[Autogenerated] let's say some of the aspects and properties of UWP processes,
let's start by running calculator, I'm going to use color here to launch it.
But in fact the actual executable doesn't really have the name cult,
it's a different one.
Culture is just a Short cut from the Windows seven days.
That was the real name of calculator back in those days,
but now we have a new one.
So it just actually is a shortcut.
Let me grab process explorer here and launch it and see what we get.
So if I look for calculator, it's actually calculator app here.
That's the actual calculator.
And currently we can see here that let me remove the oils on top here.
We can see the calculator is currently running normally.
And if I go ahead and minimize it,
then we can see it's uh CPU here is changing to suspended.
And so if I double click that to see the properties of calculator,
we can go to threats, see what's going on.
You can see that all threats have the suspend count of one,
which means that this process is essentially suspended.
All the threats are not doing anything.
They cannot make any kind of forward progress once we
restore the window for calculator,
the suspend count is removed sometimes takes a while for process
Explorer here to uh to actually refresh that,
that bug in Process Explorer.
But all the threats are free to do their work.
If they so desire going back to minimizing it again,
we should see the suspend count changing,
but it might take a while because process is still
loading symbols and not updating it.
Suspend count properly.
Let's see what's going on in terms of the actual process in
in the current debugger So the process I.
D.
Is 10412.
Let's find it.
So we'll use a process here Which has the value one already forgot
the value that will be 104 and two and see what we get when we look
for that process and what you notice there's an additional value
here shown as deep freeze.
This process is in a deep free state.
In fact this freezing capability is actually part of jobs power
and we'll discuss jobs later in this course.
But in any case this is a special kind of suspension is not a normal suspension.
You can perhaps resume all of the threads in calculator.
In fact that you can't but um if you try to do that it will not help.
It will not work unless the entire process is
removed from its deep freeze state.
Here's a look at the actual threats here.
If we just see some more details here if we so desire and
nothing special seems to be showing here.
But there is a freeze count here.
So you can see there's a freeze count here for all these threats which really
is something that you get because of the deep free state.
The process is in.
Okay,
so what else if we go to the security tab we'll find some interesting
aspects related to those capabilities that I mentioned.
So the security tab in general is about showing parameters that
are part of the access token will discuss access tokens in
greater detail in the future course.
But for now we can just admire the fact that there are some
capabilities here Using this flag of capability.
Each one of these capabilities represented as a C the security identifier,
which is just a way to nuclear identify entities in the security
space officially known as principles and capable.
These are also provided and represented as seeds.
You can see that one of them has a string based name
here called your internet connection.
This just simply means that process.
Explorer knows how to translate some of these seeds into a human friendly name,
which of course is just something which is very human friendly.
But behind the scenes there's still a seed.
Most seeds process explore doesn't really know how to properly interpret as
a human readable something and it shows the actual seed.
So you can see here that calculator has four capabilities.
One of them is to access the internet which is the capability onto itself.
You might take this thing for granted for normal processes and it is
provided kind of automatically for normal processes.
But UWP processes have to ask permission have to extend and
declare that capability is something that they need.
You also might be wondering why is that?
I mean it's just calculator we're talking about,
I guess that if I try to calculate like something like four plus eight,
I hope that calculator is not going to the web to figure out maybe there
is some server that can help with this calculation.
In fact it doesn't calculate that locally but the internet connection
capability is required because calculator has the option of providing
something that is related to currency conversions.
So because it has the ability to convert currency,
this is why internet connection is required because then it
has to go to the web to figure out what's the exchange rate
for a particular conversion.
In fact,
if you have watched the calculator being developed perhaps or
extended in earlier versions of Windows in the initial Windows 10
version calculator didn't support currency exchange conversion rates
so it didn't require internet connection but a few versions later on
when it got that capability, it required that exact thing.
So we have these capabilities, we can look at other things.
For example,
we might look at other um other kinds of applications that are
similar that are also UWP How can we tell that things that UWP So
obviously we have the science color and that's one hint to that but
we know that some processes that have this color are not necessarily
UWP such as Explorer,
it just means that they're hosting the Windows
runtime using the Windows runtime,
which can be used by non UWP processes as well.
So how can we tell when something is really UWP or not.
And so here's another example of UWP application,
that's the start menu experience host,
that's the one implementing the start button,
so to speak.
And you can see that has many more capabilities here,
not just internet,
but also home and work network and many others that process explore,
doesn't know how to show in a human readable form.
So obviously some processes require more capabilities than others to
actually figure out whether something is really UWP or not.
We should add another column here which is called a package name.
Every UWP application is created based on something called an application
package and that application package has some form of identity and that identity
is represented here but its four chunks of values here.
So you can see by the way,
the runtime brokers I've mentioned earlier that these are
helpers for for other UWP process to do some of the things
that they can't really do.
For example, the photos application is not really able to print directly,
but it's run time broker is able to perform that printing and it's
running with higher security power than the real photos applications
going back to calculator just for a moment,
you can see the package full name here.
So it consists of these four parts.
One of them is a short parts such as Microsoft Windows calculator here,
then we have a version with these four numbers.
Then there's a CPU architecture X 64 in this case and then
there's something that identifies the publisher.
This is a sha one hash of the publisher name.
So for all Microsoft application,
that's always going to be these particular 13 characters
there and and so uniquely around the world,
this entire string is guaranteed to be unique because a
particular publisher will only create one application with a
particular name in a particular version.
And this is the thing to that identifies really a package.
So let's take a deeper look a little bit.
So if I double click again and look at the image tab,
you notice that the parent of this calculator application is this sbc host,
which seems to be very weird because I try to launch
calculator using the start run button,
which is essentially going to talk to explore in some way.
But apparently Explorer is not the parent of this processes.
Instead,
this sbc host in one particular with 1128 being the process ID in this case.
So switching to the tree view, we can see in fact that not only that,
but many and in fact all UWP processes are always
Children of the same sbc host here which has this 1128
process IDE and this is no accident.
In fact,
because all your UWP processes are created and
launched by a service known as the D.
Com launch service,
That's the one and that's because the Windows runtime is built on
top of the component object model technology,
something I briefly mentioned the previous course and we'll discuss
in greater detail in the future course anyway,
this is the one that always launches these kinds of
applications based on the full package name.
And so here's another example of why things are a
bit different for UWP processes.
Let me go to calculator again, just as a canonical example of sorts.
Let me double click and look at the command line.
So first and foremost, this command line looks like a command line from helper.
You probably don't want to use these kinds of
command lines in your applications.
But anyway,
let's disregard this thing and just simply copy the entire cmdlet here
and then I can go to my run dialog box and just paste this command line
and see what happens and if I do that Well,
apparently calculator is running as expected,
but you'll notice there's another process calculator is coming out of this and
in fact you can see that something weird has happened here,
the calculator actually crushed.
And normally if you try this thing on a Windows 10 machine,
you'll find that it doesn't really work as expected.
So in this case the run dialog box is a bit smarter than it used to be.
But let's go to the command line and try to pace this crazy
long command line here and see if we can launch this thing
and again it seems to work.
But again,
calculator seems to _____ something is kind of off a little bit here and so
the thing is that in Windows 10 if you try this thing you can see that
you'll see that it's completely failing and will not really run normally
because typically you're not supposed to run these applications using normal
create process calls because you have to provide the full package name
that's really necessary and and for that you need to use different APIs
because they create process function although it it is possible to provide
it with a full package name in an extended the property but it is
undocumented.
So there are other ways of launching you dopey processes properly using
other APIs which in fact are calm based and documented.
So here's an application that I've written called Metro
Manager to kind of give tribute to the original name for
these kinds of applications.
So you can see here the list of all the packages are installed
online machine right now on this machine right now,
you can see the package name that's the short name.
Some details here whether that's a framework package.
Some of these packages can be framework packages which are like
things you cannot really launched directly.
They are being used by other applications.
You can see the CP architecture here is the full package name.
This is exactly the full package name containing all these four
pieces that we've seen in the calculator example,
you also know that there's the install location,
Most of them are installed under Windows system apps for Microsoft,
some some out of the box uh sort of inbox components and applications,
but normally in most cases what you'll find is that most
applications you download from the store are going to be
stored here under program files,
Windows apps and then uh some kind of directory that
is based on the full package name.
And this provides a way to uniquely identify directory when
we need it and of course you can look at what's going on
inside this directory regardless.
One of the things we can do here is is filter just to see
the various applications that exist.
I can even find something that I would like to launch like being
weather here and use the launch button to to launch it.
So this essentially uses those APIs that I mentioned
earlier to launch UWP application.
You're welcome to look at the source code for this application that is in
my GIT repositories to see exactly the APIs that I'm using this
application is written in C Sharp by the way and I have a similar version
written in C Plus Plus if you prefer that.
But that's just to give you a sense of how these applications are launched
differently than you would launch a normal Windows application.
So this is some of the aspects of UWP application, it's not everything.
There are other things to look at in terms of security and
object namespace and we'll do that in the appropriate
course in in the future date.