NTSTATUS GetProcessNameByPID(IN HANDLE ProcessId, OUT PCHAR ProcessName) {

    ULONG ulBufferSize = 0x8000;
    LPVOID pBuffer = NULL;
    NTSTATUS Status;
    PSYSTEM_PROCESSES pSystemProcessInfo;
    ULONG tmp;

    do
    {
        pBuffer = ExAllocatePool (NonPagedPool, ulBufferSize);
        if( pBuffer == NULL ) {
            return STATUS_UNSUCCESSFUL;
        }
        
        Status = ZwQuerySystemInformation(SystemProcessesAndThreadsInformation, 
                                          pBuffer, ulBufferSize, NULL);
        
        if( Status == STATUS_INFO_LENGTH_MISMATCH ) {
            ExFreePool(pBuffer); 
            ulBufferSize *= 2;
        }
        else if( !NT_SUCCESS(Status) ) {
            ExFreePool(pBuffer);
            return STATUS_UNSUCCESSFUL;
        }

    }
    while (Status == STATUS_INFO_LENGTH_MISMATCH);

    pSystemProcessInfo = (PSYSTEM_PROCESSES)pBuffer;

    for(;;) {

        LPWSTR pszProcessName = pSystemProcessInfo->ProcessName.Buffer;
        
        if( pszProcessName == NULL ) {
            pszProcessName = L"Idle";
        }

        if( pSystemProcessInfo->ProcessId == (ULONG)ProcessId ) { 
            tmp = wcstombs(ProcessName, pszProcessName, PROCNAMELEN);
            break;
        }

        if( pSystemProcessInfo->NextEntryDelta == 0 ) {
            break;
        }

        pSystemProcessInfo = (PSYSTEM_PROCESSES)(((PUCHAR)pSystemProcessInfo)+pSystemProcessInfo->NextEntryDelta);

    }
    
    DbgPrint("Process name: %s %lu", ProcessName, tmp); // Вот тут не вижу процесса при его завершении, а tmp равна какому-то большому числу.

    ExFreePool(pBuffer);
    return STATUS_SUCCESS;

}

typedef struct _EPROCESS
{
  ...
  LIST_ENTRY                      ActiveProcessLinks;
  ...
}
EPROCESS, *PEPROCESS;

void GetProcessNameOffset()
{
    PEPROCESS curproc;
    int i;
    curproc = PsGetCurrentProcess();
    for( i = 0; i < 3*PAGE_SIZE; i++ )
    {
        if( !strncmp( "System", (PCHAR) curproc + i, strlen("System") ))
        {
            gProcessNameOffset = i;
        }
    }
}

NTSTATUS GetProcessNameById(OUT PCHAR ProcessName, IN HANDLE ProcessId)
{
    PEPROCESS       curproc;
    char            *nameptr;
    
    if (!gProcessNameOffset || !ProcessId) return STATUS_INVALID_PARAMETER;
    if (!NT_SUCCESS(PsLookupProcessByProcessId(ProcessId,&curproc))) 
        return STATUS_INVALID_PARAMETER;
    nameptr   = (PCHAR) curproc + gProcessNameOffset;
    strncpy( ProcessName, nameptr, PROCNAMELEN );
    ProcessName[PROCNAMELEN] = 0;
    return STATUS_SUCCESS;
}

U>typedef struct _EPROCESS
U>{
U>  ...
U>  LIST_ENTRY                      ActiveProcessLinks;
U>  ...
U>}
U>EPROCESS, *PEPROCESS;
U>

NTSYSAPI NTSTATUS NTAPI
ZwQueryInformationProcess(
  IN       HANDLE ProcessHandle,
  IN       PROCESSINFOCLASS SystemInformationClass,
  OUT      PVOID SystemInformation,
  IN       ULONG SystemInformationLength,
  OUT      PULONG ReturnLength
);

NTSYSAPI NTSTATUS NTAPI
ObOpenObjectByPointer(
  IN PVOID  Object,
  IN ULONG  HandleAttributes,
  IN PACCESS_STATE  PassedAccessState OPTIONAL,
  IN ACCESS_MASK  DesiredAccess,
  IN POBJECT_TYPE  ObjectType,
  IN KPROCESSOR_MODE  AccessMode,
  OUT PHANDLE  Handle
);

// Для XP SP2
#define PIDOFFSET   0x84
#define FLINKOFFSET 0x88

...
while(1) {

    if( (DWORD)hProcID == dwCurrentPID ) {

        Status = ObOpenObjectByPointer((PVOID)hProcID,
                                       0,
                                       NULL,
                                       0,
                                       NULL,
                                       0,
                                       &hOutHandle);
        if(!NT_SUCCESS(Status)) {
            DbgPrint("Error: ObOpenObjectByPointer");
        }

        pBuffer = ExAllocatePool (NonPagedPool, ulBufferSize);
        if( pBuffer == NULL ) {
            return 0x00000000;
        }

        Status = ZwQueryInformationProcess(hOutHandle, SystemProcessImageFileName, 
                                  pBuffer, ulBufferSize, NULL);

        if( NT_SUCCESS(Status) ) {
            DbgPrint("YES");
        }

        ExFreePool(pBuffer);

        return ...;

    }
    else if( (dwCount >= 1) && (dwStartPID == dwCurrentPID) ) {
        return 0x00000000;
    }
    else {
        pListEntry = (LIST_ENTRY*)(dwEprocAddr+FLINKOFFSET);
        dwEprocAddr = (DWORD)pListEntry->Flink;
        dwEprocAddr = dwEprocAddr-FLINKOFFSET;
        dwCurrentPID = *((int*)(dwEprocAddr+PIDOFFSET));
        dwCount++;
    }
}
...

        KeStackAttachProcess((PKPROCESS)pProcess, &ApcState);

    __try
    {
        PPEB pProcessPeb = pProcess->Peb;
        PRTL_USER_PROCESS_PARAMETERS pProcessParameters = pProcessPeb->ProcessParameters;

        RtlCopyUnicodeString(&usImagePathName, &pProcessParameters->ImagePathName);
        RtlCopyUnicodeString(&usCommandLine, &pProcessParameters->CommandLine);
    }
    __except(EXCEPTION_EXECUTE_HANDLER)
    {
    }

    KeUnstackDetachProcess(&ApcState);

Тут драйвер пробую написать для отслеживания запуска и завершения процессов (PsSetCreateProcessNotifyRoutine) и хочу получать имена исполняемых модулей. При запуске все хорошо и имя процесса я могу увидеть

1. Если Windows Vista и выше

ZwQueryInformationProcess() с флагом ProcessImageFileNameWin32.

2. Если Windows Server 2003 и ниже

ZwQueryInformationProcess() с флагом ProcessImageFileName.