Windows sysinternals

22 Part I Getting Started
■ The contents of a set of CPU registers representing the state of the processor. These
include an instruction pointer that identifies the next machine instruction the thread
will execute.
■ Two stacks, one for the thread to use while executing in kernel mode and one for
executing in user mode.
■ A private storage area called thread-local storage (TLS) for use by subsystems, run-time
libraries, and dynamic-link libraries (DLLs).
■ A unique identifier called a thread ID (TID). Process IDs and thread IDs are generated
from the same namespace, so they never overlap.
■ Threads sometimes have their own security context that is often used by multithreaded
server applications that impersonate the security context of the clients they serve.
Although threads have their own execution context, every thread within a process shares
the process’ virtual address space (in addition to the rest of the resources belonging to the
process), meaning that all the threads in a process can write to and read from one another’s
memory. Threads cannot reference the address space of another process, however, unless the
other process makes available part of its private address space as a shared memory section
(called a file mapping object in the Windows API) or unless one process has the right to open
another process to use cross-process memory functions.
By default, threads don’t have their own access token, but they can obtain one, thus allowing
individual threads to impersonate a different security context—including that of a process
running on a remote Windows system—without affecting other threads in the process.
User Mode and Kernel Mode
To prevent user applications from accessing or modifying critical operating system data,
Windows uses two processor access modes: user mode and kernel mode. All processes other
than the System process run in user mode (Ring 3 on Intel x86 and x64 architectures), whereas
device drivers and operating system components such as the executive and kernel run
only in kernel mode. Kernel mode refers to a mode of execution (Ring 0 on x86 and x64) in a
processor that grants access to all system memory and to all CPU instructions. By providing
the low-level operating system software with a higher privilege level than user-mode processes
have, the processor provides a necessary foundation for operating system designers to
ensure that a misbehaving application can’t disrupt the stability of the system as a whole.
Note Do not confuse the user-mode vs. kernel-mode distinction with that of user rights
vs. administrator rights. “User mode” in this context does not mean “has only standard user
privileges.”
www.it-ebooks.info