Monday, January 10, 2011 3:07 AM
I use SYSTEM_PROCESSES in develop windows driver (WiNDDK), I find an interesting things, the sizeof(SYSTEM_PROCESSES) in ws 2003 x86 is 0xb4, in ws 2008 r2 amd x64 is 0x134, but in <<windows native API 2000>> the length is 0xb0.
what's the problem? is this date type has been changed ?
Monday, January 10, 2011 2:49 PM
Who promised that these structures will never change? You use undocumented stuff on your own risk.
Wednesday, November 02, 2011 10:31 PM
Anyone knows how this struct is defined in Windows 7?
Wednesday, November 02, 2011 11:23 PM
Load the symbols and try "dt" command in the debugger.
Thursday, November 03, 2011 7:29 PM
That would work if the struct were exported, but apparently it's not.
However, found elsewhere that the correct name of this struct
is SYSTEM_PROCESS_INFORMATION, and the definition as well.