The Windows application programming interface (API) is the programming interface to the Microsoft Windows operating system family. It provides services used by all Windows-based applications to enable applications to provide a Graphical User Interface (GUI), access system resources, incorporate audio and much more. The API consists of thousands of documented, callable subroutines such as CreateProcess and CreateFile . Major categories of Windows API functions include Base Services, Component Services, Graphics & Multimedia, Messaging, Networking and Web Services. There are hundreds of books and websites that cover programming using the Windows API - but let me just add the disclaimer that programming using the Windows API is by no means an "entry-level" type task! And with that, it's time to move on to Services ...
When examining services from a programming viewpoint, a Service could refer to a callable routine in the operating system, a device driver or a server process. However, from a user perspective, we consider a service as a process that is loaded by the OS in user-mode, independent of a logged-in user. The Services are controlled by the Windows Service Manager. Services can be loaded using the System account, or credentials that are assigned to that service specifically - either during the service installation, or through the properties page for that service. Some common services include the Spooler service which controls printing, the Server service which supports file, print and named-pipe sharing over the network and the DHCP client service which registers and updates IP addresses and DNS records.
Now, let's take a look at Programs, Processes and Threads. One of our Escalation Engineers uses a very simple analogy for explaining the difference between these three terms:
Think of a process as a room and a thread as a person in the room. A program is a set of instructions for the person in the room to carry out. Looking at it in this fashion, it is easy to see that the process itself doesn't do any work, but the thread does. A thread lives in a process, and executes the instructions of the program.
With that analogy in mind, a Windows process includes the following:
The diagram below which is in the Windows Internals book shows how the components interact
The thread is what Windows schedules for execution within a process. Without threads, the program used by the process cannot run. Threads consist of the following components:
And that brings us to the end of our Windows Architecture 101 post. Stay tuned for more ...
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.