Author
Hi,
I am writing device driver in Windows. I want to use the following function.
struct _EPROCESS*
STDCALL
IoGetCurrentProcess (
VOID
);
But I can not find _EPROCESS definition anywhere. Is it not exported? If not, How can we use IoGetCurrentProcess ?
Srinivas
Don't look in a header file for reference, always check out the documentation.
msdn: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/Kernel_r/hh/Kernel_r/k104_f59c640e-e335-46e0-a6ca-2f672bb6fc35.xml.asp
msdn: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/Kernel_r/hh/Kernel_r/k104_f59c640e-e335-46e0-a6ca-2f672bb6fc35.xml.asp
Author
Hi,
No where I can see definition of _EPROCESS. Is it not documented and exported?
Srinivas
No where I can see definition of _EPROCESS. Is it not documented and exported?
Srinivas
If you checked the MSDN link I provided, you see the documented return value of your function is PEPROCESS. So use that and never use _EPROCESS.
_EPROCESS is probably not documented, I wouldn't trust any structure name beginning with an underscore either. I'm not sure about that one, but it may be a naming convention for internal structure representations or something along those lines. So only stick with what you see in the docs (PEPROCESS that is).
_EPROCESS is probably not documented, I wouldn't trust any structure name beginning with an underscore either. I'm not sure about that one, but it may be a naming convention for internal structure representations or something along those lines. So only stick with what you see in the docs (PEPROCESS that is).
If it's not documented, then maybe they don't want you to play with the structure fieds. The reason is probably that the underlying structure depends on the Windows version. There are some functions that allow you to get some informations out from this pointer. For example, PsGetProcessId() (which also states The EPROCESS-typed process object structure is an opaque data structure that the operating system uses internally BTW).
What do you want to get from this EPROCESS structure?
What do you want to get from this EPROCESS structure?
This topic is closed to new replies.
Advertisement
Popular Topics
Advertisement
