Introduction

A Windows process is one of the most important concepts to understand before working with the WinAPI, process memory, DLL loading, shellcode execution, process injection, debugging, or malware analysis.

At a high level, a process is a running instance of a program. For example, launching notepad.exe creates a process for Notepad. Launching two separate Notepad windows usually creates two separate processes, even though both processes are backed by the same executable file on disk.

A process is not only the executable code. It is a container that includes several runtime resources, such as:

• A private virtual address space.
• One or more threads.
• A handle table.
• A security token.
• Loaded modules, such as EXEs and DLLs.
• Environment variables and command-line parameters.
• Heaps, stacks, mapped files, and other memory regions.

Understanding how these pieces fit together is necessary before working with more advanced Windows internals.

User vs Kernel Modes View of a Process

Knowing that Windows consists of two components: kernel mode and user mode, it is important to understand how each of these layers views and represents a process. From user mode, a process can be thought of as a container that owns and manages resources required by the application. Some of the most important user-mode components of a process include:

• Virtual Address Space - The range of virtual memory addresses available to a process. Each process has its own private virtual address space, which contains its code, data, stacks, heaps, loaded modules, and other memory regions.
• Threads - The units of execution inside a process. A process does not execute code directly; its threads execute code within the process's virtual address space.
• Loaded Modules - Executable images loaded into the process address space. This includes the main executable file and any loaded DLLs.
• Heaps - Memory regions used for dynamic memory allocations. A process has at least one default heap and may also have additional private heaps created by the application or by loaded DLLs.
• Stacks - Per-thread memory regions used to store function call information, local variables, return addresses, and other temporary execution data.
• Handle Table - A per-process table used to track handles opened by the process. Handles allow a process to reference Windows objects such as files, threads, processes, registry keys, events, mutexes, and sections.