Windows kernel mode components

The core is implemented in ntoskrnl.exe. This executable implements its functionalist in 2 layers - executive and kernel.

The executive implements the system call interface and major OS components such as I/O manager, memory manager, process and thread manager). Kernel mode device drives is in layer between the executive's I/O manager and HAL. The kernel implements low level routines (e.g. synchronization, thread scheduling, interrupt handling) that executive uses to provide high level services.

There are several version of kernel executives

• ntoskrnl.exe - uniprocessor without PAE 
• ntkrnlpa.exe - uniprocessor with PAE 
• ntkrnlmp.exe - multiprocessor without PAE 
• ntkrpamp.exe - multiprocessor with PAE 

win32k.sys is a kernel mode driver tat implement both user and graphic device interface (GDI) services. GDI is pushed to run in kernel mode for speed.