NT Process Internals

[Nytro]

INTRODUCTION TO NT INTERNALS

Part 1: Processes, Threads, Fibers and Jobs

© 2004 Alex Ionescu

Table of Contents
1. INTRODUCTION................................................................................................................ 4
2. STRUCTURES AND TERMINOLOGY........................................................................... 5
3. IMAGE FILE EXECUTION (PROCESS CREATION)................................................. 8
4. USER-MODE PROCESS STRUCTURES..................................................................... 10
4.1 PROCESS ENVIRONMENT BLOCK (PEB)................................................................... 10
4.2 PROCESS PARAMETERS BLOCK (PPB)..................................................................... 23
4.3 LOADER DATA (LDRD).............................................................................................. 28
4.4 LOADED MODULE (LDR_LM)................................................................................... 28
4.5 VARIOUS OTHER STRUCTURES (PEB_FREE_BLOCK, RTL_BITMAP).............. 30
4.6 FLAGS (GLOBAL_FLAG, KAFFINITY)................................................................. 30
4.7 GDI STRUCTURES (HANDLE_TABLE, GDI_OBJECT)....................................... 32
5. KERNEL-MODE PROCESS STRUCTURES............................................................... 34
5.1 EXECUTIVE PROCESS (EPROCESS)........................................................................ 34
5.2 KERNEL PROCESS (KPROCESS)............................................................................. 48
5.3 LPC PORT (LPC_PORT_OBJECT)........................................................................ 53
5.4 HANDLE TABLE (HANDLE_TABLE)....................................................................... 57
5.5 VIRTUAL ADDRESS DESCRIPTOR TABLE (MM_AVL_TABLE) .............................. 60
5.6 TOKEN (TOKEN) ....................................................................................................... 62
6. USER-MODE THREAD STRUCTURES....................................................................... 68
6.1 THREAD ENVIRONMENT BLOCK (PEB) .................................................................... 68
6.2 NT THREAD INFORMATION BLOCK (TIB) ................................................................ 77
6.3 MISCELLANEOUS USER-MODE STRUCTURES ........................................................... 79
7. KERNEL-MODE THREAD STRUCTURES................................................................. 81
7.1 EXECUTIVE THREAD (ETHREAD) ........................................................................... 81
7.2 KERNEL THREAD (KTHREAD) ................................................................................ 87
7.3 IMPERSONATION (PS_IMPERSIONATION_INFORMATION) ........................ 100
7.4 APC STATE (KAPC_STATE) ................................................................................. 100
8. KERNEL-MODE JOB STRUCTURE.......................................................................... 102
8.1 EXECUTIVE JOB (EJOB).......................................................................................... 102

Download:

http://www.alex-ionescu.com/part1.pdf

Sursa: Publications « Alex Ionescu’s Blog