获得进程的EPROCESS

获得进程的EPROCESS(11)             {
                free( buf );
                buf = NULL;
            }
            else
            {
                printf( "ZwQuerySystemInformation() failed");
                goto GetEprocessFromPid_exit;
            }
        }
        else
        {
            break;
        }
    }  /* end of for */

    //返回到缓冲区的首先是一个ULONG类型的数据,表示有多少数组
    NumOfHandle = (ULONG)buf;

    h_info = ( PSYSTEM_HANDLE_INFORMATION )((ULONG)buf+4);
    
    for(i = 0; i<NumOfHandle ;i++)
    {
        if( ( h_info[i].ProcessId == PID )&&( h_info[i].ObjectTypeNumber == 5  ))//&&( h_info[i].Handle==0x3d8 ) )
        {
            printf("Handle:0x%x,OBJECT 0x%x\n\r",h_info[i].Handle,h_info[i].Object);
            return((DWORD)(h_info[i].Object));