Advertisement
EWTD

Untitled

Apr 15th, 2022
320
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.81 KB | None | 0 0
  1. #include <ntddk.h>
  2. #include <ntifs.h>
  3. #include <ndk/exfuncs.h>
  4. #include <ndk/ketypes.h>
  5. #include <pseh/pseh2.h>
  6. #include <ntstrsafe.h>
  7. #include <debug.h>
  8.  
  9. NTSTATUS
  10. NTAPI
  11. DriverEntry(IN PDRIVER_OBJECT DriverObject,
  12. IN PUNICODE_STRING RegPath)
  13. {
  14. NTSTATUS Status;
  15. PVOID Buffer, NewBuffer;
  16. ULONG BufferSize;
  17. ULONG ReturnLength;
  18. PSYSTEM_PROCESS_INFORMATION ProcessInfo;
  19. Buffer = ExAllocatePool(PagedPool,4096);
  20. if (Buffer){
  21. BufferSize = 4096;
  22. }
  23. else{
  24. DPRINT1("Exiting, no memory");
  25. return STATUS_NO_MEMORY;
  26. }
  27. while (TRUE)
  28. {
  29. ProcessInfo = (PSYSTEM_PROCESS_INFORMATION)(Buffer);
  30. Status = ZwQuerySystemInformation(SystemProcessInformation,
  31. ProcessInfo,
  32. BufferSize,
  33. &ReturnLength);
  34. if(Status != STATUS_INFO_LENGTH_MISMATCH && ReturnLength < BufferSize){break;}
  35. NewBuffer = ExAllocatePool(PagedPool,BufferSize+4096);
  36. if (!NewBuffer){
  37. DPRINT1("Exiting, no memory");
  38. return STATUS_NO_MEMORY;
  39. }
  40. ExFreePool(Buffer);
  41. BufferSize += 4096;
  42. Buffer = NewBuffer;
  43. }
  44. DPRINT1("Student:Vladislav Bermishev\n");
  45. DPRINT1("Process list:\n");
  46. while (TRUE){
  47. if (ProcessInfo->ImageName.Buffer){
  48. DbgPrint("%i <- %i:%ws\n",(int)ProcessInfo->InheritedFromUniqueProcessId,
  49. (int)ProcessInfo->UniqueProcessId,
  50. ProcessInfo->ImageName.Buffer);
  51. }
  52. if (!ProcessInfo->NextEntryOffset) break;
  53. ProcessInfo = (PVOID)((ULONG_PTR)ProcessInfo + ProcessInfo->NextEntryOffset);
  54. }
  55. return STATUS_SUCCESS;
  56. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement