EJOB

The EJOB structure (formally _EJOB) is the kernel’s representation of a job object. For instance, if the ObReferenceObjectByHandle function successfully resolves a handle though directed to do so only if the object type is PsJobObject, then what the function produces as its point to the object is a pointer to an EJOB structure.

A job is a collection of processes that act with some common purpose. There is no particular definition of the purpose or even of how the processes act together, just that there be enough commonality that the processes are usefully managed collectively.

Jobs were arguably a little obscure until some of the features that had been developed for managing them as a collection of processes came to attention as being useful for security. Various restrictions that might be desired for a process but which cannot be applied directly to a process can instead be applied indirectly by putting the process into a suitably configured job, even if the job only ever has the one process.

Windows 10 brought new use to the job to support containers of the sort that Microsoft calls silos. It does not seem to have got much attention at first, but the original Windows 10 has a separate ESILO structure for a silo object. The connection with jobs is that the only way to create a silo object is through the JobObjectCreateSilo information class of the NtSetInformationJobObject function. This sets the created silo into the given job as the latter’s Container. That containers and silos were tightly integrated with jobs was therefore plain enough from the start (if only to those who look beyond what Microsoft documents). A heavy reworking of both the implementation and its interface (even of exported functions) as soon as Version 1511 kept something very like the ESILO but no longer as an object and now renamed as a SILO_CONTEXT. In this version, a silo object is already a job object but specifically one that has a SILO_CONTEXT. Further reworking for Version 1607 merged the SILO_CONTEXT into the EJOB. Ever since, a silo is a special type of job, distinguished by a set Silo bit in the JobFlags. The JobObjectCreateSilo information class now turns the given job into a silo. Call a function such as PsGetProcessSilo and what you get back nowadays is a pointer to an EJOB. It’s not fanciful that many security researchers are most familiar with the EJOB not directly from looking at processes in jobs but from their studies of breaking out of silos.

Documentation Status

The EJOB is not documented. Before Windows 10, no header from a Device Driver Kit (DDK) or Windows Driver Kit (WDK) even declares the EJOB as an opaque type. This had to wait for NTOSP.H in the “minwin” subdirectory of headers in early editions of the WDK for Windows 10, specifically for the original release and for Version 1511. Since this subdirectory is in turn in a subdirectory named “um”, as if for user-mode programming, this header’s publication was presumably an oversight (which is not known to have been repeated). The reworking of silos as jobs for Version 1607 brought with it that NTDDK.H now defines both PEJOB and PESILO as pointers to an opaque _EJOB.

Access

The EJOB exists only in kernel-mode memory. User-mode software has only indirect access through handles. Kernel-mode software has direct access through several undocumented kernel exports. For instance, PsGetProcessJob returns a pointer to the EJOB, if any, for the given EPROCESS. It seems a fair bet that even this kernel-mode software is supposed to treat the structure as opaque.

Size and Variability

Inasmuch as the EJOB is internal to the kernel, it is free to vary widely between versions and even between builds. That said, its development over two decades has been relatively orderly. There have been insertions and deletions, and even a few rearrangements, but not nearly as many as for other Process Structure structures that are similarly internal and similarly sized. New members tend to be appended.

Layout

These sizes, and the offsets, types and names in the table below, are from Microsoft’s public symbol files for the kernel starting with Windows 2000 SP3. The structure is not known to differ between the original Windows 2000 and the later service packs that have type information in the public symbol files. See anyway that the !strct and !dso commands of debugger extensions from the Windows 2000 DDK both list the EJOB with something like the certainty of the missing type information.

KEVENT Event;

LIST_ENTRY JobLinks;

LIST_ENTRY ProcessListHead;

ERESOURCE JobLock;

LARGE_INTEGER TotalUserTime;

LARGE_INTEGER TotalKernelTime;

LARGE_INTEGER TotalCycleTime;

LARGE_INTEGER ThisPeriodTotalUserTime;

LARGE_INTEGER ThisPeriodTotalKernelTime;

ULONGLONG TotalContextSwitch;

ULONG TotalPageFaultCount;

ULONG TotalProcesses;

ULONG ActiveProcesses;

ULONG TotalTerminatedProcesses;

LARGE_INTEGER PerProcessUserTimeLimit;

LARGE_INTEGER PerJobUserTimeLimit;

ULONG LimitFlags;

SIZE_T MinimumWorkingSetSize;

SIZE_T MaximumWorkingSetSize;

ULONG LimitFlags;

ULONG ActiveProcessLimit;

KAFFINITY Affinity;

KAFFINITY_EX Affinity;

UCHAR PriorityClass;

JOB_ACCESS_STATE *AccessState;

PVOID AccessStateQuotaReference;

ULONG UIRestrictionsClass;

ULONG SecurityLimitFlags;

PVOID Token;

PS_JOB_TOKEN_FILTER *Filter;

ULONG EndOfJobTimeAction;

PVOID CompletionPort;

PVOID CompletionKey;

ULONGLONG CompletionCount;

ULONG SessionId;

ULONG SchedulingClass;

ULONGLONG ReadOperationCount;

ULONGLONG WriteOperationCount;

ULONGLONG OtherOperationCount;

ULONGLONG ReadTransferCount;

ULONGLONG WriteTransferCount;

ULONGLONG OtherTransferCount;

IO_COUNTERS IoInfo;

PROCESS_DISK_COUNTERS *DiskIoInfo;

SIZE_T ProcessMemoryLimit;

SIZE_T JobMemoryLimit;

SIZE_T JobTotalMemoryLimit;

SIZE_T PeakProcessMemoryUsed;

SIZE_T PeakJobMemoryUsed;

KAFFINITY_EX EffectiveAffinity;

LARGE_INTEGER EffectivePerProcessUserTimeLimit;

SIZE_T EffectiveMinimumWorkingSetSize;

SIZE_T EffectiveMaximumWorkingSetSize;

SIZE_T EffectiveProcessMemoryLimit;

EJOB *EffectiveProcessMemoryLimitJob;

EJOB *EffectivePerProcessUserTimeLimitJob;

EJOB *EffectiveDiskIoRateLimitJob;

EJOB *EffectiveNetIoRateLimitJob;

EJOB *EffectiveHeapAttributionJob;

ULONG EffectiveLimitFlags;

ULONG EffectiveSchedulingClass;

ULONG EffectiveFreezeCount;

ULONG EffectiveBackgroundCount;

ULONG EffectiveSwapCount;

ULONG EffectiveNotificationLimitCount;

UCHAR EffectivePriorityClass;

UCHAR PriorityClass;

UCHAR NestingDepth;

UCHAR Reserved1 [2];

UCHAR Reserved1 [1];

ULONG CompletionFilter;

union {
    WNF_STATE_NAME WakeChannel;
    PS_WAKE_INFORMATION WakeInfo;
};

JOBOBJECT_WAKE_FILTER WakeFilter;

ULONG LowEdgeLatchFilter;

ULONG OwnedHighEdgeFilters;

EJOB *NotificationLink;

SIZE_T CurrentJobMemoryUsed;

ULONGLONG CurrentJobMemoryUsed;

JOB_NOTIFICATION_INFO *NotificationInfo;

PVOID NotificationInfoQuotaReference;

IO_MINI_COMPLETION_PACKET_USER *NotificationPacket;

JOB_CPU_RATE_CONTROL *CpuRateControl;

PVOID EffectiveSchedulingGroup;

ULONGLONG ReadyTime;

FAST_MUTEX MemoryLimitsLock;

EX_PUSH_LOCK MemoryLimitsLock;

LIST_ENTRY JobSetLinks;

ULONG MemberLevel;

LIST_ENTRY SiblingJobLinks;

LIST_ENTRY ChildJobListHead;

EJOB *ParentJob;

EJOB *ParentSilo;

EJOB * volatile RootJob;

LIST_ENTRY IteratorListHead;

ULONG_PTR AncestorCount;

EJOB **Ancestors;

union {
    EJOB *Ancestors;
    PVOID SessionObject;
};

ULONG_PTR TimerListLock;

LIST_ENTRY TimerListHead;

EPROCESS_VALUES Accounting;

ULONG ShadowActiveProcessCount;

ULONG ActiveAuxiliaryProcessCount;

ULONG SequenceNumber;

ULONG_PTR TimerListLock;

LIST_ENTRY TimerListHead;

ULONG JobId;

GUID ContainerId;

GUID ContainerTelemetryId;

ESILO *Container;

SILO_CONTEXT *Container;

ESERVERSILO_GLOBALS *ServerSiloGlobals;

PS_PROPERTY_SET PropertySet;

PSP_STORAGE *Storage;

JOB_NET_RATE_CONTROL *NetRateControl;

JOB_IO_RATE_CONTROL *IoRateControl;

ULONG JobFlags;

union {
    ULONG JobFlags;
    struct {
        /*  changing bit fields, follow link  */
    };
};

union {
    ULONG JobFlags2;
    struct {
        /*  changing bit fields, follow link  */
    };
};

ULONG EffectiveHighEdgeFilters;

PROCESS_ENERGY_VALUES *EnergyValues;

ULONG_PTR volatile SharedCommitCharge;

EJOB * volatile WakeRoot;

ULONG DiskIoAttributionUserRefCount;

ULONG DiskIoAttributionRefCount;

union {
    PVOID DiskIoAttributionContext;
    EJOB *DiskIoAttributionOwnerJob;
};

JOB_RATE_CONTROL_HEADER IoRateControlHeader;

PS_IO_CONTROL_ENTRY GlobalIoControl;

LONG volatile VolumeIoControlLock;

LONG volatile IoControlStateLock;

RTL_RB_TREE VolumeIoControlTree;

ULONGLONG IoRateOverQuotaHistory;

ULONG IoRateCurrentGeneration;

ULONG IoRateLastQueryGeneration;

ULONG IoRateGenerationLength;

ULONG IoRateOverQuotaNotifySequenceId;

ULONGLONG LastThrottledIoTime;

EX_PUSH_LOCK IoControlLock;

ULONG SiloHardReferenceCount;

WORK_QUEUE_ITEM RundownWorkItem;

PVOID MemoryPartitionObject;

PVOID PartitionObject;

EJOB *PartitionOwnerJob;

JOBOBJECT_ENERGY_TRACKING_STATE EnergyTrackingState;

ULONGLONG KernelWaitTime;

ULONGLONG UserWaitTime;