Operating systems – The Windows operating system

Main components of the Windows operating system (overview)

Windows NT operating system family's architecture

Windows NT operating system family's architecture

software (sw) layers

main sw layers in an IBM PC or Wintel-compatible computer [Wintel refers to the partnership of Microsoft Windows and Intel producing personal computers using Intel x86 (or x64) compatible processors running Microsoft Windows]

The terms layer and interface, as well as client and service describe interaction between software components in an abstract way. In this case, we usually assume that the layers form a hierarchical structure.
Each layer provides an interface for the higher (i.e. more abstract) layer in a form of services implementing basic functions of the layer. So the higher layer can use the services through the interface in a standardized way without having to know the details of the implementation.
Sometimes the higher layer is called a client, and the lower layer that provides services (i.e. callable routines, functions, methods, access to shared objects etc.) for the client is called a server. The communication mechanism between them (called inter-process communication or IPC) is provided by the OS in order to manage shared data.
There are different approaches of IPC; e.g. shared memory buffers ("file mapping"), named pipes (following the FIFO principle), message passing through Asynchronous Local Procedure Calls (ALPCs), server mailslots or mailboxes, providing access to COM (Component Object Model) objects through method calls, access to shared resources through kernel mutexes ("mutual exclusion" synchronization objects) and semaphores etc.
further reading:
Wikipedia: IBM PC compatible
Wikipedia: Wintel
Wikipedia: Utility software
Wikipedia: Inter-process communication

Main components of the Windows operating system I.

Windows OS components running in kernel mode

Windows NT OS family's architecture - kernel mode

(1.1) hardware abstraction layer (HAL) (sets of routines that provide access to hw resources through standardized or unified interfaces; the HAL layer depends on the actual configuration of the personal computer; the HAL layer is intended to hide the low-level hardware details from device drivers; therefore this abstract layer allows the programmers to write device independent apps)

(1.2) device drivers (a driver is a program that operates a particular type of device; it provides a software interface for a given device enabling the OS and other programs to access hw functions without needing to know precise details about the hardware being used; kernel mode drivers are located in files with *.sys extension)

(e.g. MS Windows 8/10 → Search/Cortana: [This PC → Properties → Settings →] Device Manager, e.g. Network Adapters → Realtek PCIe FE Family Controller [interfacing the CPU PCI Express bus to a Fast Ethernet (100Mbps) network] → Driver)

(1.3) (micro- or hybrid) kernel* (the core of the OS which is the first OS program to be loaded and always resident in memory; generally, the kernel facilitates and controls interactions between hardware and software components; specifically, the kernel provides the core functions of the OS like task scheduling and interrupt handling; the components of the kernel are located in the ntoskrnl.exe file in the System32 directory)

(1.4) executive (executive services provide higher level functions such as memory management, security, I/O management, IPC management, process and thread management, PnP management, power management etc.; the services are implemented as objects which can be accessed by handles through well-defined interfaces; the objects are managed by the Object Manager; the components of the executive are located in the ntoskrnl.exe file in the System32 directory)

Windows handles are abstract pointers (i.e. unique identifiers) to the Windows executive objects (which represent system resources, e.g. files, images, threads etc.). Each handle has an entry in an internally maintained table and the entry, among others, contains the address of a given object. In order to manipulate (examine, modify etc.) the objects, the API functions use those handles to have access to the attributes (or properties) and the callable methods of the selected objects. For example, HANDLE hfile=CreateFile(L"example.txt",...); creates an instance of the file object; using this handle methods like read, write etc. can be called.

Main components of the Windows operating system II.

Windows OS components running in user mode

Windows NT OS family's architecture - user mode

(2.1) subsystem DLLs* (the Windows Subsystem DLLs act as intermedieries between user applications and the Windows kernel, translating API calls into system functions)

Windows Subsystems (e.g. Windows Subsystem for Linux, WSL; Windows Subsystem for Android, WSA) are compatibility layers within the Windows OS that allow applications to run in different OS environments (e.g. Linux or Android); a given subsystem provides an environment and an interface between a user mode application and the Windows kernel; each subsystem typically provides an application programming interface (API) that allows applications to interact with the Windows kernel and other system components such as drivers and other services

(2.2) Windows API* functions (the Windows application programming interface is the user-mode system programming interface for the Windows OS family; using the functions of Windows API we can develop applications that can run on the different versions of the Windows OS)

(2.3) Windows services* (Windows services are background processes that are launched by the OS and operate in the background independently from the logged-on users (similarly in concept to Unix daemons); they offer common services to the programs or processes in system, local or network context)

(e.g. MS Windows 8/10 → Search/Cortana: Services; Task Manager: Services; e.g. Device Setup Manager, DHCP Client, DNS Client, Windows Update etc.)

(2.4) system processes and threads,* including

  • – resident system processes* (they are always present and responsible for the boot process and the operation of the computer)
  • – background processes (each providing a set of resources for running apps)
    further reading:
    Wikipedia: List of Microsoft Windows components
    Wikipedia: Dynamic-link library

    • firmware (fw)

    In general, programs which provide hardware abstraction services to "high-level" software and stored in non-volatile memory devices are considered firmware (like BIOS and UEFI).
    further reading:
    Wikipedia: Firmware

    BIOS (basic input-output system)

    further reading:
    Wikipedia: BIOS

    UEFI (Unified Extensible Firmware Interface)

    further reading:
    Wikipedia: UEFI

    kernel

    there are different kernel architecture designs

    further reading:
    Wikipedia: Kernel

    Dynamic-link libraries (DLLs)

    a DLL is a shared library in the Microsoft Windows operating system which can contain portable executable code, functions, data and other resources (e.g. icons, fonts etc.) in an executable file format; for example,

    Note that executable files (.exe), DLL files (.dll) and driver files (.drv) use the same format.

    further reading:
    Wikipedia: Microsoft Windows library files⇒

    Windows API (Application Programming Interface)

    The Windows API provides core services to build desktop and server apps that can run successfully on all versions of MS Windows. The functions provided by the Windows API can be grouped into certain categories. (The functions reside in one or more corresponding DLL files in the \Windows\System32 folder.)

    .NET Framework

    The .NET Framework (pronounced as "dot net") is a proprietary software framework developed by Microsoft that runs primarily on Microsoft Windows. The .NET ("dot net") is a free and open-source computer software framework for Windows, Linux, and macOS operating systems.

    Both platforms provide various services (user interface, data access, database connectivity, cryptography, web application development, numeric algorithms, network communications etc.) for application program developers to build desktop, web, and mobile apps in a software environment that can be implemented and run on any OS.

    The main components of the implementation of the .NET Framework in Windows are as follows:

    further reading:
    Wikipedia: .NET Framework⇒
    Wikipedia: .NET⇒
    Microsoft: What is .NET Framework?⇒
    Microsoft: What is .NET?⇒

    Windows services

    Examples of Windows services

    (1) native Windows system services (background processes that run without a user interface and provide core OS functionality; they are managed by the Service Control Manager or SCM system process that starts, stops and manages Windows services; SCM manages a database and acts as a supervisor of the installed services; SCM is located in the \Windows\System32\services.exe executable file)

    (1.1) Remote Procedure Call (RPC, RpcSs); RPC a critical system service leading to BSOD (Blue Screen of Death) if the user stops it. RPC is a powerful, central IPC technology based on the client-server model; RPC enables a client process to call functions through the RPC server process across process or machine boundaries.

    In case a standard local synchronous RPC (Advanced LPC, ALPC), the Windows Memory Manager creates an ALPC Section Object (in kernel mode) allocating enough physical memory for a large data payload, and then associate the Section Object with the ALPC port. The Section Object will handle memory mapping to facilitate communication between the client and the server processes via shared memory.

    Memory mapping means creating a shared, common physical memory space for separate processes so that they can read and write data in user mode directly through their own virtual addresses to the shared memory (to avoid interrupts). When communicating, the calling thread is blocked and placed into a wait state by the kernel (i.e. waiting for the called process to return data).

    Windows local asynchronous RPC (LRPC or Advanced LPC, ALPC) utilizes the APC mechanism for local inter-process communication (IPC).

    In older 32-bit systems (like legacy Windows) system calls invoked software interrupts. Modern 64-bit systems are capable to bypass the RAM-involved "traditional" interrupt system using alternative hardware features of modern CPU-s.

    (1.2) DCOM Server Process Launcher (DcomLaunch); a critical system service running inside svchost.exe. It is responsible for launching ("spawning") separate, independent background processes as COM servers to provide access to object-based software components for client processes.

    The requested sw component should be registered as a COM object, and its host can be implemented as either an executable to be run directly, or it can be located in a dll file to be hosted by dllhost.exe. The COM server (as the host for the requested COM object) will run as a background process, and the DcomLaunch service returns a pointer to a serialized and aptly structured ("marshaled") data packet to the client which contains e.g. data and instructions how to find and access the requested COM object. After the data packet has been processed, the client process can communicate with the background COM server process using RPC and so directly bypassing the DcomLaunch service.

    Other examples of Windows services

    (2) third-party services (programs that are registered as background services by installed external applications (e.g. antivirus software, hardware drivers etc.); they are often located in the Program Files directory)

    Note that for those DLL-based services which do not have their own executable (*.exe) file, the Service Host (svchost.exe) process (a generic host or "container" process) is responsible for hosting, executing and running background services launched by the Service Control Manager (SCM, services.exe) system process.*

    processes and threads

    In general, a program has an executable (*.exe) file which is a static sequence of instructions. A running program has its own unique process. A process is a container for a set of resources (memory, security context, handles to system objects, pointer(s) to at least one thread etc.) needed and used when executing the program. A process can contain multiple threads (a kind of "lightweight" processes) that share the same memory. Although most applications run as a single process, some applications (e.g. browsers) create multiple child processes.

    When a client (a program or one of its processes) needs a particular resource, the corresponding process will serve the requested resource for the client by its promptly created instance or thread.

    A program (or process) can create one or more processes each of which can also be a parent of one or more child processes. In this way the parent-child relationships between the processes form a tree hierarchy where each child process points to its parent process. In case a parent process is deployed ("killed") its child processes will be called orphans.

    A thread is an instance of a process which can be executed. Multiple threads can run concurrently. There should normally be at least one thread for each running process, and a process can host many threads.

    The tasks (i.e. the apps, the background processes, and the system processes including their threads) that are actually running on the computer can be explored by the Task Manager. Some noteworthy information provided by the Task Manager are as follows:

    Note that the parent and child processes may form a process tree but the Task Manager does not show the parent-child relationships between processes. Instead, we can use the Process Explorer from Sysinternals, or the tlist /t command from the Windows SDK.

    further reading:
    Wikipedia: Thread (computing)
    Microsoft: Process Explorer⇒

    system processes

    further reading:
    Medium: Windows System Processes –
    – An Overview for Blue Teams by Nasreddine Bencherchali⇒
    Wikipedia: Client/Server Runtime Subsystem

    GUI (graphical user interface; Windows)

    further reading:
    Wikipedia: Windows shell

    Boda István, 2024-2026.