The Windows application programming interface (API) is the programming interface to the Microsoft Windows operating system family. It provides services used by all Windows-based applications to enable applications to provide a Graphical User Interface (GUI), access system resources, incorporate audio and much more. The API consists of thousands of documented, callable subroutines such as CreateProcess and CreateFile . Major categories of Windows API functions include Base Services, Component Services, Graphics & Multimedia, Messaging, Networking and Web Services. There are hundreds of books and websites that cover programming using the Windows API - but let me just add the disclaimer that programming using the Windows API is by no means an "entry-level" type task! And with that, it's time to move on to Services ...
When examining services from a programming viewpoint, a Service could refer to a callable routine in the operating system, a device driver or a server process. However, from a user perspective, we consider a service as a process that is loaded by the OS in user-mode, independent of a logged-in user. The Services are controlled by the Windows Service Manager. Services can be loaded using the System account, or credentials that are assigned to that service specifically - either during the service installation, or through the properties page for that service. Some common services include the Spooler service which controls printing, the Server service which supports file, print and named-pipe sharing over the network and the DHCP client service which registers and updates IP addresses and DNS records.
Now, let's take a look at Programs, Processes and Threads. One of our Escalation Engineers uses a very simple analogy for explaining the difference between these three terms:
Think of a process as a room and a thread as a person in the room. A program is a set of instructions for the person in the room to carry out. Looking at it in this fashion, it is easy to see that the process itself doesn't do any work, but the thread does. A thread lives in a process, and executes the instructions of the program.
With that analogy in mind, a Windows process includes the following:
-
An executable program, consisting of initial code and data
-
A private virtual address space
-
System resources that are accessible to all threads in the process
-
A unique identifier, called a process ID
-
At least one thread of execution
- A security context (also known as an access token)
The diagram below which is in the Windows Internals book shows how the components interact
The thread is what Windows schedules for execution within a process. Without threads, the program used by the process cannot run. Threads consist of the following components:
-
The contents of the registers representing the state of the processor
-
Two stacks - one for the thread to use when executing kernel-mode instructions, and one for user-mode
-
A private storage area used by the subsystems, run-time libraries and DLL's
- A unique identifier, called a thread ID
And that brings us to the end of our Windows Architecture 101 post. Stay tuned for more ...
Additional Resources:
-
MSDN Overview of the Windows API
-
Windows API Reference (MSDN)
-
Windows API on Wikipedia
- Microsoft® Windows® Internals, Fourth Edition: Microsoft Windows Server™ 2003, Windows XP, and...