Architecture and components - Win32 apps (2023)

  • Article
  • 8 minutes to read


For apps on Windows 10, we recommend using Windows.UI.Composition APIs instead of DirectComposition. For more info, see Modernize your desktop app using the Visual layer.

This topic describes the components that make up Microsoft DirectComposition. It consists of the following sections.

  • Software components
  • Application library
  • Composition engine
  • Related topics

Software components

DirectComposition consists of the following main software components.

  • A user-mode application library (dcomp.dll) that implements the Component Object Model (COM)-based public API.
  • A user-mode composition engine (dwmcore.dll) that is hosted in the Desktop Window Manager (DWM) process (dwm.exe), and performs the actual desktop composition.
  • A kernel-mode object database (part of win32k.sys) that marshals commands from the application to the composition engine.

A single instance of the composition engine handles the DirectComposition composition trees for all applications and the DWM composition tree, which represents the entire desktop. Both the kernel-mode object database and the user-mode composition engine are instantiated once per session, so a Terminal Server machine with multiple users has multiple instances of both of those components.

The following diagram shows the main DirectComposition components and how they relate to one another.

Architecture and components - Win32 apps (1)

Application library

The DirectComposition application library is a public COM-based API with a single flat entry-point that is exported from dcomp.dll and returns an interface pointer to a device object. The device object, in turn, has methods for creating all other objects, each of which is represented by an interface pointer. All DirectComposition interfaces inherit from and fully implement the IUnknown interface. All methods that accept DirectComposition interfaces check whether the interface is implemented inside of dcomp.dll or whether it is implemented by another component. Because DirectComposition is not extensible, methods that take interfaces as parameters return E_INVALIDARG if the interfaces are not implemented in dcomp.dll. The API requires no special privileges; it can be called by processes running at the lowest level of access. However, because the API does not operate in session 0, it is not suitable for services. In these respects, the DirectComposition API is similar to other Microsoft DirectX APIs, most notably Direct2D, Microsoft Direct3D, and Microsoft DirectWrite.

Because the composition engine is designed exclusively for asynchronous execution, object properties in the DirectComposition API are write-only. All properties have setter methods, but not getter methods. Reading properties is not only resource intensive, but can also be inaccurate because any value that the composition engine returns can immediately become invalid. This can happen if, for example, an independent animation is bound to the property that is being read.

The API is thread-safe. An application can call any method from any thread at any time. However, because many API methods must be called in a particular sequence, without any synchronization an application can experience unpredictable behavior depending on how the threads interleave. For example, if two threads change the same property of the same object to different values at the same time, the application cannot predict which of the two values will be the final value of the property. Similarly, if two threads call Commit on the same device, neither thread gets truly transactional behavior because a call to Commit on one thread will submit the batch of all commands issued by both threads, not just the one that called Commit.

The system maintains all internal state per device object. If an application creates two or more DirectComposition device objects, the application can maintain independent batches and other state between the two.

All DirectComposition objects have device object affinity; objects created by a particular device object can be used only with that device object, and can be associated only with other objects created by the same device object. In other words, each device object is a separate disjoint island of functionality. The one exception is the visual class, which permits the building of visual trees where a visual can belong to a different device object than its parent. This enables scenarios where an application and a control can manage a single composition tree without also needing to share a single DirectComposition device object.

Composition engine

The DirectComposition composition engine runs on a dedicated process, separate from any application process. A single composition process, dwm.exe, supports every application in a session. Each application can create two visual trees for each window that it owns. All of the trees are actually implemented as subtrees of a larger visual tree that also encompasses the composition structures of DWM. The DWM constructs one large visual tree for each desktop in a session. Here are the key advantages to this architecture:

  • The composition engine has access to all application bitmaps and visual trees, which enables cross-process window interoperability and composition.
  • The composition engine runs in a trusted system process that is separate from any application process, enabling applications that have low access rights to securely compose protected content.
  • The composition engine can detect when a particular window is fully occluded and avoid wasting CPU and graphics processing unit (GPU) resources composing for the window.
  • The composition engine can compose directly to the screen back buffer, avoiding the need for an extra copy that is required for per-process composition engines.
  • All applications share a single Direct3D device for composition, which offers considerable memory savings

The visual tree is a retained structure. The DirectComposition API exposes methods to edit the structure in batches of changes that are processed atomically. The root object in the DirectComposition API is the device object, which serves as the factory for all other DirectComposition objects and contains a method called Commit. The composition engine does not reflect any changes that the application makes to the visual tree until the application calls Commit, at which point all changes since the last Commit are processed as a single transaction.

The requirement to call Commit is similar to the concept of a "frame" except that, because the composition engine runs asynchronously, it can present several different frames between calls to Commit. In DirectComposition, a frame is a single iteration of the composition engine, and the interval spent by an application between two calls to Commit is called a batch.

DirectComposition batches all application calls to the DirectComposition API. The kernel object database, which is implemented in the win32k.sys session driver, stores all state information that is associated with the API calls.

The composition engine produces one frame for each vertical blank in the display. The frame is started at a vertical blank and targets the subsequent vertical blank. When the frame starts, the composition engine picks up all pending batches and includes their commands in that frame. Batches are placed in a pending queue when the application calls Commit, and the pending queue is flushed atomically at the beginning of the frame. Therefore, there is a single point in time that marks the beginning of a frame. Any batches submitted before this point are included in the frame, while any batches submitted after must wait until the next frame to be processed. The full composition loop is as follows:

  1. Estimate the time of the next vertical blank.
  2. Retrieve all pending batches.
  3. Process the retrieved batches.
  4. Update all animations using the time estimated in step 1.
  5. Determine the regions of the screen that need to be re-composed.
  6. Re-compose the dirty regions.
  7. Present the frame by flipping the back and front buffers for each screen.
  8. If nothing was composed and presented in steps 6 and 7, wait for a batch to be committed.
  9. Wait for the next vertical blank.

If there are multiple monitors attached to a single video adapter, the composition engine uses the vertical blank of the primary monitor to drive the composition loop and set the animation sampling times. Each monitor is represented by a separate full-screen flip chain; the composition engine repeats steps 6 and 7 for each monitor, in a round-robin fashion, using a single Direct3D device. If there are also multiple video adapters, the composition engine uses a separate Direct3D device for each video adapter in steps 6 and 7.

Composition frames are scheduled to always start at a vertical blank, as the following illustration shows.

Architecture and components - Win32 apps (2)

If the composition engine has no work to do because the composition tree has not changed, the composition thread sleeps while waiting for a new batch. When a new batch is submitted, the composition thread wakes up but immediately goes back to sleep until the next vertical blank. This behavior ensures predictable frame start and end times for applications and for the composition engine.

The composition engine publishes the frame presentation times and the current frame rate. Publishing this information enables applications to estimate the presentation time for their own batches, which in turns enables animations to be synchronized. In particular, an application can use a combination of frame statistics from the composition engine, and a historical model of how long its UI thread takes to produce a batch, to determine the sampling time for its own animations.

For example, at the beginning of the application batch shown in the previous illustration, the application can query the composition engine to determine the exact presentation time of the next frame. The application can then use the current time, along with information about previous batches that it has produced, to determine whether the application can complete the current batch before the next vertical blank. Therefore, the application uses the frame presentation time as the sampling time for its own animations. If the application determines that it is unlikely to complete its work in the current vertical blank, the application can use the subsequent frame time as the sampling time instead, using the frame rate information returned by the composition engine to compute that time.

DirectComposition Concepts


What are Win32 applications? ›

Win32 is the 32-bit application programming interface (API) for 32-bit versions of Windows (NT, 95, and later versions). The API consists of functions implemented, as with Win16, in system DLLs. The core DLLs of Win32 are kernel32.

What are the basic components of Microsoft windows? ›

An application window includes elements such as a title bar, a menu bar, the window menu (formerly known as the system menu), the minimize button, the maximize button, the restore button, the close button, a sizing border, a client area, a horizontal scroll bar, and a vertical scroll bar.

Why Win32? ›

It's just a convention. win32 is just shorthand for a program running on windows with 32 bits. If you prefer to call it flimflam, you're welcome to do so, though it may not be very clear in your project.

What are the windows APIs? ›

The Windows API (application programming interface) allows user-written programs to interact with Windows, for example to display things on screen and get input from mouse and keyboard. All Windows programs except console programs must interact with the Windows API regardless of the language.

Is Win32 an operating system? ›

The Win32_OperatingSystem WMI class represents a Windows-based operating system installed on a computer.

How do I create a Win32 app? ›

Add a Win32 app to Intune
  1. Sign in to the Microsoft Intune admin center.
  2. Select Apps > All apps > Add.
  3. On the Select app type pane, under the Other app types, select Windows app (Win32). Important. Be sure to use the latest version of the Microsoft Win32 Content Prep Tool. ...
  4. Click Select. The Add app steps appear.
Feb 22, 2023

What is Microsoft components? ›

The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft's OLE (compound documents), ActiveX (Internet-enabled components), as well as others.

What are the 5 components that we need for the installation of Windows 10? ›

Here's what Microsoft says you need to run Windows 10:
  • Processor: 1 gigahertz (GHz) or faster.
  • RAM: 1 gigabyte (GB) (32-bit) or 2 GB (64-bit)
  • Free hard disk space: 16 GB.
  • Graphics card: Microsoft DirectX 9 graphics device with WDDM driver.
  • A Microsoft account and Internet access.
Mar 5, 2015

What is a Win32 platform? ›

The Win32 API (also called the Windows API) is the original platform for native C/C++ Windows applications that require direct access to Windows and hardware. It provides a first-class development experience without depending on a managed runtime environment like . NET and WinRT (for UWP apps for Windows 10).

What is another name for Win32? ›

Alternatively called the Windows API and WinAPI, Win32 is the main set of Microsoft Windows APIs used for developing 32-bit applications.

What is Win32 process? ›

The Win32_Process WMI class represents a process on an operating system. The following syntax is simplified from Managed Object Format (MOF) code and includes all of the inherited properties. Note. For a general discussion on Processes and Threads within Windows, please see the topic Processes and Threads.

What are the 4 types of API? ›

APIs are broadly accepted and used in web applications. There are four different types of APIs commonly used in web services: public, partner, private and composite.

What is difference between API and APIs? ›

The key distinction is that web services are a type of API: All web services are APIs, but not all APIs are web services. 'API' is the broader category because, by definition, it refers to any software component that acts as an intermediary between two otherwise disconnected applications.

What is the difference between Win64 and Win32? ›

What Are 32-Bit and 64-Bit? When it comes to computers, the difference between 32-bit and a 64-bit is all about processing power. Computers with 32-bit processors are older, slower, and less secure, while a 64-bit processor is newer, faster, and more secure.

Is Win32 a Trojan? ›

Win32/Agent Trojans have been observed to perform any, or all, of the following actions: Redirecting web traffic to malicious/compromised websites/domains. Manipulating certain Windows or other installed applications, including the specific settings and/or configurations.

Where is Win32 location? ›

For the folder c:\windows\system32\wbem, the path is \windows\system32\.

Where are Win32 files stored? ›

Win32.exe is located in the C:\Windows\System32 folder.

Is Win32 the same as x86? ›

Yes. In this context x86 is synonymous with Win32.

What is the size limit for win32app? ›

Add, assign, and monitor a Win32 app

Windows application size is limited to 8 GB per app.

Is Win32 a C++? ›

Win32++ is a C++ library used to build windows applications. Win32++ is a free alternative to MFC. It has the added advantage of being able to run on a wide range of free compilers, including Visual Studio Community, Clang, and the MinGW compiler provided with CodeBlocks and Dev-C++.

How do I identify Windows components? ›

The first place you can look for information on your PC's configuration is Settings > System > About. The easiest way to get there is to right-click on the Windows icon and select “System” from the menu. This is how to check PC parts according to Microsoft.

What are the 5 types of Windows operating system? ›

Windows versions
  • Windows 11 (2021) Current client version of Windows. ...
  • Windows 10 S (2017) ...
  • Windows 10 (2015) - MS Version 6.4. ...
  • Windows 8/8.1 (2012-2013) - MS Version 6.2/6.3. ...
  • Windows 7 (2009) - MS Version 6.1. ...
  • Windows Vista (2006) - MS Version 6.0. ...
  • Windows XP (2001) - MS Version 5.1. ...
  • Windows 2000 (2000) - MS Version 5.0.

What is component services used for? ›

Component services define an application programming model for developing distributed applications. They also provide a run-time infrastructure for deploying and managing these applications. Component services enable you to break down transactions into components that perform discrete functions.

What is the difference between feature and component? ›

A feature is a part of the application's total functionality that a user may decide to install independently. For more information, see Windows Installer Features. A component is a piece of the application or product to be installed.

What are the three different components of Windows 10 desktop? ›

There are several principal components to Windows desktops: The Start menu, the Task bar, and the time, which are all located at the bottom of the screen, and the main workspace, which takes up most of your screen.

What are two basic system requirements for Windows 10? ›

Windows 10 system requirements
  • Latest OS: Make sure you're running the latest version—either Windows 7 SP1 or Windows 8.1 Update. ...
  • Processor: 1 gigahertz (GHz) or faster processor or SoC.
  • RAM: 1 gigabyte (GB) for 32-bit or 2 GB for 64-bit.
  • Hard disk space: 16 GB for 32-bit OS or 20 GB for 64-bit OS.

Are Win32 apps 32-bit? ›

Win32 applications are programs written for the Windows operating system. Microsoft Intune allows Win32 app management capabilities and supports both 32-bit and 64-bit operating system architecture for Windows applications.

What is a module Win32? ›

A module is an executable file or DLL. Each process consists of one or more modules. You can retrieve the list of module handles for a process by calling the EnumProcessModules function. This function fills an array of HMODULE values with the module handles for the specified process.

Is Win32 better than win64? ›

The terms 32-bit and 64-bit refer to the way a computer's processor (also called a CPU), handles information. The 64-bit version of Windows handles large amounts of random access memory (RAM) more effectively than a 32-bit system.

Is Win32 API open source? ›

Win32++ is a C++ library used to build windows applications. It is a simple, open source alternative to MFC.

How do I get rid of Win32? ›

How to remove Win32 / Virut in 3 simple steps
  1. Download. Download our free removal tool: rmvirut.exe.
  2. Run the tool. To remove infected files, run the tool. ...
  3. Update. After your computer has restarted, make sure your antivirus is up-to-date and then run a full computer scan.

What is Win32 virus? ›


A is a file infecting virus that infects . EXE and . SCR files accessed on infected systems. Win32/Virut. A also opens a backdoor by connecting to an IRC server, allowing a remote attacker to download and run files on the infected computer.

Is System32 malware? ›

Though the System32 folder is completely safe and in fact the most important folder of the OS, the cybercriminals use its name to create trojans and other dangerous malware. There are many viruses that are designed in a way to look like the System32 folder.

What is win32 in Linux? ›

Win32 is meant to be the single point of interaction between your application and the operating system, and it can provide this because every aspect of the operating system is fixed to some standard. There are too many variable components of a Linux system for there to be a generic "Sure, use this library" answer.

Is my computer win32 or win64? ›

Check whether Windows 10 is running in 32-bit or 64-bit

Click the Start button, then choose Settings. Select System. Choose About. Check the bit version on the System type field.

What is API architecture? ›

API architecture refers to the process of developing a software interface that exposes backend data and application functionality for use in new applications. With an API-first architecture, you can create ecosystems of applications that are modular and reusable — which is ideal for microservices.

What is SOAP and REST API? ›

SOAP is a protocol, whereas REST is an architectural style

An API is designed to expose certain aspects of an application's business logic on a server, and SOAP uses a service interface to do this while REST uses URIs.

What are the three most common APIs? ›

There are also three common types of API architectures:
  • REST, a collection of guidelines for lightweight, scalable web APIs.
  • SOAP, a stricter protocol for more secure APIs.
  • RPC, a protocol for invoking processes that can be written with XML (XML-RPC) or JSON (JSON-RPC).
Jan 16, 2023

What is difference between REST and REST API? ›

It is a set of constraints that set out how an API (application programming interface) should work. If an API is RESTful, that simply means that the API adheres to the REST architecture. Put simply, there are no differences between REST and RESTful as far as APIs are concerned.

What is difference between REST and web API? ›

A web API lets you interact with a web server through HTTP requests, while a REST API lets you interact with any kind of server over HTTP. REST APIs are web services that use HTTP and provide an interface for clients to interact with the service.

What is the difference between REST API and HTTP? ›

REST APIs support more features than HTTP APIs, while HTTP APIs are designed with minimal features so that they can be offered at a lower price. Choose REST APIs if you need features such as API keys, per-client throttling, request validation, AWS WAF integration, or private API endpoints.

Why is Windows called Win32? ›

Win32 is the 32-bit application programming interface (API) for 32-bit versions of Windows (NT, 95, and later versions). The API consists of functions implemented, as with Win16, in system DLLs. The core DLLs of Win32 are kernel32.

What is 32-bit vs 64-bit architecture? ›

As its name suggests, the 32 bit OS can store and handle lesser data than the 64 bit OS. More specifically, it addresses a maximum of 4,294,967,296 bytes (4 GB) of RAM. The 64 bit OS, on the other hand, can handle more data than the 32 bit OS.

Can you run Win32 programs on win64? ›

The 64-bit versions of Windows don't provide support for 16-bit binaries or 32-bit drivers. Programs that depend on 16-bit binaries or 32-bit drivers can't run on the 64-bit versions of Windows unless the program manufacturer provides an update for the program.

Is Win32 a virus? ›

Virut. The virus adds the executable file of the host process to the Windows firewall list of trusted applications. Then it disables the “Restore system files” function.

What does Win32 mean? ›

(1) A 32-bit version of Windows. Many editions of Windows have come in both 32-bit and 64-bit versions. See 32-bit computing and x86/x64. (2) Win32 is the programming interface (API) for 32-bit and 64-bit Windows operating systems.

How do I fix Win32 application Cannot be run? ›

Right-click the .exe file, or a shortcut to the .exe file, and select Properties. Click the Compatibility tab. Then check Run this program in compatibility mode for and select an appropriate option. Then try launching it again.

Is win32 a Trojan? ›

Win32/Agent Trojans have been observed to perform any, or all, of the following actions: Redirecting web traffic to malicious/compromised websites/domains. Manipulating certain Windows or other installed applications, including the specific settings and/or configurations.

Can system 32 have malware? ›

Though the System32 folder is completely safe and in fact the most important folder of the OS, the cybercriminals use its name to create trojans and other dangerous malware. There are many viruses that are designed in a way to look like the System32 folder.

Is win32 malware Gen harmful? ›

Win32 Malware. gen is a so-called generic threat - a suspicious file fetched by an anti-virus scan that appears to be malicious but does not match any of the definitions of known malware threats contained in the anti-virus software's database.
EnigmaSoft Threat Scorecard.
Infected Computers:20,616
1 more row

What is the difference between Win32 and win64? ›

The terms 32-bit and 64-bit refer to the way a computer's processor (also called a CPU), handles information. The 64-bit version of Windows handles large amounts of random access memory (RAM) more effectively than a 32-bit system.

Do I need Win32 exe on my computer? ›

The file win32.exe is associated with Windows System 32, where the drivers and . dll files are stored. This file is responsible for running all the executable files found on your computer. If this win32.exe file is corrupt, it could stop programs from launching.

Which service is required to install Win32 application on Windows devices? ›

To use Win32 app management, be sure the following criteria are met: Use Windows 10 version 1607 or later (Enterprise, Pro, or Education editions).
Devices must be enrolled in Intune and either:
  • Azure AD registered.
  • Azure AD joined.
  • Hybrid Azure AD joined.
Feb 22, 2023

How do I run a Win32 program on Windows 10? ›

Right-click on the Default Application Tool option and choose Advanced Settings in the right area. 10. In the Advanced Settings window, under the General section, click on the dropdown behind Enable 32-Bit Applications option and select True.

How do I clean my computer from Trojan virus? ›

Installing and using a trusted antivirus solution is also one of the top ways to get rid of trojans. An effective antivirus program searches for valid trust and app behavior, as well as trojan signatures in files in order to detect, isolate and then promptly remove them.

How do I manually remove malware from Windows? ›

Windows Security is a powerful scanning tool that finds and removes malware from your PC.
Remove malware from your Windows PC
  1. Open your Windows Security settings.
  2. Select Virus & threat protection > Scan options.
  3. Select Windows Defender Offline scan, and then select Scan now.

What is Trojan in malware? ›

A Trojan Horse (Trojan) is a type of malware that disguises itself as legitimate code or software. Once inside the network, attackers are able to carry out any action that a legitimate user could perform, such as exporting files, modifying data, deleting files or otherwise altering the contents of the device.


Top Articles
Latest Posts
Article information

Author: Kerri Lueilwitz

Last Updated: 08/01/2023

Views: 5820

Rating: 4.7 / 5 (47 voted)

Reviews: 94% of readers found this page helpful

Author information

Name: Kerri Lueilwitz

Birthday: 1992-10-31

Address: Suite 878 3699 Chantelle Roads, Colebury, NC 68599

Phone: +6111989609516

Job: Chief Farming Manager

Hobby: Mycology, Stone skipping, Dowsing, Whittling, Taxidermy, Sand art, Roller skating

Introduction: My name is Kerri Lueilwitz, I am a courageous, gentle, quaint, thankful, outstanding, brave, vast person who loves writing and wants to share my knowledge and understanding with you.