-
-
X86内核笔记_4_进程和线程
-
发表于: 2021-12-7 15:06
-
CPU控制块结构，每一个逻辑核都有一个KPCR结构描述当前CPU的各种信息。全局变量“KeNumberProcessors”中保存了当前机器的CPU核数。
在系统调用章节我们初步了解了KPCR的部分成员。
KPCR结构成员列表：
CPU控制块扩展块。全局变量“KiProcessorBlock”中保存了KPRCB的地址。
KPRCB结构成员列表：
其余字段在后续分析内核代码时再了解。
在3环下，每个进程都有一个PEB结构用来描述这个进程的一些信息。这些信息仅是为了3环更好的操作进程。而在0环，每个进程又有一个结构体用于描述该进程的所有信息：EPROCESS。
结构体成员列表：
+0 Pcb：Kprocess结构体。参考下文。
+98 ProcessLock：进程锁。修改EPROCESS结构存放锁结构，防止同时修改。改完了置0.
+A0 CreateTime：进程的创建时间。
+A8 ExitTime：进程的退出时间。
+B0 RundownProtect：进程锁。该字段置值后，进程无法被访问、打开、结束，相当于保护。但是会容易卡死。
+B4 UniqueProcessId：进程ID。任务管理器中显示的进程ID就是这个。
+B8 ActiveProcessLinks：双向链表。包括了windows中所有活动的进程。全局变量“PsActiveProcessHead”指向了这个链表的头部。通过该全局变量可以遍历整条链表。
+C0 ProcessQuotaUsage：进程物理页相关统计信息。
+C8 ProcessQuotaPeak：进程物理页相关统计信息。
+D0 CommitCharge：进程虚拟内存相关统计信息。
+D4 QuotaBlock：进程虚拟内存相关统计信息。
+D8 CpuQuotaBlock：进程虚拟内存相关统计信息。
+E4 SessionProcessLinks：会话进程链表。保存了当前登录的用户的所有进程。
+EC DebugPort：调试相关。如果该进程处于调试状态，这里会有值（一个结构体），该结构体用于进程与调试器之间通信。通过循环清0可以达到反调试效果。
+F0 ExceptionPortData：调试相关。
+F4 ObjectTable：进程的句柄表。句柄相关章节再学。
+F8 Token：进程Token。
+FC WorkingSetPage：表明当前进程用了多少个物理页。
+16C ImageFileName：当前进程的进程名。
+188 ThreadListHead：当前进程内所有线程的链表。
+198 ActiveThreads：当前进程内活动的线程数量。
+1A8 Peb。就是3环下该进程的PEB。（PEB结构此处不赘述了，网上有非常多的PEB结构说明。）
+1EC SeAuditProcessCreationInfo：当前进程完整路径。
+26C Flags2：一个联合体，每个位影响该进程的一些属性。
ProtectedProcess：进程保护位。该位置1后该进程被保护。CE看不到图片，打不开了进程。OD附加进程列表遍历不到。一个最简单的进程保护。
+270 Flags：一个联合体，每个位影响该进程的一些属性。
ProcessExiting：进程退出标志位。置1后表明该进程已退出，但实际还在运行。可以达到反调试的效果。同时进程无法使用任务管理器结束。
ProcessDelete：进程退出标志位。置1后表明该进程已退出，但实际还在运行。可以达到反调试的效果。同时进程无法使用任务管理器结束。
BreakOnTermination：该位置1后，任务管理器结束进程时将提示“是否结束系统进程XXX”。结束后windbg将会断下。
VmTopDown：该位置1时，VirtualAlloc一类的申请内存函数将会从大地址开始申请。
ProcessInserted：该位置0后，OD附加进程列表找不到该进程。任务管理器结束不掉该进程。CE打不开该进程，无图标。
+274 ExitStatus：进程退出状态码。进程创建时默认值是250（0x103）。如果不是这个值基本上就是进程退出了。
+278 VadRoot：标识当前进程用户空间（低2G）中哪些地址没被分配。该成员指向了一个二叉树。
Eprocess第一个成员是一个Kprocess结构。
Kprocess结构成员列表：
+0 Header：可等待对象头部。所有0环结构体只要以_DISPATCHER_HEADER结构开头的，都可以使用WaitForSingleObject等待。如互斥体、事件。
+10 ProfileListHead：性能分析相关，任务管理器，性能栏那些数据。
+18 DirectoryTableBase：页目录表基址。物理地址，指向页目录表，CR3中的值就从这里获取。
+2C ThreadListHead：当前进程的所有线程结构体链表。
+38 Affinity：亲核性。规定了当前进程内的所有线程可以在哪些CPU上跑，4字节，共32位，每一位对应一个CPU核。如000000A1，转换为二进制为1010 0001，则该进程中的线程只能在0、5、7号CPU上运行。因此32位系统最多支持32核CPU，64位系统支持64核CPU。该值仅为线程结构中的亲核性做初始化赋值使用，没有实际的限制功能。
如果只有1个CPU，但此处值为2（0010），则该进程为一个“死”了的进程。
+44 ReadyListHead：当前进程内的就绪线程链表。
+4C SwapListEntry：交换到文件磁盘上时使用该链表。记录了哪些内存被交换到文件里。
+50 ActiveProcessors：当前进程内正在运行的线程运行在哪些CPU上。
+5C AutoAlignment：强制内存对齐。一般为0。
+5C DisableBoost：置1为关闭当前进程内所有线程的时间碎片。（置1后，不会由于时间中断触发线程切换）
+60 BasePriority：基础优先级。该进程内所有线程最初的优先级。
+61 QuantumReset：当前进程内线程的初始时间碎片。每一次时钟中断会将线程中的时间碎片减6，为0时，切换线程。线程从就绪变为运行时，会从这个值中取到初始的时间碎片。改大这个值会让该进程内的线程跑的更久。
+78 ProcessListEntry：系统内所有进程的链表。win7及以上此处为空，已弃用。
+80 CycleTime：当前进程执行了多少个指令周期。当进程结束时才会被赋值，指明了该进程存活了多久。
+88 KernelTime：（统计信息）当前进程在0环的运行时间。当进程结束时才会被赋值，指明了该进程存活了多久。
+8C UserTime：（统计信息）当前进程在3环的运行时间。当进程结束时才会被赋值，指明了该进程存活了多久。
+90 VdmTrapcHandler：虚拟8086模式时使用。
与进程一样， 3环下有TEB描述某个线程。在0环，也有一个ETHREAD描述某个线程的所有信息。
ETHREAD结构成员列表：
与进程一样，第一个成员为KTHREAD结构。
KTHREAD结构成员列表：
每一个内核对象都有一个OBJECT_HEADER结构，大小为0x18。将某个内核对象地址-0x18就是OBJECT_HEADER结构地址。
OBJECT_HEADER结构成员列表：
线程大体上可分为3种状态：等待、正在运行、就绪。系统上的所有未处于正在运行状态的线程都被存储在两种链表中：等待链表+就绪链表。
全局变量KiWaitListHead是一个双向链表的头部，里面是所有等待执行的线程的ETHREAD结构，每个核都有一个等待链表。链表中每个节点指向ETHREAD中的KTHREAD->WaitListEntry。
当调用Sleep、WaitForSingleObject一类的等待函数时，该线程会被加入到这个链表中。
所有就绪的线程都会存储在就绪链表中，共有32个就绪链表（32位），所有核共享这32个链表，每个链表对应一个优先级（0~31）。全局变量KiDispatcherReadyListHead存储了这32个链表的起始位置。
操作系统中所有的线程 = 所有核中等待链表中的所有线程 + 32个就绪链表中所有线程 + 所有核的KPCR中正在运行的线程。
而通过遍历线程可以找到每个线程所属的进程。即使断链也无法阻挡这种遍历。
在逆向windows线程切换逻辑之前，先自己写一个模拟的线程切换代码，感受下线程切换的大体思路。
滴水模拟线程切换源码：f60K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6$3W2Q4x3X3g2D9j5h3&6*7L8%4g2A6i4K6u0W2j5$3!0E0i4K6u0r3K9f1E0T1k6e0m8$3k6r3b7&6y4h3M7`.
首先初始化四个线程。然后观察初始化函数RegisterGMThread。
代码中定义了一个线程池，是一个全局数组变量，每个元素都是自定义的线程结构体。
initGMThread函数里首先为新线程分配一个堆栈空间。
然后向分配出来的堆栈空间里压入了几个初始值，这些值皆是线程切换时要用到的数值，在创建完第一次被切换时这些值会作为初始值参与线程切换。而其中的push 9作用只是为了占用4个字节。这里需要配合后文线程切换函数才能体会到这4字节的作用。
至此，线程初始化工作完成，我们接下来需要看看线程是怎么跑起来的，怎么切换的。
main函数中初始完四个线程结构后，进入死循环，每隔20毫秒调用一次线程切换函数Scheduling。这相当于Windows线程切换中的时钟中断。当执行了20毫秒后，强制切换当前线程。
遍历线程池，找到第一个处于就绪状态的线程。随后调用SwitchContext开始切换线程。
保存当前线程的寄存器，并将当前线程的ESP单独存入线程结构体的KernelStack中。当线程被切换回来时拿着这个ESP可以继续执行代码。
还原新线程的寄存器。
最后执行个ret，此时的ret返回的地址就是线程初始化函数initGMThread压入的GMThreadStartup函数地址。
这个函数是线程函数的调度函数。由于在初始化时压入了线程结构体指针。因此可以直接使用这个结构体去调用线程函数。如果这个线程函数执行完，就会切换到下一个线程。
函数调用约定中，ESP为返回地址，ESP+4为第一个参数。因为上文线程初始化函数中push 9占用了4字节，所以这里ESP+4刚好指向了预先压入的线程结构体。这就是push 9占用四字节的妙处。
然后我们还需要看看其中一个线程函数，发现里面有自定义的GMSleep函数。
GMSleep函数会将当前线程设置为休眠状态，并设置休眠时间。在线程切换时会遍历线程判断休眠时间是否结束来恢复就绪状态。当线程调用GMSleep时代表主动提出休眠，此时会调用线程切换函数Scheduling将执行权交给下一个就绪线程。这就是主动切换。
这一份简单的模拟线程切换的Demo具有如下特点：
KPRCB中ReadySummary成员（0x31EC）为就绪位图，4字节32位。每一位对应一条就绪链表。某一位为1则说明对应的就绪链表中有等待执行的线程。32条就绪链表存储在KPRCB中DispatcherReadyListHead成员。
如：ReadySummary值为5，二进制0101，说明第0号、第3号就绪链表中存在待执行线程。在线程切换时就会从这两个链表中取待切换的线程。
KiFindReadyThread有三个函数，通过交叉引用回溯可以知道三个函数的意义：
首先代码会解析就绪位图，找到优先级最高且包含就绪线程的就绪链表索引号。通过代码逻辑可以得知，就绪链表索引号越大，优先级越高。
随后遍历就绪链表中所有线程，对比线程亲核性是否与当前核一致。只有当核组与核编号全部一样时才可以。若当前就绪链表内所有线程都不满足亲核性，则更换下一条就绪链表。若所有就绪链表中的线程都不满足，则返回0。
若成功找到一个满足亲核性的线程，则会将这个线程从就绪链表中摘除，然后继续判断该线程所在就绪链表是否为空（所谓空，为去掉空闲线程之后。CPU不会休息，所以系统准备了一个循环无意义线程让CPU保持活性），如果为空则将KPRCB中的就绪位图对应的位至0，代表这个就绪链表里没有就绪线程了。 然后会将找到的那个可用的线程的NextProcessor成员设置为当前核编号以准备运行。最终返回找到的线程的结构体首地址。
一个物理核为一组，里面有很多逻辑核。 线程的亲核性如果设置多核，那么这些核也都会属于一个核组。所以代码层会先判断核组，再判断具体的核。
通过对KiFindReadyThread函数的逆向得知（仅对于实验中这个win7 X86版本）：
Windows经常优化线程调度算法，不同版本系统的代码可能会有不同。
Windows线程切换有两种方式：主动切换（调用WaitForSingleObject、Sleep一类的延迟等待函数）、被动切换（CPU时钟中断）。
WRK中定义的线程状态枚举如下：
Windows线程切换细节很多，目前的知识只要逆向主流程就可以，分支流程不需要太关注。
对KiSwapThread进行多次交叉引用，得出结论：绝大部分API底层都会调用WaitForSingleObject一类的函数，此时会调用KiSwapThread切换线程。
通过交叉引用向上回溯，得知KiSwapThread有两个参数：
首先判断延迟就绪链表中是否有值，如果有值就唤醒里面的线程。
然后是性能统计相关，不需要关注，直接跳过去。
调用函数KiSearchForNewThread获取一个就绪线程。
判断这个就绪线程是不是空闲线程，是不是与当前线程相同。
如果就绪线程通过了上面的判断，则调用SwapContext。
KiSwapContext中没有做什么事情，只是调用了SwapContext，传入新、老线程。
首先判断新线程的运行状态，如果正在运行就执行自旋直到新线程处于非运行状态。
随后将新线程运行状态置为 1 ，代表将要切换了。然后执行性能统计。
然后处理浮点相关数据。
切换堆栈，切换后再判断新老线程是否为同一个进程。如果不是同一个进程，再切换CR3。
然后处理浮点相关，还原CR0、浮点寄存器一类的东西，不重要。
随后处理DPC、APC，目前知识不够，暂时不用管这部分，处理完后就返回了。
WIndows的线程切换有很多细节，目前的知识点不足以把每一行代码的功能作用都分析透彻，总体分析完毕能得出以下结论：
除了API主动切换线程，Windows还具备另外一种线程切换方式：时钟中断（可屏蔽）。接下来论证一下。
windbg输入命令 !idt 查看idt表中对应的函数，其中有一项名为hal!HalpHpetClockInterrupt。
该函数属于hal模块，但Windows系统对于不同的处理器提供了不同的hal模块。在Windbg中输入命令lm查看当前Windows使用的hal模块全名称。我这里的是halmacpi.dll
定位至HalpHpetClockInterrupt函数，简单看一下函数的调用结构，可以发现函数内部共调用了HalBeginSystemInterrupt@12、HalpHpetClockInterruptWork@0、KeUpdateSystemTime@0三个函数。
进入前两个函数发现没什么实际功能，最后一个函数用于调用ntoskrnl模块的KeUpdateSystemTime函数。
定位至ntoskrnl模块的KeUpdateSystemTime函数，发现这个函数非常长。慢慢往下翻，该函数会调用KeUpdateRunTime函数。
KeUpdateRunTime函数内部会调用hal模块的HalRequestSoftwareInterrupt函数。该函数会触发软件中断。
HalRequestSoftwareInterrupt内部调用KfLowerIrql函数。
KfLowerIrql函数调用HalpCheckForSoftwareInterrupt函数。该函数用于检查软件中断。
HalpCheckForSoftwareInterrupt函数内部会调用HalpDispatchSoftwareInterrupt来派发软件中断。
再调用ntoskrnl的KiDispatchInterrupt函数来执行派发。
而在KiDispatchInterrupt函数中会调用KiQueueReadyThread与SwapContext函数，因此会导致线程切换。
上文论证了时钟中断会导致线程切换，整体执行流程为：
通过对流程的分析，还可以得出另外一个结论：软件中断会导致线程的切换。保护模式章节提到过int X一类的软件中断本质为异常。因此，在Windows操作系统中，调用绝大部分API 以及 触发各种异常 均会导致线程的切换。如果想让自己的线程永远占有CPU，则不可以调用API、不能触发异常（内存访问也可能触发缺页异常，在用户层是看不出来的）。
windows的进程线程管理非常复杂，这里仅对主线功能进行了分析。目的是认识进程线程，摆脱传统的进程线程观念。
在Win7系统中，由于不存在PG，因此可以HOOK SwapContext，达到替换指定线程的GDT、IDT的效果，从而绕过一些防护检测。
//0x3748 bytes (sizeof)struct _KPCR{ union { struct _NT_TIB NtTib; //0x0 struct { struct _EXCEPTION_REGISTRATION_RECORD* Used_ExceptionList; //0x0 VOID* Used_StackBase; //0x4 VOID* Spare2; //0x8 VOID* TssCopy; //0xc ULONG ContextSwitches; //0x10 ULONG SetMemberCopy; //0x14 VOID* Used_Self; //0x18 }; }; struct _KPCR* SelfPcr; //0x1c struct _KPRCB* Prcb; //0x20 UCHAR Irql; //0x24 ULONG IRR; //0x28 ULONG IrrActive; //0x2c ULONG IDR; //0x30 VOID* KdVersionBlock; //0x34 struct _KIDTENTRY* IDT; //0x38 struct _KGDTENTRY* GDT; //0x3c struct _KTSS* TSS; //0x40 USHORT MajorVersion; //0x44 USHORT MinorVersion; //0x46 ULONG SetMember; //0x48 ULONG StallScaleFactor; //0x4c UCHAR SpareUnused; //0x50 UCHAR Number; //0x51 UCHAR Spare0; //0x52 UCHAR SecondLevelCacheAssociativity; //0x53 ULONG VdmAlert; //0x54 ULONG KernelReserved[14]; //0x58 ULONG SecondLevelCacheSize; //0x90 ULONG HalReserved[16]; //0x94 ULONG InterruptMode; //0xd4 UCHAR Spare1; //0xd8 ULONG KernelReserved2[17]; //0xdc struct _KPRCB PrcbData; //0x120};//0x3748 bytes (sizeof)struct _KPCR{ union { struct _NT_TIB NtTib; //0x0 struct { struct _EXCEPTION_REGISTRATION_RECORD* Used_ExceptionList; //0x0 VOID* Used_StackBase; //0x4 VOID* Spare2; //0x8 VOID* TssCopy; //0xc ULONG ContextSwitches; //0x10 ULONG SetMemberCopy; //0x14 VOID* Used_Self; //0x18 }; }; struct _KPCR* SelfPcr; //0x1c struct _KPRCB* Prcb; //0x20 UCHAR Irql; //0x24 ULONG IRR; //0x28 ULONG IrrActive; //0x2c ULONG IDR; //0x30 VOID* KdVersionBlock; //0x34 struct _KIDTENTRY* IDT; //0x38 struct _KGDTENTRY* GDT; //0x3c struct _KTSS* TSS; //0x40 USHORT MajorVersion; //0x44 USHORT MinorVersion; //0x46 ULONG SetMember; //0x48 ULONG StallScaleFactor; //0x4c UCHAR SpareUnused; //0x50 UCHAR Number; //0x51 UCHAR Spare0; //0x52 UCHAR SecondLevelCacheAssociativity; //0x53 ULONG VdmAlert; //0x54 ULONG KernelReserved[14]; //0x58 ULONG SecondLevelCacheSize; //0x90 ULONG HalReserved[16]; //0x94 ULONG InterruptMode; //0xd4 UCHAR Spare1; //0xd8 ULONG KernelReserved2[17]; //0xdc struct _KPRCB PrcbData; //0x120};//0x3628 bytes (sizeof)struct _KPRCB{ USHORT MinorVersion; //0x0 USHORT MajorVersion; //0x2 struct _KTHREAD* CurrentThread; //0x4 struct _KTHREAD* NextThread; //0x8 struct _KTHREAD* IdleThread; //0xc UCHAR LegacyNumber; //0x10 UCHAR NestingLevel; //0x11 USHORT BuildType; //0x12 CHAR CpuType; //0x14 CHAR CpuID; //0x15 union { USHORT CpuStep; //0x16 struct { UCHAR CpuStepping; //0x16 UCHAR CpuModel; //0x17 }; }; struct _KPROCESSOR_STATE ProcessorState; //0x18 ULONG KernelReserved[16]; //0x338 ULONG HalReserved[16]; //0x378 ULONG CFlushSize; //0x3b8 UCHAR CoresPerPhysicalProcessor; //0x3bc UCHAR LogicalProcessorsPerCore; //0x3bd UCHAR PrcbPad0[2]; //0x3be ULONG MHz; //0x3c0 UCHAR CpuVendor; //0x3c4 UCHAR GroupIndex; //0x3c5 USHORT Group; //0x3c6 ULONG GroupSetMember; //0x3c8 ULONG Number; //0x3cc UCHAR PrcbPad1[72]; //0x3d0 struct _KSPIN_LOCK_QUEUE LockQueue[17]; //0x418 struct _KTHREAD* NpxThread; //0x4a0 ULONG InterruptCount; //0x4a4 ULONG KernelTime; //0x4a8 ULONG UserTime; //0x4ac ULONG DpcTime; //0x4b0 ULONG DpcTimeCount; //0x4b4 ULONG InterruptTime; //0x4b8 ULONG AdjustDpcThreshold; //0x4bc ULONG PageColor; //0x4c0 UCHAR DebuggerSavedIRQL; //0x4c4 UCHAR NodeColor; //0x4c5 UCHAR PrcbPad20[2]; //0x4c6 ULONG NodeShiftedColor; //0x4c8 struct _KNODE* ParentNode; //0x4cc ULONG SecondaryColorMask; //0x4d0 ULONG DpcTimeLimit; //0x4d4 ULONG PrcbPad21[2]; //0x4d8 ULONG CcFastReadNoWait; //0x4e0 ULONG CcFastReadWait; //0x4e4 ULONG CcFastReadNotPossible; //0x4e8 ULONG CcCopyReadNoWait; //0x4ec ULONG CcCopyReadWait; //0x4f0 ULONG CcCopyReadNoWaitMiss; //0x4f4 volatile LONG MmSpinLockOrdering; //0x4f8 volatile LONG IoReadOperationCount; //0x4fc volatile LONG IoWriteOperationCount; //0x500 volatile LONG IoOtherOperationCount; //0x504 union _LARGE_INTEGER IoReadTransferCount; //0x508 union _LARGE_INTEGER IoWriteTransferCount; //0x510 union _LARGE_INTEGER IoOtherTransferCount; //0x518 ULONG CcFastMdlReadNoWait; //0x520 ULONG CcFastMdlReadWait; //0x524 ULONG CcFastMdlReadNotPossible; //0x528 ULONG CcMapDataNoWait; //0x52c ULONG CcMapDataWait; //0x530 ULONG CcPinMappedDataCount; //0x534 ULONG CcPinReadNoWait; //0x538 ULONG CcPinReadWait; //0x53c ULONG CcMdlReadNoWait; //0x540 ULONG CcMdlReadWait; //0x544 ULONG CcLazyWriteHotSpots; //0x548 ULONG CcLazyWriteIos; //0x54c ULONG CcLazyWritePages; //0x550 ULONG CcDataFlushes; //0x554 ULONG CcDataPages; //0x558 ULONG CcLostDelayedWrites; //0x55c ULONG CcFastReadResourceMiss; //0x560 ULONG CcCopyReadWaitMiss; //0x564 ULONG CcFastMdlReadResourceMiss; //0x568 ULONG CcMapDataNoWaitMiss; //0x56c ULONG CcMapDataWaitMiss; //0x570 ULONG CcPinReadNoWaitMiss; //0x574 ULONG CcPinReadWaitMiss; //0x578 ULONG CcMdlReadNoWaitMiss; //0x57c ULONG CcMdlReadWaitMiss; //0x580 ULONG CcReadAheadIos; //0x584 ULONG KeAlignmentFixupCount; //0x588 ULONG KeExceptionDispatchCount; //0x58c ULONG KeSystemCalls; //0x590 ULONG AvailableTime; //0x594 ULONG PrcbPad22[2]; //0x598 struct _PP_LOOKASIDE_LIST PPLookasideList[16]; //0x5a0 struct _GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32]; //0x620 struct _GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32]; //0xf20 volatile ULONG PacketBarrier; //0x1820 volatile LONG ReverseStall; //0x1824 VOID* IpiFrame; //0x1828 UCHAR PrcbPad3[52]; //0x182c VOID* volatile CurrentPacket[3]; //0x1860 volatile ULONG TargetSet; //0x186c VOID (* volatileWorkerRoutine)(VOID* arg1, VOID* arg2, VOID* arg3, VOID* arg4); //0x1870 volatile ULONG IpiFrozen; //0x1874 UCHAR PrcbPad4[40]; //0x1878 volatile ULONG RequestSummary; //0x18a0 struct _KPRCB* volatile SignalDone; //0x18a4 UCHAR PrcbPad50[56]; //0x18a8 struct _KDPC_DATA DpcData[2]; //0x18e0 VOID* DpcStack; //0x1908 LONG MaximumDpcQueueDepth; //0x190c ULONG DpcRequestRate; //0x1910 ULONG MinimumDpcRate; //0x1914 ULONG DpcLastCount; //0x1918 ULONG PrcbLock; //0x191c struct _KGATE DpcGate; //0x1920 UCHAR ThreadDpcEnable; //0x1930 volatile UCHAR QuantumEnd; //0x1931 volatile UCHAR DpcRoutineActive; //0x1932 volatile UCHAR IdleSchedule; //0x1933 union { volatile LONG DpcRequestSummary; //0x1934 SHORT DpcRequestSlot[2]; //0x1934 struct { SHORT NormalDpcState; //0x1934 union { volatile USHORT DpcThreadActive:1; //0x1936 SHORT ThreadDpcState; //0x1936 }; }; }; volatile ULONG TimerHand; //0x1938 ULONG LastTick; //0x193c LONG MasterOffset; //0x1940 ULONG PrcbPad41[2]; //0x1944 ULONG PeriodicCount; //0x194c ULONG PeriodicBias; //0x1950 ULONGLONG TickOffset; //0x1958 struct _KTIMER_TABLE TimerTable; //0x1960 struct _KDPC CallDpc; //0x31a0 LONG ClockKeepAlive; //0x31c0 UCHAR ClockCheckSlot; //0x31c4 UCHAR ClockPollCycle; //0x31c5 UCHAR PrcbPad6[2]; //0x31c6 LONG DpcWatchdogPeriod; //0x31c8 LONG DpcWatchdogCount; //0x31cc LONG ThreadWatchdogPeriod; //0x31d0 LONG ThreadWatchdogCount; //0x31d4 volatile LONG KeSpinLockOrdering; //0x31d8 ULONG PrcbPad70[1]; //0x31dc struct _LIST_ENTRY WaitListHead; //0x31e0 ULONG WaitLock; //0x31e8 ULONG ReadySummary; //0x31ec ULONG QueueIndex; //0x31f0 struct _SINGLE_LIST_ENTRY DeferredReadyListHead; //0x31f4 ULONGLONG StartCycles; //0x31f8 volatile ULONGLONG CycleTime; //0x3200 volatile ULONG HighCycleTime; //0x3208 ULONG PrcbPad71; //0x320c ULONGLONG PrcbPad72[2]; //0x3210 struct _LIST_ENTRY DispatcherReadyListHead[32]; //0x3220 VOID* ChainedInterruptList; //0x3320 LONG LookasideIrpFloat; //0x3324 volatile LONG MmPageFaultCount; //0x3328 volatile LONG MmCopyOnWriteCount; //0x332c volatile LONG MmTransitionCount; //0x3330 volatile LONG MmCacheTransitionCount; //0x3334 volatile LONG MmDemandZeroCount; //0x3338 volatile LONG MmPageReadCount; //0x333c volatile LONG MmPageReadIoCount; //0x3340 volatile LONG MmCacheReadCount; //0x3344 volatile LONG MmCacheIoCount; //0x3348 volatile LONG MmDirtyPagesWriteCount; //0x334c volatile LONG MmDirtyWriteIoCount; //0x3350 volatile LONG MmMappedPagesWriteCount; //0x3354 volatile LONG MmMappedWriteIoCount; //0x3358 volatile ULONG CachedCommit; //0x335c volatile ULONG CachedResidentAvailable; //0x3360 VOID* HyperPte; //0x3364 UCHAR PrcbPad8[4]; //0x3368 UCHAR VendorString[13]; //0x336c UCHAR InitialApicId; //0x3379 UCHAR LogicalProcessorsPerPhysicalProcessor; //0x337a UCHAR PrcbPad9[5]; //0x337b ULONG FeatureBits; //0x3380 union _LARGE_INTEGER UpdateSignature; //0x3388 volatile ULONGLONG IsrTime; //0x3390 ULONGLONG RuntimeAccumulation; //0x3398 struct _PROCESSOR_POWER_STATE PowerState; //0x33a0 struct _KDPC DpcWatchdogDpc; //0x3468 struct _KTIMER DpcWatchdogTimer; //0x3488 VOID* WheaInfo; //0x34b0 VOID* EtwSupport; //0x34b4 union _SLIST_HEADER InterruptObjectPool; //0x34b8 union _SLIST_HEADER HypercallPageList; //0x34c0 VOID* HypercallPageVirtual; //0x34c8 VOID* VirtualApicAssist; //0x34cc ULONGLONG* StatisticsPage; //0x34d0 VOID* RateControl; //0x34d4 struct _CACHE_DESCRIPTOR Cache[5]; //0x34d8 ULONG CacheCount; //0x3514 ULONG CacheProcessorMask[5]; //0x3518 struct _KAFFINITY_EX PackageProcessorSet; //0x352c ULONG PrcbPad91[1]; //0x3538 ULONG CoreProcessorSet; //0x353c struct _KDPC TimerExpirationDpc; //0x3540 ULONG SpinLockAcquireCount; //0x3560 ULONG SpinLockContentionCount; //0x3564 ULONG SpinLockSpinCount; //0x3568 ULONG IpiSendRequestBroadcastCount; //0x356c ULONG IpiSendRequestRoutineCount; //0x3570 ULONG IpiSendSoftwareInterruptCount; //0x3574 ULONG ExInitializeResourceCount; //0x3578 ULONG ExReInitializeResourceCount; //0x357c ULONG ExDeleteResourceCount; //0x3580 ULONG ExecutiveResourceAcquiresCount; //0x3584 ULONG ExecutiveResourceContentionsCount; //0x3588 ULONG ExecutiveResourceReleaseExclusiveCount; //0x358c ULONG ExecutiveResourceReleaseSharedCount; //0x3590 ULONG ExecutiveResourceConvertsCount; //0x3594 ULONG ExAcqResExclusiveAttempts; //0x3598 ULONG ExAcqResExclusiveAcquiresExclusive; //0x359c ULONG ExAcqResExclusiveAcquiresExclusiveRecursive; //0x35a0 ULONG ExAcqResExclusiveWaits; //0x35a4 ULONG ExAcqResExclusiveNotAcquires; //0x35a8 ULONG ExAcqResSharedAttempts; //0x35ac ULONG ExAcqResSharedAcquiresExclusive; //0x35b0 ULONG ExAcqResSharedAcquiresShared; //0x35b4 ULONG ExAcqResSharedAcquiresSharedRecursive; //0x35b8 ULONG ExAcqResSharedWaits; //0x35bc ULONG ExAcqResSharedNotAcquires; //0x35c0 ULONG ExAcqResSharedStarveExclusiveAttempts; //0x35c4 ULONG ExAcqResSharedStarveExclusiveAcquiresExclusive; //0x35c8 ULONG ExAcqResSharedStarveExclusiveAcquiresShared; //0x35cc ULONG ExAcqResSharedStarveExclusiveAcquiresSharedRecursive; //0x35d0 ULONG ExAcqResSharedStarveExclusiveWaits; //0x35d4 ULONG ExAcqResSharedStarveExclusiveNotAcquires; //0x35d8 ULONG ExAcqResSharedWaitForExclusiveAttempts; //0x35dc ULONG ExAcqResSharedWaitForExclusiveAcquiresExclusive; //0x35e0 ULONG ExAcqResSharedWaitForExclusiveAcquiresShared; //0x35e4 ULONG ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive; //0x35e8 ULONG ExAcqResSharedWaitForExclusiveWaits; //0x35ec ULONG ExAcqResSharedWaitForExclusiveNotAcquires; //0x35f0 ULONG ExSetResOwnerPointerExclusive; //0x35f4 ULONG ExSetResOwnerPointerSharedNew; //0x35f8 ULONG ExSetResOwnerPointerSharedOld; //0x35fc ULONG ExTryToAcqExclusiveAttempts; //0x3600 ULONG ExTryToAcqExclusiveAcquires; //0x3604 ULONG ExBoostExclusiveOwner; //0x3608 ULONG ExBoostSharedOwners; //0x360c ULONG ExEtwSynchTrackingNotificationsCount; //0x3610 ULONG ExEtwSynchTrackingNotificationsAccountedCount; //0x3614 struct _CONTEXT* Context; //0x3618 ULONG ContextFlags; //0x361c struct _XSAVE_AREA* ExtendedState; //0x3620};//0x3628 bytes (sizeof)struct _KPRCB{ USHORT MinorVersion; //0x0 USHORT MajorVersion; //0x2 struct _KTHREAD* CurrentThread; //0x4 struct _KTHREAD* NextThread; //0x8 struct _KTHREAD* IdleThread; //0xc UCHAR LegacyNumber; //0x10 UCHAR NestingLevel; //0x11 USHORT BuildType; //0x12 CHAR CpuType; //0x14 CHAR CpuID; //0x15 union { USHORT CpuStep; //0x16 struct { UCHAR CpuStepping; //0x16 UCHAR CpuModel; //0x17 }; }; struct _KPROCESSOR_STATE ProcessorState; //0x18 ULONG KernelReserved[16]; //0x338 ULONG HalReserved[16]; //0x378 ULONG CFlushSize; //0x3b8 UCHAR CoresPerPhysicalProcessor; //0x3bc UCHAR LogicalProcessorsPerCore; //0x3bd UCHAR PrcbPad0[2]; //0x3be ULONG MHz; //0x3c0 UCHAR CpuVendor; //0x3c4 UCHAR GroupIndex; //0x3c5 USHORT Group; //0x3c6 ULONG GroupSetMember; //0x3c8 ULONG Number; //0x3cc UCHAR PrcbPad1[72]; //0x3d0 struct _KSPIN_LOCK_QUEUE LockQueue[17]; //0x418 struct _KTHREAD* NpxThread; //0x4a0 ULONG InterruptCount; //0x4a4 ULONG KernelTime; //0x4a8 ULONG UserTime; //0x4ac ULONG DpcTime; //0x4b0 ULONG DpcTimeCount; //0x4b4 ULONG InterruptTime; //0x4b8 ULONG AdjustDpcThreshold; //0x4bc ULONG PageColor; //0x4c0 UCHAR DebuggerSavedIRQL; //0x4c4 UCHAR NodeColor; //0x4c5 UCHAR PrcbPad20[2]; //0x4c6 ULONG NodeShiftedColor; //0x4c8 struct _KNODE* ParentNode; //0x4cc ULONG SecondaryColorMask; //0x4d0 ULONG DpcTimeLimit; //0x4d4 ULONG PrcbPad21[2]; //0x4d8 ULONG CcFastReadNoWait; //0x4e0 ULONG CcFastReadWait; //0x4e4 ULONG CcFastReadNotPossible; //0x4e8 ULONG CcCopyReadNoWait; //0x4ec ULONG CcCopyReadWait; //0x4f0 ULONG CcCopyReadNoWaitMiss; //0x4f4 volatile LONG MmSpinLockOrdering; //0x4f8 volatile LONG IoReadOperationCount; //0x4fc volatile LONG IoWriteOperationCount; //0x500 volatile LONG IoOtherOperationCount; //0x504 union _LARGE_INTEGER IoReadTransferCount; //0x508 union _LARGE_INTEGER IoWriteTransferCount; //0x510 union _LARGE_INTEGER IoOtherTransferCount; //0x518 ULONG CcFastMdlReadNoWait; //0x520 ULONG CcFastMdlReadWait; //0x524 ULONG CcFastMdlReadNotPossible; //0x528 ULONG CcMapDataNoWait; //0x52c ULONG CcMapDataWait; //0x530 ULONG CcPinMappedDataCount; //0x534 ULONG CcPinReadNoWait; //0x538 ULONG CcPinReadWait; //0x53c ULONG CcMdlReadNoWait; //0x540 ULONG CcMdlReadWait; //0x544 ULONG CcLazyWriteHotSpots; //0x548 ULONG CcLazyWriteIos; //0x54c ULONG CcLazyWritePages; //0x550 ULONG CcDataFlushes; //0x554 ULONG CcDataPages; //0x558 ULONG CcLostDelayedWrites; //0x55c ULONG CcFastReadResourceMiss; //0x560 ULONG CcCopyReadWaitMiss; //0x564 ULONG CcFastMdlReadResourceMiss; //0x568 ULONG CcMapDataNoWaitMiss; //0x56c ULONG CcMapDataWaitMiss; //0x570 ULONG CcPinReadNoWaitMiss; //0x574 ULONG CcPinReadWaitMiss; //0x578 ULONG CcMdlReadNoWaitMiss; //0x57c ULONG CcMdlReadWaitMiss; //0x580 ULONG CcReadAheadIos; //0x584 ULONG KeAlignmentFixupCount; //0x588 ULONG KeExceptionDispatchCount; //0x58c ULONG KeSystemCalls; //0x590 ULONG AvailableTime; //0x594 ULONG PrcbPad22[2]; //0x598 struct _PP_LOOKASIDE_LIST PPLookasideList[16]; //0x5a0 struct _GENERAL_LOOKASIDE_POOL PPNPagedLookasideList[32]; //0x620 struct _GENERAL_LOOKASIDE_POOL PPPagedLookasideList[32]; //0xf20 volatile ULONG PacketBarrier; //0x1820 volatile LONG ReverseStall; //0x1824 VOID* IpiFrame; //0x1828 UCHAR PrcbPad3[52]; //0x182c VOID* volatile CurrentPacket[3]; //0x1860 volatile ULONG TargetSet; //0x186c VOID (* volatileWorkerRoutine)(VOID* arg1, VOID* arg2, VOID* arg3, VOID* arg4); //0x1870 volatile ULONG IpiFrozen; //0x1874 UCHAR PrcbPad4[40]; //0x1878 volatile ULONG RequestSummary; //0x18a0 struct _KPRCB* volatile SignalDone; //0x18a4 UCHAR PrcbPad50[56]; //0x18a8 struct _KDPC_DATA DpcData[2]; //0x18e0 VOID* DpcStack; //0x1908 LONG MaximumDpcQueueDepth; //0x190c ULONG DpcRequestRate; //0x1910 ULONG MinimumDpcRate; //0x1914 ULONG DpcLastCount; //0x1918 ULONG PrcbLock; //0x191c struct _KGATE DpcGate; //0x1920 UCHAR ThreadDpcEnable; //0x1930 volatile UCHAR QuantumEnd; //0x1931 volatile UCHAR DpcRoutineActive; //0x1932 volatile UCHAR IdleSchedule; //0x1933 union { volatile LONG DpcRequestSummary; //0x1934 SHORT DpcRequestSlot[2]; //0x1934 struct { SHORT NormalDpcState; //0x1934 union { volatile USHORT DpcThreadActive:1; //0x1936 SHORT ThreadDpcState; //0x1936 }; }; }; volatile ULONG TimerHand; //0x1938 ULONG LastTick; //0x193c LONG MasterOffset; //0x1940 ULONG PrcbPad41[2]; //0x1944 ULONG PeriodicCount; //0x194c ULONG PeriodicBias; //0x1950 ULONGLONG TickOffset; //0x1958 struct _KTIMER_TABLE TimerTable; //0x1960 struct _KDPC CallDpc; //0x31a0 LONG ClockKeepAlive; //0x31c0 UCHAR ClockCheckSlot; //0x31c4 UCHAR ClockPollCycle; //0x31c5 UCHAR PrcbPad6[2]; //0x31c6 LONG DpcWatchdogPeriod; //0x31c8 LONG DpcWatchdogCount; //0x31cc LONG ThreadWatchdogPeriod; //0x31d0 LONG ThreadWatchdogCount; //0x31d4 volatile LONG KeSpinLockOrdering; //0x31d8 ULONG PrcbPad70[1]; //0x31dc struct _LIST_ENTRY WaitListHead; //0x31e0 ULONG WaitLock; //0x31e8 ULONG ReadySummary; //0x31ec ULONG QueueIndex; //0x31f0 struct _SINGLE_LIST_ENTRY DeferredReadyListHead; //0x31f4 ULONGLONG StartCycles; //0x31f8 volatile ULONGLONG CycleTime; //0x3200 volatile ULONG HighCycleTime; //0x3208 ULONG PrcbPad71; //0x320c ULONGLONG PrcbPad72[2]; //0x3210 struct _LIST_ENTRY DispatcherReadyListHead[32]; //0x3220 VOID* ChainedInterruptList; //0x3320 LONG LookasideIrpFloat; //0x3324 volatile LONG MmPageFaultCount; //0x3328 volatile LONG MmCopyOnWriteCount; //0x332c volatile LONG MmTransitionCount; //0x3330 volatile LONG MmCacheTransitionCount; //0x3334 volatile LONG MmDemandZeroCount; //0x3338 volatile LONG MmPageReadCount; //0x333c volatile LONG MmPageReadIoCount; //0x3340 volatile LONG MmCacheReadCount; //0x3344 volatile LONG MmCacheIoCount; //0x3348 volatile LONG MmDirtyPagesWriteCount; //0x334c volatile LONG MmDirtyWriteIoCount; //0x3350 volatile LONG MmMappedPagesWriteCount; //0x3354 volatile LONG MmMappedWriteIoCount; //0x3358 volatile ULONG CachedCommit; //0x335c volatile ULONG CachedResidentAvailable; //0x3360 VOID* HyperPte; //0x3364 UCHAR PrcbPad8[4]; //0x3368 UCHAR VendorString[13]; //0x336c UCHAR InitialApicId; //0x3379 UCHAR LogicalProcessorsPerPhysicalProcessor; //0x337a UCHAR PrcbPad9[5]; //0x337b ULONG FeatureBits; //0x3380 union _LARGE_INTEGER UpdateSignature; //0x3388 volatile ULONGLONG IsrTime; //0x3390 ULONGLONG RuntimeAccumulation; //0x3398 struct _PROCESSOR_POWER_STATE PowerState; //0x33a0 struct _KDPC DpcWatchdogDpc; //0x3468 struct _KTIMER DpcWatchdogTimer; //0x3488 VOID* WheaInfo; //0x34b0 VOID* EtwSupport; //0x34b4 union _SLIST_HEADER InterruptObjectPool; //0x34b8 union _SLIST_HEADER HypercallPageList; //0x34c0 VOID* HypercallPageVirtual; //0x34c8 VOID* VirtualApicAssist; //0x34cc ULONGLONG* StatisticsPage; //0x34d0 VOID* RateControl; //0x34d4 struct _CACHE_DESCRIPTOR Cache[5]; //0x34d8 ULONG CacheCount; //0x3514 ULONG CacheProcessorMask[5]; //0x3518 struct _KAFFINITY_EX PackageProcessorSet; //0x352c ULONG PrcbPad91[1]; //0x3538 ULONG CoreProcessorSet; //0x353c struct _KDPC TimerExpirationDpc; //0x3540 ULONG SpinLockAcquireCount; //0x3560 ULONG SpinLockContentionCount; //0x3564 ULONG SpinLockSpinCount; //0x3568 ULONG IpiSendRequestBroadcastCount; //0x356c ULONG IpiSendRequestRoutineCount; //0x3570 ULONG IpiSendSoftwareInterruptCount; //0x3574 ULONG ExInitializeResourceCount; //0x3578 ULONG ExReInitializeResourceCount; //0x357c ULONG ExDeleteResourceCount; //0x3580 ULONG ExecutiveResourceAcquiresCount; //0x3584 ULONG ExecutiveResourceContentionsCount; //0x3588 ULONG ExecutiveResourceReleaseExclusiveCount; //0x358c ULONG ExecutiveResourceReleaseSharedCount; //0x3590 ULONG ExecutiveResourceConvertsCount; //0x3594 ULONG ExAcqResExclusiveAttempts; //0x3598 ULONG ExAcqResExclusiveAcquiresExclusive; //0x359c ULONG ExAcqResExclusiveAcquiresExclusiveRecursive; //0x35a0 ULONG ExAcqResExclusiveWaits; //0x35a4 ULONG ExAcqResExclusiveNotAcquires; //0x35a8 ULONG ExAcqResSharedAttempts; //0x35ac ULONG ExAcqResSharedAcquiresExclusive; //0x35b0 ULONG ExAcqResSharedAcquiresShared; //0x35b4 ULONG ExAcqResSharedAcquiresSharedRecursive; //0x35b8 ULONG ExAcqResSharedWaits; //0x35bc ULONG ExAcqResSharedNotAcquires; //0x35c0 ULONG ExAcqResSharedStarveExclusiveAttempts; //0x35c4 ULONG ExAcqResSharedStarveExclusiveAcquiresExclusive; //0x35c8 ULONG ExAcqResSharedStarveExclusiveAcquiresShared; //0x35cc ULONG ExAcqResSharedStarveExclusiveAcquiresSharedRecursive; //0x35d0 ULONG ExAcqResSharedStarveExclusiveWaits; //0x35d4 ULONG ExAcqResSharedStarveExclusiveNotAcquires; //0x35d8 ULONG ExAcqResSharedWaitForExclusiveAttempts; //0x35dc ULONG ExAcqResSharedWaitForExclusiveAcquiresExclusive; //0x35e0 ULONG ExAcqResSharedWaitForExclusiveAcquiresShared; //0x35e4 ULONG ExAcqResSharedWaitForExclusiveAcquiresSharedRecursive; //0x35e8 ULONG ExAcqResSharedWaitForExclusiveWaits; //0x35ec ULONG ExAcqResSharedWaitForExclusiveNotAcquires; //0x35f0 ULONG ExSetResOwnerPointerExclusive; //0x35f4 ULONG ExSetResOwnerPointerSharedNew; //0x35f8 ULONG ExSetResOwnerPointerSharedOld; //0x35fc ULONG ExTryToAcqExclusiveAttempts; //0x3600 ULONG ExTryToAcqExclusiveAcquires; //0x3604 ULONG ExBoostExclusiveOwner; //0x3608 ULONG ExBoostSharedOwners; //0x360c ULONG ExEtwSynchTrackingNotificationsCount; //0x3610 ULONG ExEtwSynchTrackingNotificationsAccountedCount; //0x3614 struct _CONTEXT* Context; //0x3618 ULONG ContextFlags; //0x361c struct _XSAVE_AREA* ExtendedState; //0x3620};//0x2c0 bytes (sizeof)struct _EPROCESS{ struct _KPROCESS Pcb; //0x0 struct _EX_PUSH_LOCK ProcessLock; //0x98 union _LARGE_INTEGER CreateTime; //0xa0 union _LARGE_INTEGER ExitTime; //0xa8 struct _EX_RUNDOWN_REF RundownProtect; //0xb0 VOID* UniqueProcessId; //0xb4 struct _LIST_ENTRY ActiveProcessLinks; //0xb8 ULONG ProcessQuotaUsage[2]; //0xc0 ULONG ProcessQuotaPeak[2]; //0xc8 volatile ULONG CommitCharge; //0xd0 struct _EPROCESS_QUOTA_BLOCK* QuotaBlock; //0xd4 struct _PS_CPU_QUOTA_BLOCK* CpuQuotaBlock; //0xd8 ULONG PeakVirtualSize; //0xdc ULONG VirtualSize; //0xe0 struct _LIST_ENTRY SessionProcessLinks; //0xe4 VOID* DebugPort; //0xec union { VOID* ExceptionPortData; //0xf0 ULONG ExceptionPortValue; //0xf0 ULONG ExceptionPortState:3; //0xf0 }; struct _HANDLE_TABLE* ObjectTable; //0xf4 struct _EX_FAST_REF Token; //0xf8 ULONG WorkingSetPage; //0xfc struct _EX_PUSH_LOCK AddressCreationLock; //0x100 struct _ETHREAD* RotateInProgress; //0x104 struct _ETHREAD* ForkInProgress; //0x108 ULONG HardwareTrigger; //0x10c struct _MM_AVL_TABLE* PhysicalVadRoot; //0x110 VOID* CloneRoot; //0x114 volatile ULONG NumberOfPrivatePages; //0x118 volatile ULONG NumberOfLockedPages; //0x11c VOID* Win32Process; //0x120 struct _EJOB* volatile Job; //0x124 VOID* SectionObject; //0x128 VOID* SectionBaseAddress; //0x12c ULONG Cookie; //0x130 ULONG Spare8; //0x134 struct _PAGEFAULT_HISTORY* WorkingSetWatch; //0x138 VOID* Win32WindowStation; //0x13c VOID* InheritedFromUniqueProcessId; //0x140 VOID* LdtInformation; //0x144 VOID* VdmObjects; //0x148 ULONG ConsoleHostProcess; //0x14c VOID* DeviceMap; //0x150 VOID* EtwDataSource; //0x154 VOID* FreeTebHint; //0x158 union { struct _HARDWARE_PTE PageDirectoryPte; //0x160 ULONGLONG Filler; //0x160 }; VOID* Session; //0x168 UCHAR ImageFileName[15]; //0x16c UCHAR PriorityClass; //0x17b struct _LIST_ENTRY JobLinks; //0x17c VOID* LockedPagesList; //0x184 struct _LIST_ENTRY ThreadListHead; //0x188 VOID* SecurityPort; //0x190 VOID* PaeTop; //0x194 volatile ULONG ActiveThreads; //0x198 ULONG ImagePathHash; //0x19c ULONG DefaultHardErrorProcessing; //0x1a0 LONG LastThreadExitStatus; //0x1a4 struct _PEB* Peb; //0x1a8 struct _EX_FAST_REF PrefetchTrace; //0x1ac union _LARGE_INTEGER ReadOperationCount; //0x1b0 union _LARGE_INTEGER WriteOperationCount; //0x1b8 union _LARGE_INTEGER OtherOperationCount; //0x1c0 union _LARGE_INTEGER ReadTransferCount; //0x1c8 union _LARGE_INTEGER WriteTransferCount; //0x1d0 union _LARGE_INTEGER OtherTransferCount; //0x1d8 ULONG CommitChargeLimit; //0x1e0 volatile ULONG CommitChargePeak; //0x1e4 VOID* AweInfo; //0x1e8 struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo; //0x1ec struct _MMSUPPORT Vm; //0x1f0 struct _LIST_ENTRY MmProcessLinks; //0x25c VOID* HighestUserAddress; //0x264 ULONG ModifiedPageCount; //0x268 union { ULONG Flags2; //0x26c struct { ULONG JobNotReallyActive:1; //0x26c ULONG AccountingFolded:1; //0x26c ULONG NewProcessReported:1; //0x26c ULONG ExitProcessReported:1; //0x26c ULONG ReportCommitChanges:1; //0x26c ULONG LastReportMemory:1; //0x26c ULONG ReportPhysicalPageChanges:1; //0x26c ULONG HandleTableRundown:1; //0x26c ULONG NeedsHandleRundown:1; //0x26c ULONG RefTraceEnabled:1; //0x26c ULONG NumaAware:1; //0x26c ULONG ProtectedProcess:1; //0x26c ULONG DefaultPagePriority:3; //0x26c ULONG PrimaryTokenFrozen:1; //0x26c ULONG ProcessVerifierTarget:1; //0x26c ULONG StackRandomizationDisabled:1; //0x26c ULONG AffinityPermanent:1; //0x26c ULONG AffinityUpdateEnable:1; //0x26c ULONG PropagateNode:1; //0x26c ULONG ExplicitAffinity:1; //0x26c }; }; union { ULONG Flags; //0x270 struct { ULONG CreateReported:1; //0x270 ULONG NoDebugInherit:1; //0x270 ULONG ProcessExiting:1; //0x270 ULONG ProcessDelete:1; //0x270 ULONG Wow64SplitPages:1; //0x270 ULONG VmDeleted:1; //0x270 ULONG OutswapEnabled:1; //0x270 ULONG Outswapped:1; //0x270 ULONG ForkFailed:1; //0x270 ULONG Wow64VaSpace4Gb:1; //0x270 ULONG AddressSpaceInitialized:2; //0x270 ULONG SetTimerResolution:1; //0x270 ULONG BreakOnTermination:1; //0x270 ULONG DeprioritizeViews:1; //0x270 ULONG WriteWatch:1; //0x270 ULONG ProcessInSession:1; //0x270 ULONG OverrideAddressSpace:1; //0x270 ULONG HasAddressSpace:1; //0x270 ULONG LaunchPrefetched:1; //0x270 ULONG InjectInpageErrors:1; //0x270 ULONG VmTopDown:1; //0x270 ULONG ImageNotifyDone:1; //0x270 ULONG PdeUpdateNeeded:1; //0x270 ULONG VdmAllowed:1; //0x270 ULONG CrossSessionCreate:1; //0x270 ULONG ProcessInserted:1; //0x270 ULONG DefaultIoPriority:3; //0x270 ULONG ProcessSelfDelete:1; //0x270 ULONG SetTimerResolutionLink:1; //0x270 }; }; LONG ExitStatus; //0x274 struct _MM_AVL_TABLE VadRoot; //0x278 struct _ALPC_PROCESS_CONTEXT AlpcContext; //0x298 struct _LIST_ENTRY TimerResolutionLink; //0x2a8 ULONG RequestedTimerResolution; //0x2b0 ULONG ActiveThreadsHighWatermark; //0x2b4 ULONG SmallestTimerResolution; //0x2b8 struct _PO_DIAG_STACK_RECORD* TimerResolutionStackRecord; //0x2bc};//0x2c0 bytes (sizeof)struct _EPROCESS{ struct _KPROCESS Pcb; //0x0 struct _EX_PUSH_LOCK ProcessLock; //0x98 union _LARGE_INTEGER CreateTime; //0xa0 union _LARGE_INTEGER ExitTime; //0xa8 struct _EX_RUNDOWN_REF RundownProtect; //0xb0 VOID* UniqueProcessId; //0xb4 struct _LIST_ENTRY ActiveProcessLinks; //0xb8 ULONG ProcessQuotaUsage[2]; //0xc0 ULONG ProcessQuotaPeak[2]; //0xc8 volatile ULONG CommitCharge; //0xd0 struct _EPROCESS_QUOTA_BLOCK* QuotaBlock; //0xd4 struct _PS_CPU_QUOTA_BLOCK* CpuQuotaBlock; //0xd8 ULONG PeakVirtualSize; //0xdc ULONG VirtualSize; //0xe0 struct _LIST_ENTRY SessionProcessLinks; //0xe4 VOID* DebugPort; //0xec union { VOID* ExceptionPortData; //0xf0 ULONG ExceptionPortValue; //0xf0 ULONG ExceptionPortState:3; //0xf0 }; struct _HANDLE_TABLE* ObjectTable; //0xf4 struct _EX_FAST_REF Token; //0xf8 ULONG WorkingSetPage; //0xfc struct _EX_PUSH_LOCK AddressCreationLock; //0x100 struct _ETHREAD* RotateInProgress; //0x104 struct _ETHREAD* ForkInProgress; //0x108 ULONG HardwareTrigger; //0x10c struct _MM_AVL_TABLE* PhysicalVadRoot; //0x110 VOID* CloneRoot; //0x114 volatile ULONG NumberOfPrivatePages; //0x118 volatile ULONG NumberOfLockedPages; //0x11c VOID* Win32Process; //0x120 struct _EJOB* volatile Job; //0x124 VOID* SectionObject; //0x128 VOID* SectionBaseAddress; //0x12c ULONG Cookie; //0x130 ULONG Spare8; //0x134 struct _PAGEFAULT_HISTORY* WorkingSetWatch; //0x138 VOID* Win32WindowStation; //0x13c VOID* InheritedFromUniqueProcessId; //0x140 VOID* LdtInformation; //0x144 VOID* VdmObjects; //0x148 ULONG ConsoleHostProcess; //0x14c VOID* DeviceMap; //0x150 VOID* EtwDataSource; //0x154 VOID* FreeTebHint; //0x158 union { struct _HARDWARE_PTE PageDirectoryPte; //0x160 ULONGLONG Filler; //0x160 }; VOID* Session; //0x168 UCHAR ImageFileName[15]; //0x16c UCHAR PriorityClass; //0x17b struct _LIST_ENTRY JobLinks; //0x17c VOID* LockedPagesList; //0x184 struct _LIST_ENTRY ThreadListHead; //0x188 VOID* SecurityPort; //0x190 VOID* PaeTop; //0x194 volatile ULONG ActiveThreads; //0x198 ULONG ImagePathHash; //0x19c ULONG DefaultHardErrorProcessing; //0x1a0 LONG LastThreadExitStatus; //0x1a4 struct _PEB* Peb; //0x1a8 struct _EX_FAST_REF PrefetchTrace; //0x1ac union _LARGE_INTEGER ReadOperationCount; //0x1b0 union _LARGE_INTEGER WriteOperationCount; //0x1b8 union _LARGE_INTEGER OtherOperationCount; //0x1c0 union _LARGE_INTEGER ReadTransferCount; //0x1c8 union _LARGE_INTEGER WriteTransferCount; //0x1d0 union _LARGE_INTEGER OtherTransferCount; //0x1d8 ULONG CommitChargeLimit; //0x1e0 volatile ULONG CommitChargePeak; //0x1e4 VOID* AweInfo; //0x1e8 struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo; //0x1ec struct _MMSUPPORT Vm; //0x1f0 struct _LIST_ENTRY MmProcessLinks; //0x25c VOID* HighestUserAddress; //0x264 ULONG ModifiedPageCount; //0x268 union { ULONG Flags2; //0x26c struct { ULONG JobNotReallyActive:1; //0x26c ULONG AccountingFolded:1; //0x26c ULONG NewProcessReported:1; //0x26c ULONG ExitProcessReported:1; //0x26c ULONG ReportCommitChanges:1; //0x26c ULONG LastReportMemory:1; //0x26c ULONG ReportPhysicalPageChanges:1; //0x26c ULONG HandleTableRundown:1; //0x26c ULONG NeedsHandleRundown:1; //0x26c ULONG RefTraceEnabled:1; //0x26c ULONG NumaAware:1; //0x26c ULONG ProtectedProcess:1; //0x26c ULONG DefaultPagePriority:3; //0x26c ULONG PrimaryTokenFrozen:1; //0x26c ULONG ProcessVerifierTarget:1; //0x26c ULONG StackRandomizationDisabled:1; //0x26c ULONG AffinityPermanent:1; //0x26c ULONG AffinityUpdateEnable:1; //0x26c ULONG PropagateNode:1; //0x26c ULONG ExplicitAffinity:1; //0x26c }; }; union { ULONG Flags; //0x270 struct { ULONG CreateReported:1; //0x270 ULONG NoDebugInherit:1; //0x270 ULONG ProcessExiting:1; //0x270 ULONG ProcessDelete:1; //0x270 ULONG Wow64SplitPages:1; //0x270 ULONG VmDeleted:1; //0x270 ULONG OutswapEnabled:1; //0x270 ULONG Outswapped:1; //0x270 ULONG ForkFailed:1; //0x270 ULONG Wow64VaSpace4Gb:1; //0x270 ULONG AddressSpaceInitialized:2; //0x270 ULONG SetTimerResolution:1; //0x270 ULONG BreakOnTermination:1; //0x270 ULONG DeprioritizeViews:1; //0x270 ULONG WriteWatch:1; //0x270 ULONG ProcessInSession:1; //0x270 ULONG OverrideAddressSpace:1; //0x270 ULONG HasAddressSpace:1; //0x270 ULONG LaunchPrefetched:1; //0x270 ULONG InjectInpageErrors:1; //0x270 ULONG VmTopDown:1; //0x270 ULONG ImageNotifyDone:1; //0x270 ULONG PdeUpdateNeeded:1; //0x270 ULONG VdmAllowed:1; //0x270 ULONG CrossSessionCreate:1; //0x270 ULONG ProcessInserted:1; //0x270 ULONG DefaultIoPriority:3; //0x270 ULONG ProcessSelfDelete:1; //0x270 ULONG SetTimerResolutionLink:1; //0x270 }; };
|
|
|---|---|
|
|
|
|
|
32位 
|
|
|
|
|
|
滴水+火哥 |
|
|
大佬， 是滴水初级+火哥中级么 |
|
|
好啊好啊，海哥子弟
|
|
|
这是火哥的盗版弟子
|
|
|
什么意思 |
