NTSTATUS GetImageNameOffset()
NTSTATUS GetImageNameOffset()
{
PEPROCESS pEprocess;
UINT i = 0;
//UINT g_IMageNameOffset = 0;
PAGED_CODE();
pEprocess = PsGetCurrentProcess();
for(i = 0; i< PAGE_SIZE; i++)
if(!strncmp("System", (PCHAR)pEprocess + i, strlen("System")))
g_ImageNameOffset = i;
if(!g_ImageNameOffset)
return STATUS_UNSUCCESSFUL;
return STATUS_SUCCESS;
}
/**
PEPROCESS pEprocess;
PeLookupProcessByProcessId((HANDLE)dwTargetPID, &pEprocess);
DebugPrint("ImageName:%s\n", (PCHAR)pEprocess + g_ImageNameOffset);
**/
Comments
0 B
|👍
/👎
0 B
|👍
/👎