This is an Ark tool's driver part. Maybe there remains some bugs..<br/>
first of all, I used Neither_IO to establish the connect between ring3 and ring0

  Each time, add ProcessId by 4 and test whether the id is valid.
  When I need to get process's full path, I used sectionobject to get fileobject, then I get the filename
in this structure.

  There are two Lists which we can travel them to find all thread in the target process
  · _EPROCESS --> ThreadListHead & _ETHREAD --> ThreadListEntry
  · _KPROCESS --> ThreadListHead & _KTHREAD --> ThreadListEntry

  In the Structure of _PEB, we can get a member called "Ldr", three list are existing in it, which recorded 
all modules >the process had loaded. so we can travel them respectively.

  Enum and adjust privilege by a a series of NTfunctions concerning ProcessToken

  ZwQuerySystemInformation + SystemHandleInformation

  NtUserBuildHwndList + NtUserQueryWindow (get from SSSDT)

  Use NtQueryVirtualMemory by force from 0 to MaxUserSpaceAddress

  Just used a NTFunction--ZwTerminateProcess

   Firstly, travel LdrDataTableEntry.
   Then, travel DirectoryObject (a hash table), Attention, travel device chain and device satck

   If sys has an Unload dispatch, then just call it
   If Sys does not have an Unload dispatch, then we need to realize it manually

   Enum -->
     · LoadImageCallback, CreateThreadCallback, CreateProcessCallback are similiar. They are all in an array.
     · RegisterCallback, BugCheckCallback, BugCheckReasonCallback, ShutDownCallback are ListEntry Structure.

   Remove -->
     call Remove function
     · LoadImageCallback, CreateThreadCallback, CreateProcessCallback: use callbackAddress
     · RegisterCallback: use Cookie
     · BugCheckCallback, BugCheckReasonCallback, ShutDownCallback: use ListEntry

   Enum --> Travel IopTimerQueueHead
     Remove --> RemoveEntryList
     Start/Stop --> IoStartTimer(DeviceObject)/IoStopTimer(DeviceObject)

    Enum --> _Kprcb->TimerTable->TimerEntries(256)->travel list
    Remove --> KeCancelTimer(Timer)

    Enum --> Travel PspCidTable to get Object, just call the function write in Enum Process Thread

    Enum --> First to get driverobject by name, then travel the driverobject's device stack and device chain.
    Remove --> change AttachedDevice

(include travel IAT EAT, etc.)