Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Overview
• Organization
• Model
• Components
• CPU Modes
• System processes
• Services processes
• Users processes
• Subsystems processes
• System services
[Link] 1
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
OS Organization
• Access to hardware is not allowed
• Access to hardware is made via system services
Applications
Virtual machine
Real machine
[Link] 2
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
OS Model
• Applications access the OS via one defined
Application Program Interface (API)
Application
API
OS
[Link] 3
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
OS Contexts
Applications
CPU runs in user mode
CPU runs in kernel mode
OS
[Link] 4
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
CPU Modes
• Protect critical system data from user applications
• User mode 3
2
• Kernel mode 1
[Link] 5
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
CPU Modes - mechanism
• User programs typically run in both modes
• CPU mode switch <> CPU context switch
mode
time
[Link] 6
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
CPU Modes - scenarios
user
kernel
[Link] 7
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
TCB
• Context
• No CPU restriction in kernel
• No memory restriction in kernel
• No security check in kernel
• Definition administrators
• Portions of the system trusted to enforce applications
the security kernel
drivers
• Components
• Most hardware hardware
• All kernel code
• Some user code (SeTcbPrivilege)
• Administrators
[Link] 8
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Memory Layout
• Each application occupies 4 GB of address space
• All applications share system memory space
memory address
Unprivileged
0x00000000
Application A Application B Application C ... Application Z
0x7FFFFFFF
memory address
Privileged
0xFFFFFFFF
[Link] 9
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
OS Major Components
System processes Services processes User processes Environment processes
Session manager POSIX
… …
Logon manager
alerter pinball
Security manager Win32
… explorer
Services manager
System services
user
kernel
Executive
Hardware Abstraction Layer
Hardware
[Link] 10
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Environment Subsystems
• Definition
• Role
• Types
.,,
... Win16 application
... Win32 application Win16 application
Posix application Win32 application Win16 application
Posix application Win32 application WOW DOS application DOS application
NTVDM NTVDM …
Posix Win32
[Link] 11
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Environment Subsystems - interfaces
• Subsystem
• Process runs in a private address space
• Application
• Sends messages to subsystem
• Unaware of messages
• Implicitely linked with systems‘s interfaces (image = code +
metadata)
[Link]
Functions calls
Win32 API
[Link] [Link] ... [Link]
Native API
[Link]
[Link] 12
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Environment Subsystems - strategy
Application Subsystem
Win32 API
Subsystem DLLs
Executive
[Link] 13
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Environment Subsystems - strategy
Application Subsystem
Win32 API
Subsystem DLLs
Native API CPU mode switch
Executive
[Link] 14
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Environment Subsystems - strategy
Application Subsystem
API
message CPU context switch
Subsystem DLLs
Native API CPU mode switch
Executive
[Link] 15
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Environment Subsystems - strategy
Service implementation CPU mode switching CPU context switching Message sent
performance
User process No No No
Executive Yes No No
Server Yes Yes Yes
[Link] 16
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Win16 Support
• MS-DOS applications
• One-one relation
• Win16 applications
• Many-one relation
< NT > NT
Windows MS-DOS
MS-DOS Windows
[Link] 17
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
System processes
• Are started by the system
• Are running on every system
• Cannot be stopped
[Link] 18
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Session Manager Subsystem
• Definition
• Role
• Particularities
• Part of the TCB
• Native user application
[Link] 19
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Logon Manager
• Definition
• Role
• Interactive logon request management
• Authentication User interface management
• User profile initialization
• Shell creation
• TASKMGR management
Who you are
(identification)
What you know What you are
(authentication) (authentication)
[Link] 20
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Local Security Authority Subsystem
• Definition
• Role
[Link] 21
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Service Control Manager
• Definition
• Role
[Link] 22
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
User Processes - creation
System
Smss
Permanent
Winlogon Csrss
Services Lsass
Userinit
Volatile (interactive)
Shell
...
[Link] 23
Windows – Key
Essential User Mode
Windows Components
Kernel Mode Components
Thanks!
[Link] 24