[Autogenerated] So the process command is very useful for looking
at processes but sometimes you want to see more details that the
process command just doesn't show.
There's so many details inside any process data structure.
There's no way a single command can show everything.
So it's always possible to examine the actual data structure behind the seat.
So here are a few examples of some window gone processes here.
I'm going to grab one of those and use the normal DT command
we've seen already with the process data structure and paste in
the address of one of these processes.
What we get is the data structure with values for this process object and you
can see here that the first member is in fact the PCB member which is of type
underscore K process as we mentioned already,
the first member of the process is always a K process And then we have
other members which are not officially documented,
but many of them Are fairly easily understood because they're fairly intuitive.
For example, the unique process idea here is 1670,
which is exactly the client idea here that we see
provided by the process command.
So that's where the process it is actually held
inside the process data structure.
Then we can see active process links This is the data structure that points
forward and backwards to the next and previous process.
In the global list of processes in the system.
We'll examine the least entry structure and momentarily and
then we have many other members like I said,
they are not documented,
but some of them can definitely help us understand certain things.
We can see a bunch of flags here,
so see flags to here is something that has that some kind of value.
But then we have the the flags actually specified here explicitly
noticed there in the same location in memory.
They're in the same offset, which means we have a union here.
Flags too is like the entire set of flags and then we have a bunch of more
specific flags that are defined in in perhaps the header file provided
internally that Microsoft is using that has this as as as bits as as a bit
set within this uh data structure by the way,
the prefix zero,
Y means binary and this is another way you can talk
to win debug in terms of numbers, you can use zero,
y as a prefix to specify numbers in binary.
So anything that can be displayed directly is simply displayed.
Anything that cannot because it's more complex is
provided with these extra links.
So this D M L links will just look at the data structure in question.
So for example, we have something here called clone route, whatever that means.
If I click that, we can see that it is something called R t L balance note,
we can continue with that.
Well actually there's not much else to go here because it's actually now but if
it had some kind of value which was known now we could continue navigating the
data structures as we've seen in earlier examples.
And you notice that again.
The DX command is used here for that purpose.
Going back to the D T command here, we can definitely use the X.
So the X is the more modern command that allows us to to view um
or to look at expressions using C++ index,
which usually is more convenient.
So if I try to do something like this to cast this as a pointed to an E process,
we can see that something doesn't work right?
And that's because I have to specify a prefix here,
if I do that,
it still doesn't work right because it doesn't understand what an E process is.
That's because the the ex command is picky about lowercase and
it requires the case to be exactly correct.
Whereas the DT command is more forgiving and does a case
insensitive search in terms of types so if we do that we should
get something very similar although the output of the X is
slightly different in its formatting,
it still provides the same information obviously because it is
the same data structure under the covers.
So you can see here the case process again and here's the unique
process ID showing a bit differently and just like DT if you have
something which is appointed to something or bigger structure that can
be displayed using the single line,
you have these links that will use the DX command again to
navigate further into the data structure here.
You can see more precision the actual bits that are used by the by the
beat set within um within this Flags member here.
So you can see the actual bits in perhaps a more
convenient way and so on and so forth.
We can move forward or backwards anyway.
You want.
Now I mentioned that all the processes are linked together
using this data structure called list entry.
So here's what list entry looks like in general,
it just contains these two pointers called F link and billing
for forward link and backwards link there pointing to the next
item in line and the previous item.
But notice there's no actual data here.
That is interesting which means that this is always embedded in the largest
structure such as a new process and it points to its sibling,
it's friends, so to speak in the next process in the previous process.
And so the head of all the processes is provided by a
global variable called active process.
Head and notice that wind debugs supports.
Tab completion for commands and for symbols it's aware of display what that is.
We get some address and then I can go ahead and use the D T
command using that least entry thing for example.
And look at what we have here.
This is the head pointing to the first process.
This should be the first process.
So let's see if I grab this address and provide that to the process command.
What am I going to get here?
It goes, I get nothing.
I get an error.
And the process command just like the PB command we've
seen earlier is a smart command.
It tries to figure out whether what it's looking at is in
actuality a process object and it says, well it is not a process object.
So what's the problem here?
And the problem is that?
Well,
maybe you should pause the video and try to figure
out what the issue here might be.
So here's what's going on.
This pointer points to the next list entry in the next process is not
going to point to the beginning of the process.
If you go to the process,
you can see that and I mentioned that the links that are
used to connect the previous next process are in this
member called Active process links.
So essentially these pointers point to the next item to the active process
links in the next process And on this particular site system is 448 hex
bite from the beginning of the actual process.
And so to make this command work correctly,
actually have to subtract 448 to get the beginning of that process.
And this should give us the first process in the
system which is the system process.
We can of course continue with that F link and continue looking at the
next process here and do exactly the same thing by using the process
command and and subtracting the same offsets,
always going to be the same offset for any process data structure
on this kind of system and see what that is.
So this is the next process called secure system and so on.
We can continue with the same idea here and of
course we can use the power of wind,
debug scripting to automate these things if you wanted to
look at all the processes in the system.
By the way,
there are other ways of working with the debugger today
which go beyond the simple commands.
In fact, the ex command is not as simple as it might appear,
it actually has access to the debugger data model.
You can see that here using when we look at the wynn debug preview,
there's something here called model which can show you the debugger
object model in this case for kernel session,
so we have a single session here and here we go,
can see a bunch of processes and each process has a bunch of
properties here and and so on and so forth.
And so we can use that in fact not just by browsing here in the
in the ui we can also use that to our advantage by performing
some things which are more complex.
So if I just stop here,
we have the ______ and we have sessions of course there's just one,
there's also a pseudo variable that allows you to get
to the current session very quickly,
then you can go to processes and the way this works that these
expressions are used the same syntax as language integrated
query or link expressions in C# Yes, I know it sounds weird,
but this is exact how it works is the same syntax used by C# So if you,
if you are familiar with Link in C Sharp,
you'll feel right at home.
So for example, I can say I don't want all the processes,
I only want the processes with certain with certain characteristics,
like a name that starts with, let's say E X P or something like this.
Maybe like Explorer,
then if I do something like this will get only the processes that
actually have this name that start with E X P.
As you can see that we explore instances here which
are the only ones start with E X P.
And so this is a lambda expression in C Sharp and of course I won't be
able to cover these things in detail but of course it's all documented
and it's mostly geared towards who those who have some experience with
link expressions in C Sharp, we can definitely use that in in different ways.
We can continue by doing things like order by performing a sorting.
So I can do something like order by the I.
D.
Of a process.
Let's just do something like order by descending,
for instance,
in order for us to uh to perform the the sorting from the highest to the lowest.
So if I try that we'll find that we get the information in reverse order here.
Notice the process ideas and of course clicking all these things provide
all the details that we need for that particular process.
We can even switch to which is the same,
is like using the dot process command to make that process the current.
So I can do very interesting things here by looking at the object model here.
Um and there are many link operators that are supported out of the box
here by the debugger and something you might want to invest in
learning if you're going to use a lot of Wind,
debug and do some clever things or try to find things in a more complex way
that the normal commands are not really powerful enough to do.
So all the processes in the system are stored with this link list and that
linked list is also circular which means that the last process points back to
the head and um I can definitely try that out.
Maybe write some some code here using the javascript engine or the
javascript language that is supported today by the scripting engine
in Windy bug and win debug preview