Section 9: Architecture Diagram

The Big Picture: Putting It All Together

You have now met every layer one by one. This section stacks them into one map of Windows. Look at it as a building: the hardware is the basement, the kernel is the ground floor with the locked doors, user mode is the open upper floors, and the single staircase between them is the system call.

Keep this page open as a cheat sheet. Later chapters will keep pointing back to it.

9.1 Complete Windows Architecture Visualization

What it is: One picture of the whole of Windows (10 and 11), from your apps down to the hardware.

┌────────────────────────────────────────────────────────────────────────┐
│ USER MODE (ring 3)                                                     │
│ ┌───────────────┐ ┌──────────────┐ ┌──────────────┐ ┌────────────────┐ │
│ │ Applications  │ │ .NET and UWP │ │ Services     │ │ System procs   │ │
│ │ chrome, Word, │ │ apps         │ │ (inside      │ │ smss, csrss,   │ │
│ │ games         │ │              │ │ svchost.exe) │ │ wininit, lsass │ │
│ └───────────────┘ └──────────────┘ └──────────────┘ └────────────────┘ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ Subsystem DLLs: kernel32, user32, gdi32, advapi32                  │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ ntdll.dll   (Native API: Nt... functions + syscall)                │ │
│ └────────────────────────────────────────────────────────────────────┘ │
╞════════════════════════════════════════════════════════════════════════╡  <- system call (syscall / sysret)
│ KERNEL MODE (ring 0)                                                   │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ EXECUTIVE (ntoskrnl.exe)                                           │ │
│ │ ┌─────────┐        ┌─────────┐       ┌─────────┐       ┌─────────┐ │ │
│ │ │ Object  │        │ Process │       │ Memory  │       │ I/O     │ │ │
│ │ │ Manager │        │ Manager │       │ Manager │       │ Manager │ │ │
│ │ └─────────┘        └─────────┘       └─────────┘       └─────────┘ │ │
│ │ ┌───────────────┐   ┌───────────────┐  ┌─────────┐  ┌────────────┐ │ │
│ │ │ Security Ref. │   │ Configuration │  │ Cache   │  │ PnP and    │ │ │
│ │ │ Monitor       │   │ Manager       │  │ Manager │  │ Power Mgrs │ │ │
│ │ └───────────────┘   └───────────────┘  └─────────┘  └────────────┘ │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ KERNEL (ntoskrnl.exe): scheduler, interrupts, exceptions, locks    │ │
│ └────────────────────────────────────────────────────────────────────┘ │
│ ┌──────────────────────┐                         ┌───────────────────┐ │
│ │ Drivers (.sys)       │                         │ win32k*.sys       │ │
│ │ device, file system, │                         │ windows + drawing │ │
│ │ filter, bus          │                         │ (kernel half)     │ │
│ └──────────────────────┘                         └───────────────────┘ │
│ ┌────────────────────────────────────────────────────────────────────┐ │
│ │ HAL (hal.dll): hides board-level hardware differences              │ │
│ └────────────────────────────────────────────────────────────────────┘ │
└────────────────────────────────────────────────────────────────────────┘
┌────────────────────────────────────────────────────────────────────────┐
│ HARDWARE: CPU, RAM, SSD, GPU, network card, motherboard                │
└────────────────────────────────────────────────────────────────────────┘

How to read it, from top to bottom:

Where the wall is. Notice the double line in the middle. Everything above it can crash without taking Windows with it. Everything below it shares one memory space and has no protection from itself. That is why a bad driver is so dangerous.

9.2 Data Flow Between Components

What it is: A trace of one real action moving through the layers. Here a program saves a file. The same path, with different managers, is used for almost any request: opening a registry key, creating a process or reading from the network.

┌──────────────────────────────────────────────────────────────┐
│ 1. Notepad: user clicks Save, calls WriteFile(...)           │ ring 3
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 2. kernel32 / kernelbase: checks input, calls NtWriteFile    │ ring 3
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 3. ntdll: puts service number in EAX, runs 'syscall'         │ ring 3
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 4. Kernel entry: switch stacks, validate arguments           │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 5. Object Manager: handle -> file object; SRM check was done │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 6. I/O Manager: builds an IRP, sends it down the stack       │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 7. Filter driver -> NTFS driver -> disk driver               │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 8. HAL / hardware: SSD writes data, raises an interrupt      │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 9. Interrupt handled; IRP completes; sysret to user mode     │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ 10. WriteFile returns 'success' to Notepad                   │ ring 3
└──────────────────────────────────────────────────────────────┘

What to notice:

• The request goes down through the layers, then the answer comes back up.
• Steps 1 to 3 are in user mode. Step 3 ends with the syscall door.
• Steps 4 to 9 are kernel mode: several managers cooperate (Object Manager, SRM, I/O Manager) and then the drivers.
• The hardware never talks to your app. It talks to the driver, and the driver answers the I/O Manager.

The same pattern for other requests:

A second flow: how the system builds itself at start-up (the "family tree" of Section 5, in order):

┌──────────────────────────────────────────────────────────────┐
│ ntoskrnl.exe + hal.dll + drivers start (boot loader hands over) │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ System process (PID 4) runs the kernel worker threads        │ ring 0
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ smss.exe: first user-mode process, builds sessions           │ ring 3
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ csrss.exe + wininit.exe (session 0); csrss + winlogon (session 1) │ ring 3
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ services.exe -> svchost.exe;  lsass.exe checks your logon    │ ring 3
└──────────────────────────────────────────────────────────────┘
                                │
                                ▼
┌──────────────────────────────────────────────────────────────┐
│ winlogon -> userinit.exe -> explorer.exe: you see the desktop │ ring 3
└──────────────────────────────────────────────────────────────┘

9.3 Which Parts Run in Kernel vs User Mode

What it is: A final sorting table. For every part you learned, is it ring 0 or ring 3?

Three rules of thumb:

1. .exe and .dll files are usually user mode. .sys files are kernel mode. The big exceptions are ntoskrnl.exe and hal.dll, which are kernel mode.
2. "SYSTEM account" does not mean "kernel mode". Many programs run as the SYSTEM user but still live in ring 3.
3. The dividing line is the CPU's ring, not how important a program is. lsass.exe is vital but is just a ring 3 program.

Why the split exists. Remember three big ideas from earlier chapters: rings (the CPU enforces who may do what), virtual memory (each process has its own private map), and system calls (the one controlled door). Windows is those three ideas turned into a working design.

Windows tip: In Task Manager's Performance tab, turn on Show kernel times (right-click the CPU graph). The darker line is ring 0 time and the lighter area is ring 3 time. Most of the time, ring 3 should dominate.

Summary