Windows® Internals

Errata for Windows® Internals




The errata list is a list of errors and their corrections that were found after the product was released. If the error was corrected in a later version or reprint the date of the correction will be displayed in the column titled "Date Corrected".

The following errata were submitted by our customers and approved as valid errors by the author or editor.

Color Key: Serious Technical Mistake Minor Technical Mistake Language or formatting error Typo Question Note Update



Version Location Description Submitted By Date Submitted Date Corrected
Printed
Page xxv
Find Additional Content Online

The website listed, www.microsoft.com/learning/books/online/developer does not exist.

Note from the Author or Editor:
The correct link is: http://technet.microsoft.com/en-us/sysinternals/bb963901

Anonymous  Oct 12, 2010  Mar 01, 2011
Printed
Page 42

"mv" should be "vm" On page 42, the fourth sentence down contains an incorrect acronym. Change: "Be sure you have the symbols loaded (enter the .reload command), and then type the “list module” command to list details for the kernel image (nt): lm mv nt." To: "Be sure you have the symbols loaded (enter the .reload command), and then type the “list module” command to list details for the kernel image (nt): lm vm nt."

Microsoft Press  May 06, 2010  Mar 01, 2011
Printed
Page 89

"0x91" should be "0x81" On page 89, the sentence in the box at the top of the page gives an incorrect interrupt number. Change: "On the system used to provide the output for this experiment, the keyboard device driver’s (I8042prt.sys) keyboard ISR is at interrupt number 0x91." To: "On the system used to provide the output for this experiment, the keyboard device driver’s (I8042prt.sys) keyboard ISR is at interrupt number 0x81."

Microsoft Press  Jul 13, 2010  Aug 26, 2011
Printed
Page 154

0x408 should be 0xAAC On page 154, the last sentence before the command example in the "EXPERIMENT: Viewing the Handle Table with the Kernel Debugger" box is incorrect. Change: "The following command displays full details about the handle table for process ID 0x408" To: "The following command displays full details about the handle table for process ID 0xAAC"

Microsoft Press  May 06, 2010  Mar 01, 2011
Printed
Page 191

Function not documented in WDK On page 191, the second sentence in the second paragraph is partially incorrect. Change: "These functions are documented in the WDK." To: "These functions, except for ExTryToAcquireResourceExclusiveLite, are documented in the WDK."

Microsoft Press  Jul 13, 2010  Mar 01, 2011
Printed
Page 243

82227ea5 should be 82228eaa On page 243, the last line is incorrect. Change: "82227ea5 ebfc jmp nt!FsRtlTeardownPerFileContexts+0x169 (82227ea5)" To: "82228eaa ebfc jmp nt!FsRtlTeardownPerFileContexts+0x169 (82227ea5)"

Microsoft Press  May 06, 2010  Mar 01, 2011
Printed
Page 243
Last line of page

There is already a confirmed error for this code. From your errata site, the corrected code is:- 82228eaa ebfc jmp nt!FsRtlTeardownPerFileContexts+0x169 (82227ea5) However, the instruction is wrong because this is a short jump with a negative offset of 7 bytes not -4 so ebfc should read ebf9 Cheers Mark

Mark Cook  Dec 05, 2010  Mar 01, 2011
Printed
Page 263

Instructions for opening Regedit are incorrect On page 263, step 6 includes incorrect instructions for opening regedit. Change: "Finally, double-click the highlighted line." To: "Finally, click the Event menu then click Jump To..."

Microsoft Press  Jul 13, 2010  Mar 01, 2011
Printed
Page 265

Incorrect information about the -i switch On page 265, the first sentence of the last page incorrect describes the use of the-i switch. Change: "The –i switch directs PsExec to have Process Monitor’s window appear on the interactive console, the –s switch has PsExec run Process Monitor in the local system account, and the –d switch has PsExec launch Process Monitor and exit without waiting for Process Monitor to terminate." To: "The -i switch in the psexec command has Process Monitor run on the session 0 desktop, the –s switch has PsExec run Process Monitor in the local system account, and the –d switch has PsExec launch Process Monitor and exit without waiting for Process Monitor to terminate."

Microsoft Press  May 06, 2010  Mar 01, 2011
Printed
Page 666
p666, inset, line 3, third sentence

p666, inset, line 3, third sentence reads: "This read behavior ... read-operation load balancing." Shouldn't each instance of "read" be "write"?

Note from the Author or Editor:
This sentence should be deleted entirely.

Anonymous  Aug 05, 2011  Aug 26, 2011
Printed
Page 719

"128" should be "64" On page 719, the first sentence of the second paragraph on the page includes an incorrect memory size for 32-bit Windows. Change: "Although the 32-bit version of Windows can support up to 128 GB of physical memory (as shown in Table 2-3), each 32-bit user process has by default only a 2-GB virtual address space." To: "Although the 32-bit version of Windows can support up to 64 GB of physical memory (as shown in Table 2-3), each 32-bit user process has by default only a 2-GB virtual address space." Microsoft Press is committed to providing informative and accurate books. All comments and corrections listed above are ready for inclusion in future printings of this book. If you have a later printing of this book, it may already contain most or all of the above corrections.

Microsoft Press  Jul 13, 2010  Mar 01, 2011