Windows 驅動：獲取當前進程名

//
// Process name max length: by bytes
// (This value is 16 bytes in RegMon)
//
#define MAX_PROC_NAME_LEN 256
//
// This is the offset into a KPEB of the current process name. This is determined
// dynamically by scanning the process block belonging to the GUI for its name.
//
ULONG                   ProcessNameOffset = 0;

//----------------------------------------------------------------------
//
// GetProcessNameOffset
//
// In an effort to remain version-independent, rather than using a
// hard-coded into the KPEB (Kernel Process Environment Block), we
// scan the KPEB looking for the name, which should match that
// of the GUI process
//
//----------------------------------------------------------------------
ULONG
GetProcessNameOffset(
    VOID
    )
{
    PEPROCESS       curproc;
    int             i;

    curproc = PsGetCurrentProcess();

    //
    // Scan for 12KB, hopping the KPEB never grows that big!
    //
    for( i = 0; i < 3*PAGE_SIZE; i++ ) {
    
        if( !strncmp( "System", (PCHAR) curproc + i, strlen("System") )) {

            return i;
        }
    }

    //
    // Name not found - oh, well
    //
    return 0;
}