Untitled

Don't look in a header file for reference, always check out the documentation.
msdn: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/Kernel_r/hh/Kernel_r/k104_f59c640e-e335-46e0-a6ca-2f672bb6fc35.xml.asp

Hi,

No where I can see definition of _EPROCESS. Is it not documented and exported?

Srinivas

If you checked the MSDN link I provided, you see the documented return value of your function is PEPROCESS. So use that and never use _EPROCESS.

_EPROCESS is probably not documented, I wouldn't trust any structure name beginning with an underscore either. I'm not sure about that one, but it may be a naming convention for internal structure representations or something along those lines. So only stick with what you see in the docs (PEPROCESS that is).

Hi,

Then how do I get PEPROCESS structure fields?

Srinivas

If it's not documented, then maybe they don't want you to play with the structure fieds. The reason is probably that the underlying structure depends on the Windows version. There are some functions that allow you to get some informations out from this pointer. For example, PsGetProcessId() (which also states The EPROCESS-typed process object structure is an opaque data structure that the operating system uses internally BTW).

What do you want to get from this EPROCESS structure?