Unit 1: Windows Operating System Fundamentals and Architecture

1. Operating System Overview & Architectural Paradigm

The modern Microsoft Windows operating system is an enterprise-grade, preemptive, multithreaded operating system built upon the modular Windows NT (New Technology) hybrid architecture. Unlike monolithic kernels where all operating system services execute in a single shared memory space, Windows NT divides system execution into two primary execution privileges: User Mode (Ring 3 in x86/x64 processor architectures) and Kernel Mode (Ring 0).

CODECopy Code
+-------------------------------------------------------------------+
|                            USER MODE                              |
|  +---------------------+  +-----------------+  +---------------+  |
|  | User Applications   |  | Win32 Subsystem |  | System Service|  |
|  | (Chrome, Office)    |  | (csrss.exe)     |  | (lsass, etc.) |  |
|  +---------------------+  +-----------------+  +---------------+  |
|                            Ntdll.dll                              |
+-------------------------------------------------------------------+
|===== Transition via System Calls / Trap Gate (Kernel Boundary) ===|
+-------------------------------------------------------------------+
|                           KERNEL MODE                             |
|  +-------------------------------------------------------------+  |
|  | Executive Services (Object, Process, Memory, I/O, Security) |  |
|  +-------------------------------------------------------------+  |
|  | Microkernel (Thread scheduling, interrupt handling, sync)   |  |
|  +-------------------------------------------------------------+  |
|  | Device Drivers (KMDF / File System / Graphics Drivers)       |  |
|  +-------------------------------------------------------------+  |
|  | Hardware Abstraction Layer (HAL.dll)                        |  |
+-------------------------------------------------------------------+
                                  |
                           Physical Hardware

1.1 Dual-Mode Operation and Security Rings

• User Mode (Ring 3): Applications execute within isolated, private virtual address spaces. A user-mode process cannot directly modify physical hardware registers, execute privileged CPU instructions, or access memory assigned to other applications or the operating system. If a user-mode process encounters an unhandled exception or crashes, only that specific application terminates without jeopardizing the stability of the entire system.
• Kernel Mode (Ring 0): The core operating system, Executive components, and device drivers run with unrestricted access to memory and physical hardware instructions. A failure or illegal memory operation in kernel mode triggers a kernel fault known as a BugCheck, displaying the Blue Screen of Death (BSOD) to halt execution and protect data integrity.

1.2 Core Architectural Layers

1. Hardware Abstraction Layer (HAL): Implemented in hal.dll, this low-level module hides motherboard-specific platform variations (such as APIC interrupt routing, ACPI power states, and multi-core memory buses) behind a uniform API. The microkernel interacts with the HAL rather than raw platform chipsets, enabling portability across diverse hardware architectures (x86, x64, ARM64).
2. Microkernel: Operates immediately above the HAL. It handles low-level CPU synchronization (spinlocks), thread dispatching, multiprocessor scheduling, interrupt dispatching, and exception routing.
3. Executive Services (ntoskrnl.exe): Sits above the microkernel and provides foundational OS services:
   • Object Manager: Creates, tracks, and protects Windows OS internal objects (events, mutexes, files, symbolic links, tokens).
   • Process and Thread Manager: Spawns and tracks process lifetimes and thread contexts.
   • Virtual Memory Manager (VMM): Translates virtual addresses to physical pages and orchestrates demand paging.
   • Security Reference Monitor (SRM): Enforces access control lists (ACLs) and inspects access tokens during security audits.
   • I/O Manager: Manages asynchronous packet-driven input/output operations through I/O Request Packets (IRPs).
4. Environment Subsystems: Expose specific operating system APIs to client software. The primary subsystem is the Windows Subsystem (Win32), composed of kernel driver win32k.sys (GUI, fonts, windowing) and user-mode server csrss.exe.

2. File Systems, Storage Hierarchy, and Partitioning

Windows supports several file systems tailored for internal system disks, high-availability storage pools, and removable media:

2.1 NTFS Advanced Features

• Access Control Lists (ACLs): NTFS assigns Discretionary Access Control Lists (DACLs) defining explicit read, write, modify, and execute privileges per user or security group.
• Journaling: The NTFS $LogFile and Update Sequence Number (USN) Journal record metadata modifications before writing changes to disk clusters. This enables rapid recovery and prevents metadata corruption upon abrupt power loss.
• Encrypting File System (EFS): Provides transparent, certificate-based symmetric file encryption tied to user security identifiers (SIDs).
• Alternate Data Streams (ADS): Allows attaching secondary data streams to an existing file identifier without changing its primary file size (e.g., Internet Explorer/Edge zones tagging downloaded files with Zone.Identifier).

2.2 Partitioning Schemes: MBR vs. GPT

• Master Boot Record (MBR): Legacy scheme utilizing a 512-byte partition table located in the first sector. Restricted to a maximum disk size of 2 TB and supports at most 4 primary partitions.
• GUID Partition Table (GPT): Modern UEFI-standard partitioning scheme. Employs 128-bit globally unique identifiers (GUIDs), supports disk capacities exceeding 9 ZB, allows up to 128 partitions in Windows without extended containers, and stores duplicate backup headers at the tail of the disk.

3. Memory Subsystem and Process Management

3.1 Processes vs. Threads

• Process: An executing instance of an application that represents a resource container. A process owns a private virtual address space, a handle table referencing system objects, an access token representing the security context, and at least one thread. A process does not run code itself; its threads do.
• Thread: The fundamental unit of CPU execution scheduled by the Windows microkernel. Each thread contains a thread context (register state, program counter, stack pointer), a priority level (0 to 31), and two stacks (a user stack and a kernel stack).

CODECopy Code
Process Resource Container:
├── Private Virtual Address Space (4 GB in 32-bit; 128 TB in 64-bit)
├── Handle Table (Open files, sockets, registry keys)
├── Access Token (User SID, Group memberships, Privileges)
└── Threads (Scheduled CPU workers)
    ├── Thread 1 (Stack, Context, Priority 8)
    └── Thread 2 (Stack, Context, Priority 8)

3.2 Virtual Memory & Paging Mechanism

Windows isolates application memory using a flat virtual addressing model managed by the Virtual Memory Manager (VMM) and CPU Memory Management Unit (MMU):

1. Page Translation: Virtual memory is subdivided into fixed-size units called Pages (commonly 4 KB). Physical RAM is divided into matching Page Frames.
2. Working Set: The subset of virtual pages belonging to a process that currently reside in physical RAM.
3. Page Faults:
   • Soft Page Fault: The requested page exists in physical RAM (e.g., in the Standby list or Transition list) and is mapped back into the process's working set without disk I/O.
   • Hard Page Fault: The requested page does not reside in physical RAM and must be retrieved from the disk-backed swap file (pagefile.sys). Excessive hard page faults lead to thrashing, severely degrading system responsiveness.

4. The Windows Registry Architecture

The Windows Registry is a centralized, hierarchical, transactional database that stores system-wide hardware configurations, installed application settings, device driver parameters, and user preference profiles.

4.1 The Five Predefined Root Hives

1. HKEY_LOCAL_MACHINE (HKLM): Contains machine-wide configuration parameters applicable to all local users. Subkeys include SYSTEM, SOFTWARE, SAM, SECURITY, and HARDWARE (volatile, generated at boot).
2. HKEY_CURRENT_USER (HKCU): Contains active configuration profiles for the user currently logged in (mapped to HKEY_USERS\<User-SID>).
3. HKEY_USERS (HKU): Contains all actively loaded user profiles on the host machine, including default profile templates.
4. HKEY_CLASSES_ROOT (HKCR): Contains file extension associations, MIME mappings, and COM Object Class IDs (ProgIDs). It is a merged composite view of HKLM\Software\Classes and HKCU\Software\Classes.
5. HKEY_CURRENT_CONFIG (HKCC): Points to the current hardware profile used at startup (HKLM\SYSTEM\CurrentControlSet\Hardware Profiles\Current).

4.2 Registry Data Types

• REG_SZ: Fixed-length Unicode text string.
• REG_EXPAND_SZ: Variable-length string containing unexpanded environment variables (e.g., %SystemRoot%).
• REG_DWORD: 32-bit numerical integer value (frequently used for boolean flags and numerical limits).
• REG_QWORD: 64-bit numerical integer value.
• REG_BINARY: Raw hexadecimal binary data.
• REG_MULTI_SZ: Multiple-string array separated by null characters.

5. System Administration, Diagnostic Utilities, and Event Logging

System administrators employ native diagnostic tools to maintain operational health and troubleshoot performance bottlenecks:

5.1 Graphical Management Consoles

• Task Manager (taskmgr.exe): Provides instant real-time telemetry on CPU, Memory, Disk, and Network utilization, startup application impacts, and process handle/thread counts.
• Resource Monitor (resmon.exe): Displays fine-grained metrics including per-process disk read/write bandwidth, TCP network connections, and active handle locks.
• Event Viewer (eventvwr.msc): Windows central log aggregator. Standard Windows Logs include:
  • Application: Events logged by third-party applications and user-space background services.
  • Security: Audited security events (logon successes/failures, privilege assignments) governed by local security policy.
  • System: Critical messages emitted by the Windows kernel, system executive, and device drivers.
• Services Console (services.msc): Controls background daemons (svchost.exe). Startup types include Automatic, Automatic (Delayed Start), Manual, and Disabled.

5.2 Critical Command-Line Diagnostic Tools

• systeminfo: Generates a comprehensive summary of OS build, BIOS version, memory specs, hotfixes installed, and network card parameters.
• sfc /scannow: System File Checker scans system protected binaries and replaces corrupt or missing files from the local component store (WinSxS).
• dism /Online /Cleanup-Image /RestoreHealth: Deployment Image Servicing and Management repairs the Windows component store using Windows Update or mounting an external ISO image.
• chkdsk C: /f /r: Analyzes volume integrity, repairs file system structure errors (/f), and locates bad sectors to recover readable data (/r).
• tasklist and taskkill /PID <pid> /F: Enumerates running processes and forces immediate termination of stubborn processes.

6. Common Pitfalls & Exam Tips

• Confusing HAL with Device Drivers: The HAL abstracts the underlying CPU and motherboard chipset architecture; device drivers interface with peripheral devices (sound cards, network cards, GPUs).
• Soft Fault vs. Hard Fault: Do not equate all page faults with performance penalties. Soft page faults are resolved entirely in RAM at CPU speeds; only hard page faults require costly secondary storage disk seek operations.
• 32-bit vs. 64-bit Virtual Memory Limits: A 32-bit x86 Windows architecture provides a 4 GB address space (by default 2 GB User / 2 GB Kernel), whereas a 64-bit x64 architecture supports 128 TB for user space and 128 TB for kernel space.
• Registry Modification Risk: Modifications in the Registry take effect immediately without confirmation prompts. Backups or System Restore points should always precede registry edits.

7. Quick Revision Summary

• Windows NT employs a hybrid kernel architecture separating User Mode (Ring 3) from Kernel Mode (Ring 0).
• The Hardware Abstraction Layer (HAL) ensures OS hardware portability across system platforms.
• NTFS is the enterprise file system of choice, offering ACLs, transaction logging via USN journal, compression, and EFS encryption.
• Modern storage leverages GPT partitioning, replacing legacy MBR's 2 TB limit and 4-partition ceiling.
• Memory management relies on 4 KB virtual pages, with disk-backed swapping managed through pagefile.sys.
• The Windows Registry organizes system state into five hierarchical root hives with typed data values.
• Administrative maintenance leverages Event Viewer (eventvwr.msc), Task Manager, Resource Monitor, and command-line tools (sfc, dism, chkdsk).