Windows 进程描述符

Question

进程的双向链表有Flink和Blink(Forward Link和Backward Link)。有一个进程标识符。所有这些都打包在一个称为 PEPROCESS 或 _KPROCESS 的结构中。但是这些在哪里，这个结构中的其他元素是什么？

或者，如果答案既不简短也不简单，如果不在文档或头文件中，可以在哪里找到引用？ (这是我看过的地方，可能忽略了什么。)

Answer 1

EPROCESS reference

The EPROCESS structure is an opaque structure that serves as the process object for a process.

Some routines, such as PsGetProcessCreateTimeQuadPart, use EPROCESS to identify the process to operate on. Drivers can use the PsGetCurrentProcess routine to obtain a pointer to the process object for the current process and can use the ObReferenceObjectByHandle routine to obtain a pointer to the process object that is associated with the specified handle. The PsInitialSystemProcess global variable points to the process object for the system process.

Note that a process object is an Object Manager object. Drivers should use Object Manager routines such as ObReferenceObject and ObDereferenceObject to maintain the object’s reference count.

这意味着，您不应该关心流程结构的成员是什么。尽管如此，还是有一些资料详细说明了流程结构的布局。

这book对各个成员有更详细的描述。