jiurldriver.h

关于win2000核心编程的文章

#ifdef __cplusplus
extern "C"
{
#endif

#include <ddk\ntddk.h>

__declspec(dllimport) KeAttachProcess(void *);
__declspec(dllimport) KeDetachProcess();

NTSTATUS 
PsLookupProcessByProcessId (
     IN ULONG ProcessId, 
     OUT VOID * pEProcess
     );

#ifdef __cplusplus
}
#endif

typedef struct _MEMORY_INFO {
	ULONG    ProcessId;
	PVOID    StartVa;
	ULONG    nBytes;
} MEMORY_INFO, *PMEMORY_INFO;


// -----------------------------------------------------------------

#define CTL_CODE( DeviceType, Function, Method, Access ) (                 \
    ((DeviceType) << 16) | ((Access) << 14) | ((Function) << 2) | (Method) \
)
#define FILE_ANY_ACCESS                 0
#define METHOD_BUFFERED                 0

#define FILE_DEVICE_JIURL   0x8000
#define JIURL_FUNCTION_BASE 0x0800

// 不用担心你的 IOCTL 的值与别人定义的值相同。
// 不要忘了，我们在应用程序中是要打开某个特定驱动程序的句柄的
// 所以这个值一定会发到你的驱动程序，由你的驱动程序来解释这个值

// -----------------------------------------------------------------

#define JIURL_IO(_code)								\
		CTL_CODE((FILE_DEVICE_JIURL),				\
				 ((JIURL_FUNCTION_BASE)+(_code)),	\
				 (METHOD_BUFFERED),					\
				 (FILE_ANY_ACCESS))

// -----------------------------------------------------------------

#define JIURL_PROCESS_MEM_OUTPUT      JIURL_IO(0)
#define JIURL_PROCESS_NAME_OUTPUT     JIURL_IO(1)
#define JIURL_PROCESS_VADROOT_OUTPUT  JIURL_IO(2)
#define JIURL_PROCESS_PEB_OUTPUT      JIURL_IO(3)
#define JIURL_ThreadListHead_OUTPUT   JIURL_IO(4)

// -----------------------------------------------------------------

// Windows 2000 build 2195

#define PsIdleProcess       0x8046a1fc  
#define PROCESS_NAME_OFFSET 0x1fc
#define VADROOT_OFFSET		0x194
#define PEB_OFFSET          0x1b0
#define tListHead_OFFSET    0x50