Process operation related functions under Win drive

1. Let's get a reputation. Functions (exported)

// 1. 声明要使函数NTKERNELAPI NTSTATUS PsSuspendProcess(PEPROCESS pEProcess);NTKERNELAPI UCHAR* PsGetProcessImageFileName(IN PEPROCESS pEProcess);NTKERNELAPI NTSTATUS PsResumeProcess(PEPROCESS pEProcess);NTKERNELAPI HANDLE PsGetProcessInheritedFromUniqueProcessId(IN PEPROCESS pEProcess);

According to the PID return process eprocess, the failure returns nullpeprocess lookupprocess (HANDLE hpid) {peprocess peprocess = NULL;    if (Nt_success (Pslookupprocessbyprocessid (Hpid, &peprocess)) return peprocess; return NULL;}    Suspend Process Boolean kernelsuspendprocess (ULONG ID) {//1. eporcess peprocess peprocess by Id; if (peprocess = Lookupprocess ((HANDLE) Id)) = NULL) {//2. Suspend process if (Nt_success (Pssuspendprocess (peproces    s)) return FALSE; } return TRUE;    Recovery process Boolean kernelresumeprocess (ULONG ID) {//1. eporcess peprocess peprocess by Id; if (peprocess = Lookupprocess ((HANDLE) Id)) = NULL) {//2. Suspend process if (Nt_success (Psresumeprocess (peprocess    )) return FALSE; } return TRUE;    End process void Kernelkillprocess () {HANDLE hprocess = NULL;    client_id ClientId = {0};    Object_attributes objattribut = {sizeof (object_attributes)}; Clientid.uniqueprocess = (HANDLE) 1234; PID Clientid.uniqueThread = 0; Opens the process, if the handle is valid, ends the process zwopenprocess (&hprocess,//returns the open handle 1,//access permission &objat   Tribut,//object attribute &clientid);        Process ID Structure if (hprocess) {zwterminateprocess (hprocess, 0);    Zwclose (hprocess); };}    Traversal process void enumprocess () {peprocess peproc = NULL;    The Loop traversal process (assuming that the maximum value of the thread does not exceed 0x25600) ULONG i = 0;        for (i = 4; i<0x25600; i = i + 4) {//A. According to PID, return peprocess Peproc = lookupprocess ((HANDLE) i);        if (!peproc) continue;            B. Print process information Dbgprint ("eprocess=%p pid=%ld ppid=%ld name=%s\n", Peproc, (UINT32) Psgetprocessid (Peproc), (UINT32)        Psgetprocessinheritedfromuniqueprocessid (Peproc), Psgetprocessimagefilename (Peproc));        C. Reduce the Process object reference count by 1 obdereferenceobject (PEPROC);    Dbgprint ("\ n"); }}

Note that this is not the kind of normal traversal that is obtained through the chain. Because it is possible to deliberately break the chain. Here through the brute-force traversal (both process IDs are even)

Process operation related functions under Win drive