SYSTEM_PROCESSES struct in ws 2008 R2 changed ?

Question

I use SYSTEM_PROCESSES in develop windows driver (WiNDDK), I find an interesting things, the sizeof(SYSTEM_PROCESSES) in ws 2003 x86 is 0xb4, in ws 2008 r2 amd x64 is 0x134, but in <<windows native API 2000>> the length is 0xb0.

what's the problem? is this date type has been changed ?

Answer 1

Who promised that these structures will never change? You use undocumented stuff on your own risk.

-- pa

Answer 2

Anyone knows how this struct is defined in Windows 7?

Thanks!

Answer 3

Load the symbols and try "dt" command in the debugger.

-- pa

 

Answer 4

That would work if the struct were exported, but apparently it's not.

However, found elsewhere that the correct name of this struct

is SYSTEM_PROCESS_INFORMATION, and the definition as well.

Thanks!