这个EPROCESS结构在ntddk.h中有定义，但是并未给出具体的结构，因此要得到EPROCESS中一些重要的成员变量，只能通过偏移的方法，比如PID,ImageName等．这些偏移可以在Windbg中dt _EPROCESS得到，但是不公开感觉还是不爽，而且这东西在不同的系统版本中不一样，如果要兼容的话，就必须先判断操作系统版本，遍历EPROCESS中的进程-The ntddk.h EPROCESS structure are defined, but did not give a specific structure, so to get some important members EPROCESS variables, only through the offset method, such as PID, ImageName and so on. These offsets can be Windbg in dt _EPROCESS, but still feel uncomfortable not open, and this version of things in different systems is not the same, if compatible, it must first determine the operating system version, the process of traversing EPROCESS