Windows system Architecture

Four types of user-mode processes:
1. System support processes, such as logon process and Session Manager, not Windows services, no service control manager started
2. Service processes, some components that run in Windows service mode
3. User Application process
4. Environment subsystem server process, which implements the Support section of the operating system environment, where the operating system is presented to the user
Or a personalized part of the programmer, three subsystems: Windows, POSIX, and OS/2. (You can subsystem from the PE file
Read out the subsystem that the application is running)

Windows kernel-mode components
1.Windows actuators, including basic operating system services such as memory management, process and thread management, security, IO,
Network and cross-process communication
The 2.Windows kernel, consisting of a set of low-level operating system functions, such as thread scheduling, interrupt and exception distribution, and multiple
Manager synchronization
3. Device drivers, including hardware device drivers, including file systems and network drivers
4. Hardware abstraction Layer HAL, a special layer of code that puts the kernel, device drivers, and the rest of the Windows execution body, with the flat
Isolate the hardware differences associated with the
5. Windows and graphics system, implemented GUI functions (i.e. Windows user and GDI functions), such as window processing, user interface
Controls, as well as drawing

Windows core System files

Ntoskrnl.exe execution Body and kernel
Ntkrnlpa.exe execution body and kernel, support Physical Address extension PAE
Hal.dll Hardware Abstraction Layer
Kernel mode part of the Win32k.syswindows subsystem
Ntdll.dll internal support functions, and system service distribution stubs for executing body functions

Kernel32.dll
Advapi32.dll
Core subsystem DLLs for User32.dllwindows
Gdi32.dll

subsystem information is stored in the HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Subsystems
Require lists the subsystems that were loaded when the system was booted, Windows and Debug. The Windows value is Csrss.exe, which represents the
Client/Server Runtime subsystem that contains the file specification for the Windows subsystem. The Kmode value is Win32k.sys, which is the Windows
The file name of the Subsystem kernel mode section.

The environment subsystem role is to expose a subset of the Windows Base System services to the application. Each subsystem provides a
Access to different parts of Windows native services.

Each executable file is bound to one and only one subsystem. When an image file is run, the generation of the process is created
The code checks the subsystem type code of the image header, so he can notify the correct subsystem that a new process has been created.

User applications do not directly invoke Windows system services, but instead, they do so through one or more subsystem DLLs.
The role of the subsystem DLL is to convert a documented function into some appropriate internal (usually not documented) Windows system
Service invocation. These conversions may or may not send a message to the environment subsystem that is serving the user application
。

When an application calls a function in a subsystem DLL, the following conditions may occur
1. The function is fully implemented in the subsystem DLL, run in user mode, the result of the run is returned to the caller, not to the environment
The subsystem process sends a message, and there is no system service to invoke the Windows execution body.
2. This function requires that the Windows execution body be called one or more times.
3. This function requires that some work be done in the environment subsystem process (the environment subsystem process runs in user mode and is responsible for maintaining the
The state of the client application running under its control). In this case, the function is sent as a message to the environment subsystem
A/C request, which allows the environment subsystem to perform an operation, and then the subsystem DLL waits for an answer and returns the answer to the caller.
CreateProcess and CreateThread are a combination of the second and the third

Components of the Windows subsystem
1. Environment subsystem process Csrss.exe, including the following support
(1) Console window
(2) Create or delete processes and threads
(3) Partial support for 16-bit virtual DOS machine
(4) Some other functions
2. Kernel-mode device driver (Win32k.sys), which contains
(1) Window Manager, Control window display, manage screen output, collect keyboard, mouse and other device input, responsible for the user
The message is passed to the application
(2) Graphics Device Interface GDI, a library of functions specifically for graphics output devices, including line, text, and graph drawing functions, and
Drawing Control functions
3. Subsystem DLLs, such as Kernel32.dll,advapi32.dll,user32.dll,gdi32.dll. They will have documented the
Windows API functions, translated into appropriate and documented kernel-mode system service invocations in Ntoskrnl.exe and Win32k.sys
4. Graphics device drivers refer to hardware-related graphics display drivers, printer drivers, and video miniport drivers
Order

Ntdll.dll
is a special system support library, mainly used for subsystem DLLs, including two types of functions
1. System service distribution stubs, they invoke the Windows Execution Body service
2. System support functions for subsystems, subsystem DLLs, and other native image files to use
The first set of functions provides an interface for Windows Execution System services, which can be called through these interface functions in user mode
System services for Windows actuators, such as NtCreateFile, most of these functions can be accessed through WINDOWSAPI
Get.
For each of these functions, Ntdll contains an entry point with the same name. The code inside the function contains the processor system node
A configuration-dependent mode switch instruction that can be switched to kernel mode to invoke the system service dispatcher. Distribution Device
After some parameters have been checked, the kernel mode system service is actually called, including the actual code inside the Ntoskrnl.exe.
Ntdll also contains a number of support functions, such as image Loader Ldr, heap Manager, Windows subsystem process communication function CSR,
As well as the general runtime process RTL, also contains the asynchronous procedure calls in user mode for APC and exception distributors.

Executive Body
The Windows execution body is the upper layer in the Ntoskrnl.exe and the kernel is the lower layer. The execution body contains the following content functions
1. Export functions, which can be called in user mode, are called system services and are exported through ntdll. These services
The vast majority can be accessed through WINDOWSAPI, or through the API of another environment subsystem. Some have not been
Functions such as ntqueryinformationprocess, etc.
2. Device driver functions that can be called through the DeviceIoControl function.
3. Functions that can only be exported in kernel mode, and functions that have been documented in DDK
4. Called in kernel mode, but not in DDK the exported function (such as INBV beginning function)
5. defined as global regal but not exported functions such as those that begin with IOP or MI
6. A function that is defined as a global symbol but inside a module

The execution body contains the following components
1. Configuration Manager, responsible for implementing and managing the Registry
2. Process and Thread Manager
3 .....

Kernel
There is a set of functions in Ntoskrnl.exe and the underlying support (interrupts and exceptions) for the hardware architecture. Many of the letters in the kernel
The number is also described in the DDK document, such as a function at the beginning of a Ke

Kernel objects
Thread scheduling and distribution, the roommate kernel itself to implement the
An executor represents a thread and other sharable resources as objects that require some policy overhead to maintain their
Like handles, and the various security checks that protect them, the corresponding resource quotas. The kernel implements a simpler set of objects, called
As a kernel object, it helps the kernel to control the central processing process, and supports the creation of the execution body object. The majority of the Executive Body layer
Objects are encapsulated into multiple kernel objects, merging their kernel attributes.
A group of control objects establishes a set of semantics for controlling the functions of various operating systems, such as APC, DPC, interrupt objects
The other group is the dispatcher object, which incorporates the ability to synchronize, which alters or affects the scheduling of threads. The Dispatcher object includes the kernel
threads, mutexes, kernel event pairs, events, semaphores, timers, wait timers. The executable uses kernel functions to create
Instances of the kernel objects and maintain those object instances.

Inside Native API

System processes and Systems threads
The system process is the mother of a particular thread, a special thread that runs only in kernel mode, called the kernel-mode system line
Ride. System threads have all the properties and environments of normal user-mode threads, but they can only run in system space in kernel mode
The loaded code, whether the code is in Ntoskrnl.exe or in any other loaded device driver. And
System threads do not have a user process address space, so any dynamic storage space, they must be from the operating system's memory
Allocations in the heap, such as from a paged or non-paged pool.

Windows system Architecture