Section 3: Kernel-Mode Components

The Big Picture: The Managers in Detail

Section 2 listed the Executive's managers. Here we open each one. A good way to remember them: imagine a city. The Process Manager is the town hall that registers new residents. The Memory Manager hands out land. The I/O Manager runs the post office. The Security Reference Monitor is the police. The Configuration Manager keeps the records office. PnP and Power look after buildings and electricity.

All of these run in kernel mode (ring 0), inside ntoskrnl.exe.

3.1 Process Manager

What it is: The Process Manager creates and ends processes and threads. A process is a running program with its own private memory. A thread is one line of work inside it (Chapter 7).

What it keeps. For every process it holds a record in kernel memory (called EPROCESS), and for every thread a record called ETHREAD. These records say:

• the process ID (PID) and its parent
• which access token (the "ID badge") it has
• its private memory map
• a list of its handles (Section 6)
• its threads and their state

Creating a process. When you double-click an app, a chain begins in user mode (the CreateProcess function, Section 8). But the real work of making the process object is done here by the Process Manager. It asks the Memory Manager for a new address space, the Object Manager for a new handle, and then the kernel gets a first thread ready to run.

What it does not do. It does not choose who runs on the CPU. That is the kernel's scheduler. The Process Manager decides what exists.

Windows tip: Open Task Manager → Details tab. Each row is a process record, and the PID column is its ID. The first real one is System with PID 4. Chapter 9 covers processes deeply.

3.2 Memory Manager

What it is: The Memory Manager controls all memory. It gives every process a virtual address space: a private, imaginary map of memory that feels like the program owns the whole PC.

Recall Chapter 3. Programs use virtual addresses. The CPU's MMU turns them into physical addresses (real RAM spots) using page tables. The Memory Manager builds and updates those tables.

Its main jobs:

Two halves of the address map. On 64-bit Windows, the huge virtual address space is split into a user half (private to each process) and a kernel half (the same kernel and drivers for every process). A program in ring 3 cannot touch the kernel half. This is the hardware protection you saw in Chapter 2.

 One process's virtual address space (not to scale)

 high  ┌─────────────────────────┐
       │  KERNEL half            │ ← same for all processes,
       │  (ntoskrnl, drivers)    │   forbidden to ring 3
       ├─────────────────────────┤
       │  USER half              │ ← private to this process
       │  (exe, DLLs, heap,      │
       │   stacks)               │
 low   └─────────────────────────┘

Page fault. When a program uses a page that is not currently in RAM, the CPU raises a page fault. The Memory Manager catches it, finds the page (on disk or as a fresh blank page), loads it, and lets the program carry on. The program never notices.

3.3 I/O Manager

What it is: The I/O Manager (Input/Output Manager) is the post office for devices. Whenever any program reads a file, sends a network packet or draws on screen, the request goes through the I/O Manager.

The IRP. The I/O Manager wraps each request in a small package called an I/O Request Packet (IRP). The IRP says: "read 4096 bytes from this file, starting here, and put them in this buffer". The IRP then travels down a stack of drivers, as seen in Section 2.4.

 App: ReadFile(...)
        │
        ▼
 ┌──────────────────┐
 │   I/O Manager    │  creates an IRP
 └────────┬─────────┘
          ▼
 ┌──────────────────┐
 │ Filter driver    │  (antivirus looks at it)
 ├──────────────────┤
 │ File system      │  (NTFS: "which disk blocks?")
 ├──────────────────┤
 │ Disk driver      │  (talks to the SSD controller)
 └────────┬─────────┘
          ▼
        Hardware does the work, raises an interrupt
          │
 answer travels back up, app's ReadFile returns

Why a stack is clever. Each driver does one job. The antivirus does not need to know about SSD chips. The file system does not need to know about antivirus. You can add or remove one layer without rewriting the others.

Synchronous vs asynchronous. In synchronous I/O the program waits until the request finishes. In asynchronous (overlapped) I/O the program carries on, and Windows tells it when the work is done. Fast servers prefer asynchronous.

Devices are files. In Windows many devices can be opened like files: a disk volume, a serial port, the keyboard. That is why the same I/O Manager path serves all.

3.4 Security Reference Monitor

What it is: The Security Reference Monitor (SRM) is the security guard in the kernel. Whenever a program tries to open a file, a registry key, a process or any other protected thing, the SRM checks whether it is allowed.

The pieces it uses:

How a check works. When you open a file, the SRM compares the process's token with the file's ACL. If the rules allow the access you asked for, you get a handle. If not, you see "Access denied".

  Process with token:  [User: Anna, Group: Users]
          │  "open report.docx for writing"
          ▼
  SRM compares with the file's ACL:
     Anna      : read, write   ← match → ALLOW
     Everyone  : read

Other jobs. The SRM also decides which privileges a process holds (for example, the right to shut down the PC) and writes audit entries (records of who tried what) to the security log.

Who does the logging in? The SRM only checks. The program that checks your password is lsass.exe, a user-mode process (Section 5.4). Together they form Windows security.

3.5 Configuration Manager (Registry)

What it is: The Configuration Manager is the part of the Executive that implements the registry: Windows' big database of settings. It loads the registry files from disk into memory, handles reads and writes, and keeps them safe.

You will study the registry fully in Section 7. For now, remember:

• The registry stores settings for Windows, drivers, services and apps.
• It is organised in keys (like folders) and values (like items inside).
• The kernel itself needs the registry during boot: it reads the list of drivers to start from it.
• Programs reach it with ordinary functions (RegOpenKeyEx and others) or tools like regedit.

3.6 Plug and Play Manager

What it is: The Plug and Play (PnP) Manager finds hardware and gets it working, mostly without you doing anything.

What it does, step by step when you plug in a USB drive:

1. Bus driver notices a new device on the USB bus
2. PnP Manager asks the device "who are you?"  (an ID like USB\VID_xxxx&PID_xxxx)
3. PnP Manager looks for a matching driver  (INF files, driver store)
4. It loads the driver and starts it
5. It tells the rest of the system "a new disk is here"

More jobs. It also hands out resources (such as interrupt numbers and memory ranges) and handles removal: when you pull the cable it unloads the driver and tells programs the device has gone.

The device tree. The PnP Manager keeps all devices in a tree that mirrors the real buses. A USB mouse sits under a USB controller, which sits under the PCI bus, and so on. You saw this tree in the Chapter 4 lab.

3.7 Power Manager

What it is: The Power Manager decides how the PC uses electricity: when to sleep, dim the screen, slow the CPU, or switch off the disk.

What it controls:

Team work. When the lid closes, the Power Manager sends a "going to sleep" message to every driver (through IRPs). Each driver saves its device state. Then the system sleeps. On wake-up, the same messages go the other way. A driver that ignores the message can keep your PC from sleeping.

Windows tip: Run powercfg /a to see which sleep states your PC supports. Run powercfg /requests (as admin) to see which programs or drivers are stopping the PC from sleeping.

3.8 Device Manager

What it is: Device Manager (devmgmt.msc) is the window you can open (Win + X → Device Manager). It is not a kernel component. It is a user-mode tool that shows the PnP Manager's device tree in a friendly way.

Why it is in this list. It is the face of the PnP and Power machinery. When you see a yellow warning triangle next to a device, the PnP Manager could not start its driver. When you click Update driver, Device Manager asks Windows to find a better one.

What you can do there:

The big idea. Remember the split: the managers live in the kernel and do the work. Device Manager, Task Manager and regedit are only windows into that work. Kill the tool and nothing in the kernel changes.

Summary