By Andrew Schulman

So if it's not true that Win95 is a brand-new, rewritten from the ground up, complete, integrated operating system that bypasses DOS, the next question obviously is: Well then, what is Windows 95? In particular, after years of running Windows on DOS, many users and developers want to know: Is Windows 95 a genuine operating system?

The answer is Yes, but this is cold comfort, because it can be shown that Windows 3.x Enhanced mode was also a genuine operating system, in exactly the same way that Win95 is. (See Unauthorized Windows 95 for a lengthy elaboration of this point. The book not only shows how Win95 interacts with DOS, but also how Windows 3.x did: it wasn't the simple operating environment relationship that many of us thought at the time.)

Windows 95 = Windows 4.0 + MS-DOS 7.0

What does it mean to say that Windows 95 is really Windows 4.0 and MS-DOS 7.0, bundled together in a single package? It means that Win95 is an upgrade. An excellent upgrade, and one that, if you have a 486 with at least 12 megabytes of memory, is a no-brainer. But it is, repeated denials notwithstanding, still an upgrade. Win95 is not a revolutionary piece of software. It is nothing more -- though also nothing less -- than the fulfillment of many capabilities that have been present all along in Windows 3.x Enhanced mode, ever since its introduction in May 1990. Many things that Windows 3.x could have done without a fundamental architectural overhaul, but didn't do, Windows 95 now does.

As one example, consider preemptive multitasking. We all "know" that Windows 3.x only provided cooperative, non-preemptive multitasking. Yet this is wrong: Windows 3.x Enhanced mode was a full-blown, preemptively-multitasking operating system. What it multitasked, however, were DOS programs running in virtual machines (VMs). What Windows 95 does is take the preemptive multitasking capabilities in the Windows Virtual Machine Manager (VMM), which was the core of Windows 3.x, and change it to instead preemptively multitask a data structure called a Thread Control Block.

Don't feel bad if you've never heard of the Windows VMM. Even though it was the core of Windows 3.x, and remains the core of Windows 95, even many experienced Windows programmers have never heard of it.

Windows is really made up of two layers. The familiar GUI layer -- including the KERNEL, USER, and GDI dynamic link libraries (DLLs) that provide the bulk of the Win16 API, and the KERNEL32, USER32, and GDI32 DLLs that provide the bulk of the Win32 API -- really is just an operating environment. However, this operating environment doesn't so much depend on the DOS operating system. It depends on an operating system called VMM, which provides APIs such as Hook_V86_Int_Chain, Begin_Nest_V86_Exec, and Allocate_V86_Break_Point, and which supports operating system add-ins called Virtual Device Drivers, (VxDs) such as IFSMGR, IOS, VWIN32, VPICD, V86MMGR, and DOSMGR. VMM uses MS-DOS as an assistant.

Most of the groovy new operating system features in Windows 95 are implemented down in the VMM/VxD layer, using capabilities that have been available at that layer ever since the introduction of Windows 3.0 more than five years ago. As noted earlier, preemptive multitasking of threads is based on VMM's previous ability to multitask VMs. The Win95 file system is based on VxDs such as IFSMgr (installable file system manager) and VFAT, which first made their appearance in Workgroups 3.11. The Win95 I/O Supervisor (IOS) has evolved out of the earlier BLOCKDEV VxD, which provided 32-bit disk access in Windows 3.1.

VMM and VxDs contain 32-bit code. So, yes, in this sense Win95 is a 32-bit operating system. But note that VMM and VxDs have been at the foundation of Windows 3.x since its introduction in 1990. Being 32-bit didn't magically make Windows stable then, and it won't now. In particular, note that these 32-bit components of Win95 run in the totally unprotected "Ring 0" of the Intel x86 processors (for a lengthy discussion of how the presence of 32-bit doesn't magically make Windows more robust, see Andrew Schulman, Vexed by VxDs, InfoWorld, February 27, 1995).

Win95, then, like Windows 3.x Enhanced mode before it, is a 32-bit protected-mode operating system, actually called the VMM, which runs a bunch of 16-bit GUI code, supplemented by a bunch of 32-bit GUI code, as a sort of subsystem. This 32-bit operating system also uses MS-DOS as a 16-bit assistant.

Win95 GUI catches up

And, while the famous Win95 Start button is merely "a glorified Apple menu," on the other hand Windows 95's desktop provides high-level logical groupings of data and resources that are mostly absent on the Mac." Win95 shortcuts are "alias knockoffs," but with a difference: for example, a Win95 shortcut can "point to information on a LAN server, remote dial-up computer, Internet site or the Microsoft Network."

All in all, despite the continuing sense that Microsoft uses Apple as its R&D lab, even MacWEEK has to admit that Win95 does some things better than Apple's System 7.5. Microsoft's Usability Labs, with their famous one-way mirrors and cameras, appear to have been the site of some genuinely innovative UI work.

Unfortunately, Microsoft appears to fear the appearance that Win95 is merely a UI. After all, the common complaint about Windows 3.x is that it was a mere layer on top of DOS. This in fact was a fairly silly criticism, since the problems with Windows 3.x had little to do with its relationship to DOS. Nonetheless, Microsoft appears to have some sort of inferiority complex about its own genuine achievements -- look at how the company repeatedly trashes DOS, the most successful software product in history -- and wants to create the impression that Win95's innovations are more than skin-deep. Hopefully most developers and users will set aside the hype and evaluate both the OS and the UI on its merits. While Windows 95 may not have been overhauled as radically at the OS layer as it has been as a user interface, it's still a significant piece of work.

The Land of a Thousand Components

A typical Windows 95 installation consists of over 1,000 different files, spread over about 150 subdirectories, and totalling about 64 megabytes in size. The Windows Software Development Kit (SDK) documents over 1,500 functions or APIs. This, incidentally, is revealed by running:

    grep WINAPI \sdk\include\*.h | wc 

At the second, lower, level of Windows, the Device Driver Kit (DDK) documents over 1,200 Virtual Device Driver (VxD) services. This is revealed by running:

    grep_Service \ddk\include\*.inc | wc 

Divide and Conquer

In other words, Windows is hardly the monolithic entity you would expect given the large number of 1000 page books describing it. Windows is comprised of individual components. I wouldn't quite call them modules, because that would imply a cleaner separation than actually exists (many of these components have "carnal knowledge" of each other, i.e., undocumented backdoor interfaces that they use to communicate with each other). But they're definitely individual, separate components that can be understood somewhat separately.

What sort of components are we talking about? We can see by examining the different file types (as indicated by the three-letter file extension, which remains all-important in Windows 95) on the Win95 retail distribution CD-ROM. (If the Windows 95 Plus CD were included, that would of course add many more files.) The following table shows the most prevalent file types in Win95.

Incidentally, this table is another good example of how simple tools can be slapped together to explore Windows. Microsoft's EXTRACT utility can display a directory of a .CAB (cabinet; a sort of compressed archive) file on the retail distribution disks or CD. It's simple to write a throw-away script, such as the following cabcount.awk, to count up the number and size of files with each extension.

# cabcount.awk
# total up contents of .CAB files
# extract /A /D d:\win95\win95_02.cab | awk -f count.awk 

NF == 5 {                  # for each file...
   fsize = $4;             # 4th field; auto conversion text -> number
   nameext = $5;           # 5th field  
   split(nameext, arr, ".");    # split "name.ext" into "name" and "ext"
   ext = arr[2];           # take the extension
   files[ext]++;           # "ext" index into associative array
   size[ext] += fsize;
   total++;
   total_size += fsize;
}

END {
   printf("Ext\t\t# Files\t\tSize (kb)\t\tAve.\n");
   for (ext in files)       # for each extension type...
      printf("%s\t\t%d\t\t%.02f\t\t%d\n", 
        ext, files[ext], size[ext], size[ext] / files[ext]);
   printf("%s\t\t%d\t\t%.02f\t\t%d\n", 
        "TOTAL", total, total_size, total_size / total);
}

    Windows == DLL + VXD + SPD + EXE + DRV + ...

The core of the Windows operating system lives in the \WINDOWS\SYSTEM subdirectory. Running dir /o-s to sort by file size in reverse order reveals some of the key components that make up Windows shown in the table on this page.

VMM32.VXD itself is made up of about 40 other VxDs. In a typical Win95 install, there are about 75 VxDs loaded. (You can check this out for yourself by running the VXDCHAIN program on O'Reilly's Web site.

A Collection of Code

This non-integrated, component-based architecture of Windows also helps explain how Microsoft can keep expanding the operating system into what was formerly considered the domain of application software: just keep on adding more DLLs and VxDs, and keep your fingers crossed that there aren't too many surprise interactions. If Microsoft is widely perceived as taking over the world -- even Garry Trudeaus Doonesbury has recently taken up this theme: "Mike, who makes the software that runs 80% of the worlds P.C.s?" "Microsoft, of course." "And does the world run on computers?" "Sure." "So who rules the world?" -- If this is so it's worth noting that Microsofts success is at least partly based on having a component-based kitchen-sink operating system into which more and more functionality can be placed: not so much an operating system, perhaps, but, like any successful piece of software, more a Dempster dumpster.