Uninformed: Informative Information for the Uninformed

Vol 4» 2006.Jun

Process Objects

Here is a brief list of things to check when scanning for EPROCESS objects.

  • Compare against a high level API such as kernel32!CreateToolhelp32Snapshot.
  • Compare against a system call such as nt!NtQuerySystemInformation.
  • Compare against the EPROCESS->ActiveProcessLinks list.
  • Does the process have a valid list of threads?
  • Can PsLookupProcessByProcessId open its UniqueProcessId?
  • Is ImageFileName a valid string? zeroed? garbage?