Unorganized Notes
Last updated
Last updated
Check out this blog post for a more organized set if notes
A running instance of a program, processes don't run they manage, threads do the running.
A process contains:
executable program, contains code and data
private virtual address space, used for allocating memory
a primary token which contains security context, this is used by threads
private handle table to executive objects, like events, semaphores and files
threads for execution
A process is identified by its PID
Note that the executable program part is not unique part of the program like the PID
has 2 major things
CLR: run time engine for .NET which has a JIT compiler that translates CIL into hardware CPU machine language, garbage collector, type verification, code access security, and more. It’s implemented as a COM in-process server (DLL) and uses various things from win api
FCL: large collection of types
every process has its own virtual, private and linear address space.
this address space starts out around empty since ntdll and executable image are the first to be mapped followed by more subsystem dlls
address space from main is private, other processes cannot access it directly
32 bit address space is 32 gb, we can specify to use more address spaces if we want
64 bit address space is 128 TB, for 32 bit on 64 bit the address space is 2gb
Each process has its own address space, which makes any process address relative, rather thanabsolute. For example, when trying to determine what lies in address 0x20000, the address itselfis not enough; the process to which this address relates to must be specified.
memory itself is virtual, there is an indirect relationship between an address range and exact location in RAM
if memory is not mapped to RAM, CPU will raise a page fault exception that will cause the memory manager’s page fault handler to fetch the data from the appropriate file, copy it to RAM, make the required changes in the page table entries that map the buffer, and instruct the CPU to try again.
unit of memory management is called page
size of page is based on CPU type
page states can be in three states
free: page is not allocated in anyway, accessing this will result in violation
committed: reverse of free,
reserved: the page is not committed, but the address range is reserved for possible future commitment. From the CPU’s perspective, it’s the same as Free – any access attempt raises an access violation exception, but the virtualalloc or ntallocatevirtualmemory that does not specify an address would not allocate in the reserved region
user mode is lower part of address space, kernel mode is higher part of address space
32 bit the operating system resides in the upper 2 GB of virtual address space, from address0x8000000to0xFFFFFFFFF
On 64-bit systems on Windows 8.1, Server 2012 R2 and later, the OS takes the upper 128 TB ofvirtual address space
A thread Contains:
Current access mode, either user or kernel.(contents of a set of CPU regisers)
thread id
Execution context, including processor registers and execution state.
One or two stacks, used for local variable allocations and call management.
Thread Local Storage array, which provides a way to store thread-private data with uniform access semantics.
Base priority and a current (dynamic) priority.
Processor affinity, indicating on which processors the thread is allowed to run on
The most common states a thread can be in are:
running
ready
waiting
threads information, registers, private storage are called the thread context
translate to user mode calls to system mode calls.
a system call number is put into eax, and then the syscall or sysenter thing is called which transitions into kernel mode
the SSDT uses the value in EAX, and jumps into the syscall itself
subsystem dlls: dlls that implement apis of subsystem, this is a certain view of capabilities exposed by the kernel. Ex. kernel32.dll, user32.dll, gdi32.dll etc.
NTDLL.DLL: lower layer of code in user mode, makes transition from user mode into kernel mode and implements the heap manager, image loader and some part of the user mode thread pool.
service processes: normal windows processes that communicate with the SCM, and allow some control over their life time. the SCM can stop, pause, resume etc. to services
executive: upper layer of Ntoskrnl.exe(the kernel), it hosts most of the code in kernel mode, and includes the various managers.
kernel: fundamental kernel mode os things
win32k.sys: kernel mode component of the windows subsystem, handles the UI and GDI apis.
HAL: closes to the CPU, allows device drivers to user APIs that do not quire detail and specific knowledge of things like DMA controller, this layer is mostly useful for device drivers written to handle hardware devices.
(TODO)
kernel exposes various types of objects for use by user mode processes, the kernel itself and kernel mode drivers, instance of these are data structures created by object manager
objects are reference counted
object can reside in system space, they cannot be access directly in user mode, the must use handles
handles are index to a entry in a table maintained on a process by process basis that points to a kernel object in system space
the kernel can use a direct pointer or handle, the choice is based on the API you want to call, Kernel code can get a pointer to an object given a valid handle using the ObReferenceObjectByHandle function.
handles are multiples of 4, 0 is not valid handle
each object points to an object type, which holds info on the type itself, these are exported as kernel global variables
