WindowsWindows – Key User User Mode Mode Components Components Overview • Organization • Model • Components • CPU Modes • System processes • Services processes • Users processes • Subsystems processes • System services www.winitor.com – dec. 2012 1 WindowsWindows – Key User User Mode Mode Components Components OS Organization • Access to hardware is not allowed • Access to hardware is made via system services Applications Virtual machine Real machine www.winitor.com – dec. 2012 2 WindowsWindows – Key User User Mode Mode Components Components OS Model • Applications access the OS via one defined Application Program Interface (API) Application API OS www.winitor.com – dec. 2012 3 WindowsWindows – Key User User Mode Mode Components Components OS Contexts Applications CPU runs in user mode CPU runs in kernel mode OS www.winitor.com – dec. 2012 4 WindowsWindows – Key User User Mode Mode Components Components CPU Modes • Protect critical system data from user applications • User mode 3 2 • Kernel mode 1 0 www.winitor.com – dec. 2012 5 WindowsWindows – Key User User Mode Mode Components Components CPU Modes - mechanism • User programs typically run in both modes • CPU mode switch <> CPU context switch mode time www.winitor.com – dec. 2012 6 WindowsWindows – Key User User Mode Mode Components Components CPU Modes - scenarios user kernel www.winitor.com – dec. 2012 7 WindowsWindows – Key User User Mode Mode Components Components TCB • Context • No CPU restriction in kernel • No memory restriction in kernel • No security check in kernel • Definition administrators • Portions of the system trusted to enforce applications the security kernel • Components drivers • Most hardware hardware • All kernel code • Some user code (SeTcbPrivilege) • Administrators www.winitor.com – dec. 2012 8 WindowsWindows – Key User User Mode Mode Components Components Memory Layout • Each application occupies 4 GB of address space • All applications share system memory space 0x00000000 Application A Application B Application C ... Application Z Unprivileged memory address memory 0x7FFFFFFF 0xFFFFFFFF Privileged memory address memory www.winitor.com – dec. 2012 9 WindowsWindows – Key User User Mode Mode Components Components OS Major Components System processes Services processes User processes Environment processes Session manager … … POSIX Logon manager alerter pinball Security manager Win32 … explorer Services manager System services user kernel Executive Hardware Abstraction Layer Hardware www.winitor.com – dec. 2012 10 WindowsWindows – Key User User Mode Mode Components Components Environment Subsystems • Definition • Role • Types .,, ... Win16 application ... Win32 application Win16 application Posix application Win32 application Win16 application Posix application Win32 application WOW DOS application DOS application NTVDM NTVDM … Posix Win32 www.winitor.com – dec. 2012 11 WindowsWindows – Key User User Mode Mode Components Components Environment Subsystems - interfaces • Subsystem • Process runs in a private address space • Application • Sends messages to subsystem • Unaware of messages • Implicitely linked with systems‘s interfaces (image = code + metadata) application.exe Functions calls Win32 API Kernel32.dll Gdi32.dll ... User32.dll Native API Ntdll.dll www.winitor.com – dec. 2012 12 WindowsWindows – Key User User Mode Mode Components Components Environment Subsystems - strategy Application Subsystem Win32 API Subsystem DLLs Executive www.winitor.com – dec. 2012 13 WindowsWindows – Key User User Mode Mode Components Components Environment Subsystems - strategy Application Subsystem Win32 API Subsystem DLLs Native API CPU mode switch Executive www.winitor.com – dec. 2012 14 WindowsWindows – Key User User Mode Mode Components Components Environment Subsystems - strategy Application Subsystem API message CPU context switch Subsystem DLLs Native API CPU mode switch Executive www.winitor.com – dec. 2012 15 WindowsWindows – Key User User Mode Mode Components Components Environment Subsystems - strategy Service implementation CPU mode switching CPU context switching Message sent User process No No No Executive Yes No No performance Server Yes Yes Yes www.winitor.com – dec. 2012 16 WindowsWindows – Key User User Mode Mode Components Components Win16 Support • MS-DOS applications • One-one relation • Win16 applications • Many-one relation < NT > NT Windows MS-DOS MS-DOS Windows www.winitor.com – dec. 2012 17 WindowsWindows – Key User User Mode Mode Components Components System processes • Are started by the system • Are running on every system • Cannot be stopped www.winitor.com – dec. 2012 18 WindowsWindows – Key User User Mode Mode Components Components Session Manager Subsystem • Definition • Role • Particularities • Part of the TCB • Native user application www.winitor.com – dec. 2012 19 WindowsWindows – Key User User Mode Mode Components Components Logon Manager • Definition • Role • Interactive logon request management • Authentication User interface management • User profile initialization • Shell creation • TASKMGR management Who you are (identification) What you know What you are (authentication) (authentication) www.winitor.com – dec. 2012 20 WindowsWindows – Key User User Mode Mode Components Components Local Security Authority Subsystem • Definition • Role www.winitor.com – dec. 2012 21 WindowsWindows – Key User User Mode Mode Components Components Service Control Manager • Definition • Role www.winitor.com – dec. 2012 22 WindowsWindows – Key User User Mode Mode Components Components User Processes - creation System Smss Winlogon Csrss Permanent Services Lsass Userinit Shell ... Volatile (interactive) (interactive) Volatile www.winitor.com – dec. 2012 23 WindowsWindows – Key User User Mode Mode Components Components Thanks! www.winitor.com – dec. 2012 24.