Learning Malware Analysis

4.1.2 Understanding ActiveProcessLinks

Windows uses a circular double linked list of _EPROCESS structures to keep track of all the active processes. The _EPROCESS structure contains a field called ActiveProcessLinks which is of type LIST_ENTRY. The _LIST_ENTRY is another structure that contains two members, as shown in the following code. The Flink (forward link) points to the _LIST_ENTRY of the next _EPROCESS structure, and the Blink (backward link) points to the _LIST_ENTRY of the previous _EPROCESS structure:

kd> dt nt!_LIST_ENTRY   +0x000 Flink : Ptr64 _LIST_ENTRY   +0x008 Blink : Ptr64 _LIST_ENTRY

Flink and Blink together create a chain of process objects; this can be visualized as follows:

A point to note is that Flink and Blink do not ...