改變進程名

改變進程名。

VOID NewName(UNICODE_STRING ProcessName){    ANSI_STRING OldProcessName;    PLIST_ENTRY ActivEProcessLinks;    PUNICODE_STRING FindProcessName;    ULONG EPROCESS,PEPROCESS,FirstEProcess;    PEPROCESS=FirstEProcess=EPROCESS=(ULONG)PsGetCurrentProcess();               while(TRUE)        {                PEPROCESS+=0x174;               __try               {                  RtlInitAnsiString(&OldProcessName,(PUCHAR)PEPROCESS);                }               __except(1)               {                }                if (strstr(OldProcessName.Buffer,"zhu")!=NULL)                 {                         PEPROCESS-=0x174;                        PEPROCESS+=0x1f4;                        __try                        {                          FindProcessName=*((ULONG*)PEPROCESS);                          RtlCopyUnicodeString(FindProcessName,&ProcessName);                          }                         __except(1)                        {                          PEPROCESS-=0x1f4;                         }                        PEPROCESS-=0x1f4;                }                 ActivEProcessLinks=(PLIST_ENTRY)(EPROCESS+0x88);                EPROCESS=(ULONG)ActivEProcessLinks->Flink-0x88;                PEPROCESS=EPROCESS;                if(EPROCESS==FirstEProcess)                break;        }}