描述:
我刚开始学写驱动程序，需要在驱动中获得系统的进程列表，并传回给应用程序。
我现在的做法是HOOK函数ZwQuerySystemInformation，在自己的Hook函数中调用原函数后，遍历所有系统进程并分配空间，将进程信息存入动态链表。但是这样会导致内核崩溃，是什么原因呢？是不是这样会改变堆栈里面的值呢？
正确的做法应该是什么呢？
附部分源代码：
typedef struct _procinfo
{
ULONG ProcessId;
UNICODE_STRING ProcessName;
struct _procinfo * Next;
}PROCINFO,*PPROCINFO;
NTSTATUS
NewZwQuerySystemInformation(
IN ULONG SystemInformationClass,
IN OUT PVOID SystemInformation,
IN ULONG SystemInformaitonLength,
OUT PULONG ReturnLength OPTIONAL)
{
NTSTATUS NtStatus;
PSYSTEM_PROCESSES ProcCur = NULL;
PSYSTEM_PROCESSES ProcPre = NULL;
PPROCINFO pNewPI = NULL;
if(SystemInformationClass == 5)
{
DbgPrint("ZwQuerySystemInformation for Process/Thead\n");
}
NtStatus = (OldZwQuerySystemInformation)(SystemInformationClass,
SystemInformation,
SystemInformaitonLength,
ReturnLength);
if(NT_SUCCESS(NtStatus) && SystemInformationClass == 5)
{
ProcCur = (PSYSTEM_PROCESSES)SystemInformation;
pCurrentPI = pFirstPI;
while(ProcCur != NULL)
{
pCurrentNK = pFirstNK;
pNewPI = ExAllocatePool(NonPagedPool,sizeof(PROCINFO));
if(pNewPI != NULL)
{
if(pFirstPI == NULL)
{
pFirstPI = pNewPI;
pCurrentPI = pNewPI;
}
else
{
pCurrentPI->Next = pNewPI;
pCurrentPI = pNewPI;
}
pCurrentPI->ProcessId = ProcCur->ProcessId;
RtlCopyUnicodeString(&pCurrentPI->ProcessName, &ProcCur->ProcessName);
pCurrentPI->Next = NULL;
NumProcInfo++;
}
ProcPre = ProcCur;
if(ProcCur->NextEntryDelta != 0)
{
ProcCur = (PSYSTEM_PROCESSES)((PTSTR)ProcCur + ProcCur->NextEntryDelta);
}
else
{
ProcCur = NULL;
}
}
}
return NtStatus;
}