开发者

PEPROCESS to PFILE_OBJECT

开发者 https://www.devze.com 2023-03-09 01:34 出处:网络
I am wondering what is the best way to convert a process object pointer over to a file object pointer. I am currently using this method:

I am wondering what is the best way to convert a process object pointer over to a file object pointer. I am currently using this method:

  1. pass PEPROCESS to ObOpenObjectByPointer to get handle to process
  2. call ZwQueryInformationProcess to get ProcessImageFileName
  3. call ZwCr开发者_StackOverfloweateFile with ProcessImageFileName to get file handle
  4. finally pass file handle to ObReferenceObjectByHandle to get PFILE_OBJECT

Any suggestions?

0

精彩评论

暂无评论...
验证码 换一张
取 消