Windows System Analysis [2]-system mechanism-Object Model

After completing the first article, I have been thinking about how to start the subsequent content. How to write this series is more difficult than I expected: Introduction
A general structure is easier and it is not difficult to introduce a specific system function. However, windows is not a simple hierarchical structure with multiple
The specific functions are easy to implement. If the first introduction makes you feel that the windows system is building blocks
The introduction of the mechanism will make you feel that Windows is more like a pot of porridge-a bit pessimistic, but our goal is to open blocks and explore
Texture and context. Remember one sentence, no matter what shape or color the building blocks are, they are essentially a piece of wood.

mechanism.
Kingsoft cloud: (1) Construction, functions, and relationships of organisms, such as childbirth mechanism;
(2) Construction and working principles of machines. For example, the mechanism of a computer.
Please take the following articles about the windows mechanism as a common principle in windows.
2. One of Windows system mechanisms-Object Model
you must have used Windows Resource Manager, even beginners often need to click the "my computer" icon on the desktop. In resource manager,
everything in the computer is at a glance, opening, searching, replacing, and deleting files ...... And control panel, network neighbors ...... All files and Control
commands are a button, and almost 90% of daily operations use it as the entry point. However, you are only a Windows user. Even if you are
administrator, you are a Super User. If you are a computer or a Windows user, it hides a lot from you. Of course, this also
is one of its advantages. We use resource manager to manage computers, while Windows uses Object Manager to manage various computer resources. First, we will give you a
tool that allows you to see everything windows has hidden from you. However, you can only look at it at the moment.
click here to download: http://www.sysinternals.com/files/winobj.zip

This tool is the object viewer winobj, which intuitively shows the Object Manager database. Be sure not to be confused with the object manager.
Is a mechanism of windows to implement resource control operations. Pay attention to the object organization method. "\" is the root node. What we see at ordinary times is the c disk in object management.
"\ Device \ harddiskvolume1" in the tool. This is a global name, like the directory tree with the "/" node as the root in Linux and UNIX? Be careful
You will find that the windows device you have seen is \?? Each node has corresponding objects. You think of the hard disk as partition c, d, e, f ......,
In Windows, the hard disk is regarded as an object \ device \ harddiskvolume1, \ device \ harddiskvolume2, \ device \ harddiskvolume3,
\ Device \ harddiskvolume4 ......, You can think of Serial Port 1 as COM1, and Windows can think of it as an object \ device \ serial0 ....... All you know
The entities in the computer, windows all implement them as objects and then process them as objects, processes, threads, files, drivers, devices, desktops, events ......
In Windows, all objects are objects, so various object handles are available. The handle looks like a 32-bit integer.
In essence, it is an indirect reference to an object for secure access. You can compare windows objects with common C ++ objects.ProgramClass Association
To understand it, a file handle is returned when a file is created (createfile). The file creation process can be understood as a class constructor to write and read files.
These operations are actually file object methods.

Okay, I have talked a lot about it. We officially started introducing the Windows Object Model.

Windows implements an object model to ensure consistent and secure access to various internal services implemented in the execution program. As described earlier
Sequence executive is in kernel state. That is to say, we cannot see objects at the application level. We can only use handle to access objects. Do
You can create files and operateCompositionBut the actual operations are completed at the kernel level.
You have no choice except to call the function provided by it. All you get is a handle and a set of well-defined operations. On the other hand,
Some execution Program-level objects often contain primitive-level objects, which are provided by a lower-level kernel. So there are two types of objects, the execution program object
And kernel objects. We don't discuss the relationship between kernel objects and execution objects. It doesn't make much sense. We only discuss the execution program objects
Let everyone see some properties and operations of the object, have a deeper understanding of the object, not only know how to use handle to execute operations, but do not know its
Of course.

To maintain a love or friendship, we often need to think differently. We also come to think differently, from the perspective of Windows designers, why?
What features should the object model have when using the object model. This will at least be a little confusing. First, submit the following requirements:

Requirement 1: computers have a variety of resources, and different resources are used in different ways. If this is done by application developers,
Windows must provide a unified resource usage mechanism, which must abstract the commonalities of various resources and visualize the methods.
Is undoubtedly a good choice;

Requirement 2: One of the goals of Windows 2000 is to achieve C2-level security. Simply put, windows must adopt a certain protection mechanism for resources,
In implementation, object protection attributes and methods must be provided;

Requirement 3: From disks to monitors, there are too many computers, and certain management mechanisms must be adopted, such as object classification and unified naming;

Requirement 4: If each object is for only one process or only the kernel, the efficiency is too low and the information of the kernel will never be transmitted to the application,
Applications cannot access the kernel either. One of the important goals of using the object model is to use protected objects to make requests to the kernel and the kernel.
Service applications. Therefore, an object may be used by the kernel and multiple application processes at the same time. A counter mechanism must be provided to ensure the lifetime of the object.

According to each requirement, we can do some analysis and design on our own. You may have a better design scheme than Windows. If you can really design
Congratulations, we have some hope for our country's own OS. However, let's take a look at the design of Ms.
The design corresponds to each of the above requirements. These are the mechanisms that are running on Windows.

Design 1: An object must have the following basic attributes: Object Name (ID object) and object directory (Object Name storage location). These two attributes are similar to the File Manager.
File Name and directory. Common Operations for all objects: Close (the most common closehandle function), copy, query (get object)
), Wait for a single object (synchronize a thread with an object), wait for multiple objects (synchronize a thread with multiple objects ). In terms of performance
You can create and open various objects separately.
It should be noted that the abstract of the object is more difficult in software design, and there is no unified standard. Don't see only these few limitations.
The operation is simple, and Ms engineers have paid a lot of attention to this issue.

Design 2: security. The most common security mechanism is multi-level security. You can specify what each level can do. Windows objects are also
So. An object attribute contains a security descriptor attribute to determine who can use the object and what operations can be performed on the object. The "who"
It can be a process, thread or other object, or a User Token. At the same time, you need to add security operations, including query Security (obtaining objects
Security Descriptor) and set security (change the object's protection attribute by modifying the Security Descriptor ). Security details will be detailed later
Chapter introduction. (ThisArticleI wrote it earlier. At that time, I had a little understanding of the access control theory and technology. I will write another article later .)

Design 3: Object Management. This is what you see in the tool winobj. A total of 27 types of objects are implemented in windows.
Special object: Type object to describe these 27 types of objects, which can be seen in the objecttypes object directory. However, many objects can only be used by the program itself.
For example, the driver object. Only the object directory \?? And the objects under \ basenamedobjects are visible to the user program, but they are basically Operators
Is similar to the file connection on Linux. Now an object type attribute is added to the object property.
A type object contains the public information of a certain type of objects, such as the access type of such objects (read-only or readable and writable) and the memory class in which such objects can be stored.
Type (whether it is page memory or non-page memory), the method of this type of object (as mentioned above, some operations are implemented by different types of object, this is
Some routines define what to do when performing operations such as opening or closing an object ).

Design 4: Object count. Both processes and kernels use objects. processes use objects through object handles, while kernels use objects directly through references. In
Add three attributes to the image properties, including the number of opened handles, the number of opened handles, the linked list (which records the processes that opened the objects), and the reference count (note
The number of times the kernel references this object ). Each process opens this object, the number of opened handles increases by 1, and the reference count increases by 1.
When the number of references increases, only the reference count is increased. When both the number of opened handles and the reference count are 0, the object is closed and resources are released.

 

After the above analysis, the basic structure of the Windows Object is displayed. As shown in the following figure, an object consists of the object header and Object Body.
The object header is the public attribute of each windows object. Windows Object Manager uses Object headers to manage objects without considering object types. For the same
Object types, the object bodies are in the same format.
As mentioned above, an object has a record of the process that opens its handle, while a Windows process has a process handle table that records
All object handles. The process handle table is implemented in a three-level solution, similar to the x86 Memory Manager, which converts virtual addresses to physical address memory. In this case
We will mention the process structure again later.

This article mainly discusses the Windows Object Model. The content is abstract. I am racking my brains to compare it with the resource manager, but I always find it inappropriate.
an object is an abstract mechanism that is invisible to users after specific content such as files, devices, and processes.
I am directly dealing with these specific content during programming. What I want to describe is the laws of these specific content. For example, when accessing files and processes, I first obtain the handle, then
to provide access methods and limit access permissions, close the handle after the access is complete. A newbie looks forward to the vast msdn and SDK documents. When I write more, I will say that these things are similar and I am confused. This article aims to help you see the essence and not guide specific programming or solve practical problems.
In fact, if you have a deep understanding of the windows mechanism, the solution to specific problems will easily appear in your mind. The rest is to write programs, note
do not look down.