遍历_EPROCESS->Vm->WorkingSetExpansionLinks链表枚举进程

#include <ntifs.h>#include <ntddk.h>  UCHAR * PsGetProcessImageFileName(__in PEPROCESS Process);HANDLE PsGetProcessInheritedFromUniqueProcessId(__in PEPROCESS Process);VOID HelloDDKUnload(IN PDRIVER_OBJECT pDriverObject){}NTSTATUS DriverEntry(IN PDRIVER_OBJECT pDriverObject, IN PUNICODE_STRING pRegistryPath){pDriverObject->DriverUnload = HelloDDKUnload;DbgBreakPoint();PUCHAR pCurrentProcessName;HANDLE InheritedFromUniqueProcessId;HANDLE UniqueProcessId;PEPROCESS CurrentProcess;PLIST_ENTRY ListEntry;static int VmOffset = 0x1f8;//测试用(这里是XP系统)  static int WorkingSetExpansionLinksOffset = 0x024;              //测试用(这里是XP系统)  static int pEprocessVmWorkingSetExpansionLinksOffset = 0x21C; //测试用(这里是XP系统) (上面两个相加的结果VmOffset+WorkingSetExpansionLinksOffset) ULONG_PTR pEprocessVm = 0;PLIST_ENTRY pEprocessWorkingSetExpansionLinksOffset = NULL;CurrentProcess = PsGetCurrentProcess();pEprocessVm = (PULONG_PTR)((ULONG_PTR)CurrentProcess + VmOffset);pEprocessWorkingSetExpansionLinksOffset = (PLIST_ENTRY)((ULONG_PTR)pEprocessVm + WorkingSetExpansionLinksOffset);pEprocessWorkingSetExpansionLinksOffset= (PLIST_ENTRY)((ULONG_PTR)CurrentProcess + pEprocessVmWorkingSetExpansionLinksOffset);for (ListEntry = pEprocessWorkingSetExpansionLinksOffset->Flink; ListEntry != pEprocessWorkingSetExpansionLinksOffset; ListEntry = ListEntry->Flink){//CurrentProcess = (PEPROCESS)(*(ULONG_PTR*)((ULONG_PTR)CurrentProcess + VmOffset+ WorkingSetExpansionLinksOffset) - VmOffset- WorkingSetExpansionLinksOffset);CurrentProcess = (PEPROCESS)(*(ULONG_PTR*)((ULONG_PTR)CurrentProcess + pEprocessVmWorkingSetExpansionLinksOffset) - pEprocessVmWorkingSetExpansionLinksOffset);if (MmIsAddressValid(CurrentProcess)==FALSE){continue;}UniqueProcessId = PsGetProcessId(CurrentProcess);pCurrentProcessName = PsGetProcessImageFileName(CurrentProcess);InheritedFromUniqueProcessId = PsGetProcessInheritedFromUniqueProcessId(CurrentProcess);KdPrint(("%d %d %s\n", UniqueProcessId, InheritedFromUniqueProcessId, pCurrentProcessName));}return STATUS_SUCCESS;}