内核模式下如何获取进程缓解策略？驱动开发技术求助

我需要编写驱动代码获取某个进程的所有缓解策略信息，目前已经能获取进程句柄，代码如下：

HANDLE h_process{};
OBJECT_ATTRIBUTES obj_attr{};
CLIENT_ID client_id{.UniqueProcess = ULongToHandle(process_id), .UniqueThread = nullptr};

InitializeObjectAttributes(&obj_attr, nullptr, OBJ_KERNEL_HANDLE, nullptr, nullptr);

NTSTATUS status = ZwOpenProcess(&h_process, PROCESS_QUERY_LIMITED_INFORMATION, &obj_attr, &client_id);

我知道可以通过ZwQueryInformationProcess函数获取策略信息，函数定义如下：

NTSTATUS WINAPI ZwQueryInformationProcess(
  _In_      HANDLE           ProcessHandle,
  _In_      PROCESSINFOCLASS ProcessInformationClass,
  _Out_     PVOID            ProcessInformation,
  _In_      ULONG            ProcessInformationLength,
  _Out_opt_ PULONG           ReturnLength
);

但不清楚ProcessInformation参数应该传入什么结构，尝试过以下方法均失败：

• 使用包含所有策略的联合结构：

typedef struct _PROCESS_MITIGATION_POLICY_INFORMATION
{
    PROCESS_MITIGATION_POLICY Policy;
    union
    {
        PROCESS_MITIGATION_ASLR_POLICY ASLRPolicy;
        PROCESS_MITIGATION_STRICT_HANDLE_CHECK_POLICY StrictHandleCheckPolicy;
        PROCESS_MITIGATION_SYSTEM_CALL_DISABLE_POLICY SystemCallDisablePolicy;
        PROCESS_MITIGATION_EXTENSION_POINT_DISABLE_POLICY ExtensionPointDisablePolicy;
        PROCESS_MITIGATION_DYNAMIC_CODE_POLICY DynamicCodePolicy;
        PROCESS_MITIGATION_CONTROL_FLOW_GUARD_POLICY ControlFlowGuardPolicy;
        PROCESS_MITIGATION_BINARY_SIGNATURE_POLICY SignaturePolicy;
        PROCESS_MITIGATION_FONT_DISABLE_POLICY FontDisablePolicy;
        PROCESS_MITIGATION_IMAGE_LOAD_POLICY ImageLoadPolicy;
        PROCESS_MITIGATION_SYSTEM_CALL_FILTER_POLICY SystemCallFilterPolicy;
        PROCESS_MITIGATION_PAYLOAD_RESTRICTION_POLICY PayloadRestrictionPolicy;
        PROCESS_MITIGATION_CHILD_PROCESS_POLICY ChildProcessPolicy;
        PROCESS_MITIGATION_SIDE_CHANNEL_ISOLATION_POLICY SideChannelIsolationPolicy;
        PROCESS_MITIGATION_USER_SHADOW_STACK_POLICY UserShadowStackPolicy;
        PROCESS_MITIGATION_REDIRECTION_TRUST_POLICY RedirectionTrustPolicy;
        PROCESS_MITIGATION_USER_POINTER_AUTH_POLICY UserPointerAuthPolicy;
        PROCESS_MITIGATION_SEHOP_POLICY SEHOPPolicy;
    };
} PROCESS_MITIGATION_POLICY_INFORMATION, *PPROCESS_MITIGATION_POLICY_INFORMATION;

传入该结构后返回状态码0xC00000BB（请求不被支持）。

• 尝试传入单个策略结构（例如PROCESS_MITIGATION_DEP_POLICY），返回状态码0xC0000004（指定的信息记录长度与所需长度不匹配）。

• 尝试获取所需结构大小时，返回值始终为0x0，相关代码如下：

NTSTATUS status = ZwQueryInformationProcess(h_process,
                   ProcessMitigationPolicy,
                   &policy_struct,                                       
                   sizeof(PROCESS_MITIGATION_POLICY_INFORMATION),
                   &ret);
if (!NT_SUCCESS(status)) {
       logger::printLog<logger::LogLevel::Warning>("Failed to check PROCESS_MITIGATION_DEP_POLICY. Status: 0x%X, ret:0x%X\n", status, ret);
       return;
}

需要协助明确ProcessInformation参数应传入的正确结构，以及获取所有缓解策略的正确方式。

内容的提问来源于stack exchange，提问作者Leonid_First