ntoskrnl.exe

ntoskrnl.exe (and ntkrnlpa.exe on systems with Physical Address Extension support) is the kernel image for the family of Microsoft Windows NT operating systems. It provides the Kernel and Executive layers of the Windows NT kernel space, and is responsible for various system services such as hardware virtualization, process and memory management, etc., thus making it a fundamental part of the system. It contains the Cache Manager, the Executive, the Kernel, the Security Reference Monitor, the Memory Manager, and the Scheduler, among other things.^[1]

Startup

This system binary is not a Native Application (in that it is not linked against ntdll.dll), instead containing a standard main entry point, a stub that calls the kernel initialization function but is unused as the OS loader (internal symbol OSLOADER) calls KiSystemStartup directly.

//
// NTOSKRNL main
//
int __cdecl main(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
{
  //
  // Fire up NT!
  //
  KiSystemStartup(LoaderBlock);
  return 0;
}

While ntoskrnl.exe is not linked against ntdll.dll, it is linked against bootvid.dll, hal.dll and kdcom.dll. Because it requires a static copy of C Runtime objects it depends on, the executable is usually about 2MB in size.

Names of kernel

• NTOSKRNL.EXE : 1 CPU
• NTKRNLMP.EXE : N CPU SMP
• NTKRNLPA.EXE : 1 CPU, PAE
• NTKRPAMP.EXE : N CPU SMP, PAE

Notes

1. ^ Russinovich, M: Systems Internals Tips and Trivia, SysInternals Information

See also

• Architecture of Windows NT
• Windows NT Startup Process
• Inside the Windows Vista Kernel (TechNet Magazine)