驱动学习笔记
InitializeListHead
InsertHeadList
RemoveTailList
InitializeListHead
KeInitializeSpinLock
ExInterlockedInsertHeadList
ExInterlockedRemoveHeadList
KeInitializeSpinLock
KeAcquireSpinLock
KeReleaseSpinLock
KeRaiseIrqlToDpcLevel
KeLowerIrql
// 通过进程ID获取进程EPROCESS
PsLookupProcessByProcessId
//通过EPROCESS获取进程的句柄
ObOpenObjectByPointer
还没有评论,来说两句吧...