Kernel Datastructures

Kernel data structures are those data structures that exist in physical memory and are accessible only by the kernel and its subsystems. Like other datastructures, these contain pointers, data, addresses of other data structures or addresses of routines etc. Here are some of the major kernel ds in Windows:

typedef struct _ACL
      UCHAR AclRevision;
      UCHAR Sbzl;
      WORD AclSize;
      WORD AceCount;
      WORD Sbz2;

This data structure is associated with access control lists that manages the permissions of various users to objects like files etc.

This link mentions about a set of data structures in Windows Vista. 

Every data structure has a purpose and although some of them are used by several kernel subsystems, they are not very hard to understand. There are many research going on where a process signature is obtained by analyzing these kernel ds during the execution of a current process. This kernel based signatures are made to detect attacks like rootkits where processes are hidden from the list of processes in the system by manipulating the process header. The kernel datastructure that maintains the processes is called EPROCESS.  

If you are interested to explore more about kernel data structures, this could be a good place to begin with. 


2 thoughts on “Kernel Datastructures

  1. naturally like your web site but you need to check the spelling on quite a few
    of your posts. A number of them aare rifce with spelling problems and I to find it very troublesome to inform the rreality nevertheless
    I’ll definitely come back again.

  2. Greetings from California! I’m bored to death at work so I decided to check out your site on my iphone
    during lunch break. I enjoy the information you present here and can’t wait
    to take a look when I get home. I’m shocked at how quick your blog
    loaded on my cell phone .. I’m not even using WIFI, just 3G
    .. Anyhow, fantastic site!

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s