One way to get the process name of the current user process in the kernel driver

One way to get the process name of the current user process in the kernel driver

In the kernel driver, you can use the psgetcurrentprocess function to obtain the eprocess structure address of the currently called driver process. many articles say that the process name is stored at the 0x174 offset of the eprocess structure. another method is provided to obtain the process name. the idea is as follows: the driver's Loading Function DriverEntry is running in the system process. you can use psgetcurrentprocess to obtain the address of the kernel eprocess structure of the system process, and then start searching for the "System" string from this address. find the offset of the eprocess process name. after obtaining the offset of the process name in the eprocess structure, the current process name can be obtained directly at this offset when a later process calls the driver. the Code is as follows:

 

DWORD getprocessnameoffset ()

{

Peprocess curproc;

DWORD procnameoffset;

Curproc = psgetcurrentprocess ();

For (INT I = 0; I <4096; I ++)

{

If (! Strncmp ("system", (pchar) curproc + I, strlen ("system ")))

{
Procnameoffset = I;

Return procnameoffset;

}

}

Return 0;
}