_EPROCESS Contents

Question 1

Pcb

Answer 1

The kerneyl’s process control black (_KRPROCESS). This structure is found at the base of _EPROCRESS and contains several critical fields, includoing the DirectoryTableBase for address translations and the amount of of time the process has spent in kernel mode and user mode.

Question 2

CreateTime

Answer 2

A UTC timestamp indicating when the process first started

Question 3

ExitTime

Answer 3

A UTC timestamp indicated the time the process exited. This value is zero for still-running processes

Question 4

UniqueProcessID

Answer 4

An integer that uniquely identifies the process (also know as the PID)

Question 5

ActiveProcessLinks

Answer 5

The doubly linked list that chains together active processes on the machine. Most APIs on a running system rely on walking this list.

Question 6

SessionProcessLinks

Answer 6

Another double linked list that chains together processes in the same session

Question 7

InheritedFromUniqueProcessID

Answer 7

An integer that specifies the PID of the parent process. After a process is funning, this member is not modified, even if its parent terminates.

Question 8

Session

Answer 8

This member points to the _MM_SESSION_SPACE structure that stores information on a user’s logon session and GUI objects.

Question 9

ImageFileName

Answer 9

The filename portion of the process’ executable. This field stores the first 16 ASCII characters, so longer filenames will appear truncated. To get the full path to the executable, or to see the Unicode name, you can access the corresponding VAD node or members in the PEB.

Question 10

ThreadListHead

Answer 10

A doubly linked list that chains together all the process’ threads (each element is an _ETHREAD)

Question 11

ActiveThreads

Answer 11

An integer indicating the number of active threads running in the process context. Seeing a process with zero active threads is a good sign that the process has exited.

Question 12

Peb

Answer 12

Peb A pointer to the Process Environment Block (PEB). Although this member (_EPROCESS.Peb) exists in kernel mode, it points to an address in user mode. The PEB contains pointers to the process’ DLL lists, current working directory, command line arguments, environmental variables, heaps, and standard handles.

Question 13

VadRoot

Answer 13

The root node of the VAD tree. It contains detailed information about a process’ allocated memory segments, including the original access permissions (read, write, execute) and whether a file is mapped into the region.