Windows kernel theory research-process creation

The process is probably the largest part of a user's exposure to a Windows system, and for Windows systems, a process is a separate address space that provides a separate execution environment for the thread.

Other words

Process =

• Stand-alone address space
• A Process Kernel object

Thread =

• A thread of its own stack
• A thread kernel object

Of course, this stack is in the address space of the process. So, the thread is the real "work" thing, the process is just a collection of some resources. Can only be said to be "raw materials."

Before I learned the Windows kernel, I always felt that the various features of the process were magical, such as how do address space independence be implemented? Our computer uses the same piece of memory how can we achieve independence?

How, for example, do processes manage and implement those functions? These questions with my learning process is not reduced, especially when I touch the user layer of some security knowledge, for example: Game plug-in,

Plug-in itself is a process, it is going to read the game process data, that is, across the process. But how did this come true?

In fact, the answers to all the questions can be found in the kernel, because the kernel is the manager of the real thing. We just have to know what the kernel is doing and all the problems are solved.

In fact, the Windows Process Manager is in the Windows kernel execution body, the process manager does not actually exist such a "thing", so-called Manager refers to a series of functions and the abstract collection of programs.

Let me ask you a few questions and then answer these questions to describe how the Windows system operates the process.

1. For the first time in everything, how did the first process in the Windows system create? or without a process, how does the system create the process? In fact, this involves the knowledge of system initialization.
2. How is the process created? How does the system manage the process?

It is important to note that creating a process is a series of tasks rather than creating the process alone. For example, I double-click the Notepad program, the process is running up. Run up contains threads created, modules loaded, and so on.

Mention the creation process, as long as the person who has been in touch with Windows programming will think of the CreateProcess function, people familiar with driver development will also know the ntcreateprocess function, which is one of the important functions of process creation, attention is one. The reason for this is that the creation process is a series of processes and not just a new process structure.

Windows kernel theory research-process creation