này sau đó được mô tả. Chương này kết thúc với một mô tả của đối tượng công việc. Trong trường hợp bộ đếm hiệu suất có liên quan hoặc các biến hạt nhân tồn tại, chúng được đề cập. Mặc dù cuốn sách này không phải là một cuốn sách Windows lập trình, quá trình thích hợp, | Chapter 5 Processes Threads and Jobs In this chapter we ll explain the data structures and algorithms that deal with processes threads and jobs in the Windows operating system. The first section focuses on the internal structures that make up a process. The second section outlines the steps involved in creating a process and its initial thread . The internals of threads and thread scheduling are then described. The chapter concludes with a description of the job object. Where relevant performance counters or kernel variables exist they are mentioned. Although this book isn t a Windows programming book the pertinent process thread and job Windows functions are listed so that you can pursue additional information on their use. Because processes and threads touch so many components in Windows a number of terms and data structures such as working sets objects and handles system memory heaps and so on are referred to in this chapter but are explained in detail elsewhere in the book. To fully understand this chapter you need to be familiar with the terms and concepts explained in Chapters 1 and 2 such as the difference between a process and a thread the Windows virtual address space layout and the difference between user mode and kernel mode. Process Internals This section describes the key Windows process data structures. Also listed are key kernel variables performance counters and functions and tools that relate to processes. Data Structures Each Windows process is represented by an executive process EPROCESS block. Besides containing many attributes relating to a process an EPROCESS block contains and points to a number of other related data structures. For example each process has one or more threads represented by executive thread ETHREAD blocks. Thread data structures are explained in the section Thread Internals later in this chapter. The EPROCESS block and its related data structures exist in system address space with the exception of the process environment .
