hi

NTDEV
1

Does any one have idea about KPEB and EPROCESS structures

Thanks,
Kedar.

INDIA TODAY @ Rs. 5 for 5 years !
http://www.indiatoday.com/itoday/intlsubscription/itsubs/it_offer.html
Subcribe Now …

2

They are opaque data structures deliberately undefined in either the DDK or
IFSKIT. What exactly are you trying to do that makes you believe you require
these data structure definitions?

=====================
Mark Roddy

-----Original Message-----
From: kedar n [mailto:xxxxx@hotmail.com]
Sent: Monday, March 08, 2004 8:34 AM
To: Windows System Software Devs Interest List
Subject: [ntdev] hi

Does any one have idea about KPEB and EPROCESS structures

Thanks,
Kedar.

INDIA TODAY @ Rs. 5 for 5 years !
http://www.indiatoday.com/itoday/intlsubscription/itsubs/it_offer.html
Subcribe Now …

Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256

You are currently subscribed to ntdev as: xxxxx@stratus.com
To unsubscribe send a blank email to xxxxx@lists.osr.com

3

I dunno what is KPEB and never heard on it, but EPROCESS fields can be
listed in WinDbg by

dt nt!_EPROCESS

Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
xxxxx@storagecraft.com
http://www.storagecraft.com

----- Original Message -----
From: “kedar n”
To: “Windows System Software Devs Interest List”
Sent: Monday, March 08, 2004 4:33 PM
Subject: [ntdev] hi

> Does any one have idea about KPEB and EPROCESS structures
>
> Thanks,
> Kedar.
>
> _________________________________________________________________
> INDIA TODAY @ Rs. 5 for 5 years !
> http://www.indiatoday.com/itoday/intlsubscription/itsubs/it_offer.html
> Subcribe Now …
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com

4

The Process Environment Block reside in user process address space.

----- Original Message -----
From: “Maxim S. Shatskih”
To: “Windows System Software Devs Interest List”
Sent: Monday, March 08, 2004 7:43 PM
Subject: Re: [ntdev] hi

> I dunno what is KPEB and never heard on it, but EPROCESS fields can be
> listed in WinDbg by
>
> dt nt!_EPROCESS
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> ----- Original Message -----
> From: “kedar n”
> To: “Windows System Software Devs Interest List”
> Sent: Monday, March 08, 2004 4:33 PM
> Subject: [ntdev] hi
>
>
> > Does any one have idea about KPEB and EPROCESS structures
> >
> > Thanks,
> > Kedar.
> >
> > _________________________________________________________________
> > INDIA TODAY @ Rs. 5 for 5 years !
> > http://www.indiatoday.com/itoday/intlsubscription/itsubs/it_offer.html
> > Subcribe Now …
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@calsoftinc.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>

5

Also u can see PEB by !peb in WinDBG

----- Original Message -----
From: “Maxim S. Shatskih”
To: “Windows System Software Devs Interest List”
Sent: Monday, March 08, 2004 7:43 PM
Subject: Re: [ntdev] hi

> I dunno what is KPEB and never heard on it, but EPROCESS fields can be
> listed in WinDbg by
>
> dt nt!_EPROCESS
>
> Maxim Shatskih, Windows DDK MVP
> StorageCraft Corporation
> xxxxx@storagecraft.com
> http://www.storagecraft.com
>
>
> ----- Original Message -----
> From: “kedar n”
> To: “Windows System Software Devs Interest List”
> Sent: Monday, March 08, 2004 4:33 PM
> Subject: [ntdev] hi
>
>
> > Does any one have idea about KPEB and EPROCESS structures
> >
> > Thanks,
> > Kedar.
> >
> > _________________________________________________________________
> > INDIA TODAY @ Rs. 5 for 5 years !
> > http://www.indiatoday.com/itoday/intlsubscription/itsubs/it_offer.html
> > Subcribe Now …
> >
> >
> > —
> > Questions? First check the Kernel Driver FAQ at
> http://www.osronline.com/article.cfm?id=256
> >
> > You are currently subscribed to ntdev as: xxxxx@storagecraft.com
> > To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>
> —
> Questions? First check the Kernel Driver FAQ at
http://www.osronline.com/article.cfm?id=256
>
> You are currently subscribed to ntdev as: xxxxx@calsoftinc.com
> To unsubscribe send a blank email to xxxxx@lists.osr.com
>
>