Introduction to NT Architecture

The Three Main Components

1. The microkernel - scheduling threads, coordinating executive services, dispatcher objects (mutexes, events, threads, timers), control objects (I/O and process objects, interrupts, etc)
2. The HAL - interface between kernel and drivers; helps NT be portable-- all you should have to do is rewrite the HAL, get HAL-compliant drivers, and recompile the OS for the target platform.
3. Executive services - files, virtual memory, GDI, window manager, security reference monitor, etc.

VM Subsystems

1. Win32 - What you mainly see; 32-bit processing, more or less preemptive multitasking, memory protection, and the Win32 suite of kernel services and API's.
2. NTVDM/WOW - VMs running within the Win32 subsystem to provide backwards compatibilty for DOS and Win31 applications; they emulate old-style operating environments.
3. POSIX, OS/2 - attempts to make NT a one-size-fits-all OS, able to run all sorts of code. In practice, these are buggy, and open security holes.

User Mode vs. Kernel Mode

• "Native NT API" used for writing things that need to run before the GUI (and therefore also the Win32 subsystem) is initialized; for writing new subsystems, certain kinds of drivers.
• User mode-- Win32 and the other subsystems.