Why is kernel32.dll running in user mode and not kernel mode
devblogs.microsoft.com
devblogs.microsoft.com
> The Graphics Device Interface is responsible for tasks such as drawing lines and curves, rendering fonts and handling palettes. The Windows NT 3.x series of releases had placed the GDI component in the user-mode Client/Server Runtime Subsystem, but this was moved into kernel mode with Windows NT 4.0 to improve graphics performance.
I remember how rock solid NT 3.51 was, then NT 4.0 and early Win 2000 was a period of less stability especially on laptops until it finally got stable again.
But this post is amazing and explains a pretty tricky concept, and history, of "subsystems" in a pretty easy way. Effectively, Kernel32(Now KernelBase) has the logic for usermode stuff, and goes into ntdll solely for syscall stubs. It then gently eases the idea of User32 having a similar purpose, as well as GDI. These are the 3 "subsystems" that interact with the Kernel, and it's a pretty core concept, but alot of newbies struggle to understand.