Now that we know the basic terminology, we can now dive into PE loading and process creation. We will look into it sequentially, as shown in the following steps:
- Starting the program: When you double-click on a program in Windows Explorer, let's say calc.exe, another process called explorer.exe (the process of Windows Explorer) calls an API called CreateProcess, which gives the operating system the request to create this process and start the execution.
- Creating the process data structures: Windows then creates the process data structure in the kernel (which is called EProcess) and sets a unique ID for this process (ProcessID), and sets the explorer.exe process ID as a parent PID for the newly created calc.exe process.
- Initialize the virtual memory: Then, Windows creates the process, virtual memory and its representation of the physical memory and saves it inside the EProcess structure, creates the PEB structure with all necessary information, and...
