Process Internals
This section describes the key Windows process data structures. Also listed are key kernel variables, performance counters, and functions and tools that relate to processes.
Data Structures
Each Windows process is represented by an executive process (EPROCESS) block. Besides containing many attributes relating to a process, an EPROCESS block contains and points to a number of other related data structures. For example, each process has one or more threads represented by executive thread (ETHREAD) blocks. (Thread data structures are explained in the section Thread Internals later in this chapter.) The EPROCESS block and its related data structures exist in system address space, with the exception of the process environment block ...
Get Windows Internals, Fifth Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
