common.inc

这是asm驱动的开发包

IOCTL_SET_NOTIFY		equ CTL_CODE(FILE_DEVICE_UNKNOWN, 800h, METHOD_BUFFERED, FILE_WRITE_ACCESS)
IOCTL_REMOVE_NOTIFY		equ CTL_CODE(FILE_DEVICE_UNKNOWN, 801h, 0, 0)
IOCTL_GET_PROCESS_DATA	equ CTL_CODE(FILE_DEVICE_UNKNOWN, 802h, METHOD_BUFFERED, FILE_READ_ACCESS)

IMAGE_FILE_PATH_LEN equ 512

PROCESS_DATA STRUCT
	bCreate				BOOL		?

	dwProcessId			DWORD		?
	szProcessName		CHAR	IMAGE_FILE_PATH_LEN dup(?)	; full process's image file path

PROCESS_DATA ENDS