Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1

Components and Basic Architecture


Before getting into the details of how Windows works, let’s start by taking a
quick look at how it evolved to its current architecture, and by listing its most
fundamental features.

Brief History


As you probably know, there used to be two different operating systems called
Windows: Windows and Windows NT. There was Windows, which was
branded as Windows 95, Windows 98, and Windows Me and was a descen-
dent of the old 16-bit versions of Windows. Windows NT was branded as Win-
dows 2000 and more recently as Windows XP and Windows Server 2003.
Windows NT is a more recent design that Microsoft initiated in the early 1990s.
Windows NT was designed from the ground up as a 32-bit, virtual memory
capable, multithreaded and multiprocessor-capable operating system, which
makes it far more suited for use with modern-day hardware and software.
Both operating systems were made compatible with the Win32 API, in order
to make applications run on both operating systems. In 2001 Microsoft finally
decided to eliminate the old Windows product (this should have happened
much earlier in my opinion) and to only offer NT-based systems. The first
general-public, consumer version of Windows NT was Windows XP, which
offered a major improvement for Windows 9xusers (and a far less significant
improvement for users of its NT-based predecessor—Windows 2000). The
operating system described in this chapter is essentially Windows XP, but
most of the discussion deals with fundamental concepts that have changed
very little between Windows NT 4.0 (which was released in 1996), and Win-
dows Server 2003. It should be safe to assume that the materials in this chapter
will be equally relevant to the upcoming Windows release (currently code-
named “Longhorn”).

Features


The following are the basic features of the Windows NT architecture.

Pure 32-bit Architecture Now that the transition to 64-bit computing is
already well on the way this may not sound like much, but Windows NT
is a pure 32-bit computing environment, free of old 16-bit relics. Current
versions of the operating system are also available in 64-bit versions.
Supports Virtual-Memory Windows NT’s memory manager employs a
full-blown virtual-memory model. Virtual memory is discussed in detail
later in this chapter.

70 Chapter 3

Free download pdf