# Process: exercise

## EPROCESS, PEB, TEB

### Kernel-mode

1. Run the demo application diplaying the address of its own PEB (the 64 bit version)

2. Open WinDbg, connect local kernel debugging, as described in [the `setup` document](https://github.com/hashereware/training/tree/master/setup#enable-local-kernel-debugging)

3. Issue a command:
```
!process 0 0
```
A list of running processes will show up...

4. Find our application on the list - compare its PEB given by WinDbg with the diplayed one

5. Find copy the address of EPROCESS structure of our application, displayed by WinDbg

6. Display the full EPROCESS structure of our process by:
```
dt nt!_EPROCESS <given address>
```
Take a look at the various fields of this structure

7. Find the PEB among the fields, and compare its address with our displayed PEB. 

+ What is the offset of the PEB in the EPROCESS structure?
+ How to find the information about the threads in the EPROCESS structure?

### User-mode

Now close the kernel mode debugging, and connect to the same process, but from a a userland mode of WinDbg. 

1. Restart WinDbg, and now instrad of kernel mode debugging, choose: `File` -> `Attach to a process`. Choose our process from the list.

2. After the breakpoint hits, issue the command:
```
~
```
you will see the list of all running threads in the process. One of them (the current) is the debug thread injected by WinDbg. The other one is the main thread of the process. Each of them has their TEB address displayed.

3. Display the full TEB structure of both of them, by the command:

```
dt nt!_TEB <teb address>
```
Walk through all the fields.

4. Find the PEB. What is it's offset?

5. Confirm that the PEB address is the same in each thread. Confirm that it is the same as it was in the EPROCESS structure
