Windows Internals. Covering Windows Server ® 2008 and Windows Vista ®

Cover
	Home Page
	Copyright
Dedication
Table of Contents
Foreword
Acknowledgments
Introduction
	Structure of the Book
	History of the Book
	Fifth Edition Changes
	Hands-On Experiments
	Topics Not Covered
	A Warning and a Caveat
	Find Additional Content Online
	Support
		From the Authors
		From Microsoft Press
		Questions and Comments
Chapter 1: Concepts and Tools
	Windows Operating System Versions
	Foundation Concepts and Terms
		Windows API
		Services, Functions, and Routines
		Processes, Threads, and Jobs
		Virtual Memory
		Kernel Mode vs. User Mode
		Terminal Services and Multiple Sessions
		Objects and Handles
		Security
		Registry
		Unicode
	Digging into Windows Internals
		Reliability and Performance Monitor
		Kernel Debugging
		Windows Software Development Kit
		Windows Driver Kit
		Sysinternals Tools
	Conclusion
Chapter 2: System Architecture
	Requirements and Design Goals
	Operating System Model
	Architecture Overview
		Portability
		Symmetric Multiprocessing
		Scalability
		Differences Between Client and Server Versions
		Checked Build
	Key System Components
		Environment Subsystems and Subsystem DLLs
		Ntdll.dll
		Executive
		Kernel
		Hardware Abstraction Layer
		Device Drivers
		System Processes
	Conclusion
Chapter 3: System Mechanisms
	Trap Dispatching
		Interrupt Dispatching
		Exception Dispatching
		System Service Dispatching
	Object Manager
		Executive Objects
		Object Structure
	Synchronization
		High-IRQL Synchronization
		Low-IRQL Synchronization
	System Worker Threads
	Windows Global Flags
	Advanced Local Procedure Calls (ALPCs)
	Kernel Event Tracing
	Wow64
		Wow64 Process Address Space Layout
		System Calls
		Exception Dispatching
		User Callbacks
		File System Redirection
		Registry Redirection and Reflection
		I/O Control Requests
		16-Bit Installer Applications
		Printing
		Restrictions
	User-Mode Debugging
		Kernel Support
		Native Support
		Windows Subsystem Support
	Image Loader
		Early Process Initialization
		Loaded Module Database
		Import Parsing
		Post Import Process Initialization
	Hypervisor (Hyper-V)
		Partitions
		Root Partition
		Child Partitions
		Hardware Emulation and Support
	Kernel Transaction Manager
	Hotpatch Support
	Kernel Patch Protection
	Code Integrity
	Conclusion
Chapter 4: Management Mechanisms
	The Registry
		Viewing and Changing the Registry
		Registry Usage
		Registry Data Types
		Registry Logical Structure
		Transactional Registry (TxR)
		Monitoring Registry Activity
		Registry Internals
	Services
		Service Applications
		The Service Control Manager
		Service Startup
		Startup Errors
		Accepting the Boot and Last Known Good
		Service Failures
		Service Shutdown
		Shared Service Processes
		Service Tags
		Service Control Programs
	Windows Management Instrumentation
		Providers
		The Common Information Model and the Managed Object Format Language
		Class Association
		WMI Implementation
		WMI Security
	Windows Diagnostic Infrastructure
		WDI Instrumentation
		Diagnostic Policy Service
		Diagnostic Functionality
	Conclusion
Chapter 5: Processes, Threads, and Jobs
	Process Internals
		Data Structures
		Kernel Variables
		Performance Counters
		Relevant Functions
	Protected Processes
	Flow of CreateProcess
		Stage 1: Converting and Validating Parameters and Flags
		Stage 2: Opening the Image to Be Executed
		Stage 3: Creating the Windows Executive Process Object (PspAllocateProcess)
		Stage 4: Creating the Initial Thread and Its Stack and Context
		Stage 5: Performing Windows Subsystem–Specific Post-Initialization
		Stage 6: Starting Execution of the Initial Thread
		Stage 7: Performing Process Initialization in the Context of the New Process
	Thread Internals
		Data Structures
		Kernel Variables
		Performance Counters
		Relevant Functions
		Birth of a Thread
	Examining Thread Activity
		Limitations on Protected Process Threads
	Worker Factories (Thread Pools)
	Thread Scheduling
		Overview of Windows Scheduling
		Priority Levels
		Windows Scheduling APIs
		Relevant Tools
		Real-Time Priorities
		Thread States
		Dispatcher Database
		Quantum
		Scheduling Scenarios
		Context Switching
		Idle Thread
		Priority Boosts
		Multiprocessor Systems
		Multiprocessor Thread-Scheduling Algorithms
		CPU Rate Limits
	Job Objects
	Conclusion
Chapter 6: Security
	Security Ratings
		Trusted Computer System Evaluation Criteria
		The Common Criteria
	Security System Components
	Protecting Objects
		Access Checks
		Security Descriptors and Access Control
	Account Rights and Privileges
		Account Rights
		Privileges
		Super Privileges
	Security Auditing
	Logon
		Winlogon Initialization
		User Logon Steps
	User Account Control
		Virtualization
		Elevation
	Software Restriction Policies
	Conclusion
Chapter 7: I/O System
	I/O System Components
		The I/O Manager
		Typical I/O Processing
	Device Drivers
		Types of Device Drivers
		Structure of a Driver
		Driver Objects and Device Objects
		Opening Devices
	I/O Processing
		Types of I/O
		I/O Request to a Single-Layered Driver
		I/O Requests to Layered Drivers
		I/O Cancellation
		I/O Completion Ports
		I/O Prioritization
		Driver Verifier
	Kernel-Mode Driver Framework (KMDF)
		Structure and Operation of a KMDF Driver
		KMDF Data Model
		KMDF I/O Model
	User-Mode Driver Framework (UMDF)
	The Plug and Play (PnP) Manager
		Level of Plug and Play Support
		Driver Support for Plug and Play
		Driver Loading, Initialization, and Installation
		Driver Installation
	The Power Manager
		Power Manager Operation
		Driver Power Operation
		Driver and Application Control of Device Power
	Conclusion
Chapter 8: Storage Management
	Storage Terminology
	Disk Drivers
		Winload
		Disk Class, Port, and Miniport Drivers
		Disk Device Objects
		Partition Manager
	Volume Management
		Basic Disks
		Dynamic Disks
		Multipartition Volume Management
		The Volume Namespace
		Volume I/O Operations
		Virtual Disk Service
	BitLocker Drive Encryption
		BitLocker Architecture
		Encryption Keys
		Trusted Platform Module (TPM)
		BitLocker Boot Process
		BitLocker Key Recovery
		Full Volume Encryption Driver
		BitLocker Management
	Volume Shadow Copy Service
		Shadow Copies
		VSS Architecture
		VSS Operation
		Uses in Windows
	Conclusion
Chapter 9: Memory Management
	Introduction to the Memory Manager
		Memory Manager Components
		Internal Synchronization
		Examining Memory Usage
	Services the Memory Manager Provides
		Large and Small Pages
		Reserving and Committing Pages
		Locking Memory
		Allocation Granularity
		Shared Memory and Mapped Files
		Protecting Memory
		No Execute Page Protection
		Copy-on-Write
		Address Windowing Extensions
	Kernel-Mode Heaps (System Memory Pools)
		Pool Sizes
		Monitoring Pool Usage
		Look-Aside Lists
	Heap Manager
		Types of Heaps
		Heap Manager Structure
		Heap Synchronization
		The Low Fragmentation Heap
		Heap Security Features
		Heap Debugging Features
		Pageheap
	Virtual Address Space Layouts
		x86 Address Space Layouts
		x86 System Address Space Layout
		x86 Session Space
		System Page Table Entries
		64-Bit Address Space Layouts
		64-Bit Virtual Addressing Limitations
		Dynamic System Virtual Address Space Management
		System Virtual Address Space Quotas
		User Address Space Layout
	Address Translation
		x86 Virtual Address Translation
		Translation Look-Aside Buffer
		Physical Address Extension (PAE)
		IA64 Virtual Address Translation
		x64 Virtual Address Translation
	Page Fault Handling
		Invalid PTEs
		Prototype PTEs
		In-Paging I/O
		Collided Page Faults
		Clustered Page Faults
		Page Files
	Stacks
		User Stacks
		Kernel Stacks
		DPC Stack
	Virtual Address Descriptors
		Process VADs
		Rotate VADs
	NUMA
	Section Objects
	Driver Verifier
	Page Frame Number Database
		Page List Dynamics
		Page Priority
		Modified Page Writer
		PFN Data Structures
	Physical Memory Limits
		Windows Client Memory Limits
	Working Sets
		Demand Paging
		Logical Prefetcher
		Placement Policy
		Working Set Management
		Balance Set Manager and Swapper
		System Working Set
		Memory Notification Events
	Proactive Memory Management (SuperFetch)
		Components
		Tracing and Logging
		Scenarios
		Page Priority and Rebalancing
		Robust Performance
		ReadyBoost
		ReadyDrive
	Conclusion
Chapter 10: Cache Manager
	Key Features of the Cache Manager
		Single, Centralized System Cache
		The Memory Manager
		Cache Coherency
		Virtual Block Caching
		Stream-Based Caching
		Recoverable File System Support
	Cache Virtual Memory Management
	Cache Size
		Cache Virtual Size
		Cache Working Set Size
		Cache Physical Size
	Cache Data Structures
		Systemwide Cache Data Structures
		Per-File Cache Data Structures
	File System Interfaces
		Copying to and from the Cache
		Caching with the Mapping and Pinning Interfaces
		Caching with the Direct Memory Access Interfaces
	Fast I/O
	Read Ahead and Write Behind
		Intelligent Read-Ahead
		Write-Back Caching and Lazy Writing
		Write Throttling
		System Threads
	Conclusion
Chapter 11: File Systems
	Windows File System Formats
		CDFS
		UDF
		FAT12, FAT16, and FAT32
		exFAT
		NTFS
	File System Driver Architecture
		Local FSDs
		Remote FSDs
		File System Operation
		File System Filter Drivers
	Troubleshooting File System Problems
		Process Monitor Basic vs. Advanced Modes
		Process Monitor Troubleshooting Techniques
	Common Log File System
	NTFS Design Goals and Features
		High-End File System Requirements
		Advanced Features of NTFS
	NTFS File System Driver
	NTFS On-Disk Structure
		Volumes
		Clusters
		Master File Table
		File Reference Numbers
		File Records
		File Names
		Resident and Nonresident Attributes
		Data Compression and Sparse Files
		The Change Journal File
		Indexing
		Object IDs
		Quota Tracking
		Consolidated Security
		Reparse Points
		Transaction Support
	NTFS Recovery Support
		Design
		Metadata Logging
		Recovery
		NTFS Bad-Cluster Recovery
		Self-Healing
	Encrypting File System Security
		Encrypting a File for the First Time
		The Decryption Process
		Backing Up Encrypted Files
	Conclusion
Chapter 12: Networking
	Windows Networking Architecture
		The OSI Reference Model
		Windows Networking Components
	Networking APIs
		Windows Sockets
		Winsock Kernel (WSK)
		Remote Procedure Call
		Web Access APIs
		Named Pipes and Mailslots
		NetBIOS
		Other Networking APIs
	Multiple Redirector Support
		Multiple Provider Router
		Multiple UNC Provider
	Name Resolution
		Domain Name System
		Windows Internet Name Service
		Peer Name Resolution Protocol
	Location and Topology
		Network Location Awareness (NLA)
		Link-Layer Topology Discovery (LLTD)
	Protocol Drivers
		Windows Filtering Platform (WFP)
	NDIS Drivers
		Variations on the NDIS Miniport
		Connection-Oriented NDIS
		Remote NDIS
		QoS
	Binding
	Layered Network Services
		Remote Access
		Active Directory
		Network Load Balancing
		Distributed File System and DFS Replication
	Conclusion
Chapter 13: Startup and Shutdown
	Boot Process
		BIOS Preboot
		The BIOS Boot Sector and Bootmgr
		The EFI Boot Process
		Initializing the Kernel and Executive Subsystems
		Smss, Csrss, and Wininit
		ReadyBoot
		Images That Start Automatically
	Troubleshooting Boot and Startup Problems
		Last Known Good
		Safe Mode
		Windows Recovery Environment (WinRE)
		Solving Common Boot Problems
	Shutdown
	Conclusion
Chapter 14: Crash Dump Analysis
	Why Does Windows Crash?
	The Blue Screen
	Troubleshooting Crashes
	Crash Dump Files
		Crash Dump Generation
	Windows Error Reporting
	Online Crash Analysis
	Basic Crash Dump Analysis
		Notmyfault
		Basic Crash Dump Analysis
		Verbose Analysis
	Using Crash Troubleshooting Tools
		Buffer Overrun, Memory Corruptions, and Special Pool
		Code Overwrite and System Code Write Protection
	Advanced Crash Dump Analysis
		Stack Trashes
		Hung or Unresponsive Systems
		When There Is No Crash Dump
	Conclusion
Glossary
Index
About the Authors
	Mark Russinovich
	David Solomon
	Alex Ionescu