Windows内核是如何实现线程挂起的？如何实现线程挂载到进程的？如何实现杀死进程和线程的？
从源码分析一下，这些操作具体在源码上是如何实现的。
进程创建、线程切换、线程跨越CPU权限级、进程挂靠、杀死进程、杀死线程
一.进程创建
可以分几个部分来说。首先说进程的地址空间是怎么创建起来的，进程的EPROCESS->VadRoot是用来描述进程的用户地址空间的。只有在VadRoot结构中分配了的空间才可能被使用。进程初始化空间使用了MmCreateProcessAddressSpace函数，这个函数如下.
二.线程切换
操作系统如何从一个线程切换到另一个线程？
首先，只有内核模式下有线程切换。
三.杀死进程
对应于官方接口分别是用户层的TerminateProcess()和内核层的ZwTerminateProcess()。
杀死进程与创建进程很像，都是一个由多步复合的过程。原因就是因为进程是一个包揽众多的容器。
比如进程有地址空间、有内核对象、也有所拥有的线程。倘若要创建进程势必要创建线程，倘若要杀死进程势必要杀死线程。
所以进程真正的“运行终止”，其实是取决于杀死线程。
四.创建线程
先放上KTHREAD和ETHREAD结构的情况，可见线程对象里面也是有很多东西的
typedef struct _KTHREAD
{
DISPATCHER_HEADER Header;
UINT64 CycleTime;
ULONG HighCycleTime;
UINT64 QuantumTarget;
PVOID InitialStack;
PVOID StackLimit;
PVOID KernelStack;
ULONG ThreadLock;
union
{
KAPC_STATE ApcState;
UCHAR ApcStateFill[];
};
CHAR Priority;
WORD NextProcessor;
WORD DeferredProcessor;
ULONG ApcQueueLock;
ULONG ContextSwitches;
UCHAR State;
UCHAR NpxState;
UCHAR WaitIrql;
CHAR WaitMode;
LONG WaitStatus;
union
{
PKWAIT_BLOCK WaitBlockList;
PKGATE GateObject;
};
union
{
ULONG KernelStackResident: ;
ULONG ReadyTransition: ;
ULONG ProcessReadyQueue: ;
ULONG WaitNext: ;
ULONG SystemAffinityActive: ;
ULONG Alertable: ;
ULONG GdiFlushActive: ;
ULONG Reserved: ;
LONG MiscFlags;
};
UCHAR WaitReason;
UCHAR SwapBusy;
UCHAR Alerted[];
union
{
LIST_ENTRY WaitListEntry;
SINGLE_LIST_ENTRY SwapListEntry;
};
PKQUEUE Queue;
ULONG WaitTime;
union
{
struct
{
SHORT KernelApcDisable;
SHORT SpecialApcDisable;
};
ULONG CombinedApcDisable;
};
PVOID Teb;
union
{
KTIMER Timer;
UCHAR TimerFill[];
};
union
{
ULONG AutoAlignment: ;
ULONG DisableBoost: ;
ULONG EtwStackTraceApc1Inserted: ;
ULONG EtwStackTraceApc2Inserted: ;
ULONG CycleChargePending: ;
ULONG CalloutActive: ;
ULONG ApcQueueable: ;
ULONG EnableStackSwap: ;
ULONG GuiThread: ;
ULONG ReservedFlags: ;
LONG ThreadFlags;
};
union
{
KWAIT_BLOCK WaitBlock[];
struct
{
UCHAR WaitBlockFill0[];
UCHAR IdealProcessor;
};
struct
{
UCHAR WaitBlockFill1[];
CHAR PreviousMode;
};
struct
{
UCHAR WaitBlockFill2[];
UCHAR ResourceIndex;
};
UCHAR WaitBlockFill3[];
};
UCHAR LargeStack;
LIST_ENTRY QueueListEntry;
PKTRAP_FRAME TrapFrame;
PVOID FirstArgument;
union
{
PVOID CallbackStack;
ULONG CallbackDepth;
};
PVOID ServiceTable;
UCHAR ApcStateIndex;
CHAR BasePriority;
CHAR PriorityDecrement;
UCHAR Preempted;
UCHAR AdjustReason;
CHAR AdjustIncrement;
UCHAR Spare01;
CHAR Saturation;
ULONG SystemCallNumber;
ULONG Spare02;
ULONG UserAffinity;
PKPROCESS Process;
ULONG Affinity;
PKAPC_STATE ApcStatePointer[];
union
{
KAPC_STATE SavedApcState;
UCHAR SavedApcStateFill[];
};
CHAR FreezeCount;
CHAR SuspendCount;
UCHAR UserIdealProcessor;
UCHAR Spare03;
UCHAR Iopl;
PVOID Win32Thread;
PVOID StackBase;
union
{
KAPC SuspendApc;
struct
{
UCHAR SuspendApcFill0[];
CHAR Spare04;
};
struct
{
UCHAR SuspendApcFill1[];
UCHAR QuantumReset;
};
struct
{
UCHAR SuspendApcFill2[];
ULONG KernelTime;
};
struct
{
UCHAR SuspendApcFill3[];
PKPRCB WaitPrcb;
};
struct
{
UCHAR SuspendApcFill4[];
PVOID LegoData;
};
UCHAR SuspendApcFill5[];
};
UCHAR PowerState;
ULONG UserTime;
union
{
KSEMAPHORE SuspendSemaphore;
UCHAR SuspendSemaphorefill[];
};
ULONG SListFaultCount;
LIST_ENTRY ThreadListEntry;
LIST_ENTRY MutantListHead;
PVOID SListFaultAddress;
PVOID MdlForLockedTeb;
} KTHREAD, *PKTHREAD;
KTHREAD
typedef struct _ETHREAD
{
KTHREAD Tcb;
LARGE_INTEGER CreateTime;
union
{
LARGE_INTEGER ExitTime;
LIST_ENTRY KeyedWaitChain;
};
union
{
LONG ExitStatus;
PVOID OfsChain;
};
union
{
LIST_ENTRY PostBlockList;
struct
{
PVOID ForwardLinkShadow;
PVOID StartAddress;
};
};
union
{
PTERMINATION_PORT TerminationPort;
PETHREAD ReaperLink;
PVOID KeyedWaitValue;
PVOID Win32StartParameter;
};
ULONG ActiveTimerListLock;
LIST_ENTRY ActiveTimerListHead;
CLIENT_ID Cid;
union
{
KSEMAPHORE KeyedWaitSemaphore;
KSEMAPHORE AlpcWaitSemaphore;
};
PS_CLIENT_SECURITY_CONTEXT ClientSecurity;
LIST_ENTRY IrpList;
ULONG TopLevelIrp;
PDEVICE_OBJECT DeviceToVerify;
_PSP_RATE_APC * RateControlApc;
PVOID Win32StartAddress;
PVOID SparePtr0;
LIST_ENTRY ThreadListEntry;
EX_RUNDOWN_REF RundownProtect;
EX_PUSH_LOCK ThreadLock;
ULONG ReadClusterSize;
LONG MmLockOrdering;
ULONG CrossThreadFlags;
ULONG Terminated: ;
ULONG ThreadInserted: ;
ULONG HideFromDebugger: ;
ULONG ActiveImpersonationInfo: ;
ULONG SystemThread: ;
ULONG HardErrorsAreDisabled: ;
ULONG BreakOnTermination: ;
ULONG SkipCreationMsg: ;
ULONG SkipTerminationMsg: ;
ULONG CopyTokenOnOpen: ;
ULONG ThreadIoPriority: ;
ULONG ThreadPagePriority: ;
ULONG RundownFail: ;
ULONG SameThreadPassiveFlags;
ULONG ActiveExWorker: ;
ULONG ExWorkerCanWaitUser: ;
ULONG MemoryMaker: ;
ULONG ClonedThread: ;
ULONG KeyedEventInUse: ;
ULONG RateApcState: ;
ULONG SelfTerminate: ;
ULONG SameThreadApcFlags;
ULONG Spare: ;
ULONG StartAddressInvalid: ;
ULONG EtwPageFaultCalloutActive: ;
ULONG OwnsProcessWorkingSetExclusive: ;
ULONG OwnsProcessWorkingSetShared: ;
ULONG OwnsSystemWorkingSetExclusive: ;
ULONG OwnsSystemWorkingSetShared: ;
ULONG OwnsSessionWorkingSetExclusive: ;
ULONG OwnsSessionWorkingSetShared: ;
ULONG OwnsProcessAddressSpaceExclusive: ;
ULONG OwnsProcessAddressSpaceShared: ;
ULONG SuppressSymbolLoad: ;
ULONG Prefetching: ;
ULONG OwnsDynamicMemoryShared: ;
ULONG OwnsChangeControlAreaExclusive: ;
ULONG OwnsChangeControlAreaShared: ;
ULONG PriorityRegionActive: ;
UCHAR CacheManagerActive;
UCHAR DisablePageFaultClustering;
UCHAR ActiveFaultCount;
ULONG AlpcMessageId;
union
{
PVOID AlpcMessage;
ULONG AlpcReceiveAttributeSet;
};
LIST_ENTRY AlpcWaitListEntry;
ULONG CacheManagerCount;
} ETHREAD, *PETHREAD;
ETHREAD
杀死线程是通过APC来实现的。首先会判断当前线程是否是最后的线程，如果是就直接调用 结束当前线程。如果有别的线程就向它们插入一个APC，用于结束。