Understanding Windows NT Internals - Part 1
0 likes10 views
Windows NT internals refer to the inner workings of the Windows NT operating system. It includes the system architecture, critical data, and how the system is organized.
Understanding Windows NT Internals - Part 1
- 1. WINDOWS NT INTERNALS – 01 Computer Call September 22, 1997
- 2. DESIGN GOALS FOR THE WINDOWS NT OPERATING SYSTEM Compatibility Portability Robustness Extensibility Performance
- 3. KERNEL MODE AND USER MODE Kernel Mode Contains system code: executives, drivers,kernel and HAL “Trusted” Allowed to execute any instructions Access all the address space User Mode Contains Application Code Accept to user address space only Cannot execute instructions that directly access Hardware Kernel Mode
- 5. Application & Subsystem Hardware Kernel Hardware Abstraction Layer NT Executive
- 6. Application & Subsystem Kernel Hardware Abstraction Layer NT Executive I/O Devices DMA/Bus Controller Timers Caches, Interrupts CPU Privileged Architecture
- 7. HAL Kernel mode library of Hardware manipulating routines Provides a Kind of Hardware independent Set of Routines Call by all higher level components
- 8. KERNEL Performs low-level operating system functions like, Thread scheduling & synchronization Multiprocessor synchronization Time keeping Interrupt and execution Dispatching Allows drivers and higher level operating system Presents an object-based interface
- 9. Application & Subsystem Kernel Hardware Abstraction Layer Hardware Object Manager Configuration Manager Process Manager Security Reference Manage5r V M M I/O mgr. L P C System service Interface
- 10. Provides a controlled path from user to Kernel mode code Object Manager Creating Objects Deleting Objects Maintaining global object namespace System service Interface Keeping track of outstanding references
- 11. Maintain a model of all Hardware & Software Process Manager Handles Creation, Management and Deletion of processes and Threads Configuration Manager Mainly handles the Registry
- 12. SECURITY REFERENCE MONITOR Object Manager calls SRM for security checks SRM , the Logon Processes & Security Subsystem from NT Security Model
- 13. VIRTUAL MEMORY MANAGER Linear addressing with the help of 32 bits Helps an overcommiting memory with the help of physical memory and HD Code not in Physical mem. Is present as files on HD (files are of equal size called pages) Demand paging technique are swapping Technique: CPU issues page fault Trap handler receives it Asks the VMM to restore the page
- 14. LOCAL PROCEDURE CALL Passing messages between client & server when both on same M/C How a call is made & attended ? Stubs play a major role
- 15. I/O MANAGER Components of I/O Manager Cache Manager File Systems Network drivers Device drivers Major role - Communicating with drivers Attends request mode by subsystem
- 16. PROTECTED SUBSYSTEM MS-DOS Environment Applications run in a process - NT Virtual DOS Machine(NTVDM) NTVDM - Simulates an Intel 486 Computer with MS-DOS Each Application on separate NTVDM NTVDM Consists of 3 threads 1. Application 2. Timer interrupt(simulation) 3. Console
- 17. Instruction execution unit 32-bit MS-DOS emulation Virtual Device Driver (COM, LPT,Keyboard) 16MB 640MB 32-bit 16 bit MS-DOS based application 16-bit MS-DOS emulation Intel x86 instruction ROM BIOS int.+Services+ MS-DOS int.(21 services) Virtual Hardware Structure of an MS-DOS NTVDM
- 18. WINDOWS 16-BIT ENVIRONMENT Instruction execution unit 32-bit MS-DOS emulation Virtual Device Driver (COM, LPT,Keyboard) 32-bit 16 bit Windows 3.1 Kernel Windows Mgr. & GDI stubs 16-bit Windows Application 16-bit MS-DOS emulation Win 32 subsystem Structure of the Win 16VDM 32-bit WOW transaction
- 19. OS/2 SUBSYSTEM Supports OS/2 1.x character-based applications OS/2 real mode application run on RISC computer in MS-DOS environment
- 20. POSIX SUBSYSTEM Defines C-Language API calls between applications & the OS
- 21. WIN32 SUBSYSTEM I/O for other subsystems and user application It defines GUI policy and style for the whole system Exposes Win32 API to interact with the Executive
- 22. DIAGRAM OF WINDOWS NT 4.0 MS-DOS App PSIX App. OS/2 App. Win16 App. MS-DOS Subsystem POSIX Subsystem OS/2 Subsystem Win32 Subsystem I/O Mgr.. Obj. Mgr.. Security Ref. Mgr.. Process Mgr.. LPC VMM Kernel mode Win Mgr. GDI Graphics Device Drivers Micro Kernel HAL Hardware
- 23. FEATURES OF NTFS Fast read write and search operations File System recovery on very large HD High Security
- 24. DETAILS OF NTFS Cluster- unit of allocating Partition Size Sec. Per cluster Cluster Size 512 MB or less 1 512 bytes 512MB-1024MB 2 1K 1025-2048MB 4 2K 2049-4096MB 8 4K 4097-8192MB 16 8K 8193-16,384MB 32 16K 16,384- 32,768MB 64 32K > 32,768MB 128 64K Storage Form-file with attributes
- 25. DETAILS OF NTFS CONT.... Formatting the HD with NTFS results in creation of File systems supported by NT • Partition Boot Sector BIOS Parameter Blk: Vol layout & FS structure Location: status at sector 0 & can be 16 sect. long Executable Code:Load startup files • Master File Table(MFT) The first on NTFS volume contains fold records
- 26. System File File Name MFT Record Purpose of File Master File Table $ Mft 0 A list of all contents of the NTFS vol Master File Table2 $ Mft Mirr 1 Mirror of 1 st 3 records of the MFT Log file $ logFile 2 Transaction steps used for NTFS recoverability Volume $ volume 3 Vol-name ,NTFS ver & others info. Of Vol. Attribute Def. Table $ AttribDef 4 A table of attribute names, numbers & description Root filename index $. 5 Root folder Cluster Bitmap $ Bitmap 6 A rep. Of vol., showing which clusters are in use MFT
- 27. A collection where all the bad clusters in the volume are located Used for converting lowercase characters to the matching unicode uppercase char. System File File Name MFT Record Purpose of File Partition Boot Sec $ Boot 7 The bootstrap for the vol. ,if this is a bootable vol. Bad cluster File $ Bad Clus 8 Quota Table $ Quota 9 Disk quota usage for each user on a vol, currently unused Upcase Tablee $ Upcase 10 11-15 Reserved for future use MFT Cont.... 1st 16 records - system info Entry of each & every file on HD Small files directly fit in the form of B-trees have pointers to external clusters
- 28. WINDOWS NT SERVICES Win32-based Application POSIX OS/2 subsystem Win32 subsystem User mode LPC Executive Privileged Processor Mode
- 29. WHAT IS AN NT OBJECT Processor Mgr.. Process Threads Mem. Mgr. Section Security System Access Token Executive Support Services Event Semaph ore Timer Mutant Event Pair
- 30. WHAT IS AN NT OBJECT CONT.. LPC Facility Port I/O Manager File Config. Mgr.. Registry Kernel Profile Object Manager Object Directory Symbolic Link
- 31. OBJECT MODEL The object model allows us to Monitor Secure Share
- 32. INTERNAL OBJECT MODEL Object Attributes Object Name Object Directory Security Description Quota Changes Open Handle Counter Open Handle Database Permanent/Temporary Kernel/User Mode Type object Pointer Object Body Object Handler Type Object
- 33. OBJECT MANAGER AND OBJECTS It manages all objects Creation Creation of Handles Manipulate Track of Objects created & in use Anything in NT is an Object E.g: Semaphore, Process, Thread, File etc.
- 34. EXTERNAL OBJECT INTERFACE Generic Functions Create xxx Open xxx - Open Handle BOOL Close Handle (hobject) BOOL Duplicate Handle(hsource process, hsource, htarget process, lphtarget, fdwaccess, fInherit, fdwOptins Scope of an Object Handle is Process Relative Object Lifetime
- 35. WHAT IS PROCESS A process is an Instance of a Program Running A process Owns Objects Objects are represented by handles What Distinguishes one Process from Another Handle Table Private Memory Windows
- 36. PROCESS CREATION & GETTING HANDLE TO IT Create Process(lpszImageName, lpszCommandLine, lpsaProcess,lpsaThreads, flnInheritHandles, fdwCreate, lpvEnvironment, lpszCurDir, lpsiStartInfo, lppiProcInfo) Creates Process & Primary Thread Process & Thread ID’s are Globally Unique Open Process (fdwAccess, fInherit, IDProcess) Get’s handle for the Process
- 37. ENDING PROCESS Exit Process(uExit Code) - closes its own handle CloseHandle(hProcess) - closes the child process’s handle) TerminateProcess(hProces, uExitCode) - used by one Process to kill another Process
- 38. INTERPROCESS COMMUNICATION Sharing of two or more Objects - IPC IPC Objects Shared Memory Files Semaphores Pipes Windows sockets RPC’s send messages between 2 processes On same M/C or On Remote M/Cs
- 39. THREAD SYNCHRONIZATION Why it is required ? Synchronization Objects Mutex Semaphore Event Critical Section
- 40. THREAD SCHEDULING Preemptive scheduling Co-operative scheduling
- 41. THREAD PRIORITIES 32 priority classes & levels 16-31 real time levels 1-15 variable levels 0 system level Only seven real time levels are available touser Setting priority of threads. Base Priority +or -2 Dispatcher changes priorities (Threads at level 1 through 15)
- 42. CONTROLLING PROCESS PRIORITY Setting Base priority - Create Process(--,--, fdwCreate,--,--) SetPriorityClass( ) - priority of a Process SetThreadPriority( ) - manipulates thread priority Priority Classes High Normal Idle Real-Time