book

Microsoft® Windows® Internals: Microsoft Windows Server™ 2003, Windows XP, and Windows 2000, 4th Edition

by Mark E. Russinovich, David A. Solomon

December 2004

Intermediate to advanced

976 pages

33h 33m

English

Microsoft Press

Read now

Unlock full access

From the AuthorsFrom Microsoft Press
Windows APIServices, Functions, and RoutinesProcesses, Threads, and JobsVirtual MemoryKernel Mode vs. User ModeTerminal Services and Multiple SessionsObjects and HandlesSecurityRegistryUnicode
Performance ToolWindows Support ToolsWindows Resource KitsKernel DebuggingSymbols for Kernel DebuggingWindows Debugging ToolsLiveKd ToolSoftICEPlatform Software Development Kit (SDK)Device Driver Kit (DDK)Sysinternals Tools
PortabilitySymmetric MultiprocessingScalabilityDifferences Between Client and Server VersionsChecked Build
Environment Subsystems and Subsystem DLLsWindows SubsystemPOSIX SubsystemOS/2 SubsystemNtdll.dllExecutiveKernelKernel ObjectsHardware SupportHardware Abstraction LayerDevice DriversWindows Driver Model (WDM)System ProcessesIdle ProcessInterrupts and DPCsSystem Process and System ThreadsSession Manager (Smss)Winlogon, LSASS and UserinitService Control Manager (SCM)
Interrupt DispatchingHardware Interrupt Processingx86 Interrupt Controllersx64 Interrupt ControllersIA64 Interrupt ControllersSoftware Interrupt Request Levels (IRQLs)Software InterruptsException DispatchingUnhandled ExceptionsWindows Error ReportingSystem Service Dispatching32-Bit System Service Dispatching64-Bit System Service DispatchingKernel-Mode System Service DispatchingService Descriptor Tables
Executive ObjectsObject StructureObject Headers and BodiesType ObjectsObject MethodsObject Handles and the Process Handle TableObject SecurityObject RetentionResource AccountingObject NamesSession Namespace
High-IRQL SynchronizationInterlocked OperationsSpinlocksQueued SpinlocksInstack Queued SpinlocksExecutive Interlocked OperationsLow-IRQL SynchronizationKernel Dispatcher ObjectsFast Mutexes and Guarded MutexesExecutive ResourcesPush Locks
Wow64 Process Address Space LayoutSystem CallsException DispatchingUser CallbacksFile System RedirectionRegistry Redirection and ReflectionI/O Control Requests16-bit Installer ApplicationsPrintingRestrictions
Viewing and Changing the RegistryRegistry UsageRegistry Data TypesRegistry Logical StructureHKEY_CURRENT_USERHKEY_USERSHKEY_CLASSES_ROOTHKEY_LOCAL_MACHINEHKEY_CURRENT_CONFIGHKEY_PERFORMANCE_DATATroubleshooting Registry ProblemsRegmon InternalsRegmon Troubleshooting TechniquesLogging Activity in Unprivileged Accounts or During Logon/LogoffRegistry InternalsHivesHive Size LimitsHive StructureCell MapsThe Registry Namespace and OperationStable StorageRegistry Optimizations
Service ApplicationsService AccountsThe Local System AccountThe Network Service AccountThe Local Service AccountRunning Services in Alternate AccountsInteractive ServicesThe Service Control ManagerService StartupStartup ErrorsAccepting the Boot and Last Known GoodService FailuresService ShutdownShared Service ProcessesService Control Programs
WMI ArchitectureProvidersThe Common Information Model and the Managed Object Format LanguageThe WMI NamespaceClass AssociationWMI ImplementationWMI Security
x86 and x64 PrebootThe x86/x64 Boot Sector and NtldrThe IA64 Boot ProcessInitializing the Kernel and Executive SubsystemsSmss, Csrss, and WinlogonImages that Start Automatically
Last Known GoodSafe ModeDriver Loading in Safe ModeSafe-Mode-Aware User ProgramsBoot Logging in Safe ModeRecovery ConsoleSolving Common Boot ProblemsMBR CorruptionBoot Sector CorruptionBoot.ini MisconfigurationSystem File CorruptionSystem Hive CorruptionPost–Splash Screen Crash or Hang
Data StructuresKernel VariablesPerformance CountersRelevant Functions
Stage 1: Opening the Image to Be ExecutedStage 2: Creating the Windows Executive Process ObjectStage 2A: Setting Up the EPROCESS BlockStage 2B: Creating the Initial Process Address SpaceStage 2C: Creating the Kernel Process BlockStage 2D: Concluding the Setup of the Process Address SpaceStage 2E: Setting Up the PEBStage 2F: Completing the Setup of the Executive Process ObjectStage 3: Creating the Initial Thread and Its Stack and ContextStage 4: Notifying the Windows Subsystem about the New ProcessStage 5: Starting Execution of the Initial ThreadStage 6: Performing Process Initialization in the Context of the New Process
Data StructuresKernel VariablesPerformance CountersRelevant FunctionsBirth of a Thread
Overview of Windows SchedulingPriority LevelsWindows Scheduling APIsRelevant ToolsReal-Time PrioritiesThread StatesDispatcher DatabaseQuantumQuantum AccountingControlling the QuantumQuantum BoostingQuantum Settings Registry ValueScheduling ScenariosVoluntary SwitchPreemptionQuantum EndTerminationContext SwitchingIdle ThreadPriority BoostsPriority Boosting after I/O CompletionBoosts after Waiting for Events and SemaphoresPriority Boosts for Foreground Threads after WaitsPriority Boosts after GUI Threads Wake UpPriority Boosts for CPU StarvationMultiprocessor SystemsMultiprocessor Dispatcher DatabaseHyperthreaded SystemsNUMA SystemsAffinityIdeal and Last ProcessorMultiprocessor Thread-Scheduling AlgorithmsChoosing a Processor for a Thread When There Are Idle ProcessorsChoosing a Processor for a Thread When There Are No Idle ProcessorsSelecting a Thread to Run on a Specific CPU (Windows 2000 and Windows XP)Selecting a Thread to Run on a Specific CPU (Windows Server 2003)
Memory Manager ComponentsInternal SynchronizationConfiguring the Memory ManagerExamining Memory Usage
Large and Small PagesReserving and Committing PagesLocking MemoryAllocation GranularityShared Memory and Mapped FilesProtecting MemoryNo Execute Page ProtectionCopy-on-WriteHeap ManagerTypes of HeapsHeap Manager StructureHeap SynchronizationLook-Aside ListsThe Low Fragmentation HeapHeap Debugging FeaturesPageheapAddress Windowing Extensions
Configuring Pool SizesMonitoring Pool UsageLook-Aside ListsDriver VerifierDriver Verifier Configuration and Initialization
x86 User Address Space Layoutsx86 System Address Space Layoutx86 Session SpaceSystem Page Table Entries64-Bit Address Space Layouts
x86 Virtual Address TranslationPage DirectoriesPage Tables and Page Table EntriesByte Within PageTranslation Look-Aside BufferPhysical Address Extension (PAE)IA-64 Virtual Address Translationx64 Virtual Address Translation
Invalid PTEsPrototype PTEsIn-Paging I/OCollided Page FaultsPage Files
Demand Paging
Placement PolicyWorking Set ManagementBalance Set Manager and SwapperSystem Working Set
Page List DynamicsModified Page WriterPFN Data StructuresLow and High Memory Notification
Access ChecksSecurity Identifiers (SIDs)TokensImpersonationRestricted TokensSecurity Descriptors and Access ControlACL AssignmentDetermining Access
Account RightsPrivilegesSuper Privileges
Winlogon InitializationUser Logon Steps
The I/O ManagerTypical I/O Processing
Types of Device DriversWDM DriversLayered DriversStructure of a DriverDriver Objects and Device ObjectsOpening Devices
Types of I/OSynchronous I/O and Asynchronous I/OFast I/OMapped File I/O and File CachingScatter/Gather I/OI/O Request PacketsIRP Stack LocationsIRP Buffer ManagementI/O Request to a Single-Layered DriverServicing an InterruptCompleting an I/O RequestSynchronizationI/O Requests to Layered DriversI/O Completion PortsThe IoCompletion ObjectUsing Completion PortsI/O Completion Port OperationDriver Verifier
Level of Plug and Play SupportDriver Support for Plug and PlayDriver Loading, Initialization, and InstallationThe Start ValueDevice EnumerationDevnodesDevnode Driver LoadingDriver Installation
Power Manager OperationDriver Power OperationDriver Control of Device Power
NtldrDisk Class, Port, and Miniport DriversiSCSI DriversMultipath I/O (MPIO) DriversDisk Device ObjectsPartition Manager
Basic DisksMBR-Style PartitioningGUID Partition Table PartitioningBasic Disk Volume ManagerDynamic DisksThe LDM DatabaseLDM and GPT or MBR-Style PartitioningDynamic Disk Volume ManagerMultipartition Volume ManagementSpanned VolumesStriped VolumesMirrored VolumesRAID-5 VolumesThe Volume NamespaceThe Mount ManagerMount PointsVolume MountingVolume I/O OperationsVirtual Disk ServiceVolume Shadow Copy Service
Single, Centralized System CacheThe Memory ManagerCache CoherencyVirtual Block CachingStream-Based CachingRecoverable File System Support
LargeSystemCacheCache Virtual SizeCache Working Set SizeCache Physical Size
Systemwide Cache Data StructuresPer-File Cache Data Structures
Copying to and from the CacheCaching with the Mapping and Pinning InterfacesCaching with the Direct Memory Access Interfaces
Intelligent Read-AheadWrite-Back Caching and Lazy WritingDisabling Lazy Writing for a FileForcing the Cache to Write Through to DiskFlushing Mapped FilesWrite ThrottlingSystem Threads
CDFSUDFFAT12, FAT16, and FAT32NTFS
Local FSDsRemote FSDsFile System OperationExplicit File I/OMemory Manager's Modified and Mapped Page WriterCache Manager's Lazy WriterCache Manager's Read-Ahead ThreadMemory Manager's Page Fault HandlerFile System Filter DriversFilemonSystem Restore
Filemon Basic vs. Advanced ModesFilemon Troubleshooting Techniques
High-End File System RequirementsRecoverabilitySecurityData Redundancy and Fault ToleranceAdvanced Features of NTFSMultiple Data StreamsUnicode-Based NamesGeneral Indexing FacilityDynamic Bad-Cluster RemappingHard Links and JunctionsCompression and Sparse FilesChange LoggingPer-User Volume QuotasLink TrackingEncryptionPOSIX SupportDefragmentationRead-Only Support
VolumesClustersMaster File TableFile Reference NumbersFile RecordsFilenamesResident and Nonresident AttributesData Compression and Sparse FilesCompressing Sparse DataCompressing Nonsparse DataSparse FilesThe Change Journal FileIndexingObject IDsQuota TrackingConsolidated SecurityReparse Points
Evolution of File System DesignCareful Write File SystemsLazy Write File SystemsRecoverable File SystemsLoggingLog File Service (LFS)Log Record TypesRecoveryAnalysis PassRedo PassUndo PassNTFS Bad-Cluster Recovery
Encrypting a File for the First TimeConstructing Key RingsEncrypting File DataEncryption Process SummaryThe Decryption ProcessDecrypted FEK CachingDecrypting File DataBacking Up Encrypted Files
The OSI Reference ModelWindows Networking Components
Windows SocketsWinsock Client OperationWinsock Server OperationWinsock ExtensionsExtending WinsockWinsock ImplementationWindows Sockets DirectRemote Procedure CallRPC OperationRPC SecurityRPC ImplementationWeb Access APIsWinInetWinHTTPHTTPNamed Pipes and MailslotsNamed Pipe OperationMailslot OperationNamed Pipe and Mailslot ImplementationNetBIOSNetBIOS NamesNetBIOS OperationNetBIOS API ImplementationOther Networking APIsReal-Time Communications (RTC)DCOMMessage QueuingUPnP
Multiple Provider RouterMultiple UNC Provider
Domain Name SystemWindows Internet Name Service
TCP/IP ExtensionsNetwork Address TranslationIP FilteringIP Filter and Filter HookInternet Protocol Security
Variations on the NDIS MiniportConnection-Oriented NDISRemote NDISQOS
Remote AccessActive DirectoryNetwork Load BalancingFile Replication ServiceDistributed File System
Crash Dump Generation
NotmyfaultBasic Crash Dump AnalysisVerbose Analysis
Buffer Overrun and Special PoolCode Overwrite and System Code Write Protection
Stack TrashesHung or Unresponsive SystemsWhen There Is No Crash Dump

Overview

The premier guide to the Windows kernel now covers Windows Server 2003, Windows XP, and Windows 2000, including 64-bit extensions. Get the architectural perspectives and insider insights needed to unlock the power of Windows.