Windows via C/C ++ Study Notes-Process

From Chapter 4, the "process" is started ".

For processes, the following definition is provided: "process" is an "instance" of a running program and a "Container" of "Thread ". It contains two parts: the operating system is used to manage a kernel object of the process and a "address space" that contains code and data with executable modules or DLL modules and space allocated by dynamic memory ".

A process is only a container, so the process is "inactive". We can learn it as only a container. As a container, we should consider how to create this container, manage the container and destroy the container.

There are one or more threads in the process. When a process is created, the main thread of the process is also created. That is to say, a process includes at least one main thread.

When multiple threads are executing a process, the Windows operating system uses the time slice method to allocate these threads to the CPU for scheduling, that is, each thread obtains a certain CPU scheduling time in turn to execute related operations.

 

An entry function is required when a C/C ++ program is running. By default, four functions are available: winmain, wwinmain, main, and wmain. The first two functions can be replaced by _ twinmain, which is the main function of GUI (graphical user interface). The last two functions can be replaced by _ tmain, which is the main function of Cui (console user interface. W indicates the Unicode version, and W indicates the normal ANSI version. The linker checks the link switch and determines whether to call the GUI or Cui main function.

 

After a program is executed, we can use the "getstartupinfo function" to obtain the startup information of the process. Its parameter is a "pointer to the startupinfo structure". To use this function, you must set the size of the CB field of startupinfo to sizeof (startupinfo) before passing its address to the getstartupinfo function to obtain the process startup information.

Each executable program or DLL file is loaded into the memory and assigned a unique "instance handle" to identify them. This instance handle is the hinstance parameter passed to the (w) winmain main function. This instance handle is the "base address" of the executable program ". Some API functions also need a hmoudle module handle to run as parameters. In 32-bit and 32-bit systems, hinstance and hmoudle are two identical types, with no difference, you can use the "getmodulehandle function" to obtain the instance handle (module handle) of a program ).

 

When creating a process, Microsoft provides us with a greateprocess () function, which returns a process kernel object handle, which allows us to conveniently manage the process container. However, just like a bucket, a container is large, small, and has different shapes. Naturally, creating a specific process also involves these properties. Therefore, when creating a bucket, microsoft provides various parameters for us. For various attributes, we can use the get * function to get the settings through Set.

 

The following four methods are provided to terminate a process:

1. The main thread enters the vertex function and returns automatically;

2. Call the exitprocess (uint) function in this process and pass a return code to it to end the process;

3. Call the terminateprocess (handle, uint) function in the current process or other processes and pass a process handle and a return code to it to end the process identified by the handle, the return code of the terminated process is the return code passed to the function;

4. All threads in the process are automatically terminated, which rarely happens.

We recommend that you use the following 1st methods: the entry point function of the main thread is returned.

 

In chapter 4, the things are very basic, and the UAC mechanism (user access control, which needs to be considered in Windows Vista) is also mentioned later. Because the UAC mechanism cannot be fully understood, it will be summarized later.