OS Internals ABCs

I started to dig deeper into windows internals. In the past couple of months I started to learn more about kernel, kernel debugging, symbols, memory management and many other windows internals components. I also took a couple of courses one of them was the Windows Internals lectures by David Solomon and Mark Russinovich authors of Windows Internals book. OS is a very interesting field to read about. Most of my information are taken from Windows Internals, 4th edition (Microsoft Press, David Solomon and Mark Russinovich) and my basic knowledge and searching the internet about operating systems in general.

The OS is the software that manages all the computer resources. These resources include managing hardware, memory, running programs, multitasking and scheduling tasks, managing storage, and handling communication.

One thing I read before is that kernel is the heart of the OS. Kernel is the core of an OS which manages the machine's hardware resources (including the processor and the memory), and provides and controls the way any other software component can access these resources. The kernel runs with a higher privilege (kernel mode) than other programs (which called user mode programs). The power and robustness of an OS's kernel play a major role in shaping overall system design and reliability.

So as a critical part of the OS that controls all devices and hardware on your computer, the kernel must be protected from being accessed or modified by a user application. User applications code runs in user mode, whereas OS code runs in kernel mode. User and kernel modes are two processor access modes, where a kernel mode refers to a mode of execution privilege that grants access to system memory and all CPU instructions. Windows protection environment prevents anything running in user mode from directly accessing hardware.

Although each Windows process has its own private memory space (where no other process can access/modify this memory space unless allowed to by the process who owns this private memory space), the kernel-mode operating system code (and by that I mean all the OS resources, system memory and CPU instructions) and the device driver code share one memory space. In other words, once in kernel mode, OS and device driver code has complete access to system memory space and can access objects.

Before we continue let's just define what's a driver is. A device driver is an executable, literally drives the hardware device to behave in a specific way (provided by the OS) and returns any results from the device about that behavior. So, the device driver allows the OS to communicate with a particular piece of hardware.

Back to kernel mode, because the bulk of windows OS runs in kernel mode, it's vital that components running in kernel mode must be carefully designed, implemented and tested; once in kernel mode you have access to all OS data. Any mistake in a driver running in kernel mode (for example trying to access or modify OS resources) will cause the OS to crash at once causing the blue screen with the name of the driver and reason of the violation. This simply means that the blue screen crash done by the windows doesn't mean that Windows is crappy; it's Windows last way of defending itself and defending the user from a misbehaved application trying to access or modify vital information. This vulnerability was one of the reasons behind driver-signing mechanism introduced in windows, which warns the user if an attempt to add an unauthorized (unsigned) driver.

Note this is kind of simplified version of the Windows architecture and it does not show all components.

The types of user-mode processes are:

• Service processes that host windows services, such as Task Scheduler and Spooler services. Services generally run independently of user logins.
• User applications.
• Environment subsystem server processes, which implement part of the support for the operating system environment, or personality presented to the user and programmer.

Under Windows, user applications don't call the native Windows operating system services directly; rather, they go through one or more subsystem dynamic-link libraries (DLLs). The role of the subsystem DLLs is to translate a documented function into the appropriate internal (and generally undocumented) Windows system service calls. This translation might or might not involve sending a message to the environment subsystem process that is serving the user application.

The kernel-mode components of Windows include the following:

• The Windows executive contains the base operating system services, such as memory management, process and thread management, security, I/O, networking, and inter-process communication.
• The Windows kernel consists of low-level operating system functions, such as thread scheduling, interrupt and exception dispatching.
• Device drivers.
• The hardware abstraction layer (HAL) is a layer of code that isolates the kernel, device drivers, and the rest of the Windows executive from platform-specific hardware differences (such as differences between motherboards).
• The windowing and graphics system.