Windows process Internal Mechanism learning summary

The process object, the thread object is in system space, but PEB,TEB is in user space. Because they need some user-state code to modify them.

CSRSS creates a csr_process structure for each process in the session.

Win32k.sys creates the w32process structure for the process that the thread that first uses the GUI belongs to.

WinDbg view: DT NT!_EPROCSS DT _kprocess

!process 0 0 You can view all the process information: the process + process address can switch the current process to that session.

Windows also has a protected process. This process can deny some of the administrator's access rights. The process of receiving protection is differentiated by marking the tag bits of the EPROCSS structure.

So you can load a bit of kernel-mode drivers by disabling the tag bits.

Windows process Internal Mechanism learning summary