Page directories are covered in Chapter 9, and kernel thread blocks are described in more detail later in this chapter. The PEB, which lives in the user process address space, contains information needed by the image loader, the heap manager, and other Windows system DLLs that need to access it from user mode. The basic structure of the PEB is illustrated in Figure and is explained in more detail later in this chapter. You can dump the PEB structure with the!
To get the address of the PEB, use the! A few key kernel global variables that relate to processes are listed in Table These variables are referred to later in the chapter, when the steps in creating a process are described. Pointer to the process block of the initial system process that contains the system threads.
Array of callback objects describing the routines to be called on process creation and deletion maximum of eight. Count of registered extended process notification routines. Array of callback objects describing the routines to be called on image load maximum of eight.
Mask for quickly checking whether any extended or standard notification routines are enabled. Windows maintains a number of counters with which you can track the processes running on your system; you can retrieve these counters programmatically or view them with the Performance tool.
Table lists the performance counters relevant to processes. Describes the percentage of time that the threads in the process have run in kernel mode during a specified interval. Describes the percentage of CPU time that the threads in the process have used during a specified interval. Describes the percentage of time that the threads in the process have run in user mode during a specified interval.
Describes the total elapsed time in seconds since this process was created. Returns the process ID. This ID applies only while the process exists because process IDs are reused. Returns the process ID of the creating process. For reference purposes, some of the Windows functions that apply to processes are described in Table Creates a new process and thread with the specified alternate security token. Creates a new process and thread to run under the credentials of the specified username and password.
Creates a new process and thread with the specified alternate security token, with additional options such as allowing the user profile to be loaded. Returns the exit code for a process, indicating how and why the process shut down.
Returns a pointer to the command-line string passed to the current process. Returns the full name of the executable image associated with the process. Returns the major and minor versions of the Windows version on which the specified process expects to run. Defines the shutdown priority and number of retries for the current process.
Specifies whether the process is aware of dots per inch DPI settings. The kernel debugger! This output is arranged in two parts for each process. After the basic process output comes a list of the threads in the process. Other commands that display process information include! Process and thread security structures are described in Chapter 6.
Windows Internals, 5th Edition. Windows Internals, Part 2, 6th Edition. Windows 7 Inside Out, Deluxe Edition. Sign in. Your cart. Page 1 of 9 Next. In this chapter from Windows Internals, 5th Edition , learn the data structures and algorithms that deal with processes, threads, and jobs in the Windows operating system.
The first section focuses on the internal structures that make up a process. The second section outlines the steps involved in creating a process and its initial thread. The internals of threads and thread scheduling are then described. Windows implements a priority-driven, preemptive scheduling system - at least one of the highest-priority runnable ready threads always runs, with the caveat that certain high-priority threads ready to run might be limited by the processors on which they might be allowed or preferred to run, a phenomenom called processor affinity.
Was this reply helpful? Yes No. Sorry this didn't help. Thanks for your feedback. This thread is locked. You can follow the question or vote as helpful, but you cannot reply to this thread. I have the same question
0コメント