The EPROCESS structure is an opaque structure that serves as the process object for a process.
Some routines, such as PsGetProcessCreateTimeQuadPart, use EPROCESS to identify the process to operate on. Drivers can use the PsGetCurrentProcess routine to obtain a pointer to the process object for the current process and can use the ObReferenceObjectByHandle routine to obtain a pointer to the process object that is associated with the specified handle. The PsInitialSystemProcess global variable points to the process object for the system process.
Note that a process object is an Object Manager object. Drivers should use Object Manager routines such as ObReferenceObject and ObDereferenceObject to maintain the object’s reference count.
Versions: All supported operating systems.
Headers: Defined in Wdm.h. Include Wdm.h, Ntddk.h, or Ntifs.h.
ObReferenceObjectByHandle, PsGetCurrentProcess, PsGetProcessCreateTimeQuadPart, PsInitialSystemProcess