The driver's Loading Function DriverEntry is running in the system process. you can use psgetcurrentprocess to obtain the address of the kernel eprocess structure of the system process, and then start searching for the "System" string from this address. find the offset of the eprocess process name. after obtaining the offset of the process name in the eprocess structure, the current process name can be obtained directly at this offset when a later process calls the driver. the Code is as follows:
Code
1 DWORD getprocessnameoffset ()
2 {
3
4 peprocess curproc;
5
6 DWORD procnameoffset;
7
8 curproc = psgetcurrentprocess ();
9
10 For (INT I = 0; I <4096; I ++)
11
12 {
13
14 if (! Strncmp ("system", (pchar) curproc + I, strlen ("system ")))
15
16 {
17 procnameoffset = I;
18
19 Return procnameoffset;
20
21}
22
23}
24
25 return 0;
26}
27
Bool getprocessname (pchar thename)
{
Peprocess curproc;
Char * nameptr;
Ulong I;
Kirql oldirql;
If (gprocessnameoffset)
{
Curproc = psgetcurrentprocess ();
Nameptr = (pchar) curproc + procnameoffset;
Strncpy (thename, nameptr, nt_procnamelen );
Thename [nt_procnamelen] = 0;/** // * null at end */
Return true;
}
Return false;
}
This method is used in regmon.