开发者

PEPROCESS to PFILE_OBJECT

I am wondering what is the best way to convert a process object pointer over to a file object pointer. I am currently using this method:

  1. pass PEPROCESS to ObOpenObjectByPointer to get handle to process
  2. call ZwQueryInformationProcess to get ProcessImageFileName
  3. call ZwCr开发者_StackOverfloweateFile with ProcessImageFileName to get file handle
  4. finally pass file handle to ObReferenceObjectByHandle to get PFILE_OBJECT

Any suggestions?

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜