MCPcopy Create free account
hub / github.com/BeneficialCode/WinArk / EnumProcess

Function EnumProcess

Anti-Rootkit/ProcManager.cpp:42–57  ·  view source on GitHub ↗

ö�ٽ���

Source from the content-addressed store, hash-verified

40
41//ö�ٽ���
42void EnumProcess() {
43 ULONG i = 0;
44 PEPROCESS eproc = NULL;
45 for (i = 4; i < 262144; i+=4) {
46 eproc = LookupProcess((HANDLE)i);
47 if (eproc != NULL) {
48 ObDereferenceObject(eproc);
49 KdPrint(("EPROCESS=%p PID=%ld PPID=%ld Name=%s\n",
50 eproc, PsGetProcessId(eproc),
51 PsGetProcessInheritedFromUniqueProcessId(eproc),
52 PsGetProcessImageFileName(eproc)));
53 //EnumThread(eproc);
54 KdPrint(("\n"));
55 }
56 }
57}
58
59//���淽����������
60void ZwKillProcess(HANDLE Pid) {

Callers

nothing calls this directly

Calls 1

LookupProcessFunction · 0.85

Tested by

no test coverage detected