摘要：
1.首先找到该进程的EPROCESS结构的址在WinDbg命令行输入!process00得到EPROCESS结构的址lkd>!process00****NTACTIVEPROCESSDUMP****PROCESS84648268SessionId:0Cid:0344Peb:7ffd7000ParentCid:02f4DirBase:18ca7000ObjectTable:e14cca28HandleCount:272.Image:winlogon.exe2.再在命令行输入dt_EPROCESS84648268lkd>dt_EPROCESS84648268nt!_EPROCESS+0 阅读全文