Chapter 1
Windows API
Definition
The user‑mode system
programming interface for
Windows operating systems.
Evolution
16‑bit Windows API: Original
interface for early Windows
versions.
Win32 API: Name used for the
32‑bit interface to distinguish it
from the 16‑bit API.
Chapter 1 1
Windows API: In this book,
encompasses both 32‑bit and
64‑bit interfaces.
Documentation
Available free online via the
Windows SDK on MSDN
( [Link] ).
Included in all MSDN subscription
levels.
Recommended reference:
Windows via C/C++, Fifth Edition
by Jeffrey Richter & Christophe
Nasarre (Microsoft Press, 2007).
Major Function Categories
1. Base Services
Chapter 1 2
2. Component Services
3. User Interface Services
4. Graphics and Multimedia
Services
5. Messaging and Collaboration
6. Networking
7. Web Services
Book’s Focus
Internals of key base services:
Processes & threads
Memory management
I/O
Security
Chapter 1 3
Microsoft .NET Framework
Core Components
Framework Class Library (FCL):
Collection of reusable classes.
Common Language Runtime
(CLR):
Managed code execution
environment.
Features: JIT compilation,
type verification, garbage
collection, code‑access
security.
Improves productivity and
reduces common errors.
Implementation Details
Chapter 1 4
CLR is a classic COM server
implemented in a user‑mode DLL.
All .NET components are
user‑mode DLLs built atop
unmanaged Windows API calls.
No part of .NET runs in kernel
mode.
Recommended Reference
CLR via C#, Third Edition by
Jeffrey Richter (Microsoft Press,
2010).
Component Relationship (Figure 1‑1)
pgsql
Copy code
Chapter 1 5
.NET Application
↳ Framework Class Library Assem
blies (user‑mode DLLs)
↳ CLR DLLs (COM server)
↳ Windows API DLLs
↳ Windows Kernel
User Mode
Managed code → FCL → CLR
Unmanaged code → Windows
API
Kernel Mode
Core OS services and drivers
Chapter 1 6
History of the Win32 API
Origins
Initial Target:
Windows NT began as a
successor to OS/2 2.0, using the
32‑bit OS/2 Presentation
Manager API as its primary
interface.
Market Shift:
Windows 3.0 launched and
rapidly gained adoption.
Microsoft redirected NT’s
purpose to be the next
Chapter 1 7
generation of Windows, not
OS/2.
Birth of “Win32”
Need for a New API:
Prior Windows APIs were 16‑bit
only (e.g., Windows 3.x).
NT required a 32‑bit interface for
modern applications.
Naming:
To distinguish from 16‑bit, the
32‑bit interface was dubbed
Win32 API.
Supported both 32‑bit
Windows NT and later 32‑bit
Chapter 1 8
Windows 95/98.
Compatibility Strategy
Function Names & Semantics:
Retained as much of the 16‑bit
API naming and behavior as
possible.
Examples: Many Win16 functions
have identical or very similar
Win32 counterparts.
Data Types & Calling Conventions:
Mapped legacy types to new
32‑bit equivalents (e.g., 16‑bit
WORD → 32‑bit DWORD ).
Chapter 1 9
Ensured minimal code changes
when porting applications.
Benefit:
Smooth porting path for existing
Windows 3.x applications to run
on NT without extensive rewrites.
Terminology Clarifications
In Windows documentation, terms like
“service” and “routine” vary by
context. Below are the definitions used
in this book.
Windows API Functions
Chapter 1 10
Definition: Documented, callable
subroutines exposed by Windows
user‑mode libraries.
Examples:
CreateProcess
CreateFile
GetMessage
Native System Services (System
Calls)
Definition: Undocumented, low‑level
OS services invoked by Windows API
functions.
User‑Mode Entry Points: Prefixed
with Nt or Zw (e.g.,
Chapter 1 11
NtCreateUserProcess ).
Role: Perform core OS work (process
creation, memory management) in
kernel mode.
Further Reading: See “System
Service Dispatching” in Chapter 3.
Kernel Support Functions
(Routines)
Definition: Internal OS routines
callable only from kernel mode.
Memory Allocation Example:
allocates
ExAllocatePoolWithTag
memory from kernel pools for
drivers.
Chapter 1 12
Windows Services
Definition: Long‑running processes
managed by the Service Control
Manager (SCM).
Characteristics:
Run in user‑mode sessions (often
Session 0).
Start automatically or on demand.
Example: Task Scheduler service
(supports the at command).
Note: Device drivers are
registry‑listed as “services” but are
not covered under this term here.
DLLs (Dynamic‑Link Libraries)
Chapter 1 13
Definition: Binary modules
containing exported functions that
can be loaded at runtime.
Advantages over Static Libraries:
Single in‑memory copy shared by
all referencing processes.
Versioning and patching via
replacement without recompiling
apps.
Examples:
[Link] (Windows API core)
[Link] (C runtime)
.NET Assemblies:
Chapter 1 14
Also built as DLLs but expose
metadata rather than native
exports.
CLR loads types & members via
assembly metadata parsing.
Chapter 1 15