Dumping EPROCESS with windbg
windbg, windows, windows-7
Solution
The command is:
dt nt!_EPROCESS <address>
You should be able to obtain address from the output of the `!process 0 7`.
Problem
I'm experimenting with LibVMI and Windows 7 32-bit; to properly set things up, I need to look at the first 8 bytes of an EPROCESS structure (the library searches memory for a magic number, this is supposed to be it). My Windows-fu is not strong, so can anyone tell me how to dump the appropriate bit of memory? I'm running the local kernel debugger, and I've gotten as far as "dt nt!_EPROCESS" but that just seems to show me the format of the structure, not what's actually in it.