2.3 常见内核数据结构 : 进程与线程数据结构
进程与线程数据结构：
1. 执行体进程块(EPROCESS)
驱动程序通过PsGetCurrentProcess函数获取指向当前进程的执行体进程块指针
kd> dt nt!_EPROCESS
Pcb _KPROCESS
ProcessLock
CreateTime
ExitTime
RundownProtect
UniqueProcessId Ptr32 Void
ActiveProcessLinks
QuotaUsage
QuotaPeak
CommitCharge
PeakVirtualSize
VirutalSize
SessionProcessLinks
DebugPort
ExceptionPort
ObjectTable Ptr32 _HANDLE_TABLE
Token _EXFAST_REF
WorkingSetLock _FAST_MUTEX
WorkingSetPage
AddressCreationLock _FAST_MUTEX
HyperSpaceLock
ForkInProgress
HardwareTrigger
VadRoot
VadHint
CloneRoot
NumberOfPrivatePages
NumberOfLockedPages
Win32Process Ptr32 Void
Job Ptr32 _EJOB
SectionObject
SectionBaseAddress Ptr32 Void
QuotaBlock
WorkingSetWatch
Win32WindowStation
InheritedFromUniqueProcessId
LdtInformation
VadFreeHint
VdmObjects
DeviceMap
PhysicalVadList _LIST_ENTRY
PageDirectoryPte
Filler
Session Ptr32 Void
ImageFileName [16] UChar
JobLinks
LockedPagesList
ThreadListHead _LIST_ENTRY
SecurityPort
PaeTop
ActiveThreads
GrantedAccess
DefaultHardErrorProcessing
LastThreadExitStatus
Peb Ptr32 _PEB
PrefetchTrace
ReadOperationCount
WriteOperationCount
OtherOperationCount
ReadTransferCount
WriteTransferCount
OtherTransferCount
CommitChargeLimit
CommitChargePeak
AweInfo
SeAuditProcessCreationInfo _SE_AUDIT_PROCESS_CREATION_INFO
Vm _MMSUPPORT
LastFaultCount
ModifiedPageCount
NumberOfVads
JobStatus
Flags
CreateReported
NoDebugInherit
ProcessExiting
ProcessDelete
Wow64SplitPages
VmDeleted
OutswapEnabled
Outswapped
ForkFailed
HasPhysicalVad
AddressSpaceInitialized
SetTimerResolution
BreakOnTermination
SessionCreationUnderway
WriteWatch
ProcessInSession
OverrideAddressSpace
HasAddressSpace
LaunchPrefetched
InjectInpageErrors
VmTopDown
Unused3
Unused4
VdmAllowed
Unused
Unused1
Unused2
ExitStatus
NextPageColor
SubSystemMinorVersion
SubSystemMajorVersion
SubSystemVersion
PriorityClass
WorkingSetAcquiredUnsafe
Cookie
2. 内核进程块(KPROCESS)
kd> dt nt!_KPROCESS
Header _DISPATCHER_HEADER
ProfileListHead _LIST_ENTRY
DirectoryTableBase
LdtDescriptor _KGDTENTRY
Int21Descriptor _KIDTENTRY
IopmOffset
Iopl
Unused
ActiveProcessors
KernelTime Uint 4B
UserTime Uint 4B
ReadyListHead _LIST_ENTRY
SwapListEntry _SINGLE_LIST_ENTRY
VdmTrapcHandler
ThreadListHead _LIST_ENTRY
ProcessLock
Affinity Uint 4B
StackCount
BasePriority
ThreadQuantum
AutoAlignment
State
ThreadSeed
DisableBoost
PowerState
DisableQuantum
IdealNode
Flags _KEXECUTE_OPTIONS
ExecuteOptions
3. 执行体线程块(ETHREAD)
驱动程序通过PsGetCurrentThread函数获取一个指向当前线程的执行体线程块指针
kd> dt nt!_ethread
Tcb _KTHREAD
CreateTime _LARGE_INTEGER
NestedFaultCount
ApcNeeded
ExitTime _LARGE_INTEGER
LpcReplyChain
KeyedWaitChain
ExitStatus
OfsChain
PostBlockList
TerminationPort
ReaperLink
KeyedWaitValue
ActiveTimerListLock
ActiveTimerListHead _LIST_ENTRY
Cid _CLIEND_ID
LpcReplySemaphore
KeyedWaitSemaphore
LpcReplyMessage
LpcWaitingOnPort
ImpersonationInfo Ptr32 _PS_IMPERSONATION_INFORMATION
IrpList _LIST_ENTRY
TopLevelIrp
DeviceToVerify
ThreadsProcess
StartAddress Ptr32 Void
Win32StartAddress
LpcReceivedMessageId Uint 4B
ThreadListEntry _LIST_ENTRY
RundownProtect _EX_RUNDOWN_REF
ThreadLock _EX_PUSH_LOCK
LpcReplyMessageId
ReadClusterSize
GrantedAccess
CrossThreadFlags
Terminated
DeadThread
HideFromDebugger
ActiveImpersonationInfo
SystemThread
HardErrorsAreDisabled
BreakOnTermination
SkipCreationMsg
SkipTerminationMsg
SameThreadPassiveFlags
ActiveExWorked
ExWorkerCanWaitUser
MemoryMaker
SameThreadApcFlags
LpcReceivedMsgIdValid
LpcExitThreadCalled
AddressSpaceOwner
ForwardClusterOnly
DisablePageFaultClustering
4. 内核线程块(KTHREAD)
kd> dt nt!_KTHREAD
Header _DISPATCHER_HEADER
MutantListHead _LIST_ENTRY
InitialStack Ptr32 Void
StackLimit Ptr32 Void
Teb Ptr32 Void
TlsArray
KernelStack
DebugActive
State
Alerted
Iopl
NpxState
Saturation
Priority
ApcState
ContextSwitches
IdleSwapBlock
Spare0
WaitStatus
WaitIrql
WaitMode
WaitNext
WaitReason
WaitBlockList
WaitListEntry _LIST_ENTRY
SwapListEntry
WaitTime
BasePriority
DecrementCount
PriorityDecrement
Quantum
WaitBlock [4] _KWAIT_BLOCK
LegoData
KernelApcDisable
UserAffinity
SystemAffinityActive
PowerState
NpxIrql
InitialNode
ServiceTable
Queue Ptr32 _KQUEUE
ApcQueueLock
Timer _KTIMER
QueueListEntry _LIST_ENTRY
SoftAffinity
Affinity
Preempted
ProcessReadyQueue
KernelStackResident
NextProcessor
CallbackStack
Win32Thread
TrapFrame
ApcStatePointer
PreviosMode
KernelTime
UserTime
SavedApcState
Alertable
ApcStateIndex
ApcQueueable
Autoalignment
StackBase
SuspendApc _KAPC
SuspendSemaphore _KSEMAPHORE
ThreadListEntry _LIST_ENTRY
FreezeConut
SuspendCount
IdealProcessor
DisableBoost