Here's a quick overview of processes that will set up
the backdrop for discussing threads.
We know that the process is a management object.
It has a virtual address space,
which is the memory address space that can be used by the process.
This is something we discussed in the second half of this course.
It has an executable image file, which is used to obtain the initial code and
data for the process. We have a handle table for each process that points to the
various objects the process is using such as files,
mutexes, semaphores, and so on.
There's a primary token, which is used as a security context for any
operation being performed by the process. And eventually, someone has
to actually run code, and these are threads.
When a process is created,
one thread is created along with it, and that thread will eventually
run the main or WinMain function for that process.
But that thread can create more threads, and these other
threads can create even more threads.
One of the questions is, why would we want to do that? What's
the meaning of threads, and how can we utilize threads in an
efficient way? So, threads are the actual workhorses, and they
abstract running some code.
This will be the topic of the next few modules.
Finally, just as an aside,
a thread can also have its own token when it's impersonating,
which means it assumes a different access token temporarily.
This is something we will not be discussing in this course.