I am wondering what is the best way to convert a process object pointer over to a file object pointer. I am currently using this method:
- pass PEPROCESS to ObOpenObjectByPointer to get handle to process
- call ZwQueryInformationProcess to get ProcessImageFileName
- call ZwCr开发者_StackOverfloweateFile with ProcessImageFileName to get file handle
- finally pass file handle to ObReferenceObjectByHandle to get PFILE_OBJECT
Any suggestions?
精彩评论