Windows Internals

Cover
	Copyright
Dedication
Contents at a Glance
Table of Contents
Historical Perspective
Foreword
Acknowledgments
Introduction
	Structure of the Book
	History of the Book
	Fourth Edition Changes
	Hands-On Experiments
	Topics Not Covered
	A Warning and Caveat
	Support
		From the Authors
		From Microsoft Press
	System Requirements
Chapter 1 Concepts and Tools
	Windows Operating System Versions
	Foundation Concepts and Terms
		Windows API
		Services, Functions, and Routines
		Processes, Threads, and Jobs
		Virtual Memory
		Kernel Mode vs. User Mode
		Terminal Services and Multiple Sessions
		Objects and Handles
		Security
		Registry
		Unicode
	Digging into Windows Internals
		Performance Tool
		Windows Support Tools
		Windows Resource Kits
		Kernel Debugging
		Platform Software Development Kit (SDK)
		Device Driver Kit (DDK)
		Sysinternals Tools
	Conclusion
Chapter 2 System Architecture
	Requirements and Design Goals
	Operating System Model
	Architecture Overview
		Portability
		Symmetric Multiprocessing
		Scalability
		Differences Between Client and Server Versions
		Checked Build
	Key System Components
		Environment Subsystems and Subsystem DLLs
		Ntdll.dll
		Executive
		Kernel
		Hardware Abstraction Layer
		Device Drivers
		System Processes
	Conclusion
Chapter 3 System Mechanisms
	Trap Dispatching
		Interrupt Dispatching
		Exception Dispatching
		System Service Dispatching
	Object Manager
		Executive Objects
		Object Structure
	Synchronization
		High-IRQL Synchronization
		Low-IRQL Synchronization
	System Worker Threads
	Windows Global Flags
	Local Procedure Calls (LPCs)
	Kernel Event Tracing
	Wow64
		Wow64 Process Address Space Layout
		System Calls
		Exception Dispatching
		User Callbacks
		File System Redirection
		Registry Redirection and Reflection
		I/O Control Requests
		16-Bit Installer Applications
		Printing
		Restrictions
	Conclusion
Chapter 4 Management Mechanisms
	The Registry
		Viewing and Changing the Registry
		Registry Usage
		Registry Data Types
		Registry Logical Structure
		Troubleshooting Registry Problems
		Registry Internals
	Services
		Service Applications
		Service Accounts
		The Service Control Manager
		Service Startup
		Startup Errors
		Accepting the Boot and Last Known Good
		Service Failures
		Service Shutdown
		Shared Service Processes
		Service Control Programs
	Windows Management Instrumentation
		WMI Architecture
		Providers
		The Common Information Model and the Managed Object Format Language
		The WMI Namespace
		Class Association
		WMI Implementation
		WMI Security
	Conclusion
Chapter 5 Startup and Shutdown
	Boot Process
		x86 and x64 Preboot
		The x86/x64 Boot Sector and Ntldr
		The IA64 Boot Process
		Initializing the Kernel and Executive Subsystems
		Smss, Csrss, and Winlogon
	Troubleshooting Boot and Startup Problems
		Last Known Good
		Safe Mode
		Recovery Console
		Solving Common Boot Problems
	Shutdown
	Conclusion
Chapter 6 Processes, Threads, and Jobs
	Process Internals
		Data Structures
		Kernel Variables
		Performance Counters
		Relevant Functions
	Flow of CreateProcess
		Stage 1: Opening the Image to Be Executed
		Stage 2: Creating the Windows Executive Process Object
		Stage 3: Creating the Initial Thread and Its Stack and Context
		Stage 4: Notifying the Windows Subsystem about the New Process
		Stage 5: Starting Execution of the Initial Thread
		Stage 6: Performing Process Initialization in the Context of the New Process
	Thread Internals
		Data Structures
		Kernel Variables
		Performance Counters
		Relevant Functions
		Birth of a Thread
	Examining Thread Activity
	Thread Scheduling
		Overview of Windows Scheduling
		Priority Levels
		Windows Scheduling APIs
		Relevant Tools
		Real-Time Priorities
		Thread States
		Dispatcher Database
		Quantum
		Scheduling Scenarios
		Context Switching
		Idle Thread
		Priority Boosts
		Multiprocessor Systems
		Multiprocessor Thread-Scheduling Algorithms
	Job Objects
	Conclusion
Chapter 7 Memory Management
	Introduction to the Memory Manager
		Memory Manager Components
		Internal Synchronization
		Configuring the Memory Manager
		Examining Memory Usage
	Services the Memory Manager Provides
		Large and Small Pages
		Reserving and Committing Pages
		Locking Memory
		Allocation Granularity
		Shared Memory and Mapped Files
		Protecting Memory
		No Execute Page Protection
		Copy-on-Write
		Heap Manager
		Address Windowing Extensions
	System Memory Pools
		Configuring Pool Sizes
		Monitoring Pool Usage
		Look-Aside Lists
		Driver Verifier
	Virtual Address Space Layouts
		x86 User Address Space Layouts
		x86 System Address Space Layout
		x86 Session Space
		System Page Table Entries
		64-Bit Address Space Layouts
	Address Translation
		x86 Virtual Address Translation
		Translation Look-Aside Buffer
		Physical Address Extension (PAE)
		IA-64 Virtual Address Translation
		x64 Virtual Address Translation
	Page Fault Handling
		Invalid PTEs
		Prototype PTEs
		In-Paging I/O
		Collided Page Faults
		Page Files
	Virtual Address Descriptors
	Section Objects
	Working Sets
		Demand Paging
	Logical Prefetcher
		Placement Policy
		Working Set Management
		Balance Set Manager and Swapper
		System Working Set
	Page Frame Number Database
		Page List Dynamics
		Modified Page Writer
		PFN Data Structures
		Low and High Memory Notification
	Conclusion
Chapter 8 Security
	Security System Components
	Protecting Objects
		Access Checks
		Security Descriptors and Access Control
	Account Rights and Privileges
		Account Rights
		Privileges
		Super Privileges
	Security Auditing
	Logon
		Winlogon Initialization
		User Logon Steps
	Software Restriction Policies
	Conclusion
Chapter 9 I/O System
	I/O System Components
		The I/O Manager
		Typical I/O Processing
	Device Drivers
		Types of Device Drivers
		Structure of a Driver
		Driver Objects and Device Objects
		Opening Devices
	I/O Processing
		Types of I/O
		I/O Request Packets
		I/O Request to a Single-Layered Driver
		I/O Requests to Layered Drivers
		I/O Completion Ports
		Driver Verifier
	The Plug and Play (PnP) Manager
		Level of Plug and Play Support
		Driver Support for Plug and Play
		Driver Loading, Initialization, and Installation
		Driver Installation
	The Power Manager
		Power Manager Operation
		Driver Power Operation
		Driver Control of Device Power
	Conclusion
Chapter 10 Storage Management
	Storage Terminology
	Disk Drivers
		Ntldr
		Disk Class, Port, and Miniport Drivers
		Disk Device Objects
		Partition Manager
	Volume Management
		Basic Disks
		Dynamic Disks
		Multipartition Volume Management
		The Volume Namespace
		Volume I/O Operations
		Virtual Disk Service
		Volume Shadow Copy Service
	Conclusion
Chapter 11 Cache Manager
	Key Features of the Cache Manager
		Single, Centralized System Cache
		The Memory Manager
		Cache Coherency
		Virtual Block Caching
		Stream-Based Caching
		Recoverable File System Support
	Cache Virtual Memory Management
	Cache Size
		LargeSystemCache
		Cache Virtual Size
		Cache Working Set Size
		Cache Physical Size
	Cache Data Structures
		Systemwide Cache Data Structures
		Per-File Cache Data Structures
	File System Interfaces
		Copying to and from the Cache
		Caching with the Mapping and Pinning Interfaces
		Caching with the Direct Memory Access Interfaces
	Fast I/O
	Read Ahead and Write Behind
		Intelligent Read-Ahead
		Write-Back Caching and Lazy Writing
		Write Throttling
		System Threads
	Conclusion
Chapter 12 File Systems
	Windows File System Formats
		CDFS
		UDF
		FAT12, FAT16, and FAT32
		NTFS
	File System Driver Architecture
		Local FSDs
		Remote FSDs
		File System Operation
		File System Filter Drivers
	Troubleshooting File System Problems
		Filemon Basic vs. Advanced Modes
		Filemon Troubleshooting Techniques
	NTFS Design Goals and Features
		High-End File System Requirements
		Advanced Features of NTFS
	NTFS File System Driver
	NTFS On-Disk Structure
		Volumes
		Clusters
		Master File Table
		File Reference Numbers
		File Records
		Filenames
		Resident and Nonresident Attributes
		Data Compression and Sparse Files
		The Change Journal File
		Indexing
		Object IDs
		Quota Tracking
		Consolidated Security
		Reparse Points
	NTFS Recovery Support
		Evolution of File System Design
		Logging
		Recovery
		NTFS Bad-Cluster Recovery
	Encrypting File System Security
		Encrypting a File for the First Time
		The Decryption Process
		Backing Up Encrypted Files
	Conclusion
Chapter 13 Networking
	Windows Networking Architecture
		The OSI Reference Model
		Windows Networking Components
	Networking APIs
		Windows Sockets
		Remote Procedure Call
		Web Access APIs
		Named Pipes and Mailslots
		NetBIOS
		Other Networking APIs
	Multiple Redirector Support
		Multiple Provider Router
		Multiple UNC Provider
	Name Resolution
		Domain Name System
		Windows Internet Name Service
	Protocol Drivers
		TCP/IP Extensions
	NDIS Drivers
		Variations on the NDIS Miniport
		Connection-Oriented NDIS
		Remote NDIS
		QOS
	Binding
	Layered Network Services
		Remote Access
		Active Directory
		Network Load Balancing
		File Replication Service
		Distributed File System
	Conclusion
Chapter 14 Crash Dump Analysis
	Why Does Windows Crash?
	The Blue Screen
	Crash Dump Files
		Crash Dump Generation
	Windows Error Reporting
	Online Crash Analysis
	Basic Crash Dump Analysis
		Notmyfault
		Basic Crash Dump Analysis
		Verbose Analysis
	Using Crash Troubleshooting Tools
		Buffer Overrun and Special Pool
		Code Overwrite and System Code Write Protection
	Advanced Crash Dump Analysis
		Stack Trashes
		Hung or Unresponsive Systems
		When There Is No Crash Dump
Glossary
About the Authors