????4. HAL
????Hardware Abstract Layer
??????????????????????????????????????API????
????5. Windowing and Graphics System
??????????????????????GUI???????
??????5???????????????????Ntoskrnl.exe?У?????Щ????????driver????
????Windows Subsystem
????Windows???????????????
????????????????????????Environment Subsystem Service Processes????????Windowing and Graphics System??
??????????Win32???????????
????[csrss.exe]
????Basesrv.dll
????Winsrv.dll
????Csrsrv.dll
??????Win32 Subsystem dll?????client?????1???????
????1. Console Windows???????д??????????GUI????????漰??Win32k.sys??
????2. ?????????Process/Thread
????3. Side-by-Side??Sxs?????
????????
??????????Win32k.sys????
?????????1????
????1. ????????????????GUI????????????豸??????????????
????2. ??GDI?????
????3. DirectX?????(???????????Dxgkrnl.sys?????)
????Ntdll
??????Subsystem dll?????Ntdll???????????????????????н????????·??
????ntdll????????????
????1. System Service Stub
??????Щ????????????Executive??????????????????????
??????????????????????????????????????????????????У?????int 80H????sysenter????
?????????????Stub???????SSDT??System Service Dispatch Table??????ntdll??stub??????????????ú????SSDT???????????service routine??С?
????2. Operating System Internal Support Functions
??????????????ó?????????????????????????????????System Support Processes??Environment Subsystem Service Processes????á?
???????????漸??

 

Image Loader functions?? Ldr[XXXX]
Heap Manager
Windows Subsystem Process Communication functions?? Csr[XXXX]
Runtime Library Routines?? Rtl[XXXX]
User-mode Debugging?? DbgUi[XXXX]
Event Tracing for Windows?? Etw[XXXX]
User-mode Asynchronous Procedure Call(APC) Dispatcher
Exception Dispatcher
subset of C Run-time(CRT)

????Executive
????executive??????????????????
??????????????????????
????1. System Services
??????????????????????????????д??????API???????ó???????????????????????????????????á?
????2. Device Driver
????3. WDK Interface Functions
?????????????????????????????????Zw[XXXX]
????4. WDKδ?????????
????????????????????????
????????Inbv[XXXX]
????5. δ????????????
????Internal IO manager support functions?? Iop[XXXX]
????Internal Memory management support functions?? Mi[XXXX]
????6. ???????????????????б????????????