程序用内核驱动的方式进入ring0,然后访问EPROCESS结构,在EPROCESS结构中找到进程链,从而可实现进程的枚举,但是由于PID 为0的系统进程Idle并没有在这个链上.所以通过这种方法自然也就找不出它来.程序输出可以用softice或DebugView工具查看. 本程序只在XP下调试通过.-Procedures with the way the kernel driver into the ring0, then visit EPROCESS structure, the structure found in EPROCESS process chain, which can realize the process of enumeration, but because the system process PID to 0 in the Idle and no chain. So by this method naturally can not find it to. process output can softice or DebugView tool to view. This program only under XP through debugging.