#pragma once#include<ntddk.h>
#include<wdm.h>UCHAR* PsGetProcessImageFileName(PEPROCESS Process);VOID DriverUnload(PDRIVER_OBJECT DriverObject)
{DbgPrint("DriverUnload()\r\n");
}
ULONG   GetProcessNameOffset ( void )
{PEPROCESS curproc;int i = 0;curproc = PsGetCurrentProcess();for ( i = 0; i < 3 * PAGE_SIZE; i++ ) {if( !strncmp( "System", (PCHAR)curproc + i, strlen("System") )) {DbgPrint("offset:%d",i);return i;}}return 0;}void GetProcessName(ULONG dwPid)
{HANDLE ProcessHandle;NTSTATUS status;OBJECT_ATTRIBUTES  ObjectAttributes;CLIENT_ID myCid;PEPROCESS EProcess;int a=GetProcessNameOffset();InitializeObjectAttributes(&ObjectAttributes,0,0,0,0); myCid.UniqueProcess = (HANDLE)dwPid;myCid.UniqueThread = 0;//打开进程，获取句柄status = ZwOpenProcess (&ProcessHandle,PROCESS_ALL_ACCESS,&ObjectAttributes,&myCid);if (!NT_SUCCESS(status)){DbgPrint("error/n");return;}//得到EPROCESS，结构中取进程名status = ObReferenceObjectByHandle(ProcessHandle,FILE_READ_DATA,0,KernelMode,&EProcess, 0);if (status == STATUS_SUCCESS){char *ProcessName = (char*)EProcess + a;char *PsName = PsGetProcessImageFileName(EProcess);DbgPrint("ProcessName is %s",ProcessName);DbgPrint("PsName is %s/n",PsName);ObDereferenceObject(EProcess);ZwClose(ProcessHandle);}else{DbgPrint("Get ProcessName error");ObDereferenceObject(EProcess);ZwClose(ProcessHandle);}
}NTSTATUS DriverEntry(IN PDRIVER_OBJECT  DriverObject,IN PUNICODE_STRING  RegistryPath)
{DbgPrint("sucess load/n");GetProcessName(2900);DriverObject->DriverUnload = DriverUnload;    return STATUS_SUCCESS;
}