUS_INFO_LENGTH_MISMATCH) //缓冲区不足
{
ExFreePool(pBuffer); 
//缓冲区不足，则先把申请好的删掉，再把申请内存的大小扩大一倍，等下再申请
cbBuffer *= 2; 
}
else if (!NT_SUCCESS(rc)) 
{
ExFreePool(pBuffer); 
//其它错误，直接返回失败，不继续
return FALSE; 
}
}while (rc == STATUS_INFO_LENGTH_MISMATCH);//直到有充足的缓冲区
//如果没有足够的缓冲区，就会接着循环，直到足够，然后获得了信息

pInfo = (PSYSTEM_PROCESSES)pBuffer;
//这时，缓冲区里就是返回来的进程信息了

while (1)
{
pszProcessName = pInfo->ProcessName.Buffer; 
//获取进程名
if (pszProcessName == NULL) 
{
pszProcessName = L"NULL";
//为空 则输出时也显示NULL
}
if (pInfo->ProcessId == 0)
{
DbgPrint("PID %5d System Idle Process", pInfo->ProcessId);
//PID是0，系统的
}
else
{
DbgPrint("PID %5d %ws", pInfo->ProcessId, pInfo->ProcessName.Buffer);
//输出PID和进程名
}

if (pInfo->NextEntryDelta == 0)
{
break;
//如果没有下一个就结束
}

pInfo = (PSYSTEM_PROCESSES)(((PUCHAR)pInfo) + pInfo->NextEntryDelta);
//指向下一个
}

ExFreePool(pBuffer);
//全部结束，释放内存
}

void unload(PDRIVER_OBJECT pO)
{

KdPrint(("unload\n"));
}

NTSTATUS DriverEntry( PDRIVER_OBJECT pObj , PUNICODE_STRING path)
{
pObj->DriverUnload = unload;
DbgPrint("load\n");

EnumProcessList();
//功能都在这个函数里

return 0;
}

vienna

高深的驱动