[Autogenerated] now that we have our project build.
Let's try this out.
I'm going to add a breakpoint here by clicking on the left margin here.
You can also press F nine to create a break point and then just press this
local Windows debugger button or press F five to run with debugger see
what's going on while we're running this code.
And so in the meantime,
we can go ahead and open Ports Explorer until we get to that break point.
Let me open ports Explorer here and see what we get.
Once we have The uh process running and hitting our break point,
I'm going to just do some customization here because it's
a new virtual machine here and here.
We've hit the breakpoint in the meantime.
Okay, fine.
So we have name here is being note that want to create a note that process.
Let's see what happens when I press F10 to step over this line of code.
So here's F 10 and it's loading some symbols into visual student.
That's what it's taking a few seconds to move to the next line.
In the meantime, I'll just do some sorting here.
We should find notes but already here somewhere.
Well actually uh we should be finding that pretty soon until we get the
symbols properly loaded so the actual line can really execute.
So you can see the students downloading symbols which perhaps should
have done previously before starting this recording.
But anyway, once it's done, we'll get to the instruction being executed.
So it might take a few more seconds let me pause the
recording while it's loading more symbols.
Okay you can see that Notepad has been created and shown right here and
we got a successful status here from create process.
Let's see what happens when we print the information
here that we get from creative process.
So let's display the values here.
We can also look at them in the debugger like like
so so you can see the process I.
D.
In the thread.
IDE let me just press control, shift escape very quickly to open task manager.
You notice task manager has changed,
this is the 22 H two version of Windows 11 that has a revamped task
manager which you may or may not like depending on your perspective one
of the features there is the ability to have a dark this is what we see
exactly here so if I look out not look up Notepad here you can see the
process that is in fact 1 to 188 which is exactly what we see here inside
the console itself.
And of course the process in the debugger that's 1 to
188 if you want to see the thread,
I didn't correlate that to the first thread in the Notepad
process of course task measure is not good enough for that we
have to go to process Explorer.
So here's our Notepad if I double click here we should be able to see the list
of threads And you can see the first thread has the threat i.
12204.
That's exactly the first thread in notepad as we as we expect.
You'll notice that of course not that might have more threats there,
but at least that thread is the first one that has been created in the process.
The other thing which is interesting if you go back to
explore and look at our creator process,
the creative process has the image name,
create process.
If you look at the handles here at the bottom,
let me just add the handle value and some other information here.
And so we can see if I just to move the handle perhaps all the
way to the left to make it a bit easier.
We should find the handles in the handle table of this process.
So looking at the process information again we can see we have two
handles here with the value to E four and to be seen.
So these two handles should be part of the create process handle table and
they should point to the Notepad process and thread.
So let's go here and look for these numbers.
So you can see here that we have the process handled here with the value to 84.
That's the value we see here.
Let me just open that up right here so we have to E
four as the process handle and two B.
C.
As the thread handle.
So going back to two B.
C.
Let me just sort by handled value to be, make it a bit easier.
So here's to B.
C.
Here's our Notepad thread handle.
Process is nice enough to show us this information and you also notice that the
access mask is showing us thread all access and process all access meaning we
can do anything we want with this process or threat.
So this point Notepad is running is behaving in its normal
Notepad the way everything is kind of normal.
What would happen if I go ahead and close the handles here,
which I'm about to do right now.
Let me go back to process Explorer.
Make it always on top so you can see that at all times
and watch these two handles there.
So we have these two handles right here.
Let me press F 10 to move to the next line and you'll notice
that the process handle has been closed and been removed from
the handle table of the process.
Let me make it a bit easier to see by changing the highlight duration
to three seconds for these red and green colors.
Let's do f 10.
Once again you can see the thread handle goes away as well.
So we've closed the handles to this process and thread but
of course Notepad is not dead at all.
Not but is still running and normally because they're still
references to this process held on by the kernel.
It just means that because I close these handles,
I no longer as the creative process have direct
access to this process or thread.
If I would like to get that,
I would have to work harder by perhaps calling the open process function and
trying to obtain another handle to the existing process.
But the creator, when it's creating a new process,
actually gets these two handles which are all powerful,
they can do anything they want it wants with these two handles.
So this point we can continue running and we're done the the creative
process is no longer running but of course not.
That is still very much alive.
And by the way,
if I go to task manager or process explorer for that matter and and go
to the columns and select the base priority column,
you'll find that the base priority is not actually normal,
but in fact it's hi this is because of the flag we use here.
The high priority class flag to use higher priority for this.
A Notepad process,
that's a very simple example to show us what happens
when process gets created successfully.
What happens if this fails?
Let's see what happens in that case let me change Notepad here to
something like Notepad one and it is unlikely I have any executable
called Notepad one in one of the search locations.
So let's see what happens when I call the create process function of
press the five again to launch this process another time you can see
here that success is returned as zero,
which means failure and so we get to the else close where we
can see the reason the function has failed.
And although we can display this number that get that information,
it's also possible to get that very quickly from the
debugger but using the E r r pseudo variable,
you can put that in the watch window.
This is a variable that is always available in the debugger and
essentially brings back whatever get last error returns.
You can see the error here,
is there number two and to figure out what to means we can use several tools.
One of them is going to the tools menu.
There is a simple tool here called Air look up which you can use to
just punch some error number like to impress,
enter it will give you a textual description of the error.
In this case the system cannot find the file specified
which of course is exactly correct.
It's also possible to use visual student to provide that information by
adding comma H R to the eight er are variable and this provides a textual
description which is essentially the same you can see here uh in fact number
two has changed to a row finally found which is the actual constant in the
windows API constants for this error,
which it's just the value to and you can see the textual description here.
H r by the way stands for each result,
which is the component object model or com H result type,
which is in this case.
Not really that,
but this same extension is used here by Visual Studio to
display the information in textual form without us having
to launch any additional tools.
We can also use the bank Air command in the Wind debug debugger to provide
that kind of get the same kind of textual descriptions.
Obviously this failed,
I can use F 10 to just show that number two has been
written here and nope process being created,
you can see the process information structure is completely zeroed out.
There is no handle there or handles.
There's nothing the process creation in this case failed
because of a very simple error providing not a very good
executable name in the next video.
I want to extend this demo a little bit further to show you a few
more details that we can grab from the create process function and
what we can do with these handles.
We got back