Section 4: User-Mode Components

The Big Picture: Everything Above the Wall

Sections 2 and 3 covered kernel mode (ring 0). Now we cross the wall into user mode (ring 3), where almost all the code on your PC runs: your apps, the Windows libraries, and the background programs that Windows starts for itself.

User mode has one big rule: code here cannot touch hardware or kernel memory directly. To do anything real, it must ask the kernel through a system call (Section 8.5). This keeps one broken program from hurting the rest.

┌──────────────────────────────────────────────────────────┐
│  USER MODE  (ring 3)                                     │
│                                                          │
│  ┌──────────────┐  ┌──────────────┐  ┌────────────────┐  │
│  │ Applications │  │  Services    │  │ System         │  │
│  │ chrome.exe   │  │  (svchost)   │  │ processes      │  │
│  │ notepad.exe  │  │              │  │ (smss, csrss)  │  │
│  └──────┬───────┘  └──────┬───────┘  └───────┬────────┘  │
│         └─────────────────┼──────────────────┘           │
│                           ▼                              │
│  ┌────────────────────────────────────────────────────┐  │
│  │ Subsystem DLLs: kernel32, user32, gdi32 ...        │  │
│  ├────────────────────────────────────────────────────┤  │
│  │ ntdll.dll  (the gateway to the kernel)             │  │
│  └────────────────────────────────────────────────────┘  │
└──────────────────────────┬───────────────────────────────┘
                           ▼   system call
                     KERNEL MODE

4.1 Win32 Subsystem

What it is: The Win32 subsystem is the layer that gives programs the familiar Windows "feel": windows, buttons, files, threads, and so on. A subsystem is a layer that presents a particular programming style on top of the NT core.

Why "subsystem"? NT was built to support more than one personality (the original design also supported OS/2 and POSIX styles). Over time the Windows (Win32) personality became the one everybody uses. Windows 10 and 11 still call the idea the "environment subsystem". Other personalities, like the Windows Subsystem for Linux, run beside it.

What it contains. A set of DLLs (Dynamic Link Libraries: files of ready-made functions that many programs share) and one helper process:

The kernel-mode half. Window management and graphics are fast-moving, so since NT 4.0 their core code runs in kernel mode, in files named win32k*.sys. user32.dll and gdi32.dll are the user-mode "front desks" that call into it.

A simple flow. When Notepad opens a file:

notepad.exe  →  kernel32!CreateFileW  →  ntdll!NtCreateFile
             →  (system call)  →  kernel: I/O Manager  →  NTFS driver  →  SSD

The app never knows about NTFS or SSDs. It only knows CreateFileW.

Windows tip: In Process Explorer (Section "Practical Lab"), select any program and open the lower pane in DLLs view. You will see kernel32.dll, user32.dll, ntdll.dll loaded in almost every graphical app.

4.2 Client/Server Runtime (csrss.exe)

What it is: csrss.exe (Client/Server Runtime Subsystem) is a protected system process. It is the server side of the Win32 subsystem: applications are "clients" that sometimes ask it for help.

Why it exists. In early NT, csrss.exe did a lot: drawing, console windows and more. Since NT 4.0 most of that moved into the kernel (win32k) for speed. Today csrss.exe handles a smaller, but still essential, set of duties:

• It is part of starting and ending processes and threads for Win32 programs (a program is told to the subsystem when it is born).
• It supports console and shell-related plumbing and some system shutdown steps (console windows themselves are mostly hosted by conhost.exe on modern Windows).
• It is part of the per-session set-up: each session gets its own csrss.exe.

How you can tell it is special. You will see one csrss.exe per session (so usually two: one for session 0, one for your session). If csrss.exe ever stops, Windows goes down with a blue screen, because the system cannot run without it. It runs as a critical process under the SYSTEM account.

Windows tip: Real csrss.exe lives only in C:\Windows\System32. Malware sometimes uses the same name in another folder. Check the path in Task Manager (right-click → Open file location).

4.3 Services Processes (svchost.exe)

What it is: A service is a program that runs in the background, without a window, usually from boot and not tied to any user. Examples: the Windows Update service, the Print Spooler, the DHCP client. Services are covered fully in Part 5.

What is svchost.exe? Many Windows services are not standalone programs but DLLs. They cannot run alone. So Windows starts a generic host program, Service Host (svchost.exe), which loads one or more service DLLs.

 services.exe  (the Service Control Manager, Section 5.3)
      │ starts
      ├── svchost.exe -k netsvcs   ── hosts: service A, B, C ...
      ├── svchost.exe -k LocalService ── hosts: service D, E
      └── svchost.exe -k ... 

Why many svchost.exe rows? In Task Manager you see dozens. Each hosts a group of services. Grouping saves memory, and splitting into separate groups limits the damage if one service crashes. On Windows 10 and 11, on PCs with plenty of RAM, many services even get their own svchost for safety and easier troubleshooting.

The -k option. The text after -k names the group (for example netsvcs, LocalServiceNetworkRestricted). Groups also decide which account the services run under (SYSTEM, Local Service, Network Service), so they get only the rights they need.

Windows tip: To see which services live inside which svchost, open Command Prompt and run tasklist /svc. In PowerShell: Get-Service | Where-Object Status -eq Running.

4.4 Session 0 (System) vs Session 1+ (Users)

What it is: A session is one separate "login world" in Windows. Each session has its own windows, desktop and set of user processes.

Session 0 isolation. Before Windows Vista, services ran in the same session as the first logged-in user (session 0). A service could pop up a window on your desktop, and a user program could easily send messages to a powerful service. That was a security hole. Starting with Vista:

        Session 0                    Session 1                Session 2
  ┌──────────────────┐        ┌──────────────────┐     ┌──────────────────┐
  │ services.exe     │        │ csrss.exe        │     │ csrss.exe        │
  │ svchost.exe ...  │        │ winlogon.exe     │     │ winlogon.exe     │
  │ lsass.exe        │        │ explorer.exe     │     │ explorer.exe     │
  │ csrss.exe        │        │ your apps        │     │ their apps       │
  └──────────────────┘        └──────────────────┘     └──────────────────┘
   no screen, no user           Anna's desktop           Ben's desktop

What this means in practice.

• A service cannot show a window on your desktop. If it must talk to you, it uses a helper app in your session.
• A normal program cannot easily attack a service: they are in different sessions and the OS blocks the shortcuts.
• Every session has its own copy of csrss.exe and (for user sessions) winlogon.exe.

Windows tip: Task Manager → Details tab → right-click a column header → Select columns → tick Session ID. You will see services at 0 and your apps at 1 (or higher).

4.5 Applications

What it is: Applications (apps) are the programs you launch: browsers, editors, games, and so on. They sit at the very top of the user-mode stack.

What every app gets when it runs:

• its own process with a private virtual address space (Section 3.2)
• an access token copied from the user who launched it (Section 3.4)
• the standard DLLs loaded into its address space (ntdll.dll always, others as needed)
• at least one thread (the main thread)

Kinds of apps:

An app's limits. A normal app runs with the user's rights only. It cannot read another user's files, change protected system files or load a driver. If it crashes, only its own process disappears. This is exactly the isolation that rings and virtual memory were built for.

An app's view of the whole system. The app calls library functions. The libraries call ntdll.dll. ntdll.dll makes a system call. The kernel does the real work and returns the result. Everything below the application is invisible to it.

Summary