内核中的 pid handle eprocess

记录使用。
转载至： csdn链接

1、pid->handle
OBJECT_ATTRIBUTES ObjectAttributes;
CLIENT_ID clientid;
InitializeObjectAttributes(&ObjectAttributes, 0 ,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
clientid.UniqueProcess = (HANDLE)pid;
clientid.UniqueThread=0;
ZwOpenProcess(&handle, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientid); 
handle即为所求。


2、handle->pid
PROCESS_BASIC_INFORMATION pbi;
ns = ZwQueryInformationProcess(ProcessHandle, ProcessBasicInformation, (PVOID)&pbi, sizeof(ProcessBasicInformation), NULL);
pid = pbi.UniqueProcessId; 
pid即为所求。


3、pid->eprocess
PEPROCESS pEProc;
PsLookupProcessByProcessId((HANDLE)pid, &pEProc);
ObDereferenceObject(pEProc); 
pEProc即为所求eprocess的指针。


4、handle->eprocess
st = ObReferenceObjectByHandle (ProcessHandle,
                                    PROCESS_TERMINATE,
                                    PsProcessType,
                                    KeGetPreviousModeByThread(&Self->Tcb),
                                    &Process,
                                    NULL);


5、eprocess->pid
_EPROCESS.UniqueProcessId即为所求，虽然声明类型为HANDLE，但实际上是pid。


6、eprocess->handle
Status = ObOpenObjectByPointer(
                    Process,
                    Attributes,
                    &AccessState,
                    0,
                    PsProcessType,
                    PreviousMode,
                    &Handle
                    );

下面是自己想到的：
HANDLE -> EPROCESS -> PID

PEPROCESS pEProcess;
	ULONG PID = NULL;
	NTSTATUS Status = ObReferenceObjectByHandle(ProcessHandle, FILE_READ_DATA, NULL, KernelMode, &pEProcess, NULL);
	if (NT_SUCCESS(Status))
	{
		PID = PsGetProcessId(pEProcess);
	}

内核中的 pid handle eprocess

留言