[Autogenerated] let's begin with protected processes.
Protected processes started their life in the vista timeframe.
And the basic idea was to protect processes from
invasive access by any user mode process,
including processes running with admin privileges.
The basic reason for that was because of the idea of the need to
protect digital rights management content at the time,
there were lots of cds and dvds created that contained audio and video.
And even though this could be encrypted by the companies creating the media,
once it has to be played,
then of course that content had to be decompressed or decrypted
before being sent to the actual playback device.
And once that's done in memory of the appropriate process,
the playback process,
someone would that mean privileges or sometimes even not with the main
privileges could open an invasive handle to the process address space
using the process VM read access mask and then just grab the content of
the media in its unprotected, unencrypted form.
And so Microsoft was asked to find some kind of solution that
and protected processes were created exactly for for this
purpose with a protected process,
there's no way to open a handle to the process with invasive access.
You can only open the handle with a very limited,
shallow superficial information you can get for the process such as the process,
name its image path, its priority of things like that.
But you can't open the handle that for example,
can look at the adverse face of the process.
Look at the list of DLS inside the process.
Even if you had admin privileges.
So this is kind of the key point here from user mode.
You can't open an invasive handles invasive handle to a
protected process regardless of which user you are.
Even if you have admin privileges on the machine,
this was very different from the previous XP days where an
administrator from user mode can do essentially anything.
So at the time there were mostly three executable
that were running as protected.
One of them was audio D G, which is the audio device craft.
That was used to decode audio.
And then there was also the Media Foundation protected
media path process that was used by the Media Foundation
engine to decode audio and video.
And finally there was this process world where fall secure,
you might be familiar with where fall dot which is executable that
is sometimes launched when some other process crashes and then wear
fault can grab a dump file or the memory snapshot of that process as
it crashes and then send that to some server for analysis could be
Microsoft server, could be some something else.
It's really based on configuration.
So what would happen if audio D G or M F P M P crashed?
The normal wear fault wouldn't be able to open a powerful enough handle
to extract dump information from the crushing process.
So this is why where false secure is created and where
false secure is running protected as well.
And so the basic rule is that the protected process has
unlimited access to another protected process,
but you can't do that with normal processes.
And that's why we're full secure work necessary.
And so that was the idea of protected processes,
which was really used just for Microsoft binaries,
a very specific binaries that had to be signed in a very particular way,
and that couldn't be used by third party someone outside of Microsoft,
fortunately, that model was later extended.
Let's see what it means to be a protected process.