Errata

The website listed, www.microsoft.com/learning/books/online/developer does not exist.

Note from the Author or Editor:
The correct link is: http://technet.microsoft.com/en-us/sysinternals/bb963901

"mv" should be "vm"
On page 42, the fourth sentence down contains an incorrect acronym.

Change:
"Be sure you have the symbols loaded (enter the .reload command), and then type the “list module” command to list details for the kernel image (nt): lm mv nt."

To:
"Be sure you have the symbols loaded (enter the .reload command), and then type the “list module” command to list details for the kernel image (nt): lm vm nt."

"0x91" should be "0x81"
On page 89, the sentence in the box at the top of the page gives an incorrect interrupt number.



Change:

"On the system used to provide the output for this experiment, the keyboard device driver’s (I8042prt.sys) keyboard ISR is at interrupt number 0x91."



To:

"On the system used to provide the output for this experiment, the keyboard device driver’s (I8042prt.sys) keyboard ISR is at interrupt number 0x81."

0x408 should be 0xAAC
On page 154, the last sentence before the command example in the "EXPERIMENT: Viewing the Handle Table with the
Kernel Debugger" box is incorrect.

Change:
"The following command displays full details about the handle table for process ID 0x408"

To:
"The following command displays full details about the handle table for process ID 0xAAC"

Function not documented in WDK
On page 191, the second sentence in the second paragraph is partially incorrect.



Change:

"These functions are documented in the WDK."



To:

"These functions, except for ExTryToAcquireResourceExclusiveLite, are documented in the WDK."

82227ea5 should be 82228eaa
On page 243, the last line is incorrect.

Change:
"82227ea5 ebfc jmp nt!FsRtlTeardownPerFileContexts+0x169 (82227ea5)"

To:
"82228eaa ebfc jmp nt!FsRtlTeardownPerFileContexts+0x169 (82227ea5)"

Instructions for opening Regedit are incorrect
On page 263, step 6 includes incorrect instructions for opening regedit.



Change:

"Finally, double-click the highlighted line."



To:

"Finally, click the Event menu then click Jump To..."

Incorrect information about the -i switch
On page 265, the first sentence of the last page incorrect describes the use of the-i switch.

Change:
"The –i switch directs PsExec to have Process Monitor’s window appear on the interactive console, the –s switch has PsExec run Process Monitor in the local system account, and the –d switch has PsExec launch Process Monitor and exit without waiting for Process Monitor to terminate."

To:
"The -i switch in the psexec command has Process Monitor run on the session 0 desktop, the –s switch has PsExec run Process Monitor in the local system account, and the –d switch has PsExec launch Process Monitor and exit without waiting for Process Monitor to terminate."

"128" should be "64"
On page 719, the first sentence of the second paragraph on the page includes an incorrect memory size for 32-bit Windows.



Change:

"Although the 32-bit version of Windows can support up to 128 GB of physical memory (as shown in Table 2-3), each 32-bit user process has by default only a 2-GB virtual address space."



To:

"Although the 32-bit version of Windows can support up to 64 GB of physical memory (as shown in Table 2-3), each 32-bit user process has by default only a 2-GB virtual address space."

Microsoft Press is committed to providing informative and accurate

books. All comments and corrections listed above are ready for

inclusion in future printings of this book. If you have a later printing

of this book, it may already contain most or all of the above corrections.