On most systems, Windows 2000 allocates half this address space (the lower half of the 4-GB virtual address space, from x00000000 through x7FFFFFFF) to processes for their unique private storage and uses the other half (the upper half, addresses x80000000 through xFFFFFFFF) for its own protected operating system memory utilization.
At the highest level of abstraction, a Windows 2000 process comprises the following:
A private virtual address space, which is a set of virtual memory addresses that the process can use
An executable program, which defines initial code and data and is mapped into the process's virtual address space
A list of open handles to various system resources, such as semaphores, communication ports, and files, that are accessible to all threads in the process
A security context called an access token that identifies the user, security groups, and privileges associated with the process
A unique identifier called a process ID (internally called a client ID)
At least one thread of execution
A thread is the entity within a process that Windows 2000 schedules for execution. Without it, the process's program can't run. A thread includes the following essential components:
The contents of a set of CPU registers representing the state of the processor
Two stacks, one for the thread to use while executing in kernel mode and one for executing in user mode
A private storage area called thread-local storage (TLS) for use by subsystems, run-time libraries, and DLLs
A unique identifier called a thread ID (also internally called a client ID—process IDs and thread IDs are generated out of the same namespace, so they never overlap)
Threads sometimes have their own security context that is often used by multithreaded server applications that impersonate the security context of the clients that they serve
本文地址：http://com.8s8s.com/it/it34456.htm