README

Process-Tree:

     :
                     
:
  :
 :
      :

A process is a program in execution, and an integral part of any modern-day operating system (OS). The OS must allocate resources to processes, enable processes to share and exchange information, protect the resources of each process from other processes and enable synchronization among processes. To meet these requirements, The OS must maintain a data structure for each process, which describes the state and resource ownership of that process, and which enables the operating system to exert control over each process.

In any modern operating system, there can be more than one instance of a program loaded in memory at the same time. For example, more than one user can be executing the same program, with each user having separate copies of the program loaded into memory. With some programs, it is possible to have one copy loaded into memory, while several users have shared access to it so that they can each execute the same program-code. Such a program is called re-entrant. At a given instant, the processor can only be executing one instruction from one program, but several processes can be sustained over a period of time by assigning each process to the processor at intervals while the remainder become temporarily inactive. The execution of multiple processes over a period of time, rather than simultaneously, is known as concurrent execution.

A multiprogramming or multitasking O.S. is a Operating System that can execute many processes concurrently. Multiprogramming requires that the processor be allocated to each process for a period of time and de-allocated or issued at an appropriate moment. If the processor is de-allocated during the execution of a process, it must be done in a way that the process can restart later as efficiently as possible.

There are two ways for an OS to regain control of the processor during a program's execution in order for the OS to perform de-allocation or allocation:

• The process issues a system call (sometimes called a software interrupt; for example, an I/O request occurs requesting to access a file on a hard disk.
• A hardware interrupt occurs; for example, a key was pressed on the keyboard, or a timer runs out (used in preemptive multitasking).

The stopping of one process and starting (or restarting) of another process is called a context switch or context change. In many modern operating systems, processes can consist of many sub-processes. This introduces the concept of a thread. A thread may be viewed as a sub-process; that is, a separate, independent sequence of execution within the code of one process. Threads are becoming increasingly important in the design of distributed and client–server systems and in software run on multi-processor systems.

Process:

In computing, a process is the instance of a computer program that is being executed by one or many threads. There are many different process models, some of which are light weight, but almost all processes (even entire virtual machines) are rooted in an operating system (OS) process which comprises the program code, assigned system resources, physical and logical access permissions, and data structures to initiate, control and coordinate execution activity. Depending on the OS, a process may be made up of multiple threads of execution that execute instructions concurrently.

In general, a computer system process consists of (or is said to own) the following resources:

• An image of the executable machine code associated with a program.
• Memory (typically some region of virtual memory); which includes the executable code, process-specific data (input and output), a call stack (to keep track of active subroutines and/or other events), and a heap to hold intermediate computation data generated during run time.
• Operating system descriptors of resources that are allocated to the process, such as file descriptors (Unix terminology) or handles (Windows), and data sources and sinks.
• Security attributes, such as the process owner and the process' set of permissions (allowable operations).
• Processor state (context), such as the content of registers and physical memory addressing. The state is typically stored in computer registers when the process is executing, and in memory otherwise.

Dump DOS Header:

The file can be identified by the ASCII string "MZ" (hexadecimal: 4D 5A) at the beginning of the file (the "magic number"). "MZ" are the initials of Mark Zbikowski, one of the leading developers of MS-DOS.

Segment handling:

EXE files normally have separate segments for the code, data, and stack. Program execution begins at address 0 of the code segment, and the stack pointer register is set to whatever value is contained in the header information (thus if the header specifies a 512 byte stack, the stack pointer is set to 200h). It is possible to not use a separate stack segment and simply use the code segment for the stack if desired.

The DS (data segment) register normally contains the same value as the CS (code segment) register and is not loaded with the actual segment address of the data segment when an EXE file is initialized; it is necessary for the programmer to set it themselves, generally done via the following instructions:

    MOV AX, @DATA
    MOV DS, AX

Termination:

In the original DOS 1.x API, it was also necessary to have the CS register pointing to the segment with the PSP at program termination; this was done via the following instructions:

    PUSH DS
    XOR AX, AX
    PUSH AX

Program termination would then be performed by a RETF instruction, which would retrieve the original segment address with the PSP from the stack and then jump to address 0, which contained an INT 20h instruction.

The DOS 2.x API introduced a new program termination function, INT 21h Function 4Ch which does not require saving the PSP segment address at the start of the program, and Microsoft advised against the use of the older DOS 1.x method.

PE-Executable Structure Information:

A PE file consists of several headers and sections that instruct the dynamic linker about on how to map the file into memory. An executable image consists of several different regions, each requiring different memory protection attributes. To ensure proper alignment, the start of each section must align to a page boundary.[8] For instance, the .text section, which contains program code, is typically mapped as an execute/read-only. Conversely, the .data section, which holds global variables, is mapped as no-execute/read write. However, to conserve space, sections are not aligned on disk in this manner. The dynamic linker maps each section to memory individually and assigns the correct permissions based on the information in the headers.

Process module:

Process module info generally refers to details about the executable files and dynamic link libraries (DLLs) loaded within a running process. This information can be retrieved using various programming APIs depending on the operating system or programming environment.

• The term "process module info" is often used in the context of:
  • Operating System APIs (Windows, Linux): For system management tools and debuggers to inspect other processes.
  • Details available: Module name, file name (full path), base address (memory location), entry point address, and memory size.
    • API examples:
    • Windows: Functions like EnumProcessModules, GetModuleInformation, and structures like MODULEINFO and RTL_PROCESS_MODULE_INFORMATION are used to access this data.
    • C# (.NET): The System.Diagnostics.ProcessModule class provides properties to access this information programmatically, such as ModuleName, FileName, and FileVersionInfo.
• Programming Language Specifics (Node.js, Java): The term can also refer to environment-specific functionality.
  • Node.js: The built-in process module provides information and control over the current Node.js runtime process, rather than other processes on the system.
  • Java (JPMS): In Java 9 and later, the module-info.java file defines a module's name, its dependencies (requires), and which packages it makes available (exports).
• Software Engineering (V-Modell XT): In process modeling, a "process module" defines encapsulated work products, activities, roles, and dependencies, which can be tailored for specific project needs.
• Key Information Typically Included The specific information returned for a process module includes:
  • ModuleName: The name of the module (e.g., kernel32.dll, notepad.exe).
  • FileName: The full path to the executable or DLL file on disk.
  • BaseAddress: The memory address where the module is loaded in the process's virtual memory space.
  • ModuleMemorySize / SizeOfImage: The amount of static memory required to load the module's code and data.
  • EntryPointAddress: The initial instruction address for the module.
  • FileVersionInfo: Details like the version number, product name, and other metadata embedded in the file.

In summary, "process module info" typically serves the purpose of inspecting the components and memory layout of an active application or system process.