for (i = 0; i < 1024; i++)
{
if (MmIsAddressValid((PVOID64)((PULONG64)TableLevel2)[i]))
{
for (j = 0; j < 512; j++)
{
if (MmIsAddressValid(((ULONG64)TableLevel2[i][j].Object) >> 0x10 | 0xFFFF000000000000 & 0xFFFFFFFFFFFFFFF0))
{
HandleAddr = ((ULONG64)TableLevel2[i][j].Object) >> 0x10 | 0xFFFF000000000000 & 0xFFFFFFFFFFFFFFF0;
if (MmIsAddressValid(*(PULONG64)(HandleAddr + 0x570)))
{
ImageFileName = (PCHAR)((ULONG64)HandleAddr + 0x5a8);
DbgPrint("进程镜像名：%s\n", ImageFileName);
}
else if (MmIsAddressValid(*(PULONG64)(HandleAddr + 0x220)))
{
ImageFileName = (PCHAR)((ULONG64) * (PULONG64)(HandleAddr + 0x220) + 0x5a8);
DbgPrint("----ETHREAD: %x, 所属进程：%s,\n", HandleAddr, ImageFileName);
}
else
{
__debugbreak();
DbgPrint("不属于任何进程或线程\n");
}
