Chapter 8 · Windows Architecture

Knowledge Check

8 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What does NT stand for, and which Windows versions use the NT architecture today?
  2. What are the two layers inside ntoskrnl.exe?
  3. What does the HAL do?
  4. What is the PID of the System process, and why is it not a normal program?
  5. Which process is the first user-mode process started by the kernel?
  6. What is a handle?
  7. Name the two "real" root keys of the registry.
  8. Where is the user's own registry hive stored?
  9. Which instruction moves the CPU from user mode to kernel mode on modern 64-bit PCs?
  10. Which session do Windows services run in, and what is that rule called?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. NT

New Technology. All modern Windows (10, 11 and the server editions) is NT-based.

2. Inside ntoskrnl.exe

The Kernel (scheduling, interrupts, exceptions, locks) and the Executive (the managers).

3. The HAL

It hides small hardware differences between boards (interrupt controller, timers, multi-core start-up) so the kernel can be the same on every PC.

4. System

PID 4. It has no .exe file. It is the process that owns the kernel-mode worker threads.

5. First user-mode process

smss.exe (Session Manager).

6. Handle

A per-process number that refers to a kernel object. The process never touches the object directly.

7. Root keys

HKEY_LOCAL_MACHINE (HKLM) and HKEY_USERS (HKU). The other three are views.

8. User hive

NTUSER.DAT in the user's profile folder, for example C:\Users\Anna\NTUSER.DAT.

9. Syscall instruction

syscall (with sysret to return).

10. Services session

Session 0. The rule is Session 0 isolation (since Windows Vista).

UNDERSTANDING QUESTIONS

Q1. Why does Windows need both a Kernel layer and an Executive layer instead of one big block?

Answer The kernel layer is small and only deals with CPUs, threads and interrupts. The Executive holds the managers that decide what exists and what is allowed. Keeping them apart makes each part simpler, easier to test and easier to change without breaking the rest.

Q2. Why do applications call kernel32.dll and not ntdll.dll directly?

Answer Win32 is documented and stable for decades. The Native API in `ntdll.dll` is mostly undocumented and may change between versions. Win32 functions check inputs and translate them (for example, `C:\file` becomes `\??\C:\file`) before calling the Native API.

Q3. Why are drive letters said to be "symbolic links"?

Answer Inside the Object Manager namespace, `C:` is an entry in `\GLOBAL??` that points to a device such as `\Device\HarddiskVolume3`. Windows follows the link and passes the request to the file system driver.

Q4. Why does Windows keep the registry in several hive files instead of one?

Answer Different parts have different life cycles and owners. SYSTEM is needed early at boot, SOFTWARE and SAM serve other purposes, and each user has a separate `NTUSER.DAT` that is loaded at logon and unloaded at logoff. Separate files make backup, protection and loading simpler, and keep one user's data apart from another's.

Q5. Why must the kernel check every pointer sent in a system call?

Answer Code in ring 3 is not trusted. A program might pass an address inside kernel memory or an invalid address, hoping the kernel writes there. By probing and validating each argument, the kernel protects the wall between ring 3 and ring 0.

SCENARIO QUESTIONS (Troubleshooting)

S1. Task Manager shows a process named svchost.exe in C:\Users\Anna\Downloads with no -k option. Is it normal?

Answer No. Real `svchost.exe` lives in `C:\Windows\System32`, is started by `services.exe` and has `-k ` in its command line. This is very likely a fake. Scan it with antivirus and check its parent.

S2. A blue screen appears right after installing a new graphics driver. Why does a driver, not an app, cause this?

Answer Drivers run in kernel mode (ring 0) in the same memory space as the kernel, with no protection from each other. A bug in a driver can overwrite kernel memory and the system halts to avoid damage. A normal app can only crash itself. Roll back the driver in Device Manager or boot in Safe Mode.

S3. A background service tries to show a message box, but nobody sees it. Why?

Answer Session 0 isolation. Services run in session 0, which has no user desktop. Windows no longer lets them draw on your screen. The service should use a helper app that runs in the user's session.

S4. explorer.exe crashes and the taskbar disappears, but the other apps keep working. What should you do?

Answer Explorer is a normal user-mode shell, not a critical process. In Task Manager use **Run new task**, type `explorer.exe` and press Enter. Windows keeps working because only the shell died.

S5. A program fails with "Access denied" when writing to HKEY_LOCAL_MACHINE\SOFTWARE. What is happening?

Answer The Security Reference Monitor compared the program's access token with the key's ACL. A standard user's token does not include write access to HKLM, so the Configuration Manager returns "Access denied". Run the program as administrator (only if trusted) or store settings in HKCU.

INTERVIEW QUESTIONS

I1. Describe the path of a CreateFile call from an application to the disk.

Answer The app calls `CreateFileW` in `kernel32` / `kernelbase`, which calls `NtCreateFile` in `ntdll`. `ntdll` runs `syscall` and the CPU switches to ring 0. In the kernel, the Object Manager resolves the name, the SRM checks access, and the I/O Manager builds an IRP that goes down the driver stack (filter, NTFS, disk). The result comes back up and a handle is returned to the app.

I2. What is the difference between the Executive and the Kernel in Windows?

Answer Both are in `ntoskrnl.exe`. The Kernel is the low layer for scheduling threads, interrupts, exceptions and synchronization. The Executive is the upper layer with managers (Object, Process, Memory, I/O, Security, Configuration, Cache, PnP, Power) that handle policy and resources.

I3. What are the roles of smss.exe, wininit.exe, winlogon.exe and lsass.exe?

Answer `smss.exe` creates sessions and starts `csrss.exe`, `wininit.exe` and `winlogon.exe`. `wininit.exe` (session 0) starts `services.exe` and `lsass.exe`. `winlogon.exe` handles Ctrl+Alt+Delete, the logon screen and profile loading, and starts `userinit.exe` and the shell. `lsass.exe` verifies credentials, builds access tokens and enforces security policy.

I4. What is a handle, and what happens at the kernel level when a handle leak occurs?

Answer A handle is an entry in a process's handle table that points to a kernel object. If a program never closes handles, the table grows and the objects' reference counts never reach zero, so the objects stay in memory. Over time it wastes memory and can hit per-process limits, causing failures.

I5. Compare Win32, the Native API and a system call.

Answer Win32 is the documented, stable API in DLLs such as `kernel32`. The Native API (`Nt*` functions in `ntdll.dll`) is the lowest user-mode layer, mostly undocumented. A system call is the actual `syscall` instruction in an `ntdll` stub that moves the CPU to ring 0, where the kernel looks up the service number in its dispatch table.

PRACTICAL TASK

Draw your own "map of Windows". On paper or in a drawing tool, draw the layers from the top (applications) to the bottom (hardware). Mark the wall between ring 3 and ring 0. Then, using what you saw in the Practical Lab, write the real name from your PC next to each layer (for example your Windows build, three svchost groups you found, the PID of System, and one registry key you visited).

Why This Matters

When something goes wrong (a crash, a slow PC, an "Access denied"), the first question is which layer is involved. A good map tells you where to look: a driver in the kernel, a service in session 0, a setting in the registry or an app in user mode.

CHAPTER SUMMARY

  • Windows is built in layers. All modern versions are NT-based: a clean, secure, 32/64-bit design started in 1993.
  • Kernel mode (ring 0) holds ntoskrnl.exe (the Kernel and the Executive), the HAL, drivers and win32k. User mode (ring 3) holds apps, services, system processes and DLLs.
  • The Executive managers: Object, Process, Memory, I/O, Security Reference Monitor, Configuration (registry), Cache, PnP and Power.
  • System processes: System (PID 4) → smss.exe → csrss.exe, wininit.exe (→ services.exe, lsass.exe), winlogon.exe (→ explorer.exe). svchost.exe hosts services.
  • Session 0 is for services; session 1+ is for users.
  • The Object Manager names and tracks every kernel resource; programs use handles.
  • The registry is stored in hives (System32\config, NTUSER.DAT); the Configuration Manager manages it.
  • APIs: Win32 → Native API (ntdll) → system call (syscall) → kernel. .NET and UWP sit on top of Win32.
  • Previous: Chapter 7 — What an Operating System Really Does
  • Next: Chapter 9 — Processes and Threads (coming soon)
  • Related: Chapter 8 Overview