[Autogenerated] A really new kind of process has emerged in Windows 10.
Known as a minimal process.
Now,
minimal processes were created based on a project within
Microsoft research called Drawbridge and they're still
videos that were created by the team,
the Drawbridge team that you can find online.
I recommend you watch them to get a better sense of what they were trying to do.
The basic idea of minimal process,
something we briefly discussed in the previous course,
which is having an empty address space.
And that address space can be used by the kernel in any way it sees fit.
So there's no N t d l N or subsystem dealers know PB no TVs,
no, nothing,
essentially something which is like an empty box of address space
that the colonel can use in any way it sees fit.
It might seem very weird.
I mean, what's the purpose of having this kind of process,
because obviously user mode code can't really run in this kind of process
and this kind of process cannot even be created by any user mode code
because that code calling something like create process always has to
provide some kind of executable but there is no executable that's going to
be mapped into such a process.
What's the really use of the minimal process.
So basically this is the way for the kernel to use an address space to store
data without having to use the kernel address space for that because the
kernel address space already has lots of entities,
they're competing for memory,
such as the various kernel drivers and the kernel itself
and some management of the pool is,
is pretty difficult to do and sometimes it may be convenient to put
memory that is used for so Certain purpose in a different location
that is easy to manage and highly protected and it's exactly what
minimal processes are about.
And the canonical example is the memory compression process,
which we've talked about in the previous course,
which stores compressed memory and that compressed memory is
simply being manipulated by the kernel in order to compress and
decompress the memory as required.
Another process was created several versions later in Windows 10 and
that is also a minimal process is the registry process and the
registry process is used for exactly the same kind of concept to store
registry related information instead of putting them in the page pool
in normal kernel memory, so to speak.
It's now putting its own process which makes it just easier
to manage and less contention happening with the normal
kernel memory used by kernel drivers.
So that's the basic idea.
However,
this idea has been significantly extended using this
thing called the PICO process.
A pickle process is a minimal process with a supporting kernel
driver which is called the PICO provider.
In fact pick a provider must be registered at boot time.
It must be signed by Microsoft and currently this is the only way to
create a pickle provider and as I'll explain a bit later,
it actually makes sense at this point.
Um there can only one b b one pickle provider on the system.
This is the current limitation which may or may not be lifted in the future.
And the basic idea is that if there are any system called or any
kind of things that require access for the Colonel,
require access to the kernel to be more precise,
then the pickle provider is going to intercept them.
So because the pickle provider is first and foremost, a minimal process.
Pickle processes, a minimal process to begin with.
So what would be the code running in the minimal process?
Because we know that normal Windows code can't
really run in the minimal process,
as there is no basic ingredients required for such processes,
such as anti Dll.
However,
pickle processes are used for implementing the
Windows subsystem for Linux version one