Edit

Process Internals

  • Every window process is represented by the process executive structure called EPROCESS.

  • EPROCESS contains reference to one more internal structures such as ETHREAD which represents the threads inside the process.

  • All process structures resides in the system address space except the Process Environment Block (PEB) which resides in the user process address space.

Last updated