Windows 7's dirty secrets revealed
Hidden work arounds and complex dependencies
PDC While chief technology officer Ray Ozzie was away in the clouds at Microsoft's Professional Developer Conference, technical fellow Mark Russinovich got down and dirty with the true heart of Windows - the kernel.
He presented a two-hour session on changes made to the kernel used by both Windows 7 and Server 2008 R2, shedding light on some confusing issues - like the Windows version number, which he said "means nothing at all". Windows 7 is version 6.1, not because it is a minor release, but for compatibility with applications that check the major number and would not run if it said 7.
Another of his themes was MinWin, a lightweight version of Windows whose purpose has sparked speculation. MinWin exists, he said, and contains the minimum necessary to boot and access the network: kernel, file system driver, device drivers, services and TCP/IP stack. It amounts to around 150 binaries, and requires 25MB disk space and 40MB RAM.
MinWin is handy for setup and system recovery, but its real purpose is to introduce what he calls "architectural layering" to Windows. Microsoft needs small footprint versions of Windows, both for embedded use and for the GUI-free Server Core edition. The problem is that the operating system is full of internal dependencies, and as Russinovich admitted: "We don't really understand those dependencies".
Engineers have added features to low-level APIs that assume the presence of dynamic link libraries (DLLs) that belong with higher level APIs, and when you try to extract just those low-level components, they break. MinWin is a first step in making Windows layered, maintainable and understandable.
A fresh DLL hell
In order to make MinWin, Microsoft had to split existing DLLs that had these unwanted dependencies, such as Kernel32.dll. The team created KernelBase.dll, which has only the base functions MinWin requires. Applications expect to find these functions in Kernel32, but they are simply forwarded to KernelBase. Kernel32 itself is outside MinWin.
A related problem is that Microsoft has been in the habit of combining unrelated APIs into the same DLL for performance reasons. Its solution is to create virtual DLLs, which are the API sets programmers call, but which are implemented in logical DLLs that might combine several virtual ones. A schema file that is mapped into every process tells Windows where the real API resides.
Russinovich went on to explain why Windows 7 is faster. Memory footprint was reduced by up to 30 per cent by reviewing excessive memory allocations, and by refactoring the Desktop Window Manager (DWM) to avoid a second copy of every Window being held in memory. The registry is no longer accessed as a memory-mapped file, reverting a change made for Windows XP. Processes that consume large amounts of memory are more aggressively pruned. Microsoft also picked out 300 common user actions, such as clicking the Start menu or opening Control Panel, and gave them intensive optimisation to improve perceived performance.
Sponsored: The Nuts and Bolts of Ransomware in 2016