Comment Feed for Channel 9 - Arun Kishan - Process Management in Windows Vista http://ecn.channel9.msdn.com/o9/previewImages/100/228723_100x75.jpg Channel 9 - Arun Kishan - Process Management in Windows Vista Ever wonder how threads and processes are managed in Windows? What's new in Windows Vista in terms of Process Management? Vista introduces a new type of process called a protected process. What are "protected processes"? How do they work? What's a Process, anyway? A thread? Here, Arun Kishan, the developer who works on Windows' Process Manager sub-component talks about all this and more. If you want to learn how processing happens in Windows, then watch this video.Check out Arun's whitepaper on Protected Processes. en Sat, 18 May 2013 23:55:26 GMT Sat, 18 May 2013 23:55:26 GMT Rev9 Re: Arun Kishan - Process Management in Windows Vista
Good stuff

posted by Cyonix

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936002470000000 Mon, 11 Sep 2006 19:37:27 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936002470000000 Cyonix Re: Arun Kishan - Process Management in Windows Vista
I can see how this might work for explicit waits (Sleep, WaitForSingleObjectEx) since you already have handing for being interrupted by APCs there in the form of alertable waits, but what about in the general case of e.g. ReadFile? Does your explanation imply that there a way to cause arbitrary kernel functions to unwind instantly without corrupting internal kernel state, or do you just wait for all such calls to terminate naturally before doing the cleanup just before the kernel -> user transition as normal? But in the case of long running calls kernel mode functions I could see that being a problem..

Thanks in advance!

BSP

posted by batterseapower

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936106350000000 Mon, 11 Sep 2006 22:30:35 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936106350000000 batterseapower Re: Arun Kishan - Process Management in Windows Vista Thanks for this video. It helped me understand how windows manages threads that I program in my apps. Great video. Keep it up.

posted by SecretSoftware

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936143410000000 Mon, 11 Sep 2006 23:32:21 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936143410000000 SecretSoftware Re: Arun Kishan - Process Management in Windows Vista
Threads only ever "die" on the return to user mode. For the same reason, system threads cannot be terminated. Instead, they must voluntarily exit (direct call to terminate), or exit their main routine. Most kernel code will continue to run uninterrupted, however, the assumption is that unbounded kernel-mode waits, etc. should not be easily controllable by a user. User-mode waits, however, are instantly aborted in the kernel once the kernel-mode half of the terminate APC is delivered.

You are absolutely right that long running kernel code, or code running with APCs disabled in kernel, will not take the kernel APC or will otherwise not terminate immediately. So TerminateThread really ensures that the target will no longer run in usermode, not that it will instantly unwind its kernel state and exit. I was only trying to stress that the mechanism is designed to ensure kernel state is unwound rather than exiting in place.

posted by arunki

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936197710000000 Tue, 12 Sep 2006 01:02:51 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936197710000000 arunki Re: Arun Kishan - Process Management in Windows Vista

posted by Alexis

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936322350000000 Tue, 12 Sep 2006 04:30:35 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936322350000000 Alexis Re: Arun Kishan - Process Management in Windows Vista
Alexis wrote:
Hey, the link to the whitepaper does not work.


Fixed. Thanks for pointing that out...
C

posted by Charles

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936335830000000 Tue, 12 Sep 2006 04:53:03 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936335830000000 Charles Re: Arun Kishan - Process Management in Windows Vista
1)  About code injection: crackers and hackers now , cannot do code injection into running processes? Like dll injection will fail? Will this also affect global system hooks? like mouse hook and the likes?

how is that actually good?



2) What happens when the system is low on threads? when you do something like, QueueWorkItem, and use the system threads to do work in your application, and you "abuse this", in a server application, what would happen to the system at this stage when its under stress? Does it shutdown? or just queues the new work items until an existing system thread is free to process it? Can a new thread be created and added to the system thread pool/ Is this actually a good thing or a bad thing for a uniprocessor system?

3) Is it actually good to use the system thread pool or to create a new unique thread for your specific application? 

posted by SecretSoftware

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936353110000000 Tue, 12 Sep 2006 05:21:51 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936353110000000 SecretSoftware Re: Arun Kishan - Process Management in Windows Vista
2) There is no one-one mapping between work items and threads. Work queues and the threadpool try to manage the number of threads based on the workload / CPU availability. For example, the Vista threadpool tries to keep # CPU threads running, but will throttle threads back when it detects this number has been exceeded. Additional threads are created as needed in this range; the excess work items accumulate and are serviced by threads as they become available.

3) It depends on your application. If it is a piece of code you just want to execute asynchronously, threadpool provides an efficient and simple means of accomplishing this. It does, however, introduce additional overhead. In other cases, you may need a dedicated thread for a task whose operation / life cycle you may need finer grained control over.

posted by arunki

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936446430000000 Tue, 12 Sep 2006 07:57:23 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936446430000000 arunki Re: Arun Kishan - Process Management in Windows Vista

posted by LiQ

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936596960000000 Tue, 12 Sep 2006 12:08:16 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936596960000000 LiQ Re: Arun Kishan - Process Management in Windows Vista
arunki wrote:
1) Code injection is only limited for the protected processes, which are not meant to provide arbitrary extensibility by design. These processes can only load specially digitally signed code. The goal is to limit what can run inside them.

2) There is no one-one mapping between work items and threads. Work queues and the threadpool try to manage the number of threads based on the workload / CPU availability. For example, the Vista threadpool tries to keep # CPU threads running, but will throttle threads back when it detects this number has been exceeded. Additional threads are created as needed in this range; the excess work items accumulate and are serviced by threads as they become available.

3) It depends on your application. If it is a piece of code you just want to execute asynchronously, threadpool provides an efficient and simple means of accomplishing this. It does, however, introduce additional overhead. In other cases, you may need a dedicated thread for a task whose operation / life cycle you may need finer grained control over.




Thanks for the reply. I like the new protected process with in vista. But I wish if we can have examples as to how to create a protected process using Visual Studio 2005 in C#. Like an introduction as to how to create a protected application.

Also, in the video , it was mentioned that the END PROCESS api will just kill of the process on the spot and this should be used only as a last measure, and if we know the state the process is in (most of us dont know that because we did not write the application that might go on a loop or hangs). But there are "Service" processes that simply refuse to be killed. You often get "Access denied" or something along those words. Can you explain that?

posted by SecretSoftware

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936750630000000 Tue, 12 Sep 2006 16:24:23 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632936750630000000 SecretSoftware Re: Arun Kishan - Process Management in Windows Vista Great and detailed on Porcess/Thread. I have been using threads in user mode and it is nice to know more about the implementation of process/thread in O/S. I am not sure if I understand 100% about the subject(s) (I probably need to revisit the clip again). One thing I don't get it is system process (pid = 4) and system idle process. How they are related and who got created first?

 

 

Thanks

posted by nativecpp

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632939472830000000 Fri, 15 Sep 2006 20:01:23 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632939472830000000 nativecpp Re: Arun Kishan - Process Management in Windows Vista This was great. I had been wondering how this worked for quite some time.

posted by Whoa

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632950854790000000 Fri, 29 Sep 2006 00:11:19 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c632950854790000000 Whoa Re: Arun Kishan - Process Management in Windows Vista
Thanks and regards,
Pranav

posted by pranavpeshwe

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633059171320000000 Thu, 01 Feb 2007 08:58:52 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633059171320000000 pranavpeshwe Re: Arun Kishan - Process Management in Windows Vista posted by svm

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633334820640000000 Mon, 17 Dec 2007 09:54:24 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633334820640000000 svm Re: Arun Kishan - Process Management in Windows Vista process management in windows vista i need to make a written project on this...plzz help...

posted by shibz

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633859984540000000 Sun, 16 Aug 2009 05:47:34 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633859984540000000 shibz Re: Arun Kishan - Process Management in Windows Vista Hi Arun,

 

Great video!!

 

I would like some clarifications on Terminate and SuspendThread - specifically when thread is executing in kernel.

 

You mentioned that terminate kicks the thread out of waits. Is that true only of UserMode waits or also of KernelMode waits? If it is true of KernelMode waits, does it bring it out both alertable and non-alterable or only alertable?
 
What are the mechanics of suspend? Does it also involve a kernel apc which queues a user apc which executes only when thread unwinds from kernel? Or in case of suspend does kernel apc itself suspend the thread?
Thanks,
Praveen

posted by PraveenRao

]]> http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633991394710000000 Fri, 15 Jan 2010 08:04:31 GMT http://channel9.msdn.com/Shows/Going+Deep/Arun-Kishan-Process-Management-in-Windows-Vista#c633991394710000000 PraveenRao