Win7 x64下的_EPROCESS结构记录

Win7下的与Win10下的基本变化不大，无非就是个别名称结构有所小变化还多了些【斜眼笑】
ntdll!_EPROCESS
+0x000 Pcb : _KPROCESS
+0x160 ProcessLock : _EX_PUSH_LOCK
+0x168 CreateTime : _LARGE_INTEGER
+0x170 ExitTime : _LARGE_INTEGER
+0x178 RundownProtect : _EX_RUNDOWN_REF
+0x180 UniqueProcessId : Ptr64 Void
+0x188 ActiveProcessLinks : _LIST_ENTRY
+0x198 ProcessQuotaUsage : [2] Uint8B
+0x1a8 ProcessQuotaPeak : [2] Uint8B
+0x1b8 CommitCharge : Uint8B
+0x1c0 QuotaBlock : Ptr64 _EPROCESS_QUOTA_BLOCK
+0x1c8 CpuQuotaBlock : Ptr64 _PS_CPU_QUOTA_BLOCK
+0x1d0 PeakVirtualSize : Uint8B
+0x1d8 VirtualSize : Uint8B
+0x1e0 SessionProcessLinks : _LIST_ENTRY
+0x1f0 DebugPort : Ptr64 Void
+0x1f8 ExceptionPortData : Ptr64 Void
+0x1f8 ExceptionPortValue : Uint8B
+0x1f8 ExceptionPortState : Pos 0, 3 Bits
+0x200 ObjectTable : Ptr64 _HANDLE_TABLE
+0x208 Token : _EX_FAST_REF
+0x210 WorkingSetPage : Uint8B
+0x218 AddressCreationLock : _EX_PUSH_LOCK
+0x220 RotateInProgress : Ptr64 _ETHREAD
+0x228 ForkInProgress : Ptr64 _ETHREAD
+0x230 HardwareTrigger : Uint8B
+0x238 PhysicalVadRoot : Ptr64 _MM_AVL_TABLE
+0x240 CloneRoot : Ptr64 Void
+0x248 NumberOfPrivatePages : Uint8B
+0x250 NumberOfLockedPages : Uint8B
+0x258 Win32Process : Ptr64 Void
+0x260 Job : Ptr64 _EJOB
+0x268 SectionObject : Ptr64 Void
+0x270 SectionBaseAddress : Ptr64 Void
+0x278 Cookie : Uint4B
+0x27c Spare8 : Uint4B
+0x280 WorkingSetWatch : Ptr64 _PAGEFAULT_HISTORY
+0x288 Win32WindowStation : Ptr64 Void
+0x290 InheritedFromUniqueProcessId : Ptr64 Void
+0x298 LdtInformation : Ptr64 Void
+0x2a0 Spare : Ptr64 Void
+0x2a8 ConsoleHostProcess : Uint8B
+0x2b0 DeviceMap : Ptr64 Void
+0x2b8 EtwDataSource : Ptr64 Void
+0x2c0 FreeTebHint : Ptr64 Void
+0x2c8 PageDirectoryPte : _HARDWARE_PTE
+0x2c8 Filler : Uint8B
+0x2d0 Session : Ptr64 Void
+0x2d8 ImageFileName : [15] UChar
+0x2e7 PriorityClass : UChar
+0x2e8 JobLinks : _LIST_ENTRY
+0x2f8 LockedPagesList : Ptr64 Void
+0x300 ThreadListHead : _LIST_ENTRY
+0x310 SecurityPort : Ptr64 Void
+0x318 Wow64Process : Ptr64 Void
+0x320 ActiveThreads : Uint4B
+0x324 ImagePathHash : Uint4B
+0x328 DefaultHardErrorProcessing : Uint4B
+0x32c LastThreadExitStatus : Int4B
+0x330 Peb : Ptr64 _PEB
+0x338 PrefetchTrace : _EX_FAST_REF
+0x340 ReadOperationCount : _LARGE_INTEGER
+0x348 WriteOperationCount : _LARGE_INTEGER
+0x350 OtherOperationCount : _LARGE_INTEGER
+0x358 ReadTransferCount : _LARGE_INTEGER
+0x360 WriteTransferCount : _LARGE_INTEGER
+0x368 OtherTransferCount : _LARGE_INTEGER
+0x370 CommitChargeLimit : Uint8B
+0x378 CommitChargePeak : Uint8B
+0x380 AweInfo : Ptr64 Void
+0x388 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x390 Vm : _MMSUPPORT
+0x418 MmProcessLinks : _LIST_ENTRY
+0x428 HighestUserAddress : Ptr64 Void
+0x430 ModifiedPageCount : Uint4B
+0x434 Flags2 : Uint4B
+0x434 JobNotReallyActive : Pos 0, 1 Bit
+0x434 AccountingFolded : Pos 1, 1 Bit
+0x434 NewProcessReported : Pos 2, 1 Bit
+0x434 ExitProcessReported : Pos 3, 1 Bit
+0x434 ReportCommitChanges : Pos 4, 1 Bit
+0x434 LastReportMemory : Pos 5, 1 Bit
+0x434 ReportPhysicalPageChanges : Pos 6, 1 Bit
+0x434 HandleTableRundown : Pos 7, 1 Bit
+0x434 NeedsHandleRundown : Pos 8, 1 Bit
+0x434 RefTraceEnabled : Pos 9, 1 Bit
+0x434 NumaAware : Pos 10, 1 Bit
+0x434 ProtectedProcess : Pos 11, 1 Bit //进程保护
+0x434 DefaultPagePriority : Pos 12, 3 Bits
+0x434 PrimaryTokenFrozen : Pos 15, 1 Bit
+0x434 ProcessVerifierTarget : Pos 16, 1 Bit
+0x434 StackRandomizationDisabled : Pos 17, 1 Bit
+0x434 AffinityPermanent : Pos 18, 1 Bit
+0x434 AffinityUpdateEnable : Pos 19, 1 Bit
+0x434 PropagateNode : Pos 20, 1 Bit
+0x434 ExplicitAffinity : Pos 21, 1 Bit
+0x438 Flags : Uint4B
+0x438 CreateReported : Pos 0, 1 Bit
+0x438 NoDebugInherit : Pos 1, 1 Bit
+0x438 ProcessExiting : Pos 2, 1 Bit
+0x438 ProcessDelete : Pos 3, 1 Bit
+0x438 Wow64SplitPages : Pos 4, 1 Bit
+0x438 VmDeleted : Pos 5, 1 Bit
+0x438 OutswapEnabled : Pos 6, 1 Bit
+0x438 Outswapped : Pos 7, 1 Bit
+0x438 ForkFailed : Pos 8, 1 Bit
+0x438 Wow64VaSpace4Gb : Pos 9, 1 Bit
+0x438 AddressSpaceInitialized : Pos 10, 2 Bits
+0x438 SetTimerResolution : Pos 12, 1 Bit
+0x438 BreakOnTermination : Pos 13, 1 Bit
+0x438 DeprioritizeViews : Pos 14, 1 Bit
+0x438 WriteWatch : Pos 15, 1 Bit
+0x438 ProcessInSession : Pos 16, 1 Bit
+0x438 OverrideAddressSpace : Pos 17, 1 Bit
+0x438 HasAddressSpace : Pos 18, 1 Bit
+0x438 LaunchPrefetched : Pos 19, 1 Bit
+0x438 InjectInpageErrors : Pos 20, 1 Bit
+0x438 VmTopDown : Pos 21, 1 Bit
+0x438 ImageNotifyDone : Pos 22, 1 Bit
+0x438 PdeUpdateNeeded : Pos 23, 1 Bit
+0x438 VdmAllowed : Pos 24, 1 Bit
+0x438 CrossSessionCreate : Pos 25, 1 Bit
+0x438 ProcessInserted : Pos 26, 1 Bit
+0x438 DefaultIoPriority : Pos 27, 3 Bits
+0x438 ProcessSelfDelete : Pos 30, 1 Bit
+0x438 SetTimerResolutionLink : Pos 31, 1 Bit
+0x43c ExitStatus : Int4B
+0x440 VadRoot : _MM_AVL_TABLE
+0x480 AlpcContext : _ALPC_PROCESS_CONTEXT
+0x4a0 TimerResolutionLink : _LIST_ENTRY
+0x4b0 RequestedTimerResolution : Uint4B
+0x4b4 ActiveThreadsHighWatermark : Uint4B
+0x4b8 SmallestTimerResolution : Uint4B
+0x4c0 TimerResolutionStackRecord : Ptr64 _PO_DIAG_STACK_RECORD