Microsoft® Windows® 2000 Security Handbook

Processes

Think of a process as an execution environment. A process contains all the information that allows programs to execute instructions. These include the following:

• The location(s) of the program code

• The location(s) of data the program is accessing

• Various state information

• Security information

• Performance counters

... and the list goes on. The important thing to keep in mind for now is that a process is just an environment. A process in and of itself executes nothing; rather, it just owns some memory and knows where some code and data is.

Using DEPENDS.EXE, I'll look at the functions exported by KERNEL32.DLL (recall from Chapter 1 that KERNEL32.DLL is one of several Win32 DLLs that translate documented calls into [undocumented] system service ...