Click here to Skip to main content
15,792,380 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
I'm working with windows 7. I wrote a driver to get the EPROCESS struct of my process.
status = PsLookupProcessByProcessId((HANDLE)pid, &EP);

the status is returned as NT_SUCCESS.
but I got an error when I tried to access any field of this struct.
like the following:

peb = (DWORD)EP->Peb;

the error was:

" left of 'Peb' specifies undefined struct/union '_EPROCESS' "

I don't know whay I got this error and how to solve it??

thanks for helping.
Updated 6-Dec-11 7:11am

Your code suggests that EP is a pointer type, but it is not obvious from it's declaration that it is. Perhaps your code should be
peb = (DWORD)EP.Peb;
Share this answer
nadia_tarik 8-Dec-11 6:58am    
Thank you for replaying.

EP is of pointer type, because PEPROCESS is of type _EPROCESS * as defined in the ntddk.h. and I try the solution of dot operator before but there still an error.
This is an "opaque" struct. YOU SHOULD NOT access it directly.

But if you want to learn (never in a real product) you can view at the fields and displacements, and build your "own" per os version of the struct using windbg....
Share this answer
nadia_tarik 27-Apr-13 15:48pm    
thank you

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900