Introduction
To explain the underlying technology, we must first start with the architecture of the window operating system.
Window operating system itself belongs to the category of software, but it needs to deal closely with hardware. It provides a public interface for upper-level application software or application systems, and is responsible for the management and allocation of hardware resources. Application software does not need to directly deal with the hardware. They use the interface provided by the operating system to implement various application tasks. If they want to access the hardware, they must complete the public interface provided by the operating system. In order to ensure the stability of the Windows system itself, Windows adopts a dual mode structure to protect the operating system itself to avoid being affected by application errors. The core of the operating system runs in kernel mode, and the application runs in user mode. Whenever the application program needs to use the service provided by the system kernel or the kernel's extension module (kernel driver), the application program switches from user mode to kernel mode through hardware instructions; when the system kernel completes the requested service, Control is back to the user mode code. In the window system, the closer it is to the application software, the lower it is to the hardware. The role of all intermediate levels, including the kernel, is to help the application software make better, safer, more convenient, and more efficient use of hardware resources, including the CPU. The underlying technology refers to the modification and secondary development of the file system, device drivers, and windows kernel programs that run in the kernel mode and closely fit the hardware.
Advantages
The underlying technology uses the interface provided by the kernel to directly control the hardware, so it has the following advantages compared with other technical means:
First of all, in terms of security, the underlying technical means mainly run in the kernel mode, that is, run in the windows background, and are executed as part of the operating system, so there is no need to start the process, and the user does not perceive the operation of the driver. Compared with the technology running at the application layer, it is more concealed and safer than bypassing and uninstalling.
Secondly, in terms of real-time performance, because the underlying technical means run synchronously with the windows operating system, we can perceive the user's operation behavior in the first time, including hardware insertion and startup, file access, and operation. And so on, while being able to accurately record and block in time.
Finally, in terms of efficiency, the underlying technical means run directly in the kernel mode, so as to achieve global control of all operating behaviors, and hardly affect the speed and performance of the computer.