| 17 | } |
| 18 | |
| 19 | void EnumThread(PEPROCESS Process) { |
| 20 | ULONG i = 0; |
| 21 | PETHREAD ethrd = nullptr; |
| 22 | PEPROCESS eproc = nullptr; |
| 23 | for (i = 4; i < 262144; i = i + 4) { // �����PID��TID��Χ�е����⣬�Ժ����� |
| 24 | ethrd = LookupThread((HANDLE)i); |
| 25 | if (ethrd != NULL) { |
| 26 | eproc = IoThreadToProcess(ethrd); |
| 27 | if (eproc == Process) { |
| 28 | KdPrint(("[THREAD] ETHREAD=%p TID=%ld\n", |
| 29 | ethrd, PsGetThreadId(ethrd))); |
| 30 | } |
| 31 | ObDereferenceObject(ethrd); |
| 32 | } |
| 33 | } |
| 34 | } |
| 35 | |
| 36 | |
| 37 | void EnumModule(PEPROCESS Process) { |
nothing calls this directly
no test coverage detected