Windows内核进程结构体EPROCESS

每个Windows进程在内核中都有一个对应的结构体，名叫EPROCESS。
通过Windbg可查看其结构体：

0: kd> dt _EPROCESS
ntdll!_EPROCESS
   +0x000 Pcb              : _KPROCESS
   +0x2d8 ProcessLock      : _EX_PUSH_LOCK
   +0x2e0 RundownProtect   : _EX_RUNDOWN_REF
   +0x2e8 UniqueProcessId  : Ptr64 Void
   +0x2f0 ActiveProcessLinks : _LIST_ENTRY
   +0x300 Flags2           : Uint4B
   +0x300 JobNotReallyActive : Pos 0, 1 Bit
   +0x300 AccountingFolded : Pos 1, 1 Bit
   +0x300 NewProcessReported : Pos 2, 1 Bit
   +0x300 ExitProcessReported : Pos 3, 1 Bit
   +0x300 ReportCommitChanges : Pos 4, 1 Bit
   +0x300 LastReportMemory : Pos 5, 1 Bit
   +0x300 ForceWakeCharge  : Pos 6, 1 Bit
   +0x300 CrossSessionCreate : Pos 7, 1 Bit
   +0x300 NeedsHandleRundown : Pos 8, 1 Bit
   +0x300 RefTraceEnabled  : Pos 9, 1 Bit
   +0x300 DisableDynamicCode : Pos 10, 1 Bit
   +0x300 EmptyJobEvaluated : Pos 11, 1 Bit
   +0x300 DefaultPagePriority : Pos 12, 3 Bits
   +0x300 PrimaryTokenFrozen : Pos 15, 1 Bit
   +0x300 ProcessVerifierTarget : Pos 16, 1 Bit
   +0x300 StackRandomizationDisabled : Pos 17, 1 Bit
   +0x300 AffinityPermanent : Pos 18, 1 Bit
   +0x300 AffinityUpdateEnable : Pos 19, 1 Bit
   +0x300 PropagateNode    : Pos 20, 1 Bit
   +0x300 ExplicitAffinity : Pos 21, 1 Bit
   +0x300 ProcessExecutionState : Pos 22, 2 Bits
   +0x300 DisallowStrippedImages : Pos 24, 1 Bit
   +0x300 HighEntropyASLREnabled : Pos 25, 1 Bit
   +0x300 ExtensionPointDisable : Pos 26, 1 Bit
   +0x300 ForceRelocateImages : Pos 27, 1 Bit
   +0x300 ProcessStateChangeRequest : Pos 28, 2 Bits
   +0x300 ProcessStateChangeInProgress : Pos 30, 1 Bit
   +0x300 DisallowWin32kSystemCalls : Pos 31, 1 Bit
   +0x304 Flags            : Uint4B
   +0x304 CreateReported   : Pos 0, 1 Bit
   +0x304 NoDebugInherit   : Pos 1, 1 Bit
   +0x304 ProcessExiting   : Pos 2, 1 Bit
   +0x304 ProcessDelete    : Pos 3, 1 Bit
   +0x304 ControlFlowGuardEnabled : Pos 4, 1 Bit
   +0x304 VmDeleted        : Pos 5, 1 Bit
   +0x304 OutswapEnabled   : Pos 6, 1 Bit
   +0x304 Outswapped       : Pos 7, 1 Bit
   +0x304 FailFastOnCommitFail : Pos 8, 1 Bit
   +0x304 Wow64VaSpace4Gb  : Pos 9, 1 Bit
   +0x304 AddressSpaceInitialized : Pos 10, 2 Bits
   +0x304 SetTimerResolution : Pos 12, 1 Bit
   +0x304 BreakOnTermination : Pos 13, 1 Bit
   +0x304 DeprioritizeViews : Pos 14, 1 Bit
   +0x304 WriteWatch       : Pos 15, 1 Bit
   +0x304 ProcessInSession : Pos 16, 1 Bit
   +0x304 OverrideAddressSpace : Pos 17, 1 Bit
   +0x304 HasAddressSpace  : Pos 18, 1 Bit
   +0x304 LaunchPrefetched : Pos 19, 1 Bit
   +0x304 Background       : Pos 20, 1 Bit
   +0x304 VmTopDown        : Pos 21, 1 Bit
   +0x304 ImageNotifyDone  : Pos 22, 1 Bit
   +0x304 PdeUpdateNeeded  : Pos 23, 1 Bit
   +0x304 VdmAllowed       : Pos 24, 1 Bit
   +0x304 ProcessRundown   : Pos 25, 1 Bit
   +0x304 ProcessInserted  : Pos 26, 1 Bit
   +0x304 DefaultIoPriority : Pos 27, 3 Bits
   +0x304 ProcessSelfDelete : Pos 30, 1 Bit
   +0x304 SetTimerResolutionLink : Pos 31, 1 Bit
   +0x308 CreateTime       : _LARGE_INTEGER
   +0x310 ProcessQuotaUsage : [2] Uint8B
   +0x320 ProcessQuotaPeak : [2] Uint8B
   +0x330 PeakVirtualSize  : Uint8B
   +0x338 VirtualSize      : Uint8B
   +0x340 SessionProcessLinks : _LIST_ENTRY
   +0x350 ExceptionPortData : Ptr64 Void
   +0x350 ExceptionPortValue : Uint8B
   +0x350 ExceptionPortState : Pos 0, 3 Bits
   +0x358 Token            : _EX_FAST_REF
   +0x360 WorkingSetPage   : Uint8B
   +0x368 AddressCreationLock : _EX_PUSH_LOCK
   +0x370 PageTableCommitmentLock : _EX_PUSH_LOCK
   +0x378 RotateInProgress : Ptr64 _ETHREAD
   +0x380 ForkInProgress   : Ptr64 _ETHREAD
   +0x388 CommitChargeJob  : Ptr64 _EJOB
   +0x390 CloneRoot        : _RTL_AVL_TREE
   +0x398 NumberOfPrivatePages : Uint8B
   +0x3a0 NumberOfLockedPages : Uint8B
   +0x3a8 Win32Process     : Ptr64 Void
   +0x3b0 Job              : Ptr64 _EJOB
   +0x3b8 SectionObject    : Ptr64 Void
   +0x3c0 SectionBaseAddress : Ptr64 Void
   +0x3c8 Cookie           : Uint4B
   +0x3d0 WorkingSetWatch  : Ptr64 _PAGEFAULT_HISTORY
   +0x3d8 Win32WindowStation : Ptr64 Void
   +0x3e0 InheritedFromUniqueProcessId : Ptr64 Void
   +0x3e8 LdtInformation   : Ptr64 Void
   +0x3f0 OwnerProcessId   : Uint8B
   +0x3f8 Peb              : Ptr64 _PEB
   +0x400 Session          : Ptr64 _MM_SESSION_SPACE
   +0x408 AweInfo          : Ptr64 Void
   +0x410 QuotaBlock       : Ptr64 _EPROCESS_QUOTA_BLOCK
   +0x418 ObjectTable      : Ptr64 _HANDLE_TABLE
   +0x420 DebugPort        : Ptr64 Void
   +0x428 WoW64Process     : Ptr64 _EWOW64PROCESS
   +0x430 DeviceMap        : Ptr64 Void
   +0x438 EtwDataSource    : Ptr64 Void
   +0x440 PageDirectoryPte : Uint8B
   +0x448 ImageFilePointer : Ptr64 _FILE_OBJECT
   +0x450 ImageFileName    : [15] UChar
   +0x45f PriorityClass    : UChar
   +0x460 SecurityPort     : Ptr64 Void
   +0x468 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
   +0x470 JobLinks         : _LIST_ENTRY
   +0x480 HighestUserAddress : Ptr64 Void
   +0x488 ThreadListHead   : _LIST_ENTRY
   +0x498 ActiveThreads    : Uint4B
   +0x49c ImagePathHash    : Uint4B
   +0x4a0 DefaultHardErrorProcessing : Uint4B
   +0x4a4 LastThreadExitStatus : Int4B
   +0x4a8 PrefetchTrace    : _EX_FAST_REF
   +0x4b0 LockedPagesList  : Ptr64 Void
   +0x4b8 ReadOperationCount : _LARGE_INTEGER
   +0x4c0 WriteOperationCount : _LARGE_INTEGER
   +0x4c8 OtherOperationCount : _LARGE_INTEGER
   +0x4d0 ReadTransferCount : _LARGE_INTEGER
   +0x4d8 WriteTransferCount : _LARGE_INTEGER
   +0x4e0 OtherTransferCount : _LARGE_INTEGER
   +0x4e8 CommitChargeLimit : Uint8B
   +0x4f0 CommitCharge     : Uint8B
   +0x4f8 CommitChargePeak : Uint8B
   +0x500 Vm               : _MMSUPPORT_FULL
   +0x610 MmProcessLinks   : _LIST_ENTRY
   +0x620 VadRoot          : _RTL_AVL_TREE
   +0x628 ModifiedPageCount : Uint4B
   +0x62c ExitStatus       : Int4B
   +0x630 VadHint          : Ptr64 Void
   +0x638 VadCount         : Uint8B
   +0x640 VadPhysicalPages : Uint8B
   +0x648 VadPhysicalPagesLimit : Uint8B
   +0x650 AlpcContext      : _ALPC_PROCESS_CONTEXT
   +0x670 TimerResolutionLink : _LIST_ENTRY
   +0x680 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD
   +0x688 RequestedTimerResolution : Uint4B
   +0x68c SmallestTimerResolution : Uint4B
   +0x690 ExitTime         : _LARGE_INTEGER
   +0x698 InvertedFunctionTable : Ptr64 _INVERTED_FUNCTION_TABLE
   +0x6a0 InvertedFunctionTableLock : _EX_PUSH_LOCK
   +0x6a8 ActiveThreadsHighWatermark : Uint4B
   +0x6ac LargePrivateVadCount : Uint4B
   +0x6b0 ThreadListLock   : _EX_PUSH_LOCK
   +0x6b8 WnfContext       : Ptr64 Void
   +0x6c0 Spare0           : Uint8B
   +0x6c8 SignatureLevel   : UChar
   +0x6c9 SectionSignatureLevel : UChar
   +0x6ca Protection       : _PS_PROTECTION
   +0x6cb HangCount        : UChar
   +0x6cc Flags3           : Uint4B
   +0x6cc Minimal          : Pos 0, 1 Bit
   +0x6cc ReplacingPageRoot : Pos 1, 1 Bit
   +0x6cc DisableNonSystemFonts : Pos 2, 1 Bit
   +0x6cc AuditNonSystemFontLoading : Pos 3, 1 Bit
   +0x6cc Crashed          : Pos 4, 1 Bit
   +0x6cc JobVadsAreTracked : Pos 5, 1 Bit
   +0x6cc VadTrackingDisabled : Pos 6, 1 Bit
   +0x6cc AuxiliaryProcess : Pos 7, 1 Bit
   +0x6cc SubsystemProcess : Pos 8, 1 Bit
   +0x6cc IndirectCpuSets  : Pos 9, 1 Bit
   +0x6cc InPrivate        : Pos 10, 1 Bit
   +0x6cc ProhibitRemoteImageMap : Pos 11, 1 Bit
   +0x6cc ProhibitLowILImageMap : Pos 12, 1 Bit
   +0x6cc SignatureMitigationOptIn : Pos 13, 1 Bit
   +0x6cc DisableDynamicCodeAllowOptOut : Pos 14, 1 Bit
   +0x6cc EnableFilteredWin32kAPIs : Pos 15, 1 Bit
   +0x6cc AuditFilteredWin32kAPIs : Pos 16, 1 Bit
   +0x6cc PreferSystem32Images : Pos 17, 1 Bit
   +0x6cc RelinquishedCommit : Pos 18, 1 Bit
   +0x6cc AutomaticallyOverrideChildProcessPolicy : Pos 19, 1 Bit
   +0x6cc HighGraphicsPriority : Pos 20, 1 Bit
   +0x6cc CommitFailLogged : Pos 21, 1 Bit
   +0x6cc ReserveFailLogged : Pos 22, 1 Bit
   +0x6cc AddressPolicyFrozen : Pos 23, 1 Bit
   +0x6cc RestrictIndirectBranchPrediction : Pos 24, 1 Bit
   +0x6cc SpeculativeStoreBypassDisable : Pos 25, 1 Bit
   +0x6d0 DeviceAsid       : Int4B
   +0x6d8 SvmData          : Ptr64 Void
   +0x6e0 SvmProcessLock   : _EX_PUSH_LOCK
   +0x6e8 SvmLock          : Uint8B
   +0x6f0 SvmProcessDeviceListHead : _LIST_ENTRY
   +0x700 LastFreezeInterruptTime : Uint8B
   +0x708 DiskCounters     : Ptr64 _PROCESS_DISK_COUNTERS
   +0x710 PicoContext      : Ptr64 Void
   +0x718 TrustletIdentity : Uint8B
   +0x720 KeepAliveCounter : Uint4B
   +0x724 NoWakeKeepAliveCounter : Uint4B
   +0x728 HighPriorityFaultsAllowed : Uint4B
   +0x730 EnergyValues     : Ptr64 _PROCESS_ENERGY_VALUES
   +0x738 VmContext        : Ptr64 Void
   +0x740 SequenceNumber   : Uint8B
   +0x748 CreateInterruptTime : Uint8B
   +0x750 CreateUnbiasedInterruptTime : Uint8B
   +0x758 TotalUnbiasedFrozenTime : Uint8B
   +0x760 LastAppStateUpdateTime : Uint8B
   +0x768 LastAppStateUptime : Pos 0, 61 Bits
   +0x768 LastAppState     : Pos 61, 3 Bits
   +0x770 SharedCommitCharge : Uint8B
   +0x778 SharedCommitLock : _EX_PUSH_LOCK
   +0x780 SharedCommitLinks : _LIST_ENTRY
   +0x790 AllowedCpuSets   : Uint8B
   +0x798 DefaultCpuSets   : Uint8B
   +0x790 AllowedCpuSetsIndirect : Ptr64 Uint8B
   +0x798 DefaultCpuSetsIndirect : Ptr64 Uint8B
   +0x7a0 DiskIoAttribution : Ptr64 Void
   +0x7a8 ReadyTime        : Uint4B
   +0x7b0 DxgProcess       : Ptr64 Void
   +0x7b8 SecurityDomain   : Uint8B

EPROCESS的第一个成员是KRPOCESS.

0: kd> dt _KPROCESS
ntdll!_KPROCESS
   +0x000 Header           : _DISPATCHER_HEADER
   +0x018 ProfileListHead  : _LIST_ENTRY
   +0x028 DirectoryTableBase : Uint8B
   +0x030 ThreadListHead   : _LIST_ENTRY
   +0x040 ProcessLock      : Uint4B
   +0x044 Spare0           : Uint4B
   +0x048 DeepFreezeStartTime : Uint8B
   +0x050 Affinity         : _KAFFINITY_EX
   +0x0f8 ReadyListHead    : _LIST_ENTRY
   +0x108 SwapListEntry    : _SINGLE_LIST_ENTRY
   +0x110 ActiveProcessors : _KAFFINITY_EX
   +0x1b8 AutoAlignment    : Pos 0, 1 Bit
   +0x1b8 DisableBoost     : Pos 1, 1 Bit
   +0x1b8 DisableQuantum   : Pos 2, 1 Bit
   +0x1b8 DeepFreeze       : Pos 3, 1 Bit
   +0x1b8 TimerVirtualization : Pos 4, 1 Bit
   +0x1b8 CheckStackExtents : Pos 5, 1 Bit
   +0x1b8 SpareFlags0      : Pos 6, 2 Bits
   +0x1b8 ActiveGroupsMask : Pos 8, 20 Bits
   +0x1b8 ReservedFlags    : Pos 28, 4 Bits
   +0x1b8 ProcessFlags     : Int4B
   +0x1bc BasePriority     : Char
   +0x1bd QuantumReset     : Char
   +0x1be Visited          : UChar
   +0x1bf Flags            : _KEXECUTE_OPTIONS
   +0x1c0 ThreadSeed       : [20] Uint4B
   +0x210 IdealNode        : [20] Uint2B
   +0x238 IdealGlobalNode  : Uint2B
   +0x23a Spare1           : Uint2B
   +0x23c StackCount       : _KSTACK_COUNT
   +0x240 ProcessListEntry : _LIST_ENTRY
   +0x250 CycleTime        : Uint8B
   +0x258 ContextSwitches  : Uint8B
   +0x260 SchedulingGroup  : Ptr64 _KSCHEDULING_GROUP
   +0x268 FreezeCount      : Uint4B
   +0x26c KernelTime       : Uint4B
   +0x270 UserTime         : Uint4B
   +0x274 Spare2           : [75] UChar
   +0x2bf AddressPolicy    : UChar
   +0x2c0 UserDirectoryTableBase : Uint8B
   +0x2c8 InstrumentationCallback : Ptr64 Void
   +0x2d0 SecurePid        : Uint8B

KPROCESS的第一个成员是DISPATCHER_HEADER

0: kd> dt _DISPATCHER_HEADER
ntdll!_DISPATCHER_HEADER
   +0x000 Lock             : Int4B
   +0x000 LockNV           : Int4B
   +0x000 Type             : UChar
   +0x001 Signalling       : UChar
   +0x002 Size             : UChar
   +0x003 Reserved1        : UChar
   +0x000 TimerType        : UChar
   +0x001 TimerControlFlags : UChar
   +0x001 Absolute         : Pos 0, 1 Bit
   +0x001 Wake             : Pos 1, 1 Bit
   +0x001 EncodedTolerableDelay : Pos 2, 6 Bits
   +0x002 Hand             : UChar
   +0x003 TimerMiscFlags   : UChar
   +0x003 Index            : Pos 0, 6 Bits
   +0x003 Inserted         : Pos 6, 1 Bit
   +0x003 Expired          : Pos 7, 1 Bit
   +0x000 Timer2Type       : UChar
   +0x001 Timer2Flags      : UChar
   +0x001 Timer2Inserted   : Pos 0, 1 Bit
   +0x001 Timer2Expiring   : Pos 1, 1 Bit
   +0x001 Timer2CancelPending : Pos 2, 1 Bit
   +0x001 Timer2SetPending : Pos 3, 1 Bit
   +0x001 Timer2Running    : Pos 4, 1 Bit
   +0x001 Timer2Disabled   : Pos 5, 1 Bit
   +0x001 Timer2ReservedFlags : Pos 6, 2 Bits
   +0x002 Timer2Reserved1  : UChar
   +0x003 Timer2Reserved2  : UChar
   +0x000 QueueType        : UChar
   +0x001 QueueControlFlags : UChar
   +0x001 Abandoned        : Pos 0, 1 Bit
   +0x001 DisableIncrement : Pos 1, 1 Bit
   +0x001 QueueReservedControlFlags : Pos 2, 6 Bits
   +0x002 QueueSize        : UChar
   +0x003 QueueReserved    : UChar
   +0x000 ThreadType       : UChar
   +0x001 ThreadReserved   : UChar
   +0x002 ThreadControlFlags : UChar
   +0x002 CycleProfiling   : Pos 0, 1 Bit
   +0x002 CounterProfiling : Pos 1, 1 Bit
   +0x002 GroupScheduling  : Pos 2, 1 Bit
   +0x002 AffinitySet      : Pos 3, 1 Bit
   +0x002 Tagged           : Pos 4, 1 Bit
   +0x002 EnergyProfiling  : Pos 5, 1 Bit
   +0x002 ThreadReservedControlFlags : Pos 6, 2 Bits
   +0x003 DebugActive      : UChar
   +0x003 ActiveDR7        : Pos 0, 1 Bit
   +0x003 Instrumented     : Pos 1, 1 Bit
   +0x003 Minimal          : Pos 2, 1 Bit
   +0x003 Reserved4        : Pos 3, 3 Bits
   +0x003 UmsScheduled     : Pos 6, 1 Bit
   +0x003 UmsPrimary       : Pos 7, 1 Bit
   +0x000 MutantType       : UChar
   +0x001 MutantSize       : UChar
   +0x002 DpcActive        : UChar
   +0x003 MutantReserved   : UChar
   +0x004 SignalState      : Int4B
   +0x008 WaitListHead     : _LIST_ENTRY

DISPATCHER_HEADER

凡是内核对象第一个成员为DISPATCHER_HEADER的，都可以被WaitForSingleObject等待，这些对象被称为可等待对象。如线程句柄HANDLE，EVENT事件，Mutex互拆体等。

UniqueProcessId

进程ID,任务管理器中PID.

ActiveProcessLinks

双向链表 所有的活动进程都连接在一起，构成了一个链表.
PsActiveProcessHead指向全局链表头

DirectoryTableBase

页目录地表的基址。页目录表中保存了进程中所有空间的页面映射，其存于CR3中。
进程切换或者Fake进程的原理就是替换页目录地表的基址.

KernelTime/UserTime

KernelTime:是进程在内核中运行的时间和。
UserTime:是进程在应用层中运行的时间和。

Affinity

进程的CPU亲和度。规定进程里面的所有线程能在哪个CPU上跑,如果值为1，那这个进程的所以线程只能在0号CPU上跑(00000001)

• 如果值为3，那这个进程的所以线程能在0、1号CPU上跑(000000011)
• 如果值为4，那这个进程的所以线程能在2号CPU上跑(000000100)
• 如果值为5，那这个进程的所以线程能在0，2号CPU上跑(000000101)
• 如果只有一个CPU 把这个设置为4 那么这个进程就死了

0: kd> dt _KAFFINITY_EX
ntdll!_KAFFINITY_EX
   +0x000 Count            : Uint2B
   +0x002 Size             : Uint2B
   +0x004 Reserved         : Uint4B
   +0x008 Bitmap           : [20] Uint8B

Windows10现在支持的CPU最大个数：

8*8*20=320

BasePriority

基础优先级或最低优先级 该进程中的所有线程最起码的优先级

CreateTime/ExitTime

进程的创建和/退出时间

ProcessQuotaUsage/ProcessQuotaPeak

物理页相关的统计信息

CommitCharge/ PeakVirtualSize /VirtualSize

虚拟内存相关的统计信息

VadRoot

标识应用层哪些地址没占用,指向一棵平衡二叉树。内存管理相关。

DebugPort/ExceptionPort

调试相关

ObjectTable

句柄表

ImageFileName

进程镜像文件名 最多16个字节

ActiveThreads

活动线程的数量

Peb

PEB((Process Environment Block 进程环境块)：进程在3环的一个结构体，里面包含了进程的模块列表、是否处于调试状态等信息。