Process Objects

Here is a brief list of things to check when scanning for EPROCESS objects.

• Compare against a high level API such as kernel32!CreateToolhelp32Snapshot.
• Compare against a system call such as nt!NtQuerySystemInformation.
• Compare against the EPROCESS->ActiveProcessLinks list.
• Does the process have a valid list of threads?
• Can PsLookupProcessByProcessId open its UniqueProcessId?
• Is ImageFileName a valid string? zeroed? garbage?