Jon Udell
UNAUTHORIZED WINDOWS 95 by Andrew Schulman IDG Books, ISBN 1-56884-305-4, $39.99
Hacker/sleuth extraordinaire Andrew Schulman loves to spelunk in the dark and cobwebby cellar on which Microsoft's software empire rests. On two previous descents, chronicled in Undocumented DOS and Undocumented Windows, he compiled encyclopedic descriptions of what he found there. These books were much more than catalogs of technical trivia, though. Schulman emerged with important insights about the nature of DOS and Windows, the role of undocumented APIs and data structures, and the issues surrounding the use of that information by Microsoft and others.
Unauthorized Windows 95 carries on in the same great tradition. This time, his focus shifts to the architecture of Window
s 95 vis-a-vis its predecessors. In particular, he attacks Microsoft's claim that Windows 95 eliminates the dependency on DOS that's widely regarded as the Achilles' heel of Windows 3.x. Schulman doesn't just refute that claim. He jumps on it with both feet and tramples it to a bloody pulp with an almost maniacal glee. The evidence just keeps piling up--we see Windows 95 issuing INT 21h calls, even on behalf of ``pure'' Win32 programs, to create PSPs (Program Segment Prefixes), get and set the time and date, and perform various other tasks.
After flogging this dead horse mercilessly, Schulman turns the argument on its head. Why shouldn't Windows 95 rely on certain DOS services, particularly when the code that supplies those services runs not in an x86 chip's real mode but in its protected V86 mode? Since version 3.0, he goes on to explain, Windows has really been two operating systems that are loosely coupled together.
The first of these, running at ring 0, is the VMM (virtual machine manager),
which multitasks V86-mode sessions or VMs (including the special VM in which all Windows 3.x and Windows 95 programs run) and provides the execution environment for the VxDs (virtual device drivers) that Schulman aptly dubs ``TSRs of the 90s.'' The second operating system, running at ring 3, is the set of 16-bit (or in the case of Windows 95, 16- and 32-bit) DLLs that directly support Windows programs.
To the VMM, virtualized DOS is merely a useful assistant that sees only those calls the VMM/VxD system chooses to reflect rather than consume. That consumption has steadily increased over time. In Windows for Workgroups 3.11, both disk and file access were handled entirely by the VMM/VxD system. The trend continues with Windows 95, which on the whole reflects even fewer calls to virtualized DOS (although, paradoxically, it does reflect some that WFW 3.11 did not, to be more compatible with third-party disk utilities).
Examining the fossil record, Schulman traces a continuous evolutionary series, f
rom Windows 3.0 to 3.1 to WFW 3.11 to Windows 95. But while he ridicules Microsoft's claim that Windows 95 represents a clean break with the past, he denies OS/2 and NT supporters the opportunity to gloat. Windows 95's continuity with its admittedly checkered past, Schulman concludes, is a hugely bankable asset.
Jon Udell is a BYTE senior technical editor at large. You can reach him on the Internet or BIX at
judell@bix.com
.
Spelunking The Cellars Of Windows 95
