4.1 Process Overview

A process is an object. The Windows operating system is object-based (not to be confused with the term object used in object-oriented languages). An object refers to a system resource such as a process, file, device, directory, mutant, and so on, and they are managed by a component of a kernel called object manager. To get an idea of all the object types on Windows, you can use the WinObj tool (https://docs.microsoft.com/en-us/sysinternals/downloads/winobj). To look at the object types in WinObj, launch WinObj as an Administrator and, in the left-hand pane, click on ObjectTypes, which will display all the Windows objects.

The objects (such as processes, files, threads, and so on) are represented as structures in C. What ...

Get Learning Malware Analysis now with the O’Reilly learning platform.

O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.