windbg 查看某个进程EPOCESS结构
转：http://blog.sina.com.cn/s/blog_5ddb672b01017xrh.html
windbg 查看某个进程EPOCESS结构，debugport清零
内核调试下
1. !process 0 0 列出所有进程的信息
lkd> !process 0 0
Unable to read selector for PCR for processor 0
**** NT ACTIVE PROCESS DUMP ****
PROCESS 8a670830 SessionId: none Cid: 0004 Peb: 00000000 ParentCid: 0000
DirBase: 0ad40020 ObjectTable: e1003e38 HandleCount: 389.
Image: System
PROCESS 8a6951b8 SessionId: none Cid: 0464 Peb: 7ffda000 ParentCid: 0004
DirBase: 0ad40040 ObjectTable: e100ac48 HandleCount: 19.
Image: smss.exe
PROCESS 871e7730 SessionId: 0 Cid: 04ac Peb: 7ffde000 ParentCid: 0464
DirBase: 0ad40060 ObjectTable: e192f880 HandleCount: 968.
Image: csrss.exe
。。。。。
PROCESS 87135bc8 SessionId: 0 Cid: 07ac Peb: 7ffd3000 ParentCid: 08d4
DirBase: 0ac811c0 ObjectTable: e3cb4468 HandleCount: 141.
Image: NOTEPAD.EXE
出现等等这种信息，找到你要调试的进程，第一个PROCESS后面的地址就是进程的EPROCESS结构
2.dt _EPROCESS 87135bc8 打印出这个结构的数据
lkd> dt _EPROCESS 87135bc8
nt!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x06c ProcessLock : _EX_PUSH_LOCK
+0x070 CreateTime : _LARGE_INTEGER 0x1cd85f7`fd7ccea6
+0x078 ExitTime : _LARGE_INTEGER 0x0
+0x080 RundownProtect : _EX_RUNDOWN_REF
+0x084 UniqueProcessId : 0x000007ac
+0x088 ActiveProcessLinks : _LIST_ENTRY [ 0x86c78660 - 0x86cbe0a8 ]
+0x090 QuotaUsage : [3] 0x16c8
+0x09c QuotaPeak : [3] 0x1898
+0x0a8 CommitCharge : 0x4c7
+0x0ac PeakVirtualSize : 0x67fa000
+0x0b0 VirtualSize : 0x6560000
+0x0b4 SessionProcessLinks : _LIST_ENTRY [ 0xa4993014 - 0x86cbe0d4 ]
+0x0bc DebugPort : (null)
+0x0c0 ExceptionPort : 0xe17ddbb8
+0x0c4 ObjectTable : 0xe3cb4468 _HANDLE_TABLE
+0x0c8 Token : _EX_FAST_REF
+0x0cc WorkingSetLock : _FAST_MUTEX
+0x0ec WorkingSetPage : 0x657f4
+0x0f0 AddressCreationLock : _FAST_MUTEX
+0x110 HyperSpaceLock : 0
+0x114 ForkInProgress : (null)
+0x118 HardwareTrigger : 0
+0x11c VadRoot : 0x88b680b8
+0x120 VadHint : 0x88b680b8
+0x124 CloneRoot : (null)
+0x128 NumberOfPrivatePages : 0x331
+0x12c NumberOfLockedPages : 0
+0x130 Win32Process : 0xe414be68
+0x134 Job : (null)
+0x138 SectionObject : 0xe35a23e0
+0x13c SectionBaseAddress : 0x01000000
+0x140 QuotaBlock : 0x889ce638 _EPROCESS_QUOTA_BLOCK
+0x144 WorkingSetWatch : (null)
+0x148 Win32WindowStation : 0x0000003c
+0x14c InheritedFromUniqueProcessId : 0x000008d4
+0x150 LdtInformation : (null)
+0x154 VadFreeHint : (null)
+0x158 VdmObjects : (null)
+0x15c DeviceMap : 0xe2cb0668
+0x160 PhysicalVadList : _LIST_ENTRY [ 0x87135d28 - 0x87135d28 ]
+0x168 PageDirectoryPte : _HARDWARE_PTE
+0x168 Filler : 0
+0x170 Session : 0xa4993000
+0x174 ImageFileName : [16] "NOTEPAD.EXE"
+0x184 JobLinks : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x18c LockedPagesList : (null)
+0x190 ThreadListHead : _LIST_ENTRY [ 0x86a319dc - 0x86b845fc ]
+0x198 SecurityPort : (null)
+0x19c PaeTop : 0xba6741c0
+0x1a0 ActiveThreads : 3
+0x1a4 GrantedAccess : 0x1f0fff
+0x1a8 DefaultHardErrorProcessing : 1
+0x1ac LastThreadExitStatus : 0
+0x1b0 Peb : 0x7ffd3000 _PEB
+0x1b4 PrefetchTrace : _EX_FAST_REF
+0x1b8 ReadOperationCount : _LARGE_INTEGER 0x18
+0x1c0 WriteOperationCount : _LARGE_INTEGER 0xa
+0x1c8 OtherOperationCount : _LARGE_INTEGER 0x43d
+0x1d0 ReadTransferCount : _LARGE_INTEGER 0x20f29f
+0x1d8 WriteTransferCount : _LARGE_INTEGER 0x373c
+0x1e0 OtherTransferCount : _LARGE_INTEGER 0x556c
+0x1e8 CommitChargeLimit : 0
+0x1ec CommitChargePeak : 0x624
+0x1f0 AweInfo : (null)
+0x1f4 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x1f8 Vm : _MMSUPPORT
+0x238 LastFaultCount : 0
+0x23c ModifiedPageCount : 0x32a
+0x240 NumberOfVads : 0x83
+0x244 JobStatus : 0
+0x248 Flags : 0x50800
+0x248 CreateReported : 0y0
+0x248 NoDebugInherit : 0y0
+0x248 ProcessExiting : 0y0
+0x248 ProcessDelete : 0y0
+0x248 Wow64SplitPages : 0y0
+0x248 VmDeleted : 0y0
+0x248 OutswapEnabled : 0y0
+0x248 Outswapped : 0y0
+0x248 ForkFailed : 0y0
+0x248 HasPhysicalVad : 0y0
+0x248 AddressSpaceInitialized : 0y10
+0x248 SetTimerResolution : 0y0
+0x248 BreakOnTermination : 0y0
+0x248 SessionCreationUnderway : 0y0
+0x248 WriteWatch : 0y0
+0x248 ProcessInSession : 0y1
+0x248 OverrideAddressSpace : 0y0
+0x248 HasAddressSpace : 0y1
+0x248 LaunchPrefetched : 0y0
+0x248 InjectInpageErrors : 0y0
+0x248 VmTopDown : 0y0
+0x248 Unused3 : 0y0
+0x248 Unused4 : 0y0
+0x248 VdmAllowed : 0y0
+0x248 Unused : 0y00000 (0)
+0x248 Unused1 : 0y0
+0x248 Unused2 : 0y0
+0x24c ExitStatus : 259
+0x250 NextPageColor : 0x2aa4
+0x252 SubSystemMinorVersion : 0 ''
+0x253 SubSystemMajorVersion : 0x4 ''
+0x252 SubSystemVersion : 0x400
+0x254 PriorityClass : 0x2 ''
+0x255 WorkingSetAcquiredUnsafe : 0 ''
+0x258 Cookie : 0xfe5c392b
看到+bc的地方就是debugport的地址，有了这两个偏移，啥都好办了
3.可以用ba w1 87135bc8 + 0xbc 对这个地址进行写入断点，g一下就能看到是哪个在对这个进行操作了，
当然了，也可以用Syser下断 bpm 87135bc8 + 0xbc w
ps:如果要进入某个进程的空间，可以使用 .process 87135bc8
lkd> .process 87135bc8
Implicit process is now 87135bc8