Jump to content

Draft:Win32k.sys

From Wikipedia, the free encyclopedia
  • Comment: No indication of notability. It's just a single file Slywriter (talk) 15:26, 9 January 2023 (UTC)
  • Comment: Most of the content is unsourced and works published by Microsoft are not independent so cannot be used to establish notability. S0091 (talk) 20:03, 7 January 2023 (UTC)

Kernel Mode Windows Subsystem (win32k.sys)

[edit]

Win32k.sys is part of the Windows Subsystem implemented in Kernel Mode, designed as an important dependency of the Windows Operating System and responsible for implementing the GDI, keyboard and mouse inputs and the Window Manager. The name contains the word Win32 which stands for the Windows Subsystem and k for Kernel mode.[1][2]

The Kernel Mode Windows Subsystem implements a System Service Table with over 800 System Calls, starting with the System Call Index 0x1000 (NtGdiAbortDoc on Windows NT 5.1).[3]

It is being loaded at startup by the Session Manager Subsystem process in the kernel address space. On load, win32k.sys calls win32kbase.sys Driver Entry Point, which attaches win32k's System Service Table to NTOS using the KeAddSystemServiceTable function.[4]

History

[edit]

In early versions of NTOS, win32k used to be a core User-Mode Dynamic-link library (just like NTDLL) but due to bad performance, the file has been ported to Kernel-Mode. This change has improved the response time of user-mode applications.

Present

[edit]

Today, the Windows Subsystem is separated into two files (besides win32k.sys): win32kfull.sys and win32kbase.sys.[5] Win32kbase contains the actual Entry Point for win32k but also experimental and additional features, whereas Win32kfull contains the most stable and commonly used functions.

Win32k port to Kernel Mode

[edit]

The port consisted in replacing Win32 calls into NTAPI calls then write the file to a driver which made it develop a lot of Denial of Service vectors where attackers could create Privilege escalation.[6]

User Mode Windows Subsystem (win32u.dll)

[edit]

The user mode component of the Windows Subsystem is win32u.dll that works just like NTDLL.

It contains pieces of generated machine code as a stub for doing a direct syscall instruction, which end up in Win32k.[7]

GDI and User-related functions are being exported from gdi32.dll and user32.dll. These DLLs use win32u.dll exported functions to perform actions.[8][9]

References

[edit]
  1. ^ "The Win32k kernel-mode driver". O’Reilly. O’Reilly. Retrieved 8 January 2023.
  2. ^ See also, the documentation for the Wine implementation of GDI32.DLL: Wine API: gdi32.dll
  3. ^ "Inside Native Applications". Archived from the original on 2010-10-23. Retrieved 2017-08-26.
  4. ^ "A short introduction in System Services Dispatching". Insinuator. Insinuator. Retrieved 8 January 2023.
  5. ^ Spencer, McIntyre (30 September 2020). "Win32k Overview". Retrieved 9 January 2023.
  6. ^ "Microsoft Warns of Windows Win32k Privilege Escalation | CISA". www.cisa.gov. CISA Gov. CISA Gov. Retrieved 9 February 2021.
  7. ^ "Inside Native Applications". Archived from the original on 2010-10-23. Retrieved 2017-08-26.
  8. ^ See the documentation for the Wine implementation of GDI32.DLL: Wine API: gdi32.dll
  9. ^ See the documentation for the Wine implementation of USER32.DLL: Wine API: user32.dlll
[edit]