"The Pulse" — Processes, Services, Memory & Devices

Every program you see running on a Windows computer — from Notepad to Chrome to the operating system itself — lives inside a process. A process is not the program file on disk (that's the executable, like notepad.exe). A process is a running instance of that program, alive in memory, doing work.

When Windows creates a process, it sets up several critical components:

• Process ID (PID) — A unique number identifying this specific running process. PIDs are assigned sequentially and are never reused while the process is alive. After the process ends, the PID can be recycled.
• Virtual Address Space — Each process gets its own private block of memory. A 64-bit process can theoretically address up to 128 TB of memory, though the OS only allocates what is actually needed. This isolation means one process cannot read or write another process's memory (without special privileges).
• Access Token — A security credential attached to every process. It contains the user's SID, group memberships, and privileges. When the process tries to access a file or resource, Windows checks this token against the resource's ACL. The token is inherited from the parent process that started it.
• Threads — The actual units of execution within a process. A process must have at least one thread (the primary thread). The CPU doesn't execute processes — it executes threads. A web browser might have dozens of threads: one for the UI, one per tab for JavaScript, others for network I/O.
• Handle Table — A list of OS objects (files, registry keys, mutexes, other processes) that this process currently has open. Handles are like numbered references to kernel objects.

Parent-Child Relationships: Every process (except the System process at PID 4) is created by another process — its parent. When you double-click an application in Explorer, explorer.exe is the parent and your application is the child. The child inherits certain properties from the parent, including the access token and environment variables. This parent-child tree is critical for security — if you see cmd.exe spawned by outlook.exe, something is very wrong.

These three terms are often confused. Here is how they relate to each other:

Think of it this way: a process is a house. Threads are the people inside the house doing work. A service is a house that runs itself — no one needs to be home to answer the door; it just keeps working automatically. The Service Control Manager (SCM) is like a building superintendent who can start, stop, and monitor all the service houses in the neighborhood.

Windows runs a set of core processes that must be present for the OS to function. Knowing what these processes are, where they live, who runs them, and who their parent should be is fundamental to threat detection. Attackers frequently try to disguise malware by naming it after these processes or running it from the wrong location.

A Windows Service is a background program that starts automatically (or on demand) and runs without requiring a user to be logged in. Services are managed by the Service Control Manager (SCM), which is the services.exe process.

Every service is defined by a registry entry under HKLM\SYSTEM\CurrentControlSet\Services\ that specifies:

• The binary path (executable or DLL)
• The startup type (Automatic, Manual, Disabled, Delayed Auto-Start)
• The account the service runs under
• Recovery actions if the service crashes
• Dependencies (other services that must start first)

Service Accounts

Services don't run as regular users. Windows provides three built-in service accounts with different privilege levels:

Service Recovery Options

The SCM can automatically respond when a service crashes. For each service, you can configure what happens on the first failure, second failure, and subsequent failures:

• Restart the Service — Most common. SCM waits a configurable delay, then restarts.
• Run a Program — Execute a script or binary (useful for notifications or cleanup).
• Restart the Computer — Nuclear option. Used for critical services where the whole system may be unstable.
• Take No Action — Just log it and leave the service stopped.

Windows uses a sophisticated memory management system that creates the illusion that each process has its own private, contiguous block of memory — even though physical RAM is shared among all running processes.

Virtual Memory

Every process works with virtual addresses, not physical RAM addresses. The CPU's Memory Management Unit (MMU) translates virtual addresses to physical addresses using page tables maintained by the OS. This translation is invisible to the application.

Virtual memory provides two critical benefits:

• Isolation — Process A's virtual address 0x00400000 maps to a completely different physical location than Process B's virtual address 0x00400000. They cannot see each other's memory.
• Overcommit — The total virtual memory used by all processes can exceed physical RAM. Pages that haven't been accessed recently are written to the page file on disk (C:\pagefile.sys).

Key Memory Concepts

Security Features in Memory

Applications never talk directly to hardware. Instead, the communication flows through layers:

A device driver is a piece of software that translates generic OS I/O requests into specific hardware commands. When you print a document, the application calls the Win32 API, which passes the request to the I/O Manager, which sends it to the printer driver, which sends the actual data to the printer hardware.

Key Driver Concepts

• Driver Signing — Since Windows Vista (64-bit), all kernel-mode drivers must be digitally signed by Microsoft or a trusted publisher. This prevents attackers from loading arbitrary code into the kernel. Secure Boot extends this protection to boot-time drivers.
• Plug and Play (PnP) — Windows automatically detects new hardware, loads the appropriate driver, and configures the device. The PnP Manager maintains a database of devices and their drivers.
• Driver Verifier — A diagnostic tool that stress-tests drivers by monitoring their behavior. It can detect memory leaks, buffer overflows, and improper API usage in drivers. Useful for identifying unstable drivers that cause blue screens.