Getting BSOD After When Trying To Print The Next Process Name In LIST_ENTRY List

I am trying to print the next process name after my process in the LIST_ENTRY list. But I am always getting BSOD.

#include <Ntifs.h>
#include <ntddk.h>
#include <WinDef.h>

void SampleUnload(_In_ PDRIVER_OBJECT DriverObject) {

    UNREFERENCED_PARAMETER(DriverObject);
    DbgPrint("Sample driver Unload called\n");
}


extern "C"
NTSTATUS
DriverEntry(_In_ PDRIVER_OBJECT DriverObject, _In_ PUNICODE_STRING RegistryPath) {
    UNREFERENCED_PARAMETER(RegistryPath);
    DriverObject->DriverUnload = SampleUnload;
    DbgPrint("Sample driver Load called\n");

    PEPROCESS EP;
    if (::PsLookupProcessByProcessId(::PsGetCurrentProcessId(), &EP) == STATUS_INVALID_PARAMETER) {
        DbgPrint("Can't get EPROCESS");
        return STATUS_INVALID_PARAMETER;
    }

    LIST_ENTRY list_entry = *((LIST_ENTRY*)(LPBYTE)EP + 0x448);
    UCHAR* fileName;
    fileName = ((UCHAR*)(LPBYTE)list_entry.Flink - 0x448 + 0x5a8);

    for (int i = 0; i < 15; i++)
        DbgPrint("%u" , fileName[i]);

    DbgPrint("Finish");

    return STATUS_SUCCESS;
}

In the EPROCESS structure there is a LIST_ENTRY object in the 0x448 offset. So I created a LIST_ENTRY object and assign him to the address of the EPROCESS + 0x448 and than I add 0x5a8-0x448 to the LIST_ENTRY.FLINK. That suppose to get to ImageFileName array in the 0x5a8 offset.

But It doesn't working from some reason.

Solution

You have multiple nonsensical casts in the code:

*((LIST_ENTRY*)(LPBYTE)EP + 0x448);

and

((UCHAR*)(LPBYTE)list_entry.Flink - 0x448 + 0x5a8);

This means for example convert EP (not the address of it) to a byte pointer, then (since casts have right-to-left associativity) immediately forget about converting to a byte pointer and instead convert to a LIST_ENTRY*. Then when done hesitating about which type to use, perform pointer arithmetic on LIST_ENTRY objects. That is 0x448 * sizeof(LIST_ENTRY) bytes.

I guess you actually meant to do this:

LPBYTE lpb = (LPBYTE)&EP + 0x448;
LIST_ENTRY list_entry = *(LIST_ENTRY*)lpb;

That's possibly a strict aliasing violation bug though. Or an alignment bug.