Reversing : The Hacker's Guide to Reverse Engineering

(ff) #1
Portable Unlike the original Windows product, Windows NT was writ-
ten in a combination of C and C++, which means that it can be recom-
piled to run on different processor platforms. Additionally, any physical
hardware access goes through a special Hardware Abstraction Layer
(HAL), which isolates the system from the hardware and makes it easier
to port the system to new hardware platforms.
Multithreaded Windows NT is a fully preemptive, multithreaded sys-
tem. While it is true that later versions of the original Windows product
were also multithreaded, they still contained nonpreemptive compo-
nents, such as the 16-bit implementations of USER and GDI (the Win-
dows GUI components). These components had an adverse effect on
those systems’ ability to achieve concurrency.
Multiprocessor-Capable The Windows NT kernel is multiprocessor-
capable, which means that it’s better suited for high-performance com-
puting environments such as large data-center servers and other
CPU-intensive applications.
Secure Unlike older versions of Windows, Windows NT was designed
with security in mind. Every object in the system has an associated
Access Control List(ACL) that determines which users are allowed to
manipulate it. The Windows NT File System (NTFS) also supports an
ACL for each individual file, and supports encryption of individual files
or entire volumes.
Compatible Windows NT is reasonably compatible with older applica-
tions and is capable of running 16-bit Windows applications and some
DOS applications as well. Old applications are executed in a special iso-
lated virtual machine where they cannot jeopardize the rest of the system.

Supported Hardware


Originally, Windows NT was designed as a cross-platform operating system,
and was released for several processor architectures, including IA-32, DEC
Alpha, and several others. With recent versions of the operating system, the
only supported 32-bit platform has been IA-32, but Microsoft now also sup-
ports 64-bit architectures such as AMD64, Intel IA-64, and Intel EMT64.


Memory Management


This discussion is specific to the 32-bit versions of Windows. The fact is that
64-bit versions of Windows are significantly different from a reversing stand-
point, because 64-bit processors (regardless of which specific architecture) use


Windows Fundamentals 71
Free download pdf