遍历_EPROCESS->ObjectTable->HandleTableList链表枚举进程

#include <ntifs.h>#include <ntddk.h>  UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);HANDLE PsGetProcessInheritedFromUniqueProcessId(__in PEPROCESS Process);VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath){pDriverObject->DriverUnload = HelloDDKUnload;DbgBreakPoint();PUCHAR pCurrentProcessName;HANDLE InheritedFromUniqueProcessId;HANDLE UniqueProcessId;PEPROCESS CurrentProcess;PLIST_ENTRY ListEntry;static int ObjectTableOffset = 0x0c4;//测试用(这里是XP系统)  static int HandleTableListOffset = 0x01c;              //测试用(这里是XP系统)  static intQuotaProcessOffset = 0x04;//测试用(这里是XP系统)  //+0x0c4 ObjectTable      : Ptr32 _HANDLE_TABLE//nt!_HANDLE_TABLE//+ 0x000 TableCode        : 0xe239b000//+ 0x004 QuotaProcess : 0x85fa4d08 _EPROCESS//+ 0x008 UniqueProcessId : 0x00000218//+ 0x00c HandleTableLock : [4] _EX_PUSH_LOCK//+ 0x01c HandleTableList : _LIST_ENTRY[0xe21cf654 - 0xe221135c]//+ 0x024 HandleContentionEvent : _EX_PUSH_LOCK//+ 0x028 DebugInfo : (null)//+0x02c ExtraInfoPages : 0//+ 0x030 FirstFree : 0x360//+ 0x034 LastFree : 0//+ 0x038 NextHandleNeedingPool : 0x800//+ 0x03c HandleCount : 213//+ 0x040 Flags : 0//+ 0x040 StrictFIFO : 0y0PLIST_ENTRY HandleTableList = 0;PULONG_PTR pEprocessObjectTable = NULL;CurrentProcess = PsGetCurrentProcess();pEprocessObjectTable = *(PULONG_PTR*)((ULONG_PTR)CurrentProcess + ObjectTableOffset);HandleTableList= (PLIST_ENTRY)((ULONG_PTR)pEprocessObjectTable + HandleTableListOffset);for (ListEntry = HandleTableList->Flink; ListEntry != HandleTableList; ListEntry = ListEntry->Flink){CurrentProcess = *(PEPROCESS *)((PUCHAR)ListEntry - HandleTableListOffset + intQuotaProcessOffset);if (MmIsAddressValid(CurrentProcess)==FALSE){continue;}UniqueProcessId = PsGetProcessId(CurrentProcess);pCurrentProcessName = PsGetProcessImageFileName(CurrentProcess);InheritedFromUniqueProcessId = PsGetProcessInheritedFromUniqueProcessId(CurrentProcess);KdPrint(("%d %d %s\n", UniqueProcessId, InheritedFromUniqueProcessId, pCurrentProcessName));}return STATUS_SUCCESS;}