The essence of Windows Programming

The essence of Windows Programming

Since Windows API programming interacts with the Windows operating system, you must understand how the Windows operating system runs applications.

1. Protection Mode

The operating system is attached to the cpu hardware, so the features of the operating system are also provided by the cpu. Intel's 32-bit CPU has two main modes: real mode and protection mode. The Dos operating system runs in the real mode, while the modern operating system fully utilizes the protection mode, which greatly improves the security and stability of the system. Modern computers use the Von noriman system, with memory at its core. Therefore, the CPU has internal registers and external memory, so the so-called real mode and protection mode are essentially different access forms to the memory. The real mode is direct access to the memory. For example, if you want to display a number on the screen, you can directly write it to the video memory. This is the case for programming in dos. However, the biggest problem is the insecurity. Any program can access the memory at will, and it is easy to conflict with the address of the operating system, so those who have played dos know that computers are easy to crash. To solve this problem, Intel's CPU after 386 provides a protection mode. The most important application in this mode is the virtual memory address. We all know that the 32-bit CPU can be addressable in the range of 4 GB, each process is allocated a 4 GB virtual address in the virtual memory. If we need 10 4 GB of virtual memory to run 10 processes at the same time, the problem is: How many memories can there be? Oh, so this is virtual memory, not real physical memory. It is only for the process that allows programmers to use the memory address. For example, if int * p = new int, a 4-byte memory is requested from the computer. The address exists in p, in real mode, p is the real physical address, but in protection mode, p only stores a virtual address, programmers are not allowed to know the actual physical address. When windows receives p, It maps the virtual address in p to a physical address, this process is black box operations, and common applications are not allowed to know.

2. kernel space and user space:

Well, now we know that in the protected mode, the write program accesses 4 GB of virtual memory, but this 4 GB space is not all used by the application, and the operating system also needs to be used, therefore, Windows requires that 4 GB space be divided into two halves. Users can use 2 GB space (0-0x7fffffff) while users cannot use 2 GB space (0x80000000-0xffffff) and leave it to the operating system. So there is a difference between user space and kernel space. In fact, this rule also uses the CPU privilege-level function: the kernel space is 0 rings, and the user space is in 3 rings, therefore, the kernel and the user program are separated at the CPU level to ensure that the user program cannot harass the kernel and thus ensure system stability.

3. kernel objects:

But now the problem is that kernel space users cannot access it. How can we call various features of the operating system? For example, to draw a line on the screen, it is very simple in the real mode, that is, to write a row of 01010101 in the video memory, but in the real mode, we can only access 2 GB of user space, I don't know where the video is stored. How can I write it? It is easy to think that the operating system helps us find the location of the video memory. We only need to call the relevant functions of the operating system. However, we still cannot directly use the operating system in a 2 GB kernel space. Now, the operating system must be used for us and not for us to use it directly. What should we do? One way Microsoft engineers come up with is to give us a number, that is, HANDLE ), let's use a handle for whatever features of the kernel, so that we don't have to know the specific kernel address. Therefore, kernel objects are generated naturally. All Windows operations on hardware are made into one kernel object. We apply for this object when we use it, and then Windows gives us a handle, in Windows, the internal counter is incremented by 1. When the counter is set to 0, the handle is closed. In Windows, the internal counter minus 1. When the counter is set to 0, Windows knows that this kernel object is no longer used, therefore, it is destroyed from the real physical memory. For our application programmers, what we need to do is apply for the kernel object, get the handle, operation handle, and destroy the handle. This process is the process of interacting with Windows, that is, the essence of Windows programming.