Pavel Yosifovich - Windows 10 System Programming, Part 1

The Windows NT line of operating systems has quite a bit of history, starting with version 3.1 launched in 1993. Todays Windows 10 is the latest successor to that initial NT 3.1. The fundamental concepts of current Windows systems is essentially the same as it was back in 1993. This shows the strength of the initial OS design. That said, Windows grew significantly since its inception, with many new features and enhancements to existing ones.

This book is about system programming, typically regarded as low-level programming of the operating systems core services, without which no significant work can be accomplished. System programming uses low level APIs to use and manipulate core objects and mechanisms in Windows, such as processes, threads and memory.

In this chapter, well take a look at the foundations of Windows system programming, starting from the core concepts and APIs.

In this chapter:

• Windows Architecture Overview
• Windows Application Development
• Working with Strings
• 32-bit vs. 64-bit Development
• Coding Conventions
• Handling API Errors
• The Windows Version

Well start with a brief description of some core concepts and components in Windows. These will be elaborated on in the relevant chapters that follow.

A process is a containment and management object that represents a running instance of a program. The term process runs which is used fairly often, is inaccurate. Processes dont run - processes manage. Threads are the ones that execute code and technically run. From a high-level perspective, a process owns the following:

• An executable program, which contains the initial code and data used to execute code within the process.
• A private virtual address space, used for allocating memory for whatever purposes the code within the process needs it.
• An access token (sometimes referred to as primary token), which is an object that stores the default security context of the process, used by threads executing code within the process (unless a thread assumes a different token by using impersonation).
• A private handle table to Executive (kernel) objects, such as events, semaphores, and files.
• One or more threads of execution. A normal user-mode process is created with one thread (executing the main entry point for the process). A user-mode process without threads is mostly useless and under normal circumstances will be destroyed by the kernel.

These elements of a process are depicted in figure 1-1.

Figure 1-1: Important ingredients of a process

A process is uniquely identified by its Process ID, which remains unique as long as the kernel process object exists. Once its destroyed, the same ID may be reused for new processes. Its important to realize that the executable file itself is not a unique identifier of a process. For example, there may be five instances of notepad.exe running at the same time. Each process has its own address space, its own threads, its own handle table, its own unique process ID, etc. All those five processes are using the same image file (notepad.exe) as their initial code and data. Figure 1-2 shows a screen shot of Task Managers Details tab showing five instances of Notepad.exe, each with its own attributes.

Figure 1-2: Five instances of notepad

Dynamic Link Libraries (DLLs) are executable files that can contain code, data and resources (at least one of these). DLLs are loaded dynamically into a process either at process initialization time (called static linking) or later when explicitly requested (dynamic linking). Well look at DLLs in more detail in chapter 15. DLLs dont contain a standard