hackalex
EN
Menu

Windows Architecture

Technical note 

Most programs run in user mode, while the Windows kernel and many components run in kernel mode.
Because of this, programs running in user mode cannot perform sensitive operations such as creating processes, allocating memory, accessing files or interacting with the hardware.
That is what the Windows API is for
Simplified Windows architecture: user mode, kernel mode and hardware
Simplified Windows architecture: user mode, kernel mode and hardware
A call to CreateFile goes through kernel32.dll and ntdll.dll until it reaches the kernel with a syscall
A call to CreateFile goes through kernel32.dll and ntdll.dll until it reaches the kernel with a syscall

NTDLL.dll

It acts as the intermediary between user mode and kernel mode. For example:
  • NtCreateFile
  • NtCreateThreadEx
  • RtlInitUnicodeString
A program can call ntdll.dll directly

Security Principals, Users, Groups, SIDs

Internally, Windows identifies principals (Administrator, computers…) with unique identifiers
  • S-1-1-0: Everyone
  • S-1-5-18: Local System
  • S-1-5-32-544: Built-in Administrators group
  • S-1-5-32-545: Built-in Users group
E.g. S-1-5-21-3623811015-3361044348-30300820-1001