#include <ntddk.h>

#define ObjectTable 0xC4
#define UniqueProcessId 0x08
#define HandleTableList 0x1C



VOID OnUnLoad(PDRIVER_OBJECT pDriverObj)
{
     DbgPrint("\nDriver exited\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegistryPath)
{
         PULONG pBaseObjectTable, pCurrentObjectTable, pBaseEprocess, pCurrentEprocess;
         PLIST_ENTRY pCurrentList, pCurrentHandleTableList;
         
         DbgPrint("\nLilxam driver OK\n");
         
         //Parcourt des Eprocess
         pBaseEprocess = (PULONG)IoGetCurrentProcess();
         pCurrentEprocess = pBaseEprocess;
         do
         {
                                   
                                   DbgPrint("\nProcess : %s", ((PUCHAR)pCurrentEprocess+0x174));
                                   pCurrentList = (PLIST_ENTRY)((PUCHAR)pCurrentEprocess+0x88);
                                   pCurrentEprocess = (PULONG)((PUCHAR)pCurrentList->Flink-0x88);
                                   
         }while(strcmp("csrss.exe", (PUCHAR)pCurrentEprocess+0x174) && pCurrentEprocess != pBaseEprocess);
         
         //On parcourt les HandlesTables
         pBaseObjectTable = (PULONG)*(PULONG)((PUCHAR)pCurrentEprocess+0xC4);
         
         pCurrentObjectTable = (PULONG)pBaseObjectTable;
         /*DbgPrint("\nObject Table : 0x%x\n", (PULONG)pCurrentObjectTable);
    
          DbgPrint("\n              --- PID : 0x%x\n", *(PULONG)((PUCHAR)pCurrentObjectTable+0x08));
          DbgPrint("\n              --- PEPROCESS : 0x%x\n", (PULONG)((PUCHAR)pCurrentObjectTable+0x04));
          DbgPrint("\n              --- EPROCESS : 0x%x\n", *(PULONG)((PUCHAR)pCurrentObjectTable+0x04));
          
          pCurrentHandleTableList = (PLIST_ENTRY)((PUCHAR)pCurrentObjectTable+0x1C);
          pCurrentObjectTable = (PULONG)((PUCHAR)pCurrentHandleTableList->Blink-0x1C);
          */
          do
          {

              //DbgPrint("\nHandle table list : 0x%x\n", (PULONG)pCurrentHandleTableList);
              DbgPrint("\nObject Table : 0x%x\n", (PULONG)pCurrentObjectTable);
    
              DbgPrint("\n              --- PID : 0x%x\n", *(PULONG)((PUCHAR)pCurrentObjectTable+0x08));
              DbgPrint("\n              --- PPEPROCESS : 0x%x\n", (PULONG)((PUCHAR)pCurrentObjectTable+0x04));
              DbgPrint("\n              --- PEPROCESS : 0x%x\n", *(PULONG)((PUCHAR)pCurrentObjectTable+0x04));    
              DbgPrint("\n              --- Name : %s\n", (PULONG)(*(PULONG)((PUCHAR)pCurrentObjectTable+0x04)+0x174));
              
              pCurrentHandleTableList = (PLIST_ENTRY)((PUCHAR)pCurrentObjectTable+0x1C);
              pCurrentObjectTable = (PULONG)((PUCHAR)pCurrentHandleTableList->Blink-0x1C);

          }while(pCurrentObjectTable != pBaseObjectTable);
              

         
         DbgPrint("\n\nEnd\n");
         
         pDriverObj->DriverUnload = OnUnLoad;
         
         return STATUS_SUCCESS;
}