Por que não existem IDs de processo do Windows estranhos?

Question

Existem várias maneiras de examinar as identificações de processo no Windows.

Por exemplo, usando o comando do PowerShell:

ps | select Id, ProcessName  | Sort Id | ft -AutoSize

Nós vemos a seguinte saída:

  Id ProcessName         
  -- -----------         
   0 Idle                
   4 System              
 264 svchost             
 388 smss                
 476 csrss               
 536 wininit             
 580 winlogon                      
 620 services            
 628 lsass                          
 728 svchost             
 828 dwm                                     
1060 chrome              
1080 rundll32            
1148 vmms                                        
1620 spoolsv                                                
2912 taskhostex          
3020 explorer       
...     

Todos os IDs de processo são números pares e, além disso, são todos múltiplos de 4 .

Não há IDs de processo ímpares em qualquer versão do Windows baseada no Windows NT.

Qual é o motivo disso?

    

Answer 1

"Por que não existem IDs de processos do Windows estranhos?"

The same code that allocates kernel handles is also used to allocate process and thread IDs. Since kernel handles are a multiple of four, so too are process and thread IDs.

Por que os IDs de processo e encadeamento são múltiplos de quatro?

On Windows NT-based operating systems, process and thread IDs happen always to be a multiple of four. Is this just a coincidence?

Yes, it's just a coincidence, and you shouldn't rely on it since it is not part of the programming contract. For example, Windows 95 process and thread IDs were not always multiples of four. (By comparison, the reason that kernel handles are always a multiple of four is part of the specification and will be guaranteed for the foreseeable future.)

Process and thread IDs are multiples of four as a side-effect of code re-use. The same code that allocates kernel handles is also used to allocate process and thread IDs. Since kernel handles are a multiple of four, so too are process and thread IDs. This is an implementation detail, so don't write code that relies on it. I'm just telling you to satisfy your curiosity.

Fonte Por que os IDs de processo e segmento são múltiplos de quatro?

Por que os HANDLEs do kernel são sempre um múltiplo de quatro?

Not very well known is that the bottom two bits of kernel HANDLEs are always zero; in other words, their numeric value is always a multiple of 4. Note that this applies only to kernel HANDLEs; it does not apply to pseudo-handles or to any other type of handle (USER handles, GDI handles, multimedia handles...) Kernel handles are things you can pass to the CloseHandle function.

The availability of the bottom two bits is buried in the ntdef.h header file:

//
// Low order two bits of a handle are ignored by the system and available
// for use by application code as tag bits.  The remaining bits are opaque
// and used to store a serial number and table index.
//

#define OBJ_HANDLE_TAGBITS  0x00000003L

That at least the bottom bit of kernel HANDLEs is always zero is implied by the GetQueuedCompletionStatus function, which indicates that you can set the bottom bit of the event handle to suppress completion port notification. In order for this to work, the bottom bit must normally be zero.

This information is not useful for most application writers, which should continue to treat HANDLEs as opaque values. The people who would be interested in tag bits are those who are implementing low-level class libraries or are wrapping kernel objects inside a larger framework.

Fonte Por que os HANDLEs do kernel são sempre um múltiplo de quatro?

Outras leituras

• A velha novidade: o desenvolvimento prático em toda a evolução do Windows por Raymond Chen (Engenheiro Principal de Design de Software na Microsoft).