How processes work with user and kernel mode in Windows OS?

Question

I have been trying to learn the Windows architecture but I am still struggling to piece all of the parts together and I think it is especially hard because I don't have any programming knowledge.

One of my pain areas is the kernel and user mode. Could anyone help me with a good example to understand how processes that run in user mode access the kernel ? And where do handles and objects come into the picture?

From what I read the kernel and user mode are just two different processor modes on Windows. User mode is used for applications, system processes, services etc. while the kernel mode is for Windows Executive, device and file-system drivers, HAL, kernel code itself, GDI etc. The processor running on Windows switches between these two modes depending on the code it is executing.

In user mode, the executing code has no ability to directly access hardware and has only limited access to system data. It would have to use handles to access kernel mode resources which are objects. In kernel mode, the executing code has complete and unrestricted access to the underlying hardware and system data. This isolation allows for better system stability and security. Crashes in the user mode only affect the application as each process runs in its own private virtual memory space called heap, while crashes in the kernel mode causes bug checks because the kernel mode shares the virtual memory space known as pool.

To show my understanding so far let us take the example of MS Paint. If I launch paint and then try to open an image by keying in the filename, a thread in the mspaint.exe process is going to be switched into the kernel mode by the processor in order to access the file-system which is in the kernel mode that will allow it to view all the files present on the disk and locate the file that matches the filename. On locating the file, the mspaint thread is provided a handle to the file object in the kernel mode and then the thread is switched back to user mode by the processor.

Please correct me if I am wrong and if so a correct example with how it works would be very much appreciated.

Answer 1

MS Paint thread call a "function" from the kernel that is used to read the file needed to be modified. This function just has the ability to load from disk to RAM or vice versa. MS Paint has access to a specific space in the RAM to which the file is loaded by the kernel. MS Paint modify the loaded copy in the RAM by changing color, font, etc. Again a function is called from the kernel to save the modifications.