#include <ntddk.h>

#define XP_OFFSET 0x60
//Si l'offset ne convient pas (si vous n'etes pas sous XP) essayé avec 0x70

VOID OnUnload(PDRIVER_OBJECT pDriverObj)
{
     DbgPrint("\nDriver Exited\n");
}

NTSTATUS DriverEntry(PDRIVER_OBJECT pDriverObj, PUNICODE_STRING pRegisteryPath)
{
         PUCHAR pInitialPtr, pCurrentPtr;
         PULONG pKiWaitListHead;
         PLIST_ENTRY KiWaitListHead, OriginalKiWaitListHead;
         PETHREAD pCurrentEthread;
         PULONG pCurrentEprocess, pPID;

         
         size_t i;
         
         DbgPrint("\nLilxam's Driver OK\n\n\n");
         pDriverObj->DriverUnload = OnUnload;
         
         /* Récup de la table KiWaitListHead */
         pInitialPtr = (PUCHAR)KeWaitForSingleObject;
         pCurrentPtr = pInitialPtr;
         DbgPrint("\nKeWaitForSignleObject Address : 0x%x\n", pInitialPtr);
         
         for(i = 0; i < 50000; i++)
         {
                      if(*((PUCHAR)pCurrentPtr-0x3) == 0x8D && *(PUCHAR)pCurrentPtr == 0xC7 && *((PUCHAR)pCurrentPtr+0x6) == 0x89 && *((PUCHAR)pCurrentPtr+0x9) == 0x89)// && *((PUCHAR)pCurrentPtr+0x10) == 0xD1  && *((PUCHAR)pCurrentPtr+0x11) == 0x72)
                                              break;
                      //DbgPrint("\n+0x%x  0x%x  \n", pCurrentPtr-pInitialPtr, *(PUCHAR)pCurrentPtr);
                      
                      pCurrentPtr += 0x1;
         }

         pKiWaitListHead = (PULONG)*(PULONG)((PUCHAR)pCurrentPtr + 0x2);
         DbgPrint("KiWaitListHead Address : 0x%x\n", pKiWaitListHead);
   
   
         /*Parcourt de la table et listing des processus */
         KiWaitListHead = (PLIST_ENTRY)*pKiWaitListHead;
         OriginalKiWaitListHead = KiWaitListHead;
         
         do
         {
             pCurrentEthread = (PETHREAD)((PUCHAR)KiWaitListHead->Flink - XP_OFFSET);
             
             DbgPrint("\n********** New Thread at : 0x%x", pCurrentEthread);
             
             pCurrentEprocess = (PULONG)*(PULONG)((PUCHAR)pCurrentEthread + 0x220); //Récup de l'EPROCESS
    
             DbgPrint("\n    [+]EPROCESS Address : 0x%x",  pCurrentEprocess);
             
             if(pCurrentEprocess != 0x0) //Pour éviter un BSOD type BAD PTR
             {
                 DbgPrint("\n    [+]Process ID : 0x%x", *(PULONG)((PUCHAR)pCurrentEprocess+0x84));
                 DbgPrint("\n    [+]Process Name : %s\n", (PULONG)((PUCHAR)pCurrentEprocess+0x174));
             }
             
             KiWaitListHead = (PLIST_ENTRY)KiWaitListHead->Flink;
             
         }while(KiWaitListHead != OriginalKiWaitListHead);
         
         DbgPrint("\n\n\nEnd\n");
         return STATUS_SUCCESS;
}