What is the difference between _EPROCESS and _KPROCESS

Question

After analysis, I found out that even _KPROCESS objects can be members of the ActiveProcessLinks list. What is the difference between _EPROCESS and _KPROCESS objects? When is one created and the other not? What are the conceptual differences between the two?

Answer 1

Look at here:

http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista

EPROCESS is the equivalent of PEB kernel mode from user mode. More information can be found in this document on Alex Ionescu, as well as Schreiber’s book and other books on NT internals.

Use dt in WinDbg to get an idea of ​​how they look.

Answer 2

This is simplified, but part of the Windows O / S kernel mode is broken into three parts: HAL, Kernel, and Executive Subsystems. Executive subsystems are involved in general policy and operations in the field of O / W. The core discusses specific details of the process architecture for low-level operations (e.g. spinlocks, thread switching), as well as scheduling. HAL deals with differences that occur in specific implementations of the processor architecture (for example, how interrupts are routed on this x86 implementation). All of this is explained in more detail in the book Windows Internals.

When you create a new Win32 process, both the kernel and the executive subsystem want to track it. For example, the kernel wants to know the priority and proximity of threads in the process, because it will affect planning. Executive subsystems want to track the process, because, for example, the Executive security subsystem wants to associate a token with the process so that we can verify security later.

The structure that the kernel uses to track the process is KPROCESS. The structure that Executive Subsystems use to track is EPROCESS. As part of the implementation, KPROCESS is the first field of EPROCESS, so the execution subsystems distribute the EPROCESS structure and then call the kernel to initialize part of KPROCESS. In the end, both structures are part of a process object that represents an instance of a user process. This should also be described in the Windows Internals book.

-Scott

Answer 3

EPROCESS is not available in user mode. Neither KPROCESS.

KPROCESS is a subset of EPROCESS. If you look at the fields in the debugger, you will see that KPROCESS contains fields that are more related to planning and accounting the process at a lower level, while EPROCESS has higher-level process contexts inside it. The names, as far as I know, come from different subsystems that interact with these structures (the Contractor has structures and functions, often prefix with Ex, while the kernel has structures and functions, often prefix with Ke)

This can be seen in various documents. Consider a prototype for KeStackAttachProcess ( http://msdn.microsoft.com/en-us/library/ff549659(v=vs.85).aspx ), which is a Ke function and accepts KPROCESS. There are no exported and documented Ex functions that accept EPROCESS (or KPROCESS), but the Ps functions are fully EPROCESSES.

A similar split exists for streams, with KTHREAD and ETHREAD.