Windows Internals, Part 1

Errata for Windows Internals, Part 1




The errata list is a list of errors and their corrections that were found after the product was released. If the error was corrected in a later version or reprint the date of the correction will be displayed in the column titled "Date Corrected".

The following errata were submitted by our customers and approved as valid errors by the author or editor.

Color Key: Serious Technical Mistake Minor Technical Mistake Language or formatting error Typo Question Note Update



Version Location Description Submitted By Date Submitted Date Corrected
Other Digital Version
Location 786
last paragraph

Under EXPERIMENT: Viewing Process Details with Process Explorer: "The first time you run it, you will receive a message that symbols are not currently configured." Running Process Explorer v15.13 dated 2/16/12, upon first use on Windows 7 x64, no prompt or message was encountered.

Note from the Author or Editor:
The sentence should be: "The first time you run it and go to the the Threads tab of a process' property page, you will receive a message that symbols are not currently configured."

matthew grossman  Apr 01, 2012  Oct 05, 2012
Printed
Page 11
1st paragraph

The URL http://msdn.microsoft.com/en-us/windows/hardware/gg462988.aspx was changed by Microsoft to be http://msdn.microsoft.com/en-us/windows/hardware/hh852360 It is a minor issue for now because Microsoft made a redirection from the old URL to a new one. But it can become invalid overtime.

Note from the Author or Editor:
Reader is correct, the URL has changed.

Dennis O.  Apr 18, 2012  Oct 05, 2012
Printed
Page 13
Last sentence in second box

Your promise to find more information on UMS in Chapter 5 is not kept (at least I can't find it in the Contents or Index). Also: With which version of Windows were UMS threads introduced?

Note from the Author or Editor:
Unfortunately the reader is correct, UMS information did not make it into this edition. The sentence promising more information in Chapter 5 should be removed.

Christian Vogt  May 03, 2012  Oct 05, 2012
Printed
Page 13
4th paragraph

2 things: "UMS threads, which are available only on 64-bit versions of Windows...", may need to be more specific and state "UMS threads, which are available only for 64-bit applications on 64-bit versions of Windows...". Also, on O'Reilly's site, the title of this book is displayed as "Windows® Internals, Part 1, Sixth Edition", which makes it impossible to find when you type "Windows" or "Windows Internals" into the Search field.

Note from the Author or Editor:
The reader is correct, please use his sentence. Also, O'Reilly, the website issue is one for you to fix...

mgrossman  Oct 05, 2012  Mar 15, 2013
Printed
Page 66
2nd paragraph

The "Inside the Native API" article is no longer available at SysInternals.com.

Note from the Author or Editor:
Reference in the book should be removed.

Anonymous  Nov 03, 2012  Mar 15, 2013
PDF
Page 78
1st paragraph

The book text says: "Userinit performs some initialization of the user environment (such as running the login script and applying group policies)" The latter is not true. Group policies are applies by the service "Group Policy Client".

Note from the Author or Editor:
Correct. The sentence should read: Userinit performs some initialization of the user environment (such as running the logon script and reestablishing network connections)

Helge Klein  Sep 28, 2012  Oct 05, 2012
Printed
Page 96
Figure 3-6

CPU IDT reads 0 2 3 ... n (missing 1)

Note from the Author or Editor:
The reader is correct. It should be 0 1 2 3 ... n

Anonymous  Apr 09, 2012  Oct 05, 2012
Printed
Page 97
97 first paragraph

Should be PS/2 keyboard device, as opposed to PS2.

Note from the Author or Editor:
The reader is correct. PS2 should be written as PS/2.

Anonymous  Apr 09, 2012  Oct 05, 2012
Printed
Page 98
3/4 down the page

The font for these directions should be changed to the common text, as opposed to the current console-like theme.

Note from the Author or Editor:
I think I agree that this is a styling error.

Anonymous  Apr 09, 2012  Oct 05, 2012
Printed
Page 103
Under IrqPolicyAllCloseProcessors

Should say machine, as oppsed to machjne

Note from the Author or Editor:
Reader is correct, the spelling is "machine".

Anonymous  Apr 10, 2012  Oct 05, 2012
Printed
Page 103
Under IrqPolicyOneCloseProcessor

Same problem as before - copy paste of machjne

Note from the Author or Editor:
Reader is correct, the spelling is "machine".

Anonymous  Apr 10, 2012  Oct 05, 2012
Printed
Page 115
2nd paragraph

"Daylight Savings Time" should be "Daylight Saving Time"

Note from the Author or Editor:
The reader is correct.

Ross J. Micheals  Apr 07, 2012  Oct 05, 2012
Printed
Page 117
4th paragraph

"slightly latency/delay" instead of "slight latency/delay"

Note from the Author or Editor:
Reader is correct.

brantgurga  Jul 09, 2012  Oct 05, 2012
Printed
Page 151
5

lkd> ?? (( ... ->TypInfo*)0xfffffa9002755b60)->TypeInfo should be lkd> ?? ((... ->TypInfo

Note from the Author or Editor:
The command (At the bottom of the experiment) should not have the "0xffffa80002755b60)->TypeInfo" after the end of ->TypeInfo*). The command should end there.

Anonymous  Jun 22, 2012  Mar 15, 2013
Printed
Page 186
Line on Semaphores in Table 3-19

A semaphore goes to the signalled state when its count increases by 1 (not when it is dropped by 1). Also: Because one call to ReleaseSemaphore can increase the value by more than 1 (parameter ReleaseCount), more than one thread may be released.

Note from the Author or Editor:
The reader is correct.

Christian Vogt  May 03, 2012  Oct 05, 2012
Printed
Page 214
3rd paragraph

"A driver can register its own callback and context with NtSetInformationAlpcPort". It doesn't seem such a function exists - at least not on Windows 7 x86. Perhaps, you are mistaken it with nt!NtAlpcSetInformation?

Note from the Author or Editor:
Reader is correct, NtAlpcSetInformation should be used instead of NtSetInformationAlpcPort.

Anonymous  Apr 20, 2012  Oct 05, 2012
Printed
Page 217
5th paragraph

"Both completion lists and message zones can be set with NtAlpcSetInformationPort". Again, it doesn't seem such a function exists - at least not on Windows 7 x86. Perhaps, you are mistaken it with nt!NtAlpcSetInformation?

Note from the Author or Editor:
The reader is correct. NtAlpcSetInformationPort should be replaced by NtAlpcSetInformation.

Anonymous  Apr 20, 2012  Oct 05, 2012
PDF
Page 282
Second paragraph

Book text says: "Data stored in a profile’s key includes the time of the last load of the profile in the ProfileLoadTimeLow value" Comment: That was probably what the registry values ProfileLoadTimeLow and ProfileLoadTimeHigh were added for. However, their value is always set to 0.

Note from the Author or Editor:
Correct. The sentence quoted in the book text should be removed.

Helge Klein  Sep 28, 2012  Oct 05, 2012
Printed
Page 411
2nd paragraph

..., which sets priorities of 4, 8, 13, 14, 6, and 10, respectively. should be ..., which sets priorities of 4, 8, 13, 24, 6, and 10, respectively. lkd> dd nt!PspPriorityTable 82e089e0 00000008 00000004 00000008 0000000d 82e089f0 00000018 00000006 0000000a

Note from the Author or Editor:
The reader is correct with his errata.

sergmat  Aug 16, 2012  Oct 05, 2012
Printed
Page 415
Image in the top of the page

Base Priority: 8 Dynamic Priority: 12 should be: Base Priority: 24 Dynamic Priority: 24

Note from the Author or Editor:
The reader is correct unfortunately we cannot change the image in a reprint, can we?

sergmat  Aug 16, 2012 
Printed
Page 416
.

"Windows Server 2008 R2 Enterprise Edition and Windows Server 2008 R2 Datacenter Edition include an optionally installable component called Windows System Resource Manager (WSRM)" Since Windows Server 2008, WSRM is included in all SKU

Note from the Author or Editor:
The author is correct. The sentence should say Windows Server 2008 R2 Standard Edition and higher SKUs include an optionally installable component called Windows System Resource Manager (WSRM)

Anonymous  Jul 27, 2012  Oct 05, 2012
Printed, PDF, ePub, Mobi, Safari Books Online, Other Digital Version
Page 418
fig 5-16

Shouldn’t the dispatch arrow go *from* ready/standby/deferred *to* 2 (running)? In the above diagram, there appears to be no way to actually reach the running state. Am I missing something? At the very least the head of the arrow should end at a node, not a label.

Note from the Author or Editor:
The reader is right and the arrow should be flipped.

Anonymous  Oct 02, 2012  Oct 05, 2012
Printed
Page 471
.

"Distributed Fair Share Scheduling" is actually called "Dynamic Fair Share Scheduling"

Note from the Author or Editor:
Reader is correct.

Anonymous  Jul 30, 2012  Oct 05, 2012
Printed
Page 494
2nd paragraph

This is illustrated in Figure 6-3 using the Sysinternals Winobj tool, showing the security descriptor for a section object in the user`s session. Should be: ... for a event object in the user`s session.

Note from the Author or Editor:
The reader is partially correct. The correct sentence should be: ... for an event object in the user's session.

sergmat  Aug 21, 2012  Oct 05, 2012
PDF
Page 496
4th paragraph 5th line

4th paragraph 5th line: ... SeAccessCheck returnsTrue or False, depending ... A space is missing between "returns" and "True"

Note from the Author or Editor:
Reader is correct.

Marco S. Zuppone  Jun 03, 2012  Oct 05, 2012
PDF
Page 562
1st paragraph after box

The book text says: "The default value is Userinit.exe, which loads the user profile" That is wrong. The user profile is loaded by the user profile service before Userinit.exe even starts.

Note from the Author or Editor:
This should say "The default value is Userinit.exe, which loads the user profile settings..."

Helge Klein  Sep 28, 2012  Oct 05, 2012