[Autogenerated] let's now examine thread priorities in a bit more detail.
The thread priority range is between one and 31 or 31 is the
highest technically priority zero exists as well,
but it is reserved to be used by something called the zero page
thread or threats which are threats that belong to the memory
manager and have some very specific role which we'll discuss
later on in this course.
So in actuality only 1 to 31 R is the valid range for priorities.
Now, the way you set a threat priority is not really that intuitive.
You can't just grab a thread and say, hey,
I would like that threat to have priority of 20 because this is how I feel
like today the Windows API the official one you can use from user mode
mandate some kind of connection between something called the base Priore
city of a process also referred to as a priority class and some offset
within or around that base priority.
So essentially cannot set up a thread priority by using some absolute value
but in fact it depends on the base priority of the process.
In a way that will see in the next slide so we can use the set thread
priority P I to change the thread priority around that base,
we cannot use an absolute value in this case.
So let's see what that looks like in practice.
So here's a diagram that's going to show us the six available priority
classes or based priorities and we'll see the possible values,
threat priorities might have by using the Windows API It's
important to note that from the Colonel's perspective,
it doesn't really care.
It just cares about the final numbers that were set eventually
after the combination of a process based priority and the threat
priority offset has been resolved.
So we have the range of priorities here.
There are two sets here.
One of them is referred to as normal priorities and the other
one is referred to as real time priorities.
I'll explain what that means at the end of this slide.
So for now let's start with the first base priority of the
process which is also the default called Normal.
Normal, simply alliance with a particular priority in this case for normal,
that would be eight.
This means that when I double click some executable and explorer
process comes up and all the threats there will run at priority eight
unless someone makes any kind of change,
that's the default for processes running with the normal priority
class If I use the set thread priority API to manipulate the threat
priority within one of these processes, I can make the following changes.
I can increase the priority by one or by two.
I can decrease it by one or by two or I can have two extreme values known
as saturation values which are 15 and one that's it.
I only have seven options for setting a threats
priority within that kind of process.
The other priority classes.
Most of them have the same kind of behavior just a different base.
So for example for the above normal priority class,
the base priority is 10 and we can increase to 11 or
12 or decrease to nine or eight.
And we have the two extreme values, situation values one in 15,
continuing on to the high priority class.
The base priority here is 13 and again we can move plus one
plus two minus one minus two and then 1 15.
So in this case we actually are limited to only six levels,
that's just how life is in this high priority class um priority.
Then we have below normal again the same idea the base this time is six and
finally we have the idol priority class which task manager refers to as low
priority class which is not accurate but task manager is allowed to invent
its own its own normal culture.
And and so what we get here is the best priority of four.
But again the same kind of behavior we can increase by one by two,
decrease by one by two.
And we have these two extreme values of one and 15.
The only slightly different range is the real time
range or the real time priority class.
Where the base priority is 24 which is very high and you can see we have the
seven values that we can manipulate the thread um using the same API but in fact
the API is slightly more flexible in this case we can get any priority between
16 and 31 of course this begs the question,
what is the real time priority class does not perhaps hint to
Windows being a real time operating system.
And so the real time here is just a name.
Please don't take that to mean that Windows is the real time West.
Windows is not a real time West and can't really be a real time operating
system at least not in the normal sense of the world.
Usually real time os s have various limits they can specify uh for example,
they can provide some upper limit to the time it takes to handle
interrupt something that windows cannot really provide.
Windows will do its best.
But because Windows works with so many kinds of different kinds of hardware,
it's simply not possible to provide any kind of guarantees of this sort.
Now,
another thing to notice that the real time priority class can only be run or
used by processes running elevated with admin privileges.
And this is because these high priorities are also
priorities used by many kernel threads.
If you spend too much time using threats running in those priorities,
you might prevent or starve certain kernel threats,
which is of course going to be detrimental to the system as a whole.
So only administrators are allowed to raise the
process priority class to real time.
If you're not administrator and try to do that,
it will not fail, but you'll get high instead of real time.
Now there are some other differences between normal
priorities and real time priorities.
One of them is related to adjustments I mentioned earlier that
adjustments are sometimes used by increasing the threat priority
term temporarily because of several reasons,
some of which I'll mention later on.
Now.
In the normal range, these adjustments happen and occur.
However, in the real time range, there never happen.
So the real time range provides some kind of
predictability in connection to thread priorities.