GuidedHacking

Windows Process Types Explained (Patreon)

Published:

2023-04-20 17:13:08

Imported:

2026-06

haven't archived this post yet. have a subscription? use the importer!

Content

In contrast to traditional Windows processes, pico processes do not have direct access to the Windows NT kernel. Instead, they are managed by a special kernel-mode driver called the pico provider (Lxss.sys and LxCore.sys in the case of WSL). The pico provider is responsible for translating Linux system calls made by the pico process into their Windows equivalents, allowing Linux applications to run seamlessly on the Windows platform.

Files

Previews only

Windows Internals - Special Process Types Explained

Not all processes are created equally. Find out why! Support us on GH: https://guidedhacking.com/register/ Support us on Patreon: https://patreon.com/guidedhacking Support us on YT: https://www.youtube.com/channel/UCCMi6F5Ac3kQDfffWXQGZDw/join Learn more here: https://guidedhacking.com/threads/windows-internals-special-process-types.20342/ Video Creator: rexir Video Narrator: Mewspaper You may also like: Processes and Threads Explained https://www.youtube.com/watch?v=1t9PrSOlNPk -- Windows Internals - Special Processes Summary -- Windows processes can be classified into several types based on their unique characteristics. Key types include: Protected Processes: Introduced for DRM purposes, they have limited access to other processes and require a special Windows Media Certificate for their executable files. Examples include Audiodg.exe, Mfpmp.exe, and Werfaultsecure.exe. Protected Processes Light (PPL): An extension of protected processes that allows third-party programs to have similar privileges. The protection level depends on the program's signature. Many Windows system processes are PPL protected. Minimal Processes: Managed by the kernel, these processes have no user-mode address space, loaded DLLs, PEB or TEB structures, or initial threads. They are for system use only. Pico Processes: Small processes that use a pico provider driver to manage their execution. The pico provider can act like a separate kernel without the process being aware of the original system. Pico processes are the basis for the Windows Subsystem for Linux (WSL). Trustlets (Secure Processes): Highly secure processes created by the Windows kernel in response to user-mode application requests. Trustlets rely on Virtual Trust Levels provided by the Hyper-V Hypervisor for isolation and can only import trusted DLLs. All our social media https://linktr.ee/guidedhacking Chapters 0:00 Intro 0:17 Protected Processes 1:30 Protected Processes Light 2:06 Join GuidedHacking.com 2:33 Minimal Process 3:06 Pico Processes 3:50 Trustlets #windows #hacking #reverseengineering process types windows processes Windows internals Process Types Explained