Chapter 9 · Processes

Knowledge Check

9 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What is the difference between a program and a process?
  2. Which part of a process actually gets CPU time: the process or its threads?
  3. What does Windows keep in the EPROCESS record?
  4. What is a PID, and can it be reused?
  5. What is a handle, and why is it not a memory address?
  6. What does an exit code of 0 usually mean?
  7. Does Windows have fork? How does it make a new process?
  8. Name the main process states and say which one uses the CPU.
  9. What is a DLL?
  10. Which IPC method is the fastest, and why?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. Program vs process

A program is a file on disk (passive). A process is a running program plus its memory, threads and handles (active). One program can make many processes.

2. CPU time

Threads. The scheduler gives CPU time to threads. The process is just the container that owns memory and handles.

3. EPROCESS

The kernel's record of the process: its ID, memory map (address space), handle table, list of threads, security token, parent ID and more.

4. PID

A number that names a process while it exists. Yes, it can be reused after the process is gone and nobody holds a handle to it.

5. Handle

A small number that stands for a kernel object (file, thread, process...) in one process's handle table. It is not an address, because the objects live in protected kernel memory and the kernel must check access on each use.

6. Exit code 0

Success: the program finished without a problem. Other numbers usually mean an error or a special result.

7. Fork

No. Windows builds a fresh, empty process with CreateProcess and loads the program into it, instead of copying the parent.

8. States

New, Ready, Running, Waiting (blocked), Terminated. Only Running uses a CPU core.

9. DLL

A Dynamic-Link Library: a file of shared code (functions) that many programs borrow at load time or run time.

10. Fastest IPC

Shared memory: two processes see the same real RAM, so there is no copying.

UNDERSTANDING QUESTIONS

Q1. Why does Windows give every process its own virtual address space?

Answer So one process cannot read or damage another's memory. A crash stays inside one process, a web page cannot spy on a password manager, and every program can behave as if it owned the whole machine. The kernel translates each process's addresses to real RAM with its own page tables.

Q2. Why can a handle number such as 0x1A4 mean different things in two processes?

Answer Each process has its own handle table. A handle is only an index into that table. In one process `0x1A4` may point to a file, in another to an event, so a handle copied as a number into another process means nothing (unless it was inherited or duplicated on purpose).

Q3. Why is a blocked process good for performance?

Answer A blocked process uses no CPU while it waits for the disk, network or user. The scheduler can give the cores to ready threads. That is why a PC can have hundreds of open programs and still feel fast: most of them are blocked.

Q4. Why do ten programs that use kernel32.dll not need ten copies of it in RAM?

Answer The DLL's code is read-only, so Windows maps the **same real RAM pages** into every process that loads it. Only the DLL's changing data is private (copy-on-write). This saves a lot of memory.

Q5. Why is the parent process ID on Windows "only a note"?

Answer Windows records the creator's PID at creation but does not link the lives of the two. If the parent exits, the child keeps running and its recorded parent ID stays the same, with no re-parenting. The number may even match a new, unrelated process later if the PID is reused.

SCENARIO QUESTIONS (Troubleshooting)

S1. You close a program, but a file it used still says "in use by another program". What can you check?

Answer The program may have left a **child process** running (children keep running after the parent exits), which still holds the file handle. Check Task Manager's Details tab (and the Command line column) for leftovers and end them. Also check whether another program has the file open.

S2. A program's Memory (private working set) in Task Manager grows every minute and never falls. What does this suggest, and what is the quick fix?

Answer Likely a **memory leak**: it asks the heap for memory and never returns it. Restarting the program frees everything (Windows releases the whole address space when a process ends). The real fix is an update from the developer.

S3. A program's Handles column rises to tens of thousands and the program becomes unstable. What is happening?

Answer A **handle leak**: it opens files, events or other kernel objects and never calls CloseHandle. Restarting clears it. A developer would find the unclosed objects with a debugging tool.

S4. You killed a process with taskkill /F, but you lost unsaved work. Why?

Answer `/F` uses TerminateProcess: Windows stops the process at once, and the program has no chance to save or clean up. Try the polite close (without `/F`) first.

S5. A window says "Not responding", yet Task Manager shows the process using 0% CPU. What is likely going on?

Answer The program's window thread is probably **blocked**, waiting for something (a slow disk, a network share, a lock) and so is not handling window messages. Using 0% CPU matches a blocked state. Wait a bit; if it never returns, end the task.

INTERVIEW QUESTIONS

I1. Explain the difference between a process and a thread.

Answer A process owns resources: a private address space, handles, a security token. A thread is a path of execution inside it, with its own stack and registers, sharing the process's memory. The scheduler runs threads, not processes. A thread crash usually kills its process; a process crash does not affect other processes.

I2. Walk through what happens when you launch an application on Windows.

Answer A parent (such as Explorer) calls CreateProcess. Windows validates the PE file, creates the kernel process record (EPROCESS) and address space, maps the image and ntdll, creates the primary thread, sets up the environment (variables, folder, token, inherited handles). The loader then loads imported DLLs and runs their start-up code, and finally the program's entry point runs.

I3. How is process creation on Windows different from Linux?

Answer Linux uses fork (copy the parent) then exec (load a program). Windows has no fork: CreateProcess builds a new process directly from an executable. Windows also does not re-parent orphans, and a child's parent ID is just a recorded value.

I4. What are the main IPC mechanisms on Windows and when would you pick each?

Answer Pipes for simple byte streams (anonymous for parent and child, named for any process or across a network); sockets for network or loopback communication; shared memory for fast, large data (with synchronization); window messages and the clipboard for UI-level notes; RPC (and COM on top of it) for calling functions in another process. Choose by speed, scope (same PC or network) and complexity.

I5. What is a job object and why is it useful?

Answer A kernel object that groups processes. It can limit their memory, CPU time and process count, give group accounting, and kill all members at once (for example on job close). It solves the problem that Windows does not automatically kill a parent's children.

PRACTICAL TASK

Draw a "process family tree" of your own PC. Using the lab, open a PowerShell window, start two programs from it (for example Notepad and Calculator), then run the Get-CimInstance Win32_Process command to list ProcessId, ParentProcessId and Name. Draw the tree on paper with PIDs, starting from explorer.exe (or the shell) down to the programs. Mark any process whose parent PID matches nothing in the list.

Why This Matters

When something misbehaves, the tree shows who started what. You can find leftover helpers, see which program owns a rogue process, and understand why ending one process does or does not end the rest.

CHAPTER SUMMARY

  • A process is a running program with private memory, threads, handles and a security token. A thread runs the code; processes are isolated from each other.
  • Creation (CreateProcess): no fork; Windows builds an empty process, maps the PE image and ntdll, sets up the environment, creates the first thread and runs the entry point.
  • Termination: ExitProcess (normal), TerminateProcess (force), or an unhandled exception. Windows frees memory and handles; children and written files stay. The exit code is left behind.
  • Memory: a private virtual address space (image, DLLs, stacks per thread, heaps), isolation via page tables, privilege levels and page permissions.
  • PIDs and handles: PIDs name processes and can be reused; handles are per-process tickets to kernel objects, kept in a handle table and optionally inherited.
  • Environment: variables (copied), working folder, command line, user token, recorded parent.
  • States: new, ready, running, waiting (blocked), terminated, with a swapped-out variant when memory is short.
  • DLLs: shared code loaded at load time or run time, through import and export tables, relocated if not at the preferred base address.
  • IPC: pipes, sockets, shared memory, messages and clipboard, RPC.
  • Parent and child: the parent ID is only a record; orphans keep running; job objects group processes.
  • Previous: Chapter 3 — RAM and Memory Internals (for virtual memory background)
  • Next: the next chapter covers threads and scheduling in depth
  • Related: Chapter 9 Overview