Windows进程&线程
Windows内核进程结构体EPROCESS
2023-11-03
8
0
每个Windows进程在内核中都有一个对应的结构体，名叫EPROCESS。
通过Windbg可查看其结构体：
0: kd> dt _EPROCESS
ntdll!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x2d8 ProcessLock : _EX_PUSH_LOCK
+0x2e0 RundownProtect : _EX_RUNDOWN_REF
+0x2e8 UniqueProcessId : Ptr64 Void
+0x2f0 ActiveProcessLinks : _LIST_ENTRY
+0x300 Flags2 : Uint4B
+0x300 JobNotReallyActive : Pos 0, 1 Bit
+0x300 AccountingFolded : Pos 1, 1 Bit
+0x300 NewProcessReported : Pos 2, 1 Bit
+0x300 ExitProcessReported : Pos 3, 1 Bit
+0x300 ReportCommitChanges : Pos 4, 1 Bit
+0x300 LastReportMemory : Pos 5, 1 Bit
+0x300 ForceWakeCharge : Pos 6, 1 Bit
+0x300 CrossSessionCreate : Pos 7, 1 Bit
+0x300 NeedsHandleRundown : Pos 8, 1 Bit
+0x300 RefTraceEnabled : Pos 9, 1 Bit
+0x300 DisableDynamicCode : Pos 10, 1 Bit
+0x300 EmptyJobEvaluated : Pos 11, 1 Bit
+0x300 DefaultPagePriority : Pos 12, 3 Bits
+0x300 PrimaryTokenFrozen : Pos 15, 1 Bit
+0x300 ProcessVerifierTarget : Pos 16, 1 Bit
+0x300 StackRandomizationDisabled : Pos 17, 1 Bit
+0x300 AffinityPermanent : Pos 18, 1 Bit
+0x300 AffinityUpdateEnable : Pos 19, 1 Bit
+0x300 PropagateNode : Pos 20, 1 Bit
+0x300 ExplicitAffinity : Pos 21, 1 Bit
+0x300 ProcessExecutionState : Pos 22, 2 Bits
+0x300 DisallowStrippedImages : Pos 24, 1 Bit
+0x300 HighEntropyASLREnabled : Pos 25, 1 Bit
+0x300 ExtensionPointDisable : Pos 26, 1 Bit
+0x300 ForceRelocateImages : Pos 27, 1 Bit
+0x300 ProcessStateChangeRequest : Pos 28, 2 Bits
+0x300 ProcessStateChangeInProgress : Pos 30, 1 Bit
+0x300 DisallowWin32kSystemCalls : Pos 31, 1 Bit
+0x304 Flags : Uint4B
+0x304 CreateReported : Pos 0, 1 Bit
+0x304 NoDebugInherit : Pos 1, 1 Bit
+0x304 ProcessExiting : Pos 2, 1 Bit
+0x304 ProcessDelete : Pos 3, 1 Bit
+0x304 ControlFlowGuardEnabled : Pos 4, 1 Bit
+0x304 VmDeleted : Pos 5, 1 Bit
+0x304 OutswapEnabled : Pos 6, 1 Bit
+0x304 Outswapped : Pos 7, 1 Bit
+0x304 FailFastOnCommitFail : Pos 8, 1 Bit
+0x304 Wow64VaSpace4Gb : Pos 9, 1 Bit
+0x304 AddressSpaceInitialized : Pos 10, 2 Bits
+0x304 SetTimerResolution : Pos 12, 1 Bit
+0x304 BreakOnTermination : Pos 13, 1 Bit
+0x304 DeprioritizeViews : Pos 14, 1 Bit
+0x304 WriteWatch : Pos 15, 1 Bit
+0x304 ProcessInSession : Pos 16, 1 Bit
+0x304 OverrideAddressSpace : Pos 17, 1 Bit
+0x304 HasAddressSpace : Pos 18, 1 Bit
+0x304 LaunchPrefetched : Pos 19, 1 Bit
+0x304 Background : Pos 20, 1 Bit
+0x304 VmTopDown : Pos 21, 1 Bit
+0x304 ImageNotifyDone : Pos 22, 1 Bit
+0x304 PdeUpdateNeeded : Pos 23, 1 Bit
+0x304 VdmAllowed : Pos 24, 1 Bit
+0x304 ProcessRundown : Pos 25, 1 Bit
+0x304 ProcessInserted : Pos 26, 1 Bit
+0x304 DefaultIoPriority : Pos 27, 3 Bits
+0x304 ProcessSelfDelete : Pos 30, 1 Bit
+0x304 SetTimerResolutionLink : Pos 31, 1 Bit
+0x308 CreateTime : _LARGE_INTEGER
+0x310 ProcessQuotaUsage : [2] Uint8B
+0x320 ProcessQuotaPeak : [2] Uint8B
+0x330 PeakVirtualSize : Uint8B
+0x338 VirtualSize : Uint8B
+0x340 SessionProcessLinks : _LIST_ENTRY
+0x350 ExceptionPortData : Ptr64 Void
+0x350 ExceptionPortValue : Uint8B
+0x350 ExceptionPortState : Pos 0, 3 Bits
+0x358 Token : _EX_FAST_REF
+0x360 WorkingSetPage : Uint8B
+0x368 AddressCreationLock : _EX_PUSH_LOCK
+0x370 PageTableCommitmentLock : _EX_PUSH_LOCK
+0x378 RotateInProgress : Ptr64 _ETHREAD
+0x380 ForkInProgress : Ptr64 _ETHREAD
+0x388 CommitChargeJob : Ptr64 _EJOB
+0x390 CloneRoot : _RTL_AVL_TREE
+0x398 NumberOfPrivatePages : Uint8B
+0x3a0 NumberOfLockedPages : Uint8B
+0x3a8 Win32Process : Ptr64 Void
+0x3b0 Job : Ptr64 _EJOB
+0x3b8 SectionObject : Ptr64 Void
+0x3c0 SectionBaseAddress : Ptr64 Void
+0x3c8 Cookie : Uint4B
+0x3d0 WorkingSetWatch : Ptr64 _PAGEFAULT_HISTORY
+0x3d8 Win32WindowStation : Ptr64 Void
+0x3e0 InheritedFromUniqueProcessId : Ptr64 Void
+0x3e8 LdtInformation : Ptr64 Void
+0x3f0 OwnerProcessId : Uint8B
+0x3f8 Peb : Ptr64 _PEB
+0x400 Session : Ptr64 _MM_SESSION_SPACE
+0x408 AweInfo : Ptr64 Void
+0x410 QuotaBlock : Ptr64 _EPROCESS_QUOTA_BLOCK
+0x418 ObjectTable : Ptr64 _HANDLE_TABLE
+0x420 DebugPort : Ptr64 Void
+0x428 WoW64Process : Ptr64 _EWOW64PROCESS
+0x430 DeviceMap : Ptr64 Void
+0x438 EtwDataSource : Ptr64 Void
+0x440 PageDirectoryPte : Uint8B
+0x448 ImageFilePointer : Ptr64 _FILE_OBJECT
+0x450 ImageFileName : [15] UChar
+0x45f PriorityClass : UChar
+0x460 SecurityPort : Ptr64 Void
+0x468 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x470 JobLinks : _LIST_ENTRY
+0x480 HighestUserAddress : Ptr64 Void
+0x488 ThreadListHead : _LIST_ENTRY
+0x498 ActiveThreads : Uint4B
+0x49c ImagePathHash : Uint4B
+0x4a0 DefaultHardErrorProcessing : Uint4B
+0x4a4 LastThreadExitStatus : Int4B
+0x4a8 PrefetchTrace : _EX_FAST_REF
+0x4b0 LockedPagesList : Ptr64 Void
+0x4b8 ReadOperationCount : _LARGE_INTEGER
+0x4c0 WriteOperationCount : _LARGE_INTEGER
+0x4c8 OtherOperationCount : _LARGE_INTEGER
+0x4d0 ReadTransferCount : _LARGE_INTEGER
+0x4d8 WriteTransferCount : _LARGE_INTEGER
+0x4e0 OtherTransferCount : _LARGE_INTEGER
+0x4e8 CommitChargeLimit : Uint8B
+0x4f0 CommitCharge : Uint8B
+0x4f8 CommitChargePeak : Uint8B
+0x500 Vm : _MMSUPPORT_FULL
+0x610 MmProcessLinks : _LIST_ENTRY
+0x620 VadRoot : _RTL_AVL_TREE
+0x628 ModifiedPageCount : Uint4B
+0x62c ExitStatus : Int4B
+0x630 VadHint : Ptr64 Void
+0x638 VadCount : Uint8B
+0x640 VadPhysicalPages : Uint8B
+0x648 VadPhysicalPagesLimit : Uint8B
+0x650 AlpcContext : _ALPC_PROCESS_CONTEXT
+0x670 TimerResolutionLink : _LIST_ENTRY
+0x680 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD
+0x688 RequestedTimerResolution : Uint4B
+0x68c SmallestTimerResolution : Uint4B
+0x690 ExitTime : _LARGE_INTEGER
+0x698 InvertedFunctionTable : Ptr64 _INVERTED_FUNCTION_TABLE
+0x6a0 InvertedFunctionTableLock : _EX_PUSH_LOCK
+0x6a8 ActiveThreadsHighWatermark : Uint4B
+0x6ac LargePrivateVadCount : Uint4B
+0x6b0 ThreadListLock : _EX_PUSH_LOCK
+0x6b8 WnfContext : Ptr64 Void
+0x6c0 Spare0 : Uint8B
+0x6c8 SignatureLevel : UChar
+0x6c9 SectionSignatureLevel : UChar
+0x6ca Protection : _PS_PROTECTION
+0x6cb HangCount : UChar
+0x6cc Flags3 : Uint4B
+0x6cc Minimal : Pos 0, 1 Bit
+0x6cc ReplacingPageRoot : Pos 1, 1 Bit
+0x6cc DisableNonSystemFonts : Pos 2, 1 Bit
+0x6cc AuditNonSystemFontLoading : Pos 3, 1 Bit
+0x6cc Crashed : Pos 4, 1 Bit
+0x6cc JobVadsAreTracked : Pos 5, 1 Bit
+0x6cc VadTrackingDisabled : Pos 6, 1 Bit
+0x6cc AuxiliaryProcess : Pos 7, 1 Bit
+0x6cc SubsystemProcess : Pos 8, 1 Bit
+0x6cc IndirectCpuSets : Pos 9, 1 Bit
+0x6cc InPrivate : Pos 10, 1 Bit
+0x6cc ProhibitRemoteImageMap : Pos 11, 1 Bit
+0x6cc ProhibitLowILImageMap : Pos 12, 1 Bit
+0x6cc SignatureMitigationOptIn : Pos 13, 1 Bit
+0x6cc DisableDynamicCodeAllowOptOut : Pos 14, 1 Bit
+0x6cc EnableFilteredWin32kAPIs : Pos 15, 1 Bit
+0x6cc AuditFilteredWin32kAPIs : Pos 16, 1 Bit
+0x6cc PreferSystem32Images : Pos 17, 1 Bit
+0x6cc RelinquishedCommit : Pos 18, 1 Bit
+0x6cc AutomaticallyOverrideChildProcessPolicy : Pos 19, 1 Bit
+0x6cc HighGraphicsPriority : Pos 20, 1 Bit
+0x6cc CommitFailLogged : Pos 21, 1 Bit
+0x6cc ReserveFailLogged : Pos 22, 1 Bit
+0x6cc AddressPolicyFrozen : Pos 23, 1 Bit
+0x6cc RestrictIndirectBranchPrediction : Pos 24, 1 Bit
+0x6cc SpeculativeStoreBypassDisable : Pos 25, 1 Bit
+0x6d0 DeviceAsid : Int4B
+0x6d8 SvmData : Ptr64 Void
+0x6e0 SvmProcessLock : _EX_PUSH_LOCK
+0x6e8 SvmLock : Uint8B
+0x6f0 SvmProcessDeviceListHead : _LIST_ENTRY
+0x700 LastFreezeInterruptTime : Uint8B
+0x708 DiskCounters : Ptr64 _PROCESS_DISK_COUNTERS
+0x710 PicoContext : Ptr64 Void
+0x718 TrustletIdentity : Uint8B
+0x720 KeepAliveCounter : Uint4B
+0x724 NoWakeKeepAliveCounter : Uint4B
+0x728 HighPriorityFaultsAllowed : Uint4B
+0x730 EnergyValues : Ptr64 _PROCESS_ENERGY_VALUES
+0x738 VmContext : Ptr64 Void
+0x740 SequenceNumber : Uint8B
+0x748 CreateInterruptTime : Uint8B
+0x750 CreateUnbiasedInterruptTime : Uint8B
+0x758 TotalUnbiasedFrozenTime : Uint8B
+0x760 LastAppStateUpdateTime : Uint8B
+0x768 LastAppStateUptime : Pos 0, 61 Bits
+0x768 LastAppState : Pos 61, 3 Bits
+0x770 SharedCommitCharge : Uint8B
+0x778 SharedCommitLock : _EX_PUSH_LOCK
+0x780 SharedCommitLinks : _LIST_ENTRY
+0x790 AllowedCpuSets : Uint8B
+0x798 DefaultCpuSets : Uint8B
+0x790 AllowedCpuSetsIndirect : Ptr64 Uint8B
+0x798 DefaultCpuSetsIndirect : Ptr64 Uint8B
+0x7a0 DiskIoAttribution : Ptr64 Void
+0x7a8 ReadyTime : Uint4B
+0x7b0 DxgProcess : Ptr64 Void
+0x7b8 SecurityDomain : Uint8B
EPROCESS的第一个成员是KRPOCESS.
0: kd> dt _KPROCESS
ntdll!_KPROCESS
+0x000 Header : _DISPATCHER_HEADER
+0x018 ProfileListHead : _LIST_ENTRY
+0x028 DirectoryTableBase : Uint8B
+0x030 ThreadListHead : _LIST_ENTRY
+0x040 ProcessLock : Uint4B
+0x044 Spare0 : Uint4B
+0x048 DeepFreezeStartTime : Uint8B
+0x050 Affinity : _KAFFINITY_EX
+0x0f8 ReadyListHead : _LIST_ENTRY
+0x108 SwapListEntry : _SINGLE_LIST_ENTRY
+0x110 ActiveProcessors : _KAFFINITY_EX
+0x1b8 AutoAlignment : Pos 0, 1 Bit
+0x1b8 DisableBoost : Pos 1, 1 Bit
+0x1b8 DisableQuantum : Pos 2, 1 Bit
+0x1b8 DeepFreeze : Pos 3, 1 Bit
+0x1b8 TimerVirtualization : Pos 4, 1 Bit
+0x1b8 CheckStackExtents : Pos 5, 1 Bit
+0x1b8 SpareFlags0 : Pos 6, 2 Bits
+0x1b8 ActiveGroupsMask : Pos 8, 20 Bits
+0x1b8 ReservedFlags : Pos 28, 4 Bits
+0x1b8 ProcessFlags : Int4B
+0x1bc BasePriority : Char
+0x1bd QuantumReset : Char
+0x1be Visited : UChar
+0x1bf Flags : _KEXECUTE_OPTIONS
+0x1c0 ThreadSeed : [20] Uint4B
+0x210 IdealNode : [20] Uint2B
+0x238 IdealGlobalNode : Uint2B
+0x23a Spare1 : Uint2B
+0x23c StackCount : _KSTACK_COUNT
+0x240 ProcessListEntry : _LIST_ENTRY
+0x250 CycleTime : Uint8B
+0x258 ContextSwitches : Uint8B
+0x260 SchedulingGroup : Ptr64 _KSCHEDULING_GROUP
+0x268 FreezeCount : Uint4B
+0x26c KernelTime : Uint4B
+0x270 UserTime : Uint4B
+0x274 Spare2 : [75] UChar
+0x2bf AddressPolicy : UChar
+0x2c0 UserDirectoryTableBase : Uint8B
+0x2c8 InstrumentationCallback : Ptr64 Void
+0x2d0 SecurePid : Uint8B
KPROCESS的第一个成员是DISPATCHER_HEADER
0: kd> dt _DISPATCHER_HEADER
ntdll!_DISPATCHER_HEADER
+0x000 Lock : Int4B
+0x000 LockNV : Int4B
+0x000 Type : UChar
+0x001 Signalling : UChar
+0x002 Size : UChar
+0x003 Reserved1 : UChar
+0x000 TimerType : UChar
+0x001 TimerControlFlags : UChar
+0x001 Absolute : Pos 0, 1 Bit
+0x001 Wake : Pos 1, 1 Bit
+0x001 EncodedTolerableDelay : Pos 2, 6 Bits
+0x002 Hand : UChar
+0x003 TimerMiscFlags : UChar
+0x003 Index : Pos 0, 6 Bits
+0x003 Inserted : Pos 6, 1 Bit
+0x003 Expired : Pos 7, 1 Bit
+0x000 Timer2Type : UChar
+0x001 Timer2Flags : UChar
+0x001 Timer2Inserted : Pos 0, 1 Bit
+0x001 Timer2Expiring : Pos 1, 1 Bit
+0x001 Timer2CancelPending : Pos 2, 1 Bit
+0x001 Timer2SetPending : Pos 3, 1 Bit
+0x001 Timer2Running : Pos 4, 1 Bit
+0x001 Timer2Disabled : Pos 5, 1 Bit
+0x001 Timer2ReservedFlags : Pos 6, 2 Bits
+0x002 Timer2Reserved1 : UChar
+0x003 Timer2Reserved2 : UChar
+0x000 QueueType : UChar
+0x001 QueueControlFlags : UChar
+0x001 Abandoned : Pos 0, 1 Bit
+0x001 DisableIncrement : Pos 1, 1 Bit
+0x001 QueueReservedControlFlags : Pos 2, 6 Bits
+0x002 QueueSize : UChar
+0x003 QueueReserved : UChar
+0x000 ThreadType : UChar
+0x001 ThreadReserved : UChar
+0x002 ThreadControlFlags : UChar
+0x002 CycleProfiling : Pos 0, 1 Bit
+0x002 CounterProfiling : Pos 1, 1 Bit
+0x002 GroupScheduling : Pos 2, 1 Bit
+0x002 AffinitySet : Pos 3, 1 Bit
+0x002 Tagged : Pos 4, 1 Bit
+0x002 EnergyProfiling : Pos 5, 1 Bit
+0x002 ThreadReservedControlFlags : Pos 6, 2 Bits
+0x003 DebugActive : UChar
+0x003 ActiveDR7 : Pos 0, 1 Bit
+0x003 Instrumented : Pos 1, 1 Bit
+0x003 Minimal : Pos 2, 1 Bit
+0x003 Reserved4 : Pos 3, 3 Bits
+0x003 UmsScheduled : Pos 6, 1 Bit
+0x003 UmsPrimary : Pos 7, 1 Bit
+0x000 MutantType : UChar
+0x001 MutantSize : UChar
+0x002 DpcActive : UChar
+0x003 MutantReserved : UChar
+0x004 SignalState : Int4B
+0x008 WaitListHead : _LIST_ENTRY
DISPATCHER_HEADER
凡是内核对象第一个成员为DISPATCHER_HEADER的，都可以被WaitForSingleObject等待，这些对象被称为可等待对象。如线程句柄HANDLE，EVENT事件，Mutex互拆体等。
UniqueProcessId
进程ID,任务管理器中PID.
ActiveProcessLinks
双向链表 所有的活动进程都连接在一起，构成了一个链表.
PsActiveProcessHead指向全局链表头
DirectoryTableBase
页目录地表的基址。页目录表中保存了进程中所有空间的页面映射，其存于CR3中。
进程切换或者Fake进程的原理就是替换页目录地表的基址.
KernelTime/UserTime
KernelTime:是进程在内核中运行的时间和。
UserTime:是进程在应用层中运行的时间和。
Affinity
进程的CPU亲和度。规定进程里面的所有线程能在哪个CPU上跑,如果值为1，那这个进程的所以线程只能在0号CPU上跑(00000001)
- 如果值为3，那这个进程的所以线程能在0、1号CPU上跑(000000011)
- 如果值为4，那这个进程的所以线程能在2号CPU上跑(000000100)
- 如果值为5，那这个进程的所以线程能在0，2号CPU上跑(000000101)
- 如果只有一个CPU 把这个设置为4 那么这个进程就死了
0: kd> dt _KAFFINITY_EX
ntdll!_KAFFINITY_EX
+0x000 Count : Uint2B
+0x002 Size : Uint2B
+0x004 Reserved : Uint4B
+0x008 Bitmap : [20] Uint8B
Windows10现在支持的CPU最大个数：
8*8*20=320
BasePriority
基础优先级或最低优先级 该进程中的所有线程最起码的优先级
CreateTime/ExitTime
进程的创建和/退出时间
ProcessQuotaUsage/ProcessQuotaPeak
物理页相关的统计信息
CommitCharge/ PeakVirtualSize /VirtualSize
虚拟内存相关的统计信息
VadRoot
标识应用层哪些地址没占用,指向一棵平衡二叉树。内存管理相关。
DebugPort/ExceptionPort
调试相关
ObjectTable
句柄表
ImageFileName
进程镜像文件名 最多16个字节
ActiveThreads
活动线程的数量
Peb
PEB((Process Environment Block 进程环境块)：进程在3环的一个结构体，里面包含了进程的模块列表、是否处于调试状态等信息。
