system process
-
how can you determine if a certain process is a system process in kernel mode? the _ETHREAD structure has a field called SystemThread. I guest that if that field is TRUE then the certain thread is a system thread and if a process has all thread with than SystemThread set to true are system processes. I gues I was wrong. i tested that on the process called "sytem" and it had'n all threads system threads even though it is system process. there must be a way. how does the taskmanager do it ? and another thing how can you enumerate all threads of a process in kernel mode. Is there a way to get them from the _EPROCESS structure ? gabby
-
how can you determine if a certain process is a system process in kernel mode? the _ETHREAD structure has a field called SystemThread. I guest that if that field is TRUE then the certain thread is a system thread and if a process has all thread with than SystemThread set to true are system processes. I gues I was wrong. i tested that on the process called "sytem" and it had'n all threads system threads even though it is system process. there must be a way. how does the taskmanager do it ? and another thing how can you enumerate all threads of a process in kernel mode. Is there a way to get them from the _EPROCESS structure ? gabby
Hi euacela I saw your answer in example's MSDN that enumerate threads of a process and detail process's