[原创]在内核驱动中获取进程终端ID(SessionId)[新手发个贴]
在内核驱动中获取进程终端ID(SessionId)
在驱动开发中为了支持RDP模式，经常在内核驱动中要获取一个进程的终端ID(SessionId)，即任务管理器中的"会话ID"列。
在应用层获取SessionId的方法很多比如WTSEnumerateProcesses函数，但是在内核中的方法目前我只知道一方法，现在分享给大家，
关键技术是：通过ZwQueryInformationProcess或NtQueryInformationProcess方法，使用ProcessSessionInformation类型获取SessionId，废话少说帖上代码
。
typedef NTSTATUS (*QUERY_INFO_PROCESS) (
__in HANDLE ProcessHandle,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID ProcessInformation,
__in ULONG ProcessInformationLength,
__out PULONG ReturnLength
);
QUERY_INFO_PROCESS ZwQueryInformationProcess = NULL;
/************************************************************************
@method:GetProcessSessionId
获取进程SessionId
@param: __out PULONG pSessionId : 返回的进程SessionId
__in DWORD dwProcessId : 进程Pid,0代表当前进程
@return:NTSTATUS
@date: [03/13/2013 zhansq]
************************************************************************/
NTSTATUS GetProcessSessionId(__out PULONG pSessionId,__in DWORD dwProcessId)
{
NTSTATUS status = STATUS_SUCCESS;
ULONG returnedLength = 0;
PROCESS_SESSION_INFORMATION SessionInfo;
HANDLE hProcess = NULL;
PAGED_CODE();
//get ZwQueryInformationProcess address
if (NULL == ZwQueryInformationProcess)
{
UNICODE_STRING routineName;
RtlInitUnicodeString(&routineName,L"ZwQueryInformationProcess");
if (KeGetCurrentIrql() != PASSIVE_LEVEL) return STATUS_UNSUCCESSFUL;
ZwQueryInformationProcess = (QUERY_INFO_PROCESS)MmGetSystemRoutineAddress(&routineName);
if (NULL == ZwQueryInformationProcess)
{
KdPrint(("MmGetSystemRoutineAddress : Cannot get ZwQueryInformationProcess\n"));
return STATUS_UNSUCCESSFUL;
}
}
if (KeGetCurrentIrql() > APC_LEVEL) return STATUS_UNSUCCESSFUL;
if (NULL == ZwQueryInformationProcess) return STATUS_UNSUCCESSFUL;
if (dwProcessId != 0)
{
//ZwOpenProcess
OBJECT_ATTRIBUTES ObjectAttributes;
CLIENT_ID clientid;
InitializeObjectAttributes(&ObjectAttributes, 0 ,OBJ_CASE_INSENSITIVE | OBJ_KERNEL_HANDLE, 0, 0);
clientid.UniqueProcess = (HANDLE)dwProcessId;
clientid.UniqueThread=0;
status = ZwOpenProcess(&hProcess, PROCESS_ALL_ACCESS, &ObjectAttributes, &clientid);
if (!NT_SUCCESS(status)) return status;
}
else
{
hProcess = ZwCurrentProcess();
}
returnedLength = sizeof(SessionInfo);
status = ZwQueryInformationProcess(hProcess,
ProcessSessionInformation,
&SessionInfo,
returnedLength,
&returnedLength);
if (NT_SUCCESS(status) && pSessionId != NULL)
{
//we got what we needed
*pSessionId = SessionInfo.SessionId;
}
return status;
}
