易语言驱动级枚举系统进程源码

易语言驱动级枚举系统进程源码系统结构:DriverEntry,驱动通信,DispatchCreateClose,驱动卸载,创建符号链接及设备,读内存,DbgPrint,DbgPrintInt,memcpy,IoCreateDevice,IoCreateSymbolicLink,RtlAnsiStringToUnicodeString,RtlInitAnsiString,RtlFreeUnicodeString,IoIsWdmVersionAvailable,IoDeleteDevice,IoDeleteSymbolicLink,IoCompleteRequest,PsLookupProcessByProcessId, ======程序集1 || ||------_启动子程序 || ||------DriverEntry || ||------驱动通信 || ||------DispatchCreateClose || ||------驱动卸载 || ||------创建符号链接及设备 || ||------读内存 || || ======调用的Dll || ||---[dll]------DbgPrint || ||---[dll]------DbgPrintInt || ||---[dll]------_Write_Int || ||---[dll]------_Read_Int || ||---[dll]------_Write_DRIVER_OBJECT || ||---[dll]------_Read_DRIVER_OBJECT || ||---[dll]------_Write_IRP || ||---[dll]------memcpy || ||---[dll]------_Read_IRP || ||---[dll]------IoCreateDevice || ||---[dll]------IoCreateSymbolicLink || ||---[dll]------RtlAnsiStringToUnicodeString || ||---[dll]------RtlInitAnsiString || ||---[dll]------RtlFreeUnicodeString || ||---[dll]------IoIsWdmVersionAvailable || ||---[dll]------IoDeleteDevice || ||---[dll]------IoDeleteSymbolicLink || ||---[dll]------IoCompleteRequest || ||---[dll]------_Read_ActiveProcessLinks || ||---[dll]------PsLookupProcessByProcessId 调用的DLL命令: .DLL命令DbgPrint,,"ntoskrnl.lib","@_DbgPrint" .参数Buffer,文本型 .DLL命令DbgPrintInt,,"ntoskrnl.lib","@_DbgPrint" .参数Format,文本型 .参数Value,整数型 .DLL命令_Write_Int,,"ntoskrnl.lib","@_memcpy" .参数目的地址,整数型 .参数源变量,整数型,传址 .参数大小,整数型 .DLL命令_Read_Int,,"ntoskrnl.lib","@_memcpy" .参数目的变量,整数型,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Write_DRIVER_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数目的地址,整数型 .参数源变量,DRIVER_OBJECT,传址 .参数大小,整数型 .DLL命令_Read_DRIVER_OBJECT,,"ntoskrnl.lib","@_memcpy" .参数目的变量,DRIVER_OBJECT,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Write_IRP,,"ntoskrnl.lib","@_memcpy" .参数目的地址,整数型 .参数源变量,IRP,传址 .参数大小,整数型 .DLL命令memcpy,,"ntoskrnl.lib","@_memcpy" .参数目的变量,整数型 .参数源地址,整数型 .参数大小,整数型 .DLL命令_Read_IRP,,"ntoskrnl.lib","@_memcpy" .参数目的变量,IRP,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令IoCreateDevice,整数型,"ntoskrnl.lib","_IoCreateDevice@28",,. .参数DriverObject,整数型 .参数DeviceExtensionSize,整数型 .参数DeviceName,UNICODE_STRING,传址 .参数DeviceType,整数型 .参数DeviceCharacteristics,整数型 .参数Exclusive,逻辑型 .参数DeviceObject,整数型,传址 .DLL命令IoCreateSymbolicLink,整数型,"ntoskrnl.lib","_IoCreateSymbolicLink@8" .参数SymbolicLinkName,UNICODE_STRING,传址 .参数DeviceName,UNICODE_STRING,传址 .DLL命令RtlAnsiStringToUnicodeString,整数型,"ntoskrnl.lib","_RtlAnsiStringToUnicodeString@12" .参数DestinationString,UNICODE_STRING,传址 .参数SourceString,ANSI_STRING,传址 .参数AllocateDestinationString,逻辑型 .DLL命令RtlInitAnsiString,,"ntoskrnl.lib","_RtlInitAnsiString@8" .参数DestinationString,ANSI_STRING,传址 .参数SourceString,文本型,传址 .DLL命令RtlFreeUnicodeString,,"ntoskrnl.lib","_RtlFreeUnicodeString@4" .参数UnicodeString,UNICODE_STRING,传址 .DLL命令IoIsWdmVersionAvailable,逻辑型,"ntoskrnl.lib","_IoIsWdmVersionAvailable@8" .参数MajorVersion,字节型 .参数MinorVersion,字节型 .DLL命令IoDeleteDevice,,"ntoskrnl.lib","_IoDeleteDevice@4" .参数DeviceObject,整数型 .DLL命令IoDeleteSymbolicLink,,"ntoskrnl.lib","_IoDeleteSymbolicLink@4" .参数SymbolicLinkName,UNICODE_STRING,传址 .DLL命令IoCompleteRequest,,"ntoskrnl.lib","_IoCompleteRequest@8" .参数Irp,整数型 .参数PriorityBoost,整数型 .DLL命令_Read_ActiveProcessLinks,,"ntoskrnl.lib","@_memcpy" .参数目的变量,LIST_ENTRY,传址 .参数源地址,整数型 .参数大小,整数型 .DLL命令PsLookupProcessByProcessId,整数型,"ntoskrnl.lib","_PsLookupProcessByProcessId@8" .参数ProcessID,整数型 .参数EProcess,整数型,传址