-
-
[原创]x64内核实验6-进程
-
发表于: 2023-10-7 13:20 9274
-
(这里写目录标题)
首先来看一下进程结构体完整的定义,然后我会介绍几个比较重要的字段属性
下面是我从pdb文件导出的头文件,这个头文件可以直接复制到ida里导入成结构体使用的,其他结构体的头文件后面我会一起放出来给大家下载
KEPROCESS.h
EPROCESS.h
这两个结构体非常大,我们简单介绍一下比较重要的几个字段
常见的差不多就这些了
下面可以做几个实验(最近比较忙我这边还是先把知识点整理出来,代码后面有空了写一份贴上来,大家可以先自己尝试这做一下)
实验1:0环断链隐藏进程
实验2:0环清空debugport反调试
实验3:通过三环peb查找自己加载的所有模块
实验4:通过修改peb里的begindebug达到反调试
typedef struct _KPROCESS
/
/
54
elements,
0x438
bytes (sizeof)
{
/
*
0x000
*
/
struct _DISPATCHER_HEADER Header;
/
/
59
elements,
0x18
bytes (sizeof)
/
*
0x018
*
/
struct _LIST_ENTRY ProfileListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x028
*
/
UINT64 DirectoryTableBase;
/
*
0x030
*
/
struct _LIST_ENTRY ThreadListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x040
*
/
ULONG32 ProcessLock;
/
*
0x044
*
/
ULONG32 ProcessTimerDelay;
/
*
0x048
*
/
UINT64 DeepFreezeStartTime;
/
*
0x050
*
/
struct _KAFFINITY_EX Affinity;
/
/
4
elements,
0xA8
bytes (sizeof)
/
*
0x0F8
*
/
UINT64 AffinityPadding[
12
];
/
*
0x158
*
/
struct _LIST_ENTRY ReadyListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x168
*
/
struct _SINGLE_LIST_ENTRY SwapListEntry;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x170
*
/
struct _KAFFINITY_EX ActiveProcessors;
/
/
4
elements,
0xA8
bytes (sizeof)
/
*
0x218
*
/
UINT64 ActiveProcessorsPadding[
12
];
union
/
/
2
elements,
0x4
bytes (sizeof)
{
struct
/
/
10
elements,
0x4
bytes (sizeof)
{
/
*
0x278
*
/
ULONG32 AutoAlignment :
1
;
/
/
0
BitPosition
/
*
0x278
*
/
ULONG32 DisableBoost :
1
;
/
/
1
BitPosition
/
*
0x278
*
/
ULONG32 DisableQuantum :
1
;
/
/
2
BitPosition
/
*
0x278
*
/
ULONG32 DeepFreeze :
1
;
/
/
3
BitPosition
/
*
0x278
*
/
ULONG32 TimerVirtualization :
1
;
/
/
4
BitPosition
/
*
0x278
*
/
ULONG32 CheckStackExtents :
1
;
/
/
5
BitPosition
/
*
0x278
*
/
ULONG32 CacheIsolationEnabled :
1
;
/
/
6
BitPosition
/
*
0x278
*
/
ULONG32 PpmPolicy :
3
;
/
/
7
BitPosition
/
*
0x278
*
/
ULONG32 VaSpaceDeleted :
1
;
/
/
10
BitPosition
/
*
0x278
*
/
ULONG32 ReservedFlags :
21
;
/
/
11
BitPosition
};
/
*
0x278
*
/
LONG32 ProcessFlags;
};
/
*
0x27C
*
/
ULONG32 ActiveGroupsMask;
/
*
0x280
*
/
CHAR BasePriority;
/
*
0x281
*
/
CHAR QuantumReset;
/
*
0x282
*
/
CHAR Visited;
/
*
0x283
*
/
union _KEXECUTE_OPTIONS Flags;
/
/
10
elements,
0x1
bytes (sizeof)
/
*
0x284
*
/
UINT16 ThreadSeed[
20
];
/
*
0x2AC
*
/
UINT16 ThreadSeedPadding[
12
];
/
*
0x2C4
*
/
UINT16 IdealProcessor[
20
];
/
*
0x2EC
*
/
UINT16 IdealProcessorPadding[
12
];
/
*
0x304
*
/
UINT16 IdealNode[
20
];
/
*
0x32C
*
/
UINT16 IdealNodePadding[
12
];
/
*
0x344
*
/
UINT16 IdealGlobalNode;
/
*
0x346
*
/
UINT16 Spare1;
/
*
0x348
*
/
union _KSTACK_COUNT StackCount;
/
/
3
elements,
0x4
bytes (sizeof)
/
*
0x34C
*
/
UINT8 _PADDING0_[
0x4
];
/
*
0x350
*
/
struct _LIST_ENTRY ProcessListEntry;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x360
*
/
UINT64 CycleTime;
/
*
0x368
*
/
UINT64 ContextSwitches;
/
*
0x370
*
/
struct _KSCHEDULING_GROUP
*
SchedulingGroup;
/
*
0x378
*
/
ULONG32 FreezeCount;
/
*
0x37C
*
/
ULONG32 KernelTime;
/
*
0x380
*
/
ULONG32 UserTime;
/
*
0x384
*
/
ULONG32 ReadyTime;
/
*
0x388
*
/
UINT64 UserDirectoryTableBase;
/
*
0x390
*
/
UINT8 AddressPolicy;
/
*
0x391
*
/
UINT8 Spare2[
71
];
/
*
0x3D8
*
/
VOID
*
InstrumentationCallback;
/
*
0x3E0
*
/
union _<anonymous
-
tag> SecureState;
/
/
2
elements,
0x8
bytes (sizeof)
/
*
0x3E8
*
/
UINT64 KernelWaitTime;
/
*
0x3F0
*
/
UINT64 UserWaitTime;
/
*
0x3F8
*
/
UINT64 EndPadding[
8
];
}KPROCESS,
*
PKPROCESS;
typedef struct _KPROCESS
/
/
54
elements,
0x438
bytes (sizeof)
{
/
*
0x000
*
/
struct _DISPATCHER_HEADER Header;
/
/
59
elements,
0x18
bytes (sizeof)
/
*
0x018
*
/
struct _LIST_ENTRY ProfileListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x028
*
/
UINT64 DirectoryTableBase;
/
*
0x030
*
/
struct _LIST_ENTRY ThreadListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x040
*
/
ULONG32 ProcessLock;
/
*
0x044
*
/
ULONG32 ProcessTimerDelay;
/
*
0x048
*
/
UINT64 DeepFreezeStartTime;
/
*
0x050
*
/
struct _KAFFINITY_EX Affinity;
/
/
4
elements,
0xA8
bytes (sizeof)
/
*
0x0F8
*
/
UINT64 AffinityPadding[
12
];
/
*
0x158
*
/
struct _LIST_ENTRY ReadyListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x168
*
/
struct _SINGLE_LIST_ENTRY SwapListEntry;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x170
*
/
struct _KAFFINITY_EX ActiveProcessors;
/
/
4
elements,
0xA8
bytes (sizeof)
/
*
0x218
*
/
UINT64 ActiveProcessorsPadding[
12
];
union
/
/
2
elements,
0x4
bytes (sizeof)
{
struct
/
/
10
elements,
0x4
bytes (sizeof)
{
/
*
0x278
*
/
ULONG32 AutoAlignment :
1
;
/
/
0
BitPosition
/
*
0x278
*
/
ULONG32 DisableBoost :
1
;
/
/
1
BitPosition
/
*
0x278
*
/
ULONG32 DisableQuantum :
1
;
/
/
2
BitPosition
/
*
0x278
*
/
ULONG32 DeepFreeze :
1
;
/
/
3
BitPosition
/
*
0x278
*
/
ULONG32 TimerVirtualization :
1
;
/
/
4
BitPosition
/
*
0x278
*
/
ULONG32 CheckStackExtents :
1
;
/
/
5
BitPosition
/
*
0x278
*
/
ULONG32 CacheIsolationEnabled :
1
;
/
/
6
BitPosition
/
*
0x278
*
/
ULONG32 PpmPolicy :
3
;
/
/
7
BitPosition
/
*
0x278
*
/
ULONG32 VaSpaceDeleted :
1
;
/
/
10
BitPosition
/
*
0x278
*
/
ULONG32 ReservedFlags :
21
;
/
/
11
BitPosition
};
/
*
0x278
*
/
LONG32 ProcessFlags;
};
/
*
0x27C
*
/
ULONG32 ActiveGroupsMask;
/
*
0x280
*
/
CHAR BasePriority;
/
*
0x281
*
/
CHAR QuantumReset;
/
*
0x282
*
/
CHAR Visited;
/
*
0x283
*
/
union _KEXECUTE_OPTIONS Flags;
/
/
10
elements,
0x1
bytes (sizeof)
/
*
0x284
*
/
UINT16 ThreadSeed[
20
];
/
*
0x2AC
*
/
UINT16 ThreadSeedPadding[
12
];
/
*
0x2C4
*
/
UINT16 IdealProcessor[
20
];
/
*
0x2EC
*
/
UINT16 IdealProcessorPadding[
12
];
/
*
0x304
*
/
UINT16 IdealNode[
20
];
/
*
0x32C
*
/
UINT16 IdealNodePadding[
12
];
/
*
0x344
*
/
UINT16 IdealGlobalNode;
/
*
0x346
*
/
UINT16 Spare1;
/
*
0x348
*
/
union _KSTACK_COUNT StackCount;
/
/
3
elements,
0x4
bytes (sizeof)
/
*
0x34C
*
/
UINT8 _PADDING0_[
0x4
];
/
*
0x350
*
/
struct _LIST_ENTRY ProcessListEntry;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x360
*
/
UINT64 CycleTime;
/
*
0x368
*
/
UINT64 ContextSwitches;
/
*
0x370
*
/
struct _KSCHEDULING_GROUP
*
SchedulingGroup;
/
*
0x378
*
/
ULONG32 FreezeCount;
/
*
0x37C
*
/
ULONG32 KernelTime;
/
*
0x380
*
/
ULONG32 UserTime;
/
*
0x384
*
/
ULONG32 ReadyTime;
/
*
0x388
*
/
UINT64 UserDirectoryTableBase;
/
*
0x390
*
/
UINT8 AddressPolicy;
/
*
0x391
*
/
UINT8 Spare2[
71
];
/
*
0x3D8
*
/
VOID
*
InstrumentationCallback;
/
*
0x3E0
*
/
union _<anonymous
-
tag> SecureState;
/
/
2
elements,
0x8
bytes (sizeof)
/
*
0x3E8
*
/
UINT64 KernelWaitTime;
/
*
0x3F0
*
/
UINT64 UserWaitTime;
/
*
0x3F8
*
/
UINT64 EndPadding[
8
];
}KPROCESS,
*
PKPROCESS;
typedef struct _EPROCESS
/
/
235
elements,
0xA40
bytes (sizeof)
{
/
*
0x000
*
/
struct _KPROCESS Pcb;
/
/
54
elements,
0x438
bytes (sizeof)
/
*
0x438
*
/
struct _EX_PUSH_LOCK ProcessLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x440
*
/
VOID
*
UniqueProcessId;
/
*
0x448
*
/
struct _LIST_ENTRY ActiveProcessLinks;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x458
*
/
struct _EX_RUNDOWN_REF RundownProtect;
/
/
2
elements,
0x8
bytes (sizeof)
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x460
*
/
ULONG32 Flags2;
struct
/
/
28
elements,
0x4
bytes (sizeof)
{
/
*
0x460
*
/
ULONG32 JobNotReallyActive :
1
;
/
/
0
BitPosition
/
*
0x460
*
/
ULONG32 AccountingFolded :
1
;
/
/
1
BitPosition
/
*
0x460
*
/
ULONG32 NewProcessReported :
1
;
/
/
2
BitPosition
/
*
0x460
*
/
ULONG32 ExitProcessReported :
1
;
/
/
3
BitPosition
/
*
0x460
*
/
ULONG32 ReportCommitChanges :
1
;
/
/
4
BitPosition
/
*
0x460
*
/
ULONG32 LastReportMemory :
1
;
/
/
5
BitPosition
/
*
0x460
*
/
ULONG32 ForceWakeCharge :
1
;
/
/
6
BitPosition
/
*
0x460
*
/
ULONG32 CrossSessionCreate :
1
;
/
/
7
BitPosition
/
*
0x460
*
/
ULONG32 NeedsHandleRundown :
1
;
/
/
8
BitPosition
/
*
0x460
*
/
ULONG32 RefTraceEnabled :
1
;
/
/
9
BitPosition
/
*
0x460
*
/
ULONG32 PicoCreated :
1
;
/
/
10
BitPosition
/
*
0x460
*
/
ULONG32 EmptyJobEvaluated :
1
;
/
/
11
BitPosition
/
*
0x460
*
/
ULONG32 DefaultPagePriority :
3
;
/
/
12
BitPosition
/
*
0x460
*
/
ULONG32 PrimaryTokenFrozen :
1
;
/
/
15
BitPosition
/
*
0x460
*
/
ULONG32 ProcessVerifierTarget :
1
;
/
/
16
BitPosition
/
*
0x460
*
/
ULONG32 RestrictSetThreadContext :
1
;
/
/
17
BitPosition
/
*
0x460
*
/
ULONG32 AffinityPermanent :
1
;
/
/
18
BitPosition
/
*
0x460
*
/
ULONG32 AffinityUpdateEnable :
1
;
/
/
19
BitPosition
/
*
0x460
*
/
ULONG32 PropagateNode :
1
;
/
/
20
BitPosition
/
*
0x460
*
/
ULONG32 ExplicitAffinity :
1
;
/
/
21
BitPosition
/
*
0x460
*
/
ULONG32 ProcessExecutionState :
2
;
/
/
22
BitPosition
/
*
0x460
*
/
ULONG32 EnableReadVmLogging :
1
;
/
/
24
BitPosition
/
*
0x460
*
/
ULONG32 EnableWriteVmLogging :
1
;
/
/
25
BitPosition
/
*
0x460
*
/
ULONG32 FatalAccessTerminationRequested :
1
;
/
/
26
BitPosition
/
*
0x460
*
/
ULONG32 DisableSystemAllowedCpuSet :
1
;
/
/
27
BitPosition
/
*
0x460
*
/
ULONG32 ProcessStateChangeRequest :
2
;
/
/
28
BitPosition
/
*
0x460
*
/
ULONG32 ProcessStateChangeInProgress :
1
;
/
/
30
BitPosition
/
*
0x460
*
/
ULONG32 InPrivate :
1
;
/
/
31
BitPosition
};
};
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x464
*
/
ULONG32 Flags;
struct
/
/
29
elements,
0x4
bytes (sizeof)
{
/
*
0x464
*
/
ULONG32 CreateReported :
1
;
/
/
0
BitPosition
/
*
0x464
*
/
ULONG32 NoDebugInherit :
1
;
/
/
1
BitPosition
/
*
0x464
*
/
ULONG32 ProcessExiting :
1
;
/
/
2
BitPosition
/
*
0x464
*
/
ULONG32 ProcessDelete :
1
;
/
/
3
BitPosition
/
*
0x464
*
/
ULONG32 ManageExecutableMemoryWrites :
1
;
/
/
4
BitPosition
/
*
0x464
*
/
ULONG32 VmDeleted :
1
;
/
/
5
BitPosition
/
*
0x464
*
/
ULONG32 OutswapEnabled :
1
;
/
/
6
BitPosition
/
*
0x464
*
/
ULONG32 Outswapped :
1
;
/
/
7
BitPosition
/
*
0x464
*
/
ULONG32 FailFastOnCommitFail :
1
;
/
/
8
BitPosition
/
*
0x464
*
/
ULONG32 Wow64VaSpace4Gb :
1
;
/
/
9
BitPosition
/
*
0x464
*
/
ULONG32 AddressSpaceInitialized :
2
;
/
/
10
BitPosition
/
*
0x464
*
/
ULONG32 SetTimerResolution :
1
;
/
/
12
BitPosition
/
*
0x464
*
/
ULONG32 BreakOnTermination :
1
;
/
/
13
BitPosition
/
*
0x464
*
/
ULONG32 DeprioritizeViews :
1
;
/
/
14
BitPosition
/
*
0x464
*
/
ULONG32 WriteWatch :
1
;
/
/
15
BitPosition
/
*
0x464
*
/
ULONG32 ProcessInSession :
1
;
/
/
16
BitPosition
/
*
0x464
*
/
ULONG32 OverrideAddressSpace :
1
;
/
/
17
BitPosition
/
*
0x464
*
/
ULONG32 HasAddressSpace :
1
;
/
/
18
BitPosition
/
*
0x464
*
/
ULONG32 LaunchPrefetched :
1
;
/
/
19
BitPosition
/
*
0x464
*
/
ULONG32 Background :
1
;
/
/
20
BitPosition
/
*
0x464
*
/
ULONG32 VmTopDown :
1
;
/
/
21
BitPosition
/
*
0x464
*
/
ULONG32 ImageNotifyDone :
1
;
/
/
22
BitPosition
/
*
0x464
*
/
ULONG32 PdeUpdateNeeded :
1
;
/
/
23
BitPosition
/
*
0x464
*
/
ULONG32 VdmAllowed :
1
;
/
/
24
BitPosition
/
*
0x464
*
/
ULONG32 ProcessRundown :
1
;
/
/
25
BitPosition
/
*
0x464
*
/
ULONG32 ProcessInserted :
1
;
/
/
26
BitPosition
/
*
0x464
*
/
ULONG32 DefaultIoPriority :
3
;
/
/
27
BitPosition
/
*
0x464
*
/
ULONG32 ProcessSelfDelete :
1
;
/
/
30
BitPosition
/
*
0x464
*
/
ULONG32 SetTimerResolutionLink :
1
;
/
/
31
BitPosition
};
};
/
*
0x468
*
/
union _LARGE_INTEGER CreateTime;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x470
*
/
UINT64 ProcessQuotaUsage[
2
];
/
*
0x480
*
/
UINT64 ProcessQuotaPeak[
2
];
/
*
0x490
*
/
UINT64 PeakVirtualSize;
/
*
0x498
*
/
UINT64 VirtualSize;
/
*
0x4A0
*
/
struct _LIST_ENTRY SessionProcessLinks;
/
/
2
elements,
0x10
bytes (sizeof)
union
/
/
3
elements,
0x8
bytes (sizeof)
{
/
*
0x4B0
*
/
VOID
*
ExceptionPortData;
/
*
0x4B0
*
/
UINT64 ExceptionPortValue;
/
*
0x4B0
*
/
UINT64 ExceptionPortState :
3
;
/
/
0
BitPosition
};
/
*
0x4B8
*
/
struct _EX_FAST_REF Token;
/
/
3
elements,
0x8
bytes (sizeof)
/
*
0x4C0
*
/
UINT64 MmReserved;
/
*
0x4C8
*
/
struct _EX_PUSH_LOCK AddressCreationLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x4D0
*
/
struct _EX_PUSH_LOCK PageTableCommitmentLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x4D8
*
/
struct _ETHREAD
*
RotateInProgress;
/
*
0x4E0
*
/
struct _ETHREAD
*
ForkInProgress;
/
*
0x4E8
*
/
struct _EJOB
*
CommitChargeJob;
/
*
0x4F0
*
/
struct _RTL_AVL_TREE CloneRoot;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x4F8
*
/
UINT64 NumberOfPrivatePages;
/
*
0x500
*
/
UINT64 NumberOfLockedPages;
/
*
0x508
*
/
VOID
*
Win32Process;
/
*
0x510
*
/
struct _EJOB
*
Job;
/
*
0x518
*
/
VOID
*
SectionObject;
/
*
0x520
*
/
VOID
*
SectionBaseAddress;
/
*
0x528
*
/
ULONG32 Cookie;
/
*
0x52C
*
/
UINT8 _PADDING0_[
0x4
];
/
*
0x530
*
/
struct _PAGEFAULT_HISTORY
*
WorkingSetWatch;
/
*
0x538
*
/
VOID
*
Win32WindowStation;
/
*
0x540
*
/
VOID
*
InheritedFromUniqueProcessId;
/
*
0x548
*
/
UINT64 OwnerProcessId;
/
*
0x550
*
/
struct _PEB
*
Peb;
/
*
0x558
*
/
struct _MM_SESSION_SPACE
*
Session;
/
*
0x560
*
/
VOID
*
Spare1;
/
*
0x568
*
/
struct _EPROCESS_QUOTA_BLOCK
*
QuotaBlock;
/
*
0x570
*
/
struct _HANDLE_TABLE
*
ObjectTable;
/
*
0x578
*
/
VOID
*
DebugPort;
/
*
0x580
*
/
struct _EWOW64PROCESS
*
WoW64Process;
/
*
0x588
*
/
VOID
*
DeviceMap;
/
*
0x590
*
/
VOID
*
EtwDataSource;
/
*
0x598
*
/
UINT64 PageDirectoryPte;
/
*
0x5A0
*
/
struct _FILE_OBJECT
*
ImageFilePointer;
/
*
0x5A8
*
/
UINT8 ImageFileName[
15
];
/
*
0x5B7
*
/
UINT8 PriorityClass;
/
*
0x5B8
*
/
VOID
*
SecurityPort;
/
*
0x5C0
*
/
struct _SE_AUDIT_PROCESS_CREATION_INFO SeAuditProcessCreationInfo;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x5C8
*
/
struct _LIST_ENTRY JobLinks;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x5D8
*
/
VOID
*
HighestUserAddress;
/
*
0x5E0
*
/
struct _LIST_ENTRY ThreadListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x5F0
*
/
ULONG32 ActiveThreads;
/
*
0x5F4
*
/
ULONG32 ImagePathHash;
/
*
0x5F8
*
/
ULONG32 DefaultHardErrorProcessing;
/
*
0x5FC
*
/
LONG32 LastThreadExitStatus;
/
*
0x600
*
/
struct _EX_FAST_REF PrefetchTrace;
/
/
3
elements,
0x8
bytes (sizeof)
/
*
0x608
*
/
VOID
*
LockedPagesList;
/
*
0x610
*
/
union _LARGE_INTEGER ReadOperationCount;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x618
*
/
union _LARGE_INTEGER WriteOperationCount;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x620
*
/
union _LARGE_INTEGER OtherOperationCount;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x628
*
/
union _LARGE_INTEGER ReadTransferCount;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x630
*
/
union _LARGE_INTEGER WriteTransferCount;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x638
*
/
union _LARGE_INTEGER OtherTransferCount;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x640
*
/
UINT64 CommitChargeLimit;
/
*
0x648
*
/
UINT64 CommitCharge;
/
*
0x650
*
/
UINT64 CommitChargePeak;
/
*
0x658
*
/
UINT8 _PADDING1_[
0x28
];
/
*
0x680
*
/
struct _MMSUPPORT_FULL Vm;
/
/
2
elements,
0x140
bytes (sizeof)
/
*
0x7C0
*
/
struct _LIST_ENTRY MmProcessLinks;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x7D0
*
/
ULONG32 ModifiedPageCount;
/
*
0x7D4
*
/
LONG32 ExitStatus;
/
*
0x7D8
*
/
struct _RTL_AVL_TREE VadRoot;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x7E0
*
/
VOID
*
VadHint;
/
*
0x7E8
*
/
UINT64 VadCount;
/
*
0x7F0
*
/
UINT64 VadPhysicalPages;
/
*
0x7F8
*
/
UINT64 VadPhysicalPagesLimit;
/
*
0x800
*
/
struct _ALPC_PROCESS_CONTEXT AlpcContext;
/
/
3
elements,
0x20
bytes (sizeof)
/
*
0x820
*
/
struct _LIST_ENTRY TimerResolutionLink;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x830
*
/
struct _PO_DIAG_STACK_RECORD
*
TimerResolutionStackRecord;
/
*
0x838
*
/
ULONG32 RequestedTimerResolution;
/
*
0x83C
*
/
ULONG32 SmallestTimerResolution;
/
*
0x840
*
/
union _LARGE_INTEGER ExitTime;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x848
*
/
struct _INVERTED_FUNCTION_TABLE
*
InvertedFunctionTable;
/
*
0x850
*
/
struct _EX_PUSH_LOCK InvertedFunctionTableLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x858
*
/
ULONG32 ActiveThreadsHighWatermark;
/
*
0x85C
*
/
ULONG32 LargePrivateVadCount;
/
*
0x860
*
/
struct _EX_PUSH_LOCK ThreadListLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x868
*
/
VOID
*
WnfContext;
/
*
0x870
*
/
struct _EJOB
*
ServerSilo;
/
*
0x878
*
/
UINT8 SignatureLevel;
/
*
0x879
*
/
UINT8 SectionSignatureLevel;
/
*
0x87A
*
/
struct _PS_PROTECTION Protection;
/
/
4
elements,
0x1
bytes (sizeof)
struct
/
/
3
elements,
0x1
bytes (sizeof)
{
/
*
0x87B
*
/
UINT8 HangCount :
3
;
/
/
0
BitPosition
/
*
0x87B
*
/
UINT8 GhostCount :
3
;
/
/
3
BitPosition
/
*
0x87B
*
/
UINT8 PrefilterException :
1
;
/
/
6
BitPosition
};
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x87C
*
/
ULONG32 Flags3;
struct
/
/
28
elements,
0x4
bytes (sizeof)
{
/
*
0x87C
*
/
ULONG32 Minimal :
1
;
/
/
0
BitPosition
/
*
0x87C
*
/
ULONG32 ReplacingPageRoot :
1
;
/
/
1
BitPosition
/
*
0x87C
*
/
ULONG32 Crashed :
1
;
/
/
2
BitPosition
/
*
0x87C
*
/
ULONG32 JobVadsAreTracked :
1
;
/
/
3
BitPosition
/
*
0x87C
*
/
ULONG32 VadTrackingDisabled :
1
;
/
/
4
BitPosition
/
*
0x87C
*
/
ULONG32 AuxiliaryProcess :
1
;
/
/
5
BitPosition
/
*
0x87C
*
/
ULONG32 SubsystemProcess :
1
;
/
/
6
BitPosition
/
*
0x87C
*
/
ULONG32 IndirectCpuSets :
1
;
/
/
7
BitPosition
/
*
0x87C
*
/
ULONG32 RelinquishedCommit :
1
;
/
/
8
BitPosition
/
*
0x87C
*
/
ULONG32 HighGraphicsPriority :
1
;
/
/
9
BitPosition
/
*
0x87C
*
/
ULONG32 CommitFailLogged :
1
;
/
/
10
BitPosition
/
*
0x87C
*
/
ULONG32 ReserveFailLogged :
1
;
/
/
11
BitPosition
/
*
0x87C
*
/
ULONG32 SystemProcess :
1
;
/
/
12
BitPosition
/
*
0x87C
*
/
ULONG32 HideImageBaseAddresses :
1
;
/
/
13
BitPosition
/
*
0x87C
*
/
ULONG32 AddressPolicyFrozen :
1
;
/
/
14
BitPosition
/
*
0x87C
*
/
ULONG32 ProcessFirstResume :
1
;
/
/
15
BitPosition
/
*
0x87C
*
/
ULONG32 ForegroundExternal :
1
;
/
/
16
BitPosition
/
*
0x87C
*
/
ULONG32 ForegroundSystem :
1
;
/
/
17
BitPosition
/
*
0x87C
*
/
ULONG32 HighMemoryPriority :
1
;
/
/
18
BitPosition
/
*
0x87C
*
/
ULONG32 EnableProcessSuspendResumeLogging :
1
;
/
/
19
BitPosition
/
*
0x87C
*
/
ULONG32 EnableThreadSuspendResumeLogging :
1
;
/
/
20
BitPosition
/
*
0x87C
*
/
ULONG32 SecurityDomainChanged :
1
;
/
/
21
BitPosition
/
*
0x87C
*
/
ULONG32 SecurityFreezeComplete :
1
;
/
/
22
BitPosition
/
*
0x87C
*
/
ULONG32 VmProcessorHost :
1
;
/
/
23
BitPosition
/
*
0x87C
*
/
ULONG32 VmProcessorHostTransition :
1
;
/
/
24
BitPosition
/
*
0x87C
*
/
ULONG32 AltSyscall :
1
;
/
/
25
BitPosition
/
*
0x87C
*
/
ULONG32 TimerResolutionIgnore :
1
;
/
/
26
BitPosition
/
*
0x87C
*
/
ULONG32 DisallowUserTerminate :
1
;
/
/
27
BitPosition
};
};
/
*
0x880
*
/
LONG32 DeviceAsid;
/
*
0x884
*
/
UINT8 _PADDING2_[
0x4
];
/
*
0x888
*
/
VOID
*
SvmData;
/
*
0x890
*
/
struct _EX_PUSH_LOCK SvmProcessLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x898
*
/
UINT64 SvmLock;
/
*
0x8A0
*
/
struct _LIST_ENTRY SvmProcessDeviceListHead;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x8B0
*
/
UINT64 LastFreezeInterruptTime;
/
*
0x8B8
*
/
struct _PROCESS_DISK_COUNTERS
*
DiskCounters;
/
*
0x8C0
*
/
VOID
*
PicoContext;
/
*
0x8C8
*
/
VOID
*
EnclaveTable;
/
*
0x8D0
*
/
UINT64 EnclaveNumber;
/
*
0x8D8
*
/
struct _EX_PUSH_LOCK EnclaveLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x8E0
*
/
ULONG32 HighPriorityFaultsAllowed;
/
*
0x8E4
*
/
UINT8 _PADDING3_[
0x4
];
/
*
0x8E8
*
/
struct _PO_PROCESS_ENERGY_CONTEXT
*
EnergyContext;
/
*
0x8F0
*
/
VOID
*
VmContext;
/
*
0x8F8
*
/
UINT64 SequenceNumber;
/
*
0x900
*
/
UINT64 CreateInterruptTime;
/
*
0x908
*
/
UINT64 CreateUnbiasedInterruptTime;
/
*
0x910
*
/
UINT64 TotalUnbiasedFrozenTime;
/
*
0x918
*
/
UINT64 LastAppStateUpdateTime;
struct
/
/
2
elements,
0x8
bytes (sizeof)
{
/
*
0x920
*
/
UINT64 LastAppStateUptime :
61
;
/
/
0
BitPosition
/
*
0x920
*
/
UINT64 LastAppState :
3
;
/
/
61
BitPosition
};
/
*
0x928
*
/
UINT64 SharedCommitCharge;
/
*
0x930
*
/
struct _EX_PUSH_LOCK SharedCommitLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x938
*
/
struct _LIST_ENTRY SharedCommitLinks;
/
/
2
elements,
0x10
bytes (sizeof)
union
/
/
2
elements,
0x10
bytes (sizeof)
{
struct
/
/
2
elements,
0x10
bytes (sizeof)
{
/
*
0x948
*
/
UINT64 AllowedCpuSets;
/
*
0x950
*
/
UINT64 DefaultCpuSets;
};
struct
/
/
2
elements,
0x10
bytes (sizeof)
{
/
*
0x948
*
/
UINT64
*
AllowedCpuSetsIndirect;
/
*
0x950
*
/
UINT64
*
DefaultCpuSetsIndirect;
};
};
/
*
0x958
*
/
VOID
*
DiskIoAttribution;
/
*
0x960
*
/
VOID
*
DxgProcess;
/
*
0x968
*
/
ULONG32 Win32KFilterSet;
/
*
0x96C
*
/
UINT8 _PADDING4_[
0x4
];
/
*
0x970
*
/
union _PS_INTERLOCKED_TIMER_DELAY_VALUES ProcessTimerDelay;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x978
*
/
ULONG32 KTimerSets;
/
*
0x97C
*
/
ULONG32 KTimer2Sets;
/
*
0x980
*
/
ULONG32 ThreadTimerSets;
/
*
0x984
*
/
UINT8 _PADDING5_[
0x4
];
/
*
0x988
*
/
UINT64 VirtualTimerListLock;
/
*
0x990
*
/
struct _LIST_ENTRY VirtualTimerListHead;
/
/
2
elements,
0x10
bytes (sizeof)
union
/
/
2
elements,
0x30
bytes (sizeof)
{
/
*
0x9A0
*
/
struct _WNF_STATE_NAME WakeChannel;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x9A0
*
/
struct _PS_PROCESS_WAKE_INFORMATION WakeInfo;
/
/
4
elements,
0x30
bytes (sizeof)
};
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x9D0
*
/
ULONG32 MitigationFlags;
/
*
0x9D0
*
/
struct _<anonymous
-
tag> MitigationFlagsValues;
/
/
32
elements,
0x4
bytes (sizeof)
};
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x9D4
*
/
ULONG32 MitigationFlags2;
/
*
0x9D4
*
/
struct _<anonymous
-
tag> MitigationFlags2Values;
/
/
32
elements,
0x4
bytes (sizeof)
};
/
*
0x9D8
*
/
VOID
*
PartitionObject;
/
*
0x9E0
*
/
UINT64 SecurityDomain;
/
*
0x9E8
*
/
UINT64 ParentSecurityDomain;
/
*
0x9F0
*
/
VOID
*
CoverageSamplerContext;
/
*
0x9F8
*
/
VOID
*
MmHotPatchContext;
/
*
0xA00
*
/
struct _RTL_AVL_TREE DynamicEHContinuationTargetsTree;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0xA08
*
/
struct _EX_PUSH_LOCK DynamicEHContinuationTargetsLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0xA10
*
/
struct _PS_DYNAMIC_ENFORCED_ADDRESS_RANGES DynamicEnforcedCetCompatibleRanges;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0xA20
*
/
ULONG32 DisabledComponentFlags;
/
*
0xA24
*
/
UINT8 _PADDING6_[
0x4
];
/
*
0xA28
*
/
ULONG32
*
PathRedirectionHashes;
/
*
0xA30
*
/
UINT8 _PADDING7_[
0x10
];
}EPROCESS,
*
PEPROCESS;
typedef struct _EPROCESS
/
/
235
elements,
0xA40
bytes (sizeof)
{
/
*
0x000
*
/
struct _KPROCESS Pcb;
/
/
54
elements,
0x438
bytes (sizeof)
/
*
0x438
*
/
struct _EX_PUSH_LOCK ProcessLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x440
*
/
VOID
*
UniqueProcessId;
/
*
0x448
*
/
struct _LIST_ENTRY ActiveProcessLinks;
/
/
2
elements,
0x10
bytes (sizeof)
/
*
0x458
*
/
struct _EX_RUNDOWN_REF RundownProtect;
/
/
2
elements,
0x8
bytes (sizeof)
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x460
*
/
ULONG32 Flags2;
struct
/
/
28
elements,
0x4
bytes (sizeof)
{
/
*
0x460
*
/
ULONG32 JobNotReallyActive :
1
;
/
/
0
BitPosition
/
*
0x460
*
/
ULONG32 AccountingFolded :
1
;
/
/
1
BitPosition
/
*
0x460
*
/
ULONG32 NewProcessReported :
1
;
/
/
2
BitPosition
/
*
0x460
*
/
ULONG32 ExitProcessReported :
1
;
/
/
3
BitPosition
/
*
0x460
*
/
ULONG32 ReportCommitChanges :
1
;
/
/
4
BitPosition
/
*
0x460
*
/
ULONG32 LastReportMemory :
1
;
/
/
5
BitPosition
/
*
0x460
*
/
ULONG32 ForceWakeCharge :
1
;
/
/
6
BitPosition
/
*
0x460
*
/
ULONG32 CrossSessionCreate :
1
;
/
/
7
BitPosition
/
*
0x460
*
/
ULONG32 NeedsHandleRundown :
1
;
/
/
8
BitPosition
/
*
0x460
*
/
ULONG32 RefTraceEnabled :
1
;
/
/
9
BitPosition
/
*
0x460
*
/
ULONG32 PicoCreated :
1
;
/
/
10
BitPosition
/
*
0x460
*
/
ULONG32 EmptyJobEvaluated :
1
;
/
/
11
BitPosition
/
*
0x460
*
/
ULONG32 DefaultPagePriority :
3
;
/
/
12
BitPosition
/
*
0x460
*
/
ULONG32 PrimaryTokenFrozen :
1
;
/
/
15
BitPosition
/
*
0x460
*
/
ULONG32 ProcessVerifierTarget :
1
;
/
/
16
BitPosition
/
*
0x460
*
/
ULONG32 RestrictSetThreadContext :
1
;
/
/
17
BitPosition
/
*
0x460
*
/
ULONG32 AffinityPermanent :
1
;
/
/
18
BitPosition
/
*
0x460
*
/
ULONG32 AffinityUpdateEnable :
1
;
/
/
19
BitPosition
/
*
0x460
*
/
ULONG32 PropagateNode :
1
;
/
/
20
BitPosition
/
*
0x460
*
/
ULONG32 ExplicitAffinity :
1
;
/
/
21
BitPosition
/
*
0x460
*
/
ULONG32 ProcessExecutionState :
2
;
/
/
22
BitPosition
/
*
0x460
*
/
ULONG32 EnableReadVmLogging :
1
;
/
/
24
BitPosition
/
*
0x460
*
/
ULONG32 EnableWriteVmLogging :
1
;
/
/
25
BitPosition
/
*
0x460
*
/
ULONG32 FatalAccessTerminationRequested :
1
;
/
/
26
BitPosition
/
*
0x460
*
/
ULONG32 DisableSystemAllowedCpuSet :
1
;
/
/
27
BitPosition
/
*
0x460
*
/
ULONG32 ProcessStateChangeRequest :
2
;
/
/
28
BitPosition
/
*
0x460
*
/
ULONG32 ProcessStateChangeInProgress :
1
;
/
/
30
BitPosition
/
*
0x460
*
/
ULONG32 InPrivate :
1
;
/
/
31
BitPosition
};
};
union
/
/
2
elements,
0x4
bytes (sizeof)
{
/
*
0x464
*
/
ULONG32 Flags;
struct
/
/
29
elements,
0x4
bytes (sizeof)
{
/
*
0x464
*
/
ULONG32 CreateReported :
1
;
/
/
0
BitPosition
/
*
0x464
*
/
ULONG32 NoDebugInherit :
1
;
/
/
1
BitPosition
/
*
0x464
*
/
ULONG32 ProcessExiting :
1
;
/
/
2
BitPosition
/
*
0x464
*
/
ULONG32 ProcessDelete :
1
;
/
/
3
BitPosition
/
*
0x464
*
/
ULONG32 ManageExecutableMemoryWrites :
1
;
/
/
4
BitPosition
/
*
0x464
*
/
ULONG32 VmDeleted :
1
;
/
/
5
BitPosition
/
*
0x464
*
/
ULONG32 OutswapEnabled :
1
;
/
/
6
BitPosition
/
*
0x464
*
/
ULONG32 Outswapped :
1
;
/
/
7
BitPosition
/
*
0x464
*
/
ULONG32 FailFastOnCommitFail :
1
;
/
/
8
BitPosition
/
*
0x464
*
/
ULONG32 Wow64VaSpace4Gb :
1
;
/
/
9
BitPosition
/
*
0x464
*
/
ULONG32 AddressSpaceInitialized :
2
;
/
/
10
BitPosition
/
*
0x464
*
/
ULONG32 SetTimerResolution :
1
;
/
/
12
BitPosition
/
*
0x464
*
/
ULONG32 BreakOnTermination :
1
;
/
/
13
BitPosition
/
*
0x464
*
/
ULONG32 DeprioritizeViews :
1
;
/
/
14
BitPosition
/
*
0x464
*
/
ULONG32 WriteWatch :
1
;
/
/
15
BitPosition
/
*
0x464
*
/
ULONG32 ProcessInSession :
1
;
/
/
16
BitPosition
/
*
0x464
*
/
ULONG32 OverrideAddressSpace :
1
;
/
/
17
BitPosition
/
*
0x464
*
/
ULONG32 HasAddressSpace :
1
;
/
/
18
BitPosition
/
*
0x464
*
/
ULONG32 LaunchPrefetched :
1
;
/
/
19
BitPosition
/
*
0x464
*
/
ULONG32 Background :
1
;
/
/
20
BitPosition
/
*
0x464
*
/
ULONG32 VmTopDown :
1
;
/
/
21
BitPosition
/
*
0x464
*
/
ULONG32 ImageNotifyDone :
1
;
/
/
22
BitPosition
/
*
0x464
*
/
ULONG32 PdeUpdateNeeded :
1
;
/
/
23
BitPosition
/
*
0x464
*
/
ULONG32 VdmAllowed :
1
;
/
/
24
BitPosition
/
*
0x464
*
/
ULONG32 ProcessRundown :
1
;
/
/
25
BitPosition
/
*
0x464
*
/
ULONG32 ProcessInserted :
1
;
/
/
26
BitPosition
/
*
0x464
*
/
ULONG32 DefaultIoPriority :
3
;
/
/
27
BitPosition
/
*
0x464
*
/
ULONG32 ProcessSelfDelete :
1
;
/
/
30
BitPosition
/
*
0x464
*
/
ULONG32 SetTimerResolutionLink :
1
;
/
/
31
BitPosition
};
};
/
*
0x468
*
/
union _LARGE_INTEGER CreateTime;
/
/
4
elements,
0x8
bytes (sizeof)
/
*
0x470
*
/
UINT64 ProcessQuotaUsage[
2
];
/
*
0x480
*
/
UINT64 ProcessQuotaPeak[
2
];
/
*
0x490
*
/
UINT64 PeakVirtualSize;
/
*
0x498
*
/
UINT64 VirtualSize;
/
*
0x4A0
*
/
struct _LIST_ENTRY SessionProcessLinks;
/
/
2
elements,
0x10
bytes (sizeof)
union
/
/
3
elements,
0x8
bytes (sizeof)
{
/
*
0x4B0
*
/
VOID
*
ExceptionPortData;
/
*
0x4B0
*
/
UINT64 ExceptionPortValue;
/
*
0x4B0
*
/
UINT64 ExceptionPortState :
3
;
/
/
0
BitPosition
};
/
*
0x4B8
*
/
struct _EX_FAST_REF Token;
/
/
3
elements,
0x8
bytes (sizeof)
/
*
0x4C0
*
/
UINT64 MmReserved;
/
*
0x4C8
*
/
struct _EX_PUSH_LOCK AddressCreationLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x4D0
*
/
struct _EX_PUSH_LOCK PageTableCommitmentLock;
/
/
7
elements,
0x8
bytes (sizeof)
/
*
0x4D8
*
/
struct _ETHREAD
*
RotateInProgress;
/
*
0x4E0
*
/
struct _ETHREAD
*
ForkInProgress;
/
*
0x4E8
*
/
struct _EJOB
*
CommitChargeJob;
/
*
0x4F0
*
/
struct _RTL_AVL_TREE CloneRoot;
/
/
1
elements,
0x8
bytes (sizeof)
/
*
0x4F8
*
/
UINT64 NumberOfPrivatePages;
/
*
0x500
*
/
UINT64 NumberOfLockedPages;
/
*
0x508
*
/
VOID
*
Win32Process;
/
*
0x510
*
/
struct _EJOB
*
Job;
/
*
0x518
*
/
VOID
*
SectionObject;
/
*
0x520
*
/
VOID
*
SectionBaseAddress;
/
*
0x528
*
/
ULONG32 Cookie;
/
*
0x52C
*
/
UINT8 _PADDING0_[
0x4
];
/
*
0x530
*
/
struct _PAGEFAULT_HISTORY
*
WorkingSetWatch;
/
*
0x538
*
/
VOID
*
Win32WindowStation;
/
*
0x540
*
/
VOID
*
InheritedFromUniqueProcessId;
/
*
0x548
*
/
UINT64 OwnerProcessId;
/
*
0x550
*
/
struct _PEB
*
Peb;
/
*
0x558
*
/
struct _MM_SESSION_SPACE
*
Session;
/
*
0x560
*
/
VOID
*
Spare1;
/
*
0x568
*
/
struct _EPROCESS_QUOTA_BLOCK
*
QuotaBlock;
/
*
0x570
*
/
struct _HANDLE_TABLE
*
ObjectTable;
/
*
0x578
*
/
VOID
*
DebugPort;
/
*
0x580
*
/
struct _EWOW64PROCESS
*
WoW64Process;
/
*
0x588
*
/
VOID
*
DeviceMap;
/
*
0x590
*
/
VOID
*
EtwDataSource;
/
*
0x598
*
/
UINT64 PageDirectoryPte;
/
*
0x5A0
*
/
struct _FILE_OBJECT
*
ImageFilePointer;
/
*
0x5A8
*
/
UINT8 ImageFileName[
15
];
赞赏
他的文章
- [原创]linux内核获取未导出函数地址的两种方法 7563
- [原创]x64内核实验7.1补充-句柄表 9093
- [原创]x64内核实验5.1-API进0环(补充) 9784
- [原创]x64内核实验7-线程 11253
- [原创]x64内核实验6-进程 9275
看原图
赞赏
雪币:
留言: