21

Just out of curiosity what are the processes between 0 and 4, and also between 4 and 200 something. enter image description here

bwDraco
  • 45,747
  • 43
  • 165
  • 205
agz
  • 8,088
  • 21
  • 70
  • 112
  • [System Idle Process](http://en.wikipedia.org/wiki/System_Idle_Process) will always be at 0. Process ID 1 is usually the [init process](http://en.wikipedia.org/wiki/Process_identifier) – Darius Mar 26 '13 at 01:07
  • 5
    Init process only applies to unix-like oses... – G Koe Mar 26 '13 at 01:49
  • See also https://superuser.com/questions/936773/why-are-there-no-odd-windows-process-ids – riQQ Aug 30 '22 at 10:46

2 Answers2

34

There is no Process ID 1,2,or3 because of how the NT kernel handle table works.

Handles are always multiples of four. The Kernel handle process object is used for both process handles and process/thread IDs. It happens that handle values all start at 0x4 (bit 2), and the InitialSystemProcess is the first process to be created, so it gets a PID of 4. Idle process isn't actually a process and you can't open it. It probably doesn't have a real PID but most tools consider it to be 0.

More on the NT handle table here although this is only accurate for NT3-5(xp) , as Windows 7 now requires that you only reference kernel handles if attached to PsInitialSystemProcess.

More on Windows 7/8 Handle limits from Mark Russinovich

More on the "multiples of four" in PIDs

Glorfindel
  • 4,089
  • 8
  • 24
  • 37
G Koe
  • 4,720
  • 1
  • 21
  • 24
  • 7
    Hmm thats interesting, i never realized that all the pids were divisible by 4 – agz Mar 26 '13 at 07:34
  • sound like they used a pre-multiplied array index for the PID – ratchet freak Mar 26 '13 at 09:26
  • Still wondering, what about all the PIDs between 4 and 200 ish still? – agz Sep 08 '13 at 00:08
  • @agz: The numbers between 4 and 200-ish (and many more) are in semi-permanent use by threads in the so-called System process. Process and thread IDs (generically called "client IDs") come from the same "number space". You can see thread IDs in Process Explorer: Double-click on a process, then look at the Threads tab in the resulting "Properties" window. – Jamie Hanrahan Apr 25 '15 at 21:18
0

you can see all of that processes between 4 and 200 and many more in the Process Explorer System process - properties - threads pane.

homer
  • 1