IRP
MDL
Expand Minimize

EPROCESS

The EPROCESS structure is an opaque structure that serves as the process object for a process.

Some routines, such as PsGetProcessCreateTimeQuadPart, use EPROCESS to identify the process to operate on. Drivers can use the PsGetCurrentProcess routine to obtain a pointer to the process object for the current process and can use the ObReferenceObjectByHandle routine to obtain a pointer to the process object that is associated with the specified handle. The PsInitialSystemProcess global variable points to the process object for the system process.

Note that a process object is an Object Manager object. Drivers should use Object Manager routines such as ObReferenceObject and ObDereferenceObject to maintain the object's reference count.

Requirements

Version

All supported operating systems.

Header

Wdm.h (include Wdm.h, Ntddk.h, or Ntifs.h)

See also

ObReferenceObjectByHandle
PsGetCurrentProcess
PsGetProcessCreateTimeQuadPart
PsInitialSystemProcess

 

 

Send comments about this topic to Microsoft

Show:
© 2014 Microsoft. All rights reserved.