Windows creates an object called EPROCESS for each process that's created in the system. This object includes all the important information about this process, such as Virtual Address Descriptors (VADs), that store the map of this process's virtual memory and its representation in physical memory. It also includes the process ID, the parent process ID, and a doubly-linked list called ActiveProcessLinks, which connects all EPROCESS objects of all processes together. Each EPROCESS includes an address to the next EPROCESS object (which represents the next process) called FLink and the address to the previous EPROCESS object (which is associated with the previous process) called BLink. Both addresses are stored in ActiveProcessLinks:
The exact structure of EPROCESS changes from one version of OS to another. That is, some fields get added, some get removed, and, sometimes, rearrangements happen. Rootkits...
