Windows Internals • Process & Thread

Overview

In Windows, a process is an executing instance of an application, and a thread is the basic unit of execution within a process. This document describes the architecture, lifecycle, and key mechanisms that govern processes and threads in modern Windows operating systems.

Process Lifecycle▼
  1. CreateProcess – Kernel creates a process object, allocates address space, and loads the executable.
  2. Initial Thread – The primary thread is created and starts at the process entry point.
  3. Execution – Threads schedule on CPUs, interacting with system services.
  4. Termination – ExitProcess cleans up resources and notifies the kernel.
HANDLE hProcess = CreateProcess(
    L"C:\\Windows\\System32\\notepad.exe",
    NULL, NULL, NULL, FALSE,
    0, NULL, NULL, &si, &pi);
Thread Management▼

Threads are represented by ETHREAD structures in the kernel. Key APIs include:

  • CreateThread / _beginthreadex
  • TerminateThread
  • SuspendThread / ResumeThread
  • SetThreadPriority
DWORD WINAPI Worker(LPVOID param) {
    // Thread body
    return 0;
}
HANDLE hThread = CreateThread(NULL,0,Worker,NULL,0,NULL);
Scheduling & Priorities▼

Windows uses a preemptive, priority‑based scheduler. Each thread has a base priority (0‑31) and a dynamic priority adjusted by the kernel.

Priority ClassBase Priority Range
Idle1‑4
Below Normal6‑9
Normal8‑13
Above Normal10‑13
High13‑15
Realtime16‑31
Memory Layout▼

A process address space is divided into regions:

  • Code (Text)
  • Data (Initialized & Uninitialized)
  • Heap
  • Stack (per thread)
  • Mapped Images (DLLs)
  • Reserved/Guard pages
VirtualQueryEx(hProcess, addr, &info, sizeof(info));

Common APIs

FunctionDescription
OpenProcessObtain a handle to an existing process.
TerminateProcessForce termination of a process.
GetProcessIdRetrieve the PID of a process handle.
GetCurrentProcessIdReturn the PID of the calling process.
SetProcessAffinityMaskRestrict a process to specific CPUs.
CreateRemoteThreadInject a thread into another process.

Further Reading