获得进程的EPROCESS

获得进程的EPROCESS(10) /************************************************************************/


static DWORD GetEprocessFromPid ( ULONG    PID )
{
    NTSTATUS                    status;
    PVOID                        buf   = NULL;
    ULONG                        size  = 1;
    ULONG                        NumOfHandle = 0;
    ULONG                        i;
    PSYSTEM_HANDLE_INFORMATION    h_info  = NULL;

    for ( size = 1; ; size *= 2 )
    {
        if ( NULL == ( buf = calloc( size, 1 ) ) )
        {
            fprintf( stderr, "calloc( %u, 1 ) failed\n", size );
            goto GetEprocessFromPid_exit;
        }
        status = ZwQuerySystemInformation( SystemHandleInformation, buf, size, NULL );
        if ( !NT_SUCCESS( status ) )
        {
            if ( STATUS_INFO_LENGTH_MISMATCH == status )