|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 |
/* 获取线程所在的进程名称 by exchen 2009-10-05 */ #include <ntddk.h> VOID MyThreadProc(IN PVOID pContext) { PEPROCESS EPROCESSPROTECT = IoGetCurrentProcess(); PTSTR ProcessName=(PTSTR)((ULONG)EPROCESSPROTECT+0x174); KdPrint(("This Thread Run in %s Process\n",ProcessName)); DbgPrint("This is My Thread\n"); PsTerminateSystemThread(0); } VOID DriverUnload(IN PDRIVER_OBJECT DriverObject) { DbgPrint("驱动已经被停止了\n"); } NTSTATUS DriverEntry(IN PDRIVER_OBJECT DriverObject, IN PUNICODE_STRING RegistryPath) { HANDLE hMyThread; PsCreateSystemThread(&hMyThread, 0, NULL, NULL, NULL, MyThreadProc, NULL); ZwClose(hMyThread); DriverObject->DriverUnload = DriverUnload; return STATUS_SUCCESS; } |
转载请注明：exchen's blog » 获取线程所在的进程名称