Shulou(Shulou.com)06/02 Report--

As the most popular desktop operating system, the development of Windows system has experienced several hardware revolutions, and its system architecture is basically stable. Microsoft claims that Windows 10 is the last generation operating system and unifies the underlying architecture of various versions of Windows.

Windows system is layered architecture, mainly divided into kernel mode and user mode, kernel mode is divided into hardware abstraction layer (HAL)-> kernel and driver layer-> execution body from bottom to top, and window management system. User mode is mainly NTDLL abstract layer, and various processes, such as: the underlying system support process-> service process-> user application, as shown in the figure:

Ntdll.dll

Ntdll.dll is a special system support library, mainly used for subsystem dll, mainly contains two types of functions:

System Services distributes stubs, calls Windows Executive System Services internal support functions for subsystems, subsystem dll, and exe image files

Most of the functions provided in Ntdll.dll are undocumented and start with Nt. environment subsystem

The environment subsystem is the operating environment for different versions of Windows (e.g. Windows 7 Ultimate, Windows Server2008 R2). Each exe executable image may not run on all versions of Windows. The/SUBSYSTEM modifier of the link command in VC++ specifies the executable environment of the exe image (e.g. dll set).

The environment subsystem process Csrss.exe (Client/Server Run-Time Subsystem) is the client/server run-time subsystem, which is the session manager (Smss.exe) process.

system process Idle process (special process, actually CPU idle time) System process (special process, including most kernel-mode system processes) Session manager (Smss.exe) Local session manager (Lsm.exe) Session 0 initialization (Wininit.exe) Login process (Winlogon.exe) Service control manager (Services.exe) Local security authentication server (Lsass.exe) Windows execution

The Windows executable is the upper layer of Ntoskrnl.exe (the lower layer is the kernel) and mainly contains the following components:

Configuration Manager Process Manager Security Reference Monitor I/O Manager Plug and Play (Pnp) Manager Power Manager Windows Driver Model Cache Manager Memory Manager Object Manager Kernel

The kernel is the lower layer of Ntoskrnl.exe and mainly includes:

kernel object kernel processor control area and control block

This is a bit more complicated, and there are articles dedicated to device drivers later

Device drivers run in kernel mode, mainly for user threads that initiate I/O requests. Device drivers are mainly divided into the following types:

Hardware Device Drivers File System Drivers File System Filter Drivers Other: (Network Redirection, Protocol Drivers, Kernel Drain Filter Drivers)

Driver framework: Early WDM, corresponding to DDK development kit WDF framework based on WDM encapsulation, corresponding to WDK development kit hardware abstraction layer (HAL)

Hardware abstraction layer is Windows can be ported to various hardware platforms, it is a loadable kernel module, for different hardware platforms, providing a unified service interface.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.