Windows 9x

Windows 9x

Screenshot of Windows 95, the first version of Windows in the 9x series Screenshot of Windows 95, the first version of Windows in the 9x series
Developer	Microsoft
Working state	Unsupported
Source model	Closed source
Kernel type	Monolithic kernel
Default user interface	Graphical user interface (command line interface also available)
License	MS-EULA

Windows 9x is the family of Microsoft Windows operating systems that comprises the hybrid 16/32-bit Windows versions: Windows 95, Windows 98, which were produced in the 1990s, and Windows Me, which was released in 2000. All these Windows releases have internal version numbers in the 4.x series.

Overview

Windows 95 was able to reduce the role of MS-DOS in Windows much further than had been done in Windows 3.1x and earlier. According to Microsoft, MS-DOS served two purposes in Windows 95: as the boot loader, and as the 16-bit legacy device driver layer.

When Windows 95 started up, MS-DOS loaded, processed CONFIG.SYS, launched COMMAND.COM, ran AUTOEXEC.BAT and finally ran WIN.COM. The WIN.COM program used MS-DOS to load the virtual machine manager, read SYSTEM.INI, load the virtual device drivers, and then turn off any running copies of EMM386 and switch into protected mode. Once in protected mode, the virtual device drivers (VxDs) transferred all state information from MS-DOS to the 32-bit file system manager, and then shut off MS-DOS. These VxDs allow Windows 9x to interact with hardware resources directly, as providing low-level functionalities such as 32-bit disk access and memory management. All future file system operations would get routed to the 32-bit file system manager.

In Windows Me, win.com was no longer executed during the startup process; instead it went directly to execute VMM32.VXD from IO.SYS.

The second role of MS-DOS (as the 16-bit legacy device driver layer) was as a backward compatibility tool for running DOS programs in Windows. Many MS-DOS programs and device drivers interacted with DOS in a low-level way; for example, by patching low-level BIOS interrupts such as int 13h, the low-level disk I/O interrupt. When a program issued an int 21h call to access MS-DOS, the call would go first to the 32-bit file system manager, which would attempt to detect this sort of patching. If it detects that the program has tried to hook into DOS, it will jump back into the 16-bit code to let the hook run. A 16-bit driver called IFSMGR.SYS would previously have been loaded by CONFIG.SYS, the job of which was to hook MS-DOS first before the other drivers and programs got a chance, then jump from 16-bit code back into 32-bit code, when the DOS program had finished, to let the 32-bit file system manager continue its work.

In other words, in the words of Windows developer Raymond Chen: "MS-DOS was just an extremely elaborate decoy. Any 16-bit drivers and programs would patch or hook what they thought was the real MS-DOS, but which was in reality just a decoy. If the 32-bit file system manager detected that somebody bought the decoy, it told the decoy to quack.

Windows 9x is designed as a single-user system. Thus, the security model is much less effective than the one in Windows NT. One reason for this is the FAT file systems (including FAT12/16/32), which are the only ones that Windows 9x supports officially, although Windows NT also supports FAT 12 and 16 (but not 32) and Windows 9x can be extended to read and write NTFS volumes using third-party Installable File System drivers. FAT systems have very limited security; every user that has access to a FAT drive also has access to all files on that drive. The FAT file systems provide no access control lists and file-system level encryption like NTFS.

Most of the feature set and compatibility of the Windows 9x line of operating systems was merged with Windows NT with the release of Windows XP, which was the successor to both Windows 2000 and Windows Me.

Architecture

The user-mode parts of Windows 9x consist of three subsystems: the Win16 subsystem, the Win32 subsystem, and MS-DOS. The GDI, which is a part of the Win32 and Win16 subsystems, is also a module that is loaded in user mode, unlike Windows NT where the GDI is loaded in kernel mode. The kernel mode parts consist of the Virtual Machine Manager (VMM), the Installable File System Manager (IFSHLP), the Configuration Manager, and in Windows 98 and later, the WDM Driver Manager (NTKERN). As a 32-bit operating system, virtual memory space is 4 GiB, divided into a lower 2 GiB for applications and an upper 2 GiB for kernel per process.

Registry

Like Windows NT, Windows 9x stores user-specific and configuration-specific settings in a large information database called the Windows registry. Hardware-specific settings are also stored in the registry, and many device drivers use the registry to load configuration data. Previous versions of Windows used files such as AUTOEXEC.BAT, CONFIG.SYS, WIN.INI, SYSTEM.INI and other files with an .INI extension to maintain configuration settings. As Windows became more complex and incorporated more features, .INI files became too unwieldy for the limitations of the then-current FAT filesystem. Backwards-compatibility with .INI files was maintained until Windows XP succeeded the 9x and NT lines.

Although Microsoft discourages using .INI files in favor of Registry entries, a large number of applications (particularly 16-bit Windows-based applications) still use .INI files. Windows 9x supports .INI files solely for compatibility with those applications and related tools (such as setup programs). The AUTOEXEC.BAT and CONFIG.SYS files also still exist for compatibility with real-mode system components and to allow users to change certain default system settings such as the PATH environment variable.

The registry consists of two files: User.dat and System.dat. In Windows Me, Classes.dat was added.

Virtual Machine Manager

The Virtual Machine Manager (VMM) is the 32-bit protected mode kernel at the core of Windows 9x. Its primary responsibility is to create, run, monitor and terminate virtual machines. The VMM provides services that manage memory, processes, interrupts, and protection faults. The VMM works with virtual devices (loadable kernel modules, which consist mostly of 32-bit ring 0 or kernel mode code, but may include other types of code, such as a 16-bit real mode initialisation segment) to allow those virtual devices to intercept interrupts and faults to control the access that an application has to hardware devices and installed software. Both the VMM and virtual device drivers run in a single, 32-bit, flat model address space at privilege level 0 (also called ring 0). The VMM provides multi-threaded, preemptive multitasking. It runs multiple applications simultaneously by sharing CPU (central processing unit) time between the threads in which the applications and virtual machines run.

The VMM is also responsible for creating MS-DOS environments for system processes and Windows applications that still need to run in MS-DOS mode. It is the replacement for Win386 in Windows 3.x, and the file vmm32.vxd is a compressed archive containing most of the core VxD, including VMM.vxd itself and ifsmgr.vxd (which facilitates file system access without the need to call the real mode file system code of the DOS kernel).

Device drivers

Device drivers in Windows 9x can be virtual device drivers or (starting with Windows 98) WDM drivers. VxDs usually have the filename extension .vxd or .386, whereas WDM compatible drivers usually use the extension .sys. The 32-bit VxD message server (msgsrv32) is a program that is able to load virtual device drivers (VxDs) at startup and then handle communication with the drivers. Additionally, the message server performs several background functions, including loading the Windows shell (such as Explorer.exe or Progman.exe).

Another type of device drivers are .DRV drivers. These drivers are loaded in user-mode, and are commonly used to control devices such as multimedia devices. To provide access to these devices, a dynamic link library is required (such as MMSYSTEM.DLL).

File management

Like Windows for Workgroups 3.11, Windows 9x provides support for 32-bit file access, and unlike Windows 3.x, Windows 9x has support for the VFAT file system, allowing file names with a maximum of 255 characters instead of having 8.3 filenames.

Advantages and disadvantages

Advantages

Windows 9x is a hybrid 16/32-bit operating system. It typically has lower system requirements than contemporary Windows NT versions.

The graphical user interface (GUI) runs on a DOS-based layer. Through Windows 9x's memory managers and other post-DOS improvements, the overall system performance and functionality is improved.

Windows 95 and Windows 98 also offer regressive support for DOS applications in the form of being able to boot into a native "DOS Mode" (MS-DOS can be booted without booting Windows, not putting the CPU in protected mode). This differs from the emulation used in Windows NT-based operating systems. Some very old applications or hardware require "DOS Mode". Having a command line mode outside of the GUI also offers the ability to fix certain system errors without entering the GUI. For example, if a virus is active in GUI mode it can often be safely removed in DOS mode, by deleting its files, which are usually locked while infected in Windows. Similarly, corrupted registry files, system files or boot files can be restored from the command line. Windows 95 and Windows 98 can be started from DOS Mode by typing 'WIN' <enter> at the command prompt. However, the Recovery Console for Windows 2000, which as a version of Windows NT played a similar role in removing viruses.

Windows 9x can run some software that does not run on Windows NT. But Windows XP (which is inherently a version of Windows NT), has compatibility mode to allow most Win32 applications for 9x to run seamlessly.

Disadvantages

Software protection

Windows 9x has never been as stable as common users required, for many reasons. Often the software developers of drivers and applications had insufficient experience with creating programs for the 'new' system, thus causing many errors which have been generally described as "system errors" by users, even if the error is not caused by parts of Windows or DOS. Windows 9x can gain high stability, by using high quality device drivers and carefully selecting application programs along with constant defragmenting of the hard disk drives.

Because DOS was not designed for multitasking purposes, Windows versions that are DOS-based lack system protection. If the user uses 16-bit DOS drivers, it gains instability. Hard disk errors often plague the Windows 9x series.

User access

Some operating systems that were available at the same time as Windows 9x are either multi-user or have multiple user accounts with different access privileges, which allows important system files (such as the kernel image) to be immutable under most user accounts. In contrast, while Windows 95 and later operating systems offer the option of having profiles for multiple users, they have no concept of access privileges, making them roughly equivalent to a single-user, single-account operating system; this means that all processes can modify all files on the system that aren't open, in addition to being able to modify the boot sector and perform other low-level hard drive modifications. This enables viruses and other clandestinely installed software to integrate themselves with the operating system in a way that is difficult for ordinary users to detect or undo. The profile support in the Windows 9x family is meant for convenience only; unless some registry keys are modified, the system can be accessed by pressing "Cancel" at login, even if all profiles have a password. Windows 95's default login dialog box also allows new user profiles to be created without having to log in first.

The reason that Windows 9x doesn't have this feature is the fact that DOS's FAT and FAT32 filesystem doesn't have the file protection nor file permissions of NTFS.

Support for software and hardware

Windows 9x has no native support for SATA drive controllers (and neither did Windows 2000 and Windows XP-SP0), USB drives (except Windows ME), hyper-threading, Data Execution Prevention, symmetric multiprocessing or multi-core processors. There are, however, many SATA-I controllers for which Windows-98/ME drivers exist. Hardware driver support for Windows 98/ME began to decline in 2005, most notably for motherboard chipsets and video cards. The decline for hardware driver support for Windows 98/ME was most dramatic (and largely complete) during 2006.

Alpha compositing and therefore transparency effects, such as fade effects in menus, are not supported by the GDI in Windows 9x.

Windows 9x does not natively support NTFS or HPFS, but there are third-party solutions which allow Windows 9x to have read-only access to NTFS volumes. Also, there is no support for event logging and tracing or error reporting which the Windows NT family of operating systems has, although software like Norton CrashGuard can be used to achieve similar capabilities on Windows 9x.

Early versions of Windows 95 didn't support USB, AGP acceleration and FAT32.

Unprotected region of memory

Although Windows 9x features memory protection, it does not protect the first megabyte of memory from userland applications. This area of memory contains code critical to the functioning of the operating system, and by writing into this area of memory an application can crash or freeze the operating system. This was a source of instability as faulty applications could by accident write into this region and with that halt the operating system.

Drivers share address space with the kernel

Drivers written for Windows 9x/Windows Me are loaded into the same address space as the kernel. This means that drivers can by accident or design overwrite critical sections of the operating system. Doing this can lead to system crashes, freezes and disk corruption. Faulty operating system drivers were a source of instability for the operating system. Other monolithic and hybrid kernels, like Linux and Windows NT, are also susceptible to malfunctioning drivers impeding the kernel's operation.

Limited system resources

Windows 9x/Me set aside two blocks of 64 KB memory regions for GDI and heap resources. By running multiple applications, applications with numerous GDI elements or by running applications over a long span of time, one could exhaust these memory areas. If free system resources dropped below 10%, Windows would become unstable and likely crash.

Altering critical files

Users and software can render the operating system unable to function by deleting or overwriting important system files from the hard disk. Users and software are also free to change configuration files in such a way that the operating system is unable to boot or properly function.

Installation software often replaced and deleted system files without properly checking if the file was still in use or of a newer version. This created a phenomenon often referred to as DLL hell.

Windows Me introduced System File Protection and System Restore to handle common problems caused by this issue.

Releases

The following Windows 9x/Me versions were released:

• Windows 95 original release (version 4.00.950)
• Windows 95 OEM Service Release 1 (OSR1) (version 4.00.950A)
• Windows 95 OEM Service Release 2 (OSR2) (version 4.00.950B)
• Windows 95 OEM Service Release 2.1 (OSR 2.1) (version 4.00.950B)
• Windows 95 OEM Service Release 2.5 (OSR 2.5) (version 4.00.950C)
• Windows 98 Standard Edition (version 4.10.1998)
• Windows 98 Second Edition (version 4.10.2222)
• Windows Millennium Edition (Me) (version 4.90.3000)

Microsoft Plus! packs

• Microsoft Plus! for Windows 95 & 98
• Microsoft Plus! Game Pack: Cards and Puzzles (released alongside Windows Me)