+−⟲ A process in kernel address spaceis represented as objects called EPROCESS's A PEB (Process Environment Block) is a structure that containsvital information about the process. Flinks (Forward links) Blinks(Backward Links) Key Takeaway: Each user-mode Processes is linkedto an EPROCESS structure in kernel address space.This will be important when discussing DKOM(Direct Kernel Object Manipulation) PEB 0x18: PEB_LDR_DATA PEB_LDR_DATA 0x10: InLoadOrderModuleList 0x20: InMemoryOrderModuleList 0x:30 InInitializationOrderModuleList Accessed using Flink or Blink LDR_DATA_TABLE_ENTRY 0x58: BaseDllName 0x48: FullDllName Flink 0x30: DllBase 0x38: EntryPoint BaseDllName.Length & BaseDllName.Buffer