How to obtain the process name based on handle

When zwterminateprocess hook is written, the parameters that hook zwterminateprocess are handle processhandle and ntstatus exitstatus. The structure is as follows:

Ntstatus
Zwterminateprocess (
In handleProcesshandle,
In ntstatusExitstatus
);

When processhandle is null, it indicates that the process has ended. When the process ends other processes, processhandle points to the process object of the terminated process. To obtain the name of the terminated process, perform the following operations.

1. Obtain the eprocess pointer of the process through obreferenceobjectbyhandle.

2. Obtain the process name through the undisclosed function psgetprocessimagefilename.

The structure of psgetprocessimagefilename is as follows:

Uchar * psgetprocessimagefilename (
_ In peprocess Process
);

The Code is as follows:

void GetProcessNamebyHandle(HANDLE handle,PCHAR Name){PEPROCESS Process;NTSTATUS status;char *nameptr=NULL;status = ObReferenceObjectByHandle(handle,0,NULL,KernelMode,&Process,NULL);if(!NT_SUCCESS(status)){DbgPrint("GetProcessNamebyHandle failed\n");strcpy(nameptr,"Unkown");return;}//KdPrint(("Process:%x\n",Process));nameptr =PsGetProcessImageFileName(Process);strncpy(Name,nameptr,PROCNAMELEN);Name[PROCNAMELEN]=0x00;return;}

The fakedzwterminateprocess code is as follows:

NTSTATUS FakedZwTerminateProcess(IN HANDLE ProcessHandle,

 IN NTSTATUS ExitStatus){char aProcessName[PROCNAMELEN];char killedProName[PROCNAMELEN];NTSTATUS status;status = RealZwTerminateProcess(ProcessHandle,ExitStatus);if(NT_SUCCESS(status)&&NT_SUCCESS(ExitStatus)){GetProcessName(aProcessName); if(ProcessHandle==NULL){strncpy(killedProName,aProcessName,sizeof(aProcessName));}else{GetProcessNamebyHandle(ProcessHandle,killedProName);}sprintf(output,"TerminateProcess: %s --> %s\n",aProcessName,killedProName);KdPrint(("%s\n",output));}return status;}

The getprocessname (aprocessname) function is used to obtain the current process that calls zwterminateprocess.

For the implementation and principle of the Code, refer to the document on how to obtain the process name of the current user process in the kernel driver.