admin/evilele-EDR-Introspection
1
0
Fork 0
mirror of https://github.com/evilele/EDR-Introspection synced 2026-06-09 08:11:09 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
master
evilele-EDR-Introspection/docs/MsMpEng-EPROCESS.txt
T
Levi Cailleret 22309dda3b Create MsMpEng-EPROCESS.txt
2025-10-13 18:20:59 +02:00

263 lines
11 KiB
Plaintext
Raw Permalink Blame History

0: kd> dt nt!_EPROCESS ffffe60182aa1080
+0x000 Pcb : _KPROCESS
+0x1c8 ProcessLock : _EX_PUSH_LOCK
+0x1d0 UniqueProcessId : 0x00000000`00000d44 Void
+0x1d8 ActiveProcessLinks : _LIST_ENTRY [ 0xffffe601`82aa7258 - 0xffffe601`82a9a418 ]
+0x1e8 RundownProtect : _EX_RUNDOWN_REF
+0x1f0 Flags2 : 0xd014
+0x1f0 JobNotReallyActive : 0y0
+0x1f0 AccountingFolded : 0y0
+0x1f0 NewProcessReported : 0y1
+0x1f0 ExitProcessReported : 0y0
+0x1f0 ReportCommitChanges : 0y1
+0x1f0 LastReportMemory : 0y0
+0x1f0 ForceWakeCharge : 0y0
+0x1f0 CrossSessionCreate : 0y0
+0x1f0 NeedsHandleRundown : 0y0
+0x1f0 RefTraceEnabled : 0y0
+0x1f0 PicoCreated : 0y0
+0x1f0 EmptyJobEvaluated : 0y0
+0x1f0 DefaultPagePriority : 0y101
+0x1f0 PrimaryTokenFrozen : 0y1
+0x1f0 ProcessVerifierTarget : 0y0
+0x1f0 RestrictSetThreadContext : 0y0
+0x1f0 AffinityPermanent : 0y0
+0x1f0 AffinityUpdateEnable : 0y0
+0x1f0 PropagateNode : 0y0
+0x1f0 ExplicitAffinity : 0y0
+0x1f0 Flags2Available1 : 0y00
+0x1f0 EnableReadVmLogging : 0y0
+0x1f0 EnableWriteVmLogging : 0y0
+0x1f0 FatalAccessTerminationRequested : 0y0
+0x1f0 DisableSystemAllowedCpuSet : 0y0
+0x1f0 Flags2Available2 : 0y000
+0x1f0 InPrivate : 0y0
+0x1f4 Flags : 0x144d0c01
+0x1f4 CreateReported : 0y1
+0x1f4 NoDebugInherit : 0y0
+0x1f4 ProcessExiting : 0y0
+0x1f4 ProcessDelete : 0y0
+0x1f4 ManageExecutableMemoryWrites : 0y0
+0x1f4 VmDeleted : 0y0
+0x1f4 OutswapEnabled : 0y0
+0x1f4 Outswapped : 0y0
+0x1f4 FailFastOnCommitFail : 0y0
+0x1f4 Wow64VaSpace4Gb : 0y0
+0x1f4 AddressSpaceInitialized : 0y11
+0x1f4 SetTimerResolution : 0y0
+0x1f4 BreakOnTermination : 0y0
+0x1f4 DeprioritizeViews : 0y0
+0x1f4 WriteWatch : 0y0
+0x1f4 ProcessInSession : 0y1
+0x1f4 OverrideAddressSpace : 0y0
+0x1f4 HasAddressSpace : 0y1
+0x1f4 LaunchPrefetched : 0y1
+0x1f4 Reserved : 0y0
+0x1f4 VmTopDown : 0y0
+0x1f4 ImageNotifyDone : 0y1
+0x1f4 PdeUpdateNeeded : 0y0
+0x1f4 VdmAllowed : 0y0
+0x1f4 ProcessRundown : 0y0
+0x1f4 ProcessInserted : 0y1
+0x1f4 DefaultIoPriority : 0y010
+0x1f4 ProcessSelfDelete : 0y0
+0x1f4 SetTimerResolutionLink : 0y0
+0x1f8 CreateTime : _LARGE_INTEGER 0x01dc3c5b`87ff7b3f
+0x200 ProcessQuotaUsage : [2] 0x36580
+0x210 ProcessQuotaPeak : [2] 0x47b58
+0x220 PeakVirtualSize : 0x00000201`4d755000
+0x228 VirtualSize : 0x00000201`47d06000
+0x230 SessionProcessLinks : _LIST_ENTRY [ 0xffffe601`82b022f0 - 0xffffe601`82a9a470 ]
+0x240 ExceptionPortData : 0xffffe601`7db7fd30 Void
+0x240 ExceptionPortValue : 0xffffe601`7db7fd30
+0x240 ExceptionPortState : 0y000
+0x248 Token : _EX_FAST_REF
+0x250 MmReserved : 0
+0x258 AddressCreationLock : _EX_PUSH_LOCK
+0x260 PageTableCommitmentLock : _EX_PUSH_LOCK
+0x268 RotateInProgress : (null)
+0x270 ForkInProgress : (null)
+0x278 CommitChargeJob : 0xffffe601`83e08060 _EJOB
+0x280 CloneRoot : _RTL_AVL_TREE
+0x288 NumberOfPrivatePages : 0xf62d
+0x290 NumberOfLockedPages : 0
+0x298 Win32Process : 0xffff8484`8cf1b9a0 Void
+0x2a0 Job : 0xffffe601`83e08060 _EJOB
+0x2a8 SectionObject : 0xffff8484`8cc299d0 Void
+0x2b0 SectionBaseAddress : 0x00007ff6`e3290000 Void
+0x2b8 Cookie : 0x23ed2c32
+0x2c0 WorkingSetWatch : (null)
+0x2c8 Win32WindowStation : 0x00000000`0000022c Void
+0x2d0 InheritedFromUniqueProcessId : 0x00000000`00000364 Void
+0x2d8 OwnerProcessId : 0x366
+0x2e0 Peb : 0x0000008a`31dbc000 _PEB
+0x2e8 Session : 0xffffe601`7d58f120 _PSP_SESSION_SPACE
+0x2f0 Spare1 : (null)
+0x2f8 QuotaBlock : 0xfffff807`e8a27c40 _EPROCESS_QUOTA_BLOCK
+0x300 ObjectTable : 0xffff8484`8ccb3400 _HANDLE_TABLE
+0x308 DebugPort : (null)
+0x310 WoW64Process : (null)
+0x318 DeviceMap : _EX_FAST_REF
+0x320 EtwDataSource : 0xffffe601`82582090 Void
+0x328 PageDirectoryPte : 0
+0x330 ImageFilePointer : 0xffffe601`82881460 _FILE_OBJECT
+0x338 ImageFileName : [15] "MsMpEng.exe"
+0x347 PriorityClass : 0x2 ''
+0x348 SecurityPort : (null)
+0x350 SeAuditProcessCreationInfo : _SE_AUDIT_PROCESS_CREATION_INFO
+0x358 JobLinks : _LIST_ENTRY [ 0xffffe601`83e08088 - 0xffffe601`83e08088 ]
+0x368 HighestUserAddress : 0x00007fff`ffff0000 Void
+0x370 ThreadListHead : _LIST_ENTRY [ 0xffffe601`82aa25f8 - 0xffffe601`84279638 ]
+0x380 ActiveThreads : 0x20
+0x384 ImagePathHash : 0xf9080403
+0x388 DefaultHardErrorProcessing : 0x8000
+0x38c LastThreadExitStatus : 0n0
+0x390 PrefetchTrace : _EX_FAST_REF
+0x398 LockedPagesList : (null)
+0x3a0 ReadOperationCount : _LARGE_INTEGER 0x0
+0x3a8 WriteOperationCount : _LARGE_INTEGER 0x0
+0x3b0 OtherOperationCount : _LARGE_INTEGER 0xfc
+0x3b8 ReadTransferCount : _LARGE_INTEGER 0x0
+0x3c0 WriteTransferCount : _LARGE_INTEGER 0x0
+0x3c8 OtherTransferCount : _LARGE_INTEGER 0x1f1a
+0x3d0 CommitChargeLimit : 0x100000
+0x3d8 CommitCharge : 0x1052e
+0x3e0 CommitChargePeak : 0x33364
+0x400 Vm : _MMSUPPORT_FULL
+0x540 MmProcessLinks : _LIST_ENTRY [ 0xffffe601`82b02600 - 0xffffe601`82a9a780 ]
+0x550 ModifiedPageCount : 0x19ddb
+0x554 ExitStatus : 0n259
+0x558 VadRoot : _RTL_AVL_TREE
+0x560 VadHint : 0xffffe601`82ba9710 Void
+0x568 VadCount : 0x653
+0x570 VadPhysicalPages : 0
+0x578 VadPhysicalPagesLimit : 0
+0x580 AlpcContext : _ALPC_PROCESS_CONTEXT
+0x5a0 TimerResolutionLink : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
+0x5b0 TimerResolutionStackRecord : (null)
+0x5b8 RequestedTimerResolution : 0
+0x5bc SmallestTimerResolution : 0
+0x5c0 ExitTime : _LARGE_INTEGER 0x0
+0x5c8 InvertedFunctionTable : 0xffff8484`8f6ed650 _INVERTED_FUNCTION_TABLE_KERNEL_MODE
+0x5d0 InvertedFunctionTableLock : _EX_PUSH_LOCK
+0x5d8 ActiveThreadsHighWatermark : 0x20
+0x5dc LargePrivateVadCount : 0
+0x5e0 ThreadListLock : _EX_PUSH_LOCK
+0x5e8 WnfContext : 0xffff8484`8cc065c0 Void
+0x5f0 ServerSilo : (null)
+0x5f8 SignatureLevel : 0x37 '7'
+0x5f9 SectionSignatureLevel : 0x7 ''
+0x5fa Protection : _PS_PROTECTION
+0x5fb HangCount : 0y000
+0x5fb GhostCount : 0y000
+0x5fb PrefilterException : 0y0
+0x5fc Flags3 : 0x40c008
+0x5fc Minimal : 0y0
+0x5fc ReplacingPageRoot : 0y0
+0x5fc Crashed : 0y0
+0x5fc JobVadsAreTracked : 0y1
+0x5fc VadTrackingDisabled : 0y0
+0x5fc AuxiliaryProcess : 0y0
+0x5fc SubsystemProcess : 0y0
+0x5fc IndirectCpuSets : 0y0
+0x5fc RelinquishedCommit : 0y0
+0x5fc HighGraphicsPriority : 0y0
+0x5fc CommitFailLogged : 0y0
+0x5fc ReserveFailLogged : 0y0
+0x5fc SystemProcess : 0y0
+0x5fc AllImagesAtBasePristineBase : 0y0
+0x5fc AddressPolicyFrozen : 0y1
+0x5fc ProcessFirstResume : 0y1
+0x5fc ForegroundExternal : 0y0
+0x5fc ForegroundSystem : 0y0
+0x5fc HighMemoryPriority : 0y0
+0x5fc EnableProcessSuspendResumeLogging : 0y0
+0x5fc EnableThreadSuspendResumeLogging : 0y0
+0x5fc SecurityDomainChanged : 0y0
+0x5fc SecurityFreezeComplete : 0y1
+0x5fc VmProcessorHost : 0y0
+0x5fc VmProcessorHostTransition : 0y0
+0x5fc AltSyscall : 0y0
+0x5fc TimerResolutionIgnore : 0y0
+0x5fc DisallowUserTerminate : 0y0
+0x5fc EnableProcessRemoteExecProtectVmLogging : 0y0
+0x5fc EnableProcessLocalExecProtectVmLogging : 0y0
+0x5fc MemoryCompressionProcess : 0y0
+0x5fc EnableProcessImpersonationLogging : 0y0
+0x600 DeviceAsid : 0n0
+0x608 SvmData : (null)
+0x610 SvmProcessLock : _EX_PUSH_LOCK
+0x618 SvmLock : 0
+0x620 SvmProcessDeviceListHead : _LIST_ENTRY [ 0xffffe601`82aa16a0 - 0xffffe601`82aa16a0 ]
+0x630 LastFreezeInterruptTime : 0
+0x638 DiskCounters : 0xffffe601`82aa18c0 _PROCESS_DISK_COUNTERS
+0x640 PicoContext : (null)
+0x648 EnclaveTable : (null)
+0x650 EnclaveNumber : 0
+0x658 EnclaveLock : _EX_PUSH_LOCK
+0x660 HighPriorityFaultsAllowed : 0
+0x668 EnergyContext : 0xffffe601`82aa18f8 _PO_PROCESS_ENERGY_CONTEXT
+0x670 VmContext : (null)
+0x678 SequenceNumber : 0x49
+0x680 CreateInterruptTime : 0x983e1b9
+0x688 CreateUnbiasedInterruptTime : 0x983e1b9
+0x690 TotalUnbiasedFrozenTime : 0
+0x698 LastAppStateUpdateTime : 0x983e1b9
+0x6a0 LastAppStateUptime : 0y0000000000000000000000000000000000000000000000000000000000000 (0)
+0x6a0 LastAppState : 0y000
+0x6a8 SharedCommitCharge : 0x1ec
+0x6b0 SharedCommitLock : _EX_PUSH_LOCK
+0x6b8 SharedCommitLinks : _LIST_ENTRY [ 0xffff8484`8efb7078 - 0xffff8484`8efb7e38 ]
+0x6c8 AllowedCpuSets : 0
+0x6d0 DefaultCpuSets : 0
+0x6c8 AllowedCpuSetsIndirect : (null)
+0x6d0 DefaultCpuSetsIndirect : (null)
+0x6d8 DiskIoAttribution : (null)
+0x6e0 DxgProcess : 0xffff8484`8ce04d70 Void
+0x6e8 Win32KFilterSet : 0
+0x6ec Machine : 0x8664
+0x6ee MmSlabIdentity : 0xff ''
+0x6ef Spare0 : 0 ''
+0x6f0 ProcessTimerDelay : _PS_INTERLOCKED_TIMER_DELAY_VALUES
+0x6f8 KTimerSets : 0
+0x6fc KTimer2Sets : 0
+0x700 ThreadTimerSets : 0x705
+0x708 VirtualTimerListLock : 0
+0x710 VirtualTimerListHead : _LIST_ENTRY [ 0xffffe601`82aa1790 - 0xffffe601`82aa1790 ]
+0x720 WakeChannel : _WNF_STATE_NAME
+0x720 WakeInfo : _PS_PROCESS_WAKE_INFORMATION
+0x750 MitigationFlags : 0x800a1
+0x750 MitigationFlagsValues : <unnamed-tag>
+0x754 MitigationFlags2 : 0x40000000
+0x754 MitigationFlags2Values : <unnamed-tag>
+0x758 PartitionObject : 0xffffe601`7b689f30 Void
+0x760 SecurityDomain : 0
+0x768 ParentSecurityDomain : 0
+0x770 CoverageSamplerContext : (null)
+0x778 MmHotPatchContext : (null)
+0x780 DynamicEHContinuationTargetsTree : _RTL_AVL_TREE
+0x788 DynamicEHContinuationTargetsLock : _EX_PUSH_LOCK
+0x790 DynamicEnforcedCetCompatibleRanges : _PS_DYNAMIC_ENFORCED_ADDRESS_RANGES
+0x7a0 DisabledComponentFlags : 0
+0x7a4 PageCombineSequence : 0n1
+0x7a8 EnableOptionalXStateFeaturesLock : _EX_PUSH_LOCK
+0x7b0 PathRedirectionHashes : (null)
+0x7b8 SyscallProvider : (null)
+0x7c0 SyscallProviderProcessLinks : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
+0x7d0 SyscallProviderDispatchContext : _PSP_SYSCALL_PROVIDER_DISPATCH_CONTEXT
+0x7d8 MitigationFlags3 : 0
+0x7d8 MitigationFlags3Values : <unnamed-tag>
+0x7dc Flags4 : 1
+0x7dc ThreadWasActive : 0y1
+0x7dc MinimalTerminate : 0y0
+0x7dc ImageExpansionDisable : 0y0
+0x7dc SessionFirstProcess : 0y0
+0x7e0 SyscallUsage : 0
+0x7e0 SyscallUsageValues : <unnamed-tag>
+0x7e4 SupervisorDeviceAsid : 0n0
+0x7e8 SupervisorSvmData : (null)
+0x7f0 NetworkCounters : 0xffffe601`82aa18e8 _PROCESS_NETWORK_COUNTERS
+0x7f8 Execution : _PROCESS_EXECUTION
+0x800 ThreadIndexTable : (null)
+0x808 FreezeWorkLinks : _LIST_ENTRY [ 0x00000000`00000000 - 0x00000000`00000000 ]
Reference in New Issue View Git Blame Copy Permalink