I'm developing a kernel mod driver and I need to get all the stack sizes of some process.
I use ZwQuerySystemInformation to find the processand then I use ZwQuerySystemInformation to get the THREAD_BASIC_INFORMATIONand then I read memory from TebBaseAddress to NT_TIB structthen I have the tib.StackLimit, tib.StackBase
if (NT_SUCCESS(PsLookupProcessByProcessId((HANDLE)process_id, &process))) { if (NT_SUCCESS(MmCpy(process, (PVOID)info.TebBaseAddress, PsGetCurrentProcess(), &tib, sizeof(NT_TIB)))) { //DbgPrintEx(0, 0, "StackLimit: %#010x to StackBase: %#010x \n", tib.StackLimit, tib.StackBase); tempStackArea = { 0 }; tempStackArea.Base = (uintptr_t)tib.StackBase; tempStackArea.Limit = (uintptr_t)tib.StackLimit; memcpy((PVOID)((ULONG_PTR)StackAreaList + (i * sizeof(StackArea))), &tempStackArea, sizeof(StackArea)); } }but I don't know if the size is
tib.StackBase - tib.StackLimitI want to read all the stack memory from tib.StackLimit to tib.StackBase and search some valueIs it okay to use it this way or it's wrong, and there's another solution?