Pro Tools MP3 Export v1.0x228 serial key or number

Foreword by Ben Fathi Corporate Vice President, Windows Core Development, Microsoft Corporation 5 Windows Internals ® FIFTH EDITION Covering Windows Server 2008 and Windows Vista ® ® Mark E. Russinovich and David A. Solomon with Alex Ionescu PUBLISHED BY Microsoft Press A Division of Microsoft Corporation One Microsoft Way Redmond, Washington 98052-6399 Copyright © 2009 by David Solomon (all); Mark Russinovich (all) All rights reserved. No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher. Library of Congress Control Number: 2009927697 Printed and bound in the United States of America. 1 2 3 4 5 6 7 8 9 QWT 4 3 2 1 0 9 Distributed in Canada by H.B. Fenn and Company Ltd. A CIP catalogue record for this book is available from the British Library. Microsoft Press books are available through booksellers and distributors worldwide. For further infor mation about international editions, contact your local Microsoft Corporation office or contact Microsoft Press International directly at fax (425) 936-7329. Visit our Web site at www.microsoft.com/mspress. Send comments to [email protected] Microsoft, Microsoft Press, Access, Active Directory, ActiveSync, ActiveX, Aero, Authenticode, BitLocker, DirectX, Excel, Hyper-V, Internet Explorer, MS, MSDN, MS-DOS, Outlook, PowerPoint, ReadyBoost, ReadyDrive, SideShow, SQL Server, SuperFetch, Visual Basic, Visual C++, Visual Studio, Win32, Windows, Windows Media, Windows NT, Windows Server, Windows Vista, and Xbox are either registered trademarks or trademarks of the Microsoft group of companies. Other product and company names mentioned herein may be the trademarks of their respective owners. The example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious. No association with any real company, organization, product, domain name, e-mail address, logo, person, place, or event is intended or should be inferred. This book expresses the author’s views and opinions. The information contained in this book is provided without any express, statutory, or implied warranties. Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book. Acquisitions Editor: Ben Ryan Developmental Editor: Devon Musgrave Project Editor: John Pierce Editorial Production: Curtis Philips, Publishing.com Cover: Tom Draper Design Body Part No. X14-95072 To Jim Allchin, our OS and rock star Table of Contents Foreword . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xix Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxi Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .xxiii 1 Concepts and Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Windows Operating System Versions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 Foundation Concepts and Terms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Windows API. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 Services, Functions, and Routines . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Processes, Threads, and Jobs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 Virtual Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Kernel Mode vs. User Mode. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Terminal Services and Multiple Sessions . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 Objects and Handles . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Unicode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 Digging into Windows Internals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 24 Reliability and Performance Monitor . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Kernel Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Windows Software Development Kit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Windows Driver Kit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 Sysinternals Tools . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32 What do you think of this book? We want to hear from you! www.microsoft.com/learning/booksurvey/ v vi Table of Contents 2 System Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Requirements and Design Goals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33 Operating System Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Architecture Overview. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Portability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Symmetric Multiprocessing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Scalability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43 Differences Between Client and Server Versions . . . . . . . . . . . . . . . . . . . . 43 Checked Build. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Key System Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49 Environment Subsystems and Subsystem DLLs . . . . . . . . . . . . . . . . . . . . . 50 Ntdll.dll . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Executive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Kernel . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 Hardware Abstraction Layer. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Device Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 System Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 3 System Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Trap Dispatching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Interrupt Dispatching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 Exception Dispatching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 System Service Dispatching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Object Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Executive Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 136 Object Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 170 High-IRQL Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 172 Low-IRQL Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177 System Worker Threads. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 198 Windows Global Flags . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200 Advanced Local Procedure Calls (ALPCs) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202 Kernel Event Tracing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207 Wow64 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 Wow64 Process Address Space Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . 211 System Calls . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Exception Dispatching. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Table of Contents User Callbacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 File System Redirection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212 Registry Redirection and Reflection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213 I/O Control Requests . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 214 16-Bit Installer Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Printing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 215 User-Mode Debugging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Kernel Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216 Native Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217 Windows Subsystem Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219 Image Loader . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220 Early Process Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 Loaded Module Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Import Parsing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 Post Import Process Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227 Hypervisor (Hyper-V) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 228 Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Root Partition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 230 Child Partitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232 Hardware Emulation and Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 Kernel Transaction Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 Hotpatch Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242 Kernel Patch Protection. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244 Code Integrity. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248 4 Management Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 The Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Viewing and Changing the Registry . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 249 Registry Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 250 Registry Data Types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251 Registry Logical Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 252 Transactional Registry (TxR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 Monitoring Registry Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262 Registry Internals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 266 Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 281 Service Applications . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 282 The Service Control Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300 vii viii Table of Contents Service Startup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 303 Startup Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 307 Accepting the Boot and Last Known Good . . . . . . . . . . . . . . . . . . . . . . . . 308 Service Failures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 310 Service Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311 Shared Service Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 313 Service Tags. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316 Service Control Programs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 317 Windows Management Instrumentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 318 Providers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319 The Common Information Model and the Managed Object Format Language. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 320 Class Association . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325 WMI Implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327 WMI Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 Windows Diagnostic Infrastructure. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329 WDI Instrumentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330 Diagnostic Policy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 330 Diagnostic Functionality . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 332 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333 5 Processes, Threads, and Jobs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 Process Internals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 Data Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 335 Kernel Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 342 Performance Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 343 Relevant Functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 344 Protected Processes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 346 Flow of CreateProcess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 348 Stage 1: Converting and Validating Parameters and Flags. . . . . . . . . . . 350 Stage 2: Opening the Image to Be Executed . . . . . . . . . . . . . . . . . . . . . . 351 Stage 3: Creating the Windows Executive Process Object (PspAllocateProcess). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 354 Stage 4: Creating the Initial Thread and Its Stack and Context . . . . . . . 359 Stage 5: Performing Windows Subsystem–Specific Post-Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 360 Stage 6: Starting Execution of the Initial Thread . . . . . . . . . . . . . . . . . . . 362 Stage 7: Performing Process Initialization in the Context of the New Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 363 Table of Contents Thread Internals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370 Data Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370 Kernel Variables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 Performance Counters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 379 Relevant Functions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380 Birth of a Thread . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 380 Examining Thread Activity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381 Limitations on Protected Process Threads. . . . . . . . . . . . . . . . . . . . . . . . . 384 Worker Factories (Thread Pools) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386 Thread Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Overview of Windows Scheduling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 391 Priority Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 393 Windows Scheduling APIs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395 Relevant Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 396 Real-Time Priorities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 399 Thread States . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 400 Dispatcher Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 404 Quantum . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 406 Scheduling Scenarios. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 413 Context Switching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 Idle Thread . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418 Priority Boosts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419 Multiprocessor Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 434 Multiprocessor Thread-Scheduling Algorithms . . . . . . . . . . . . . . . . . . . . 442 CPU Rate Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .444 Job Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450 6 Security. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451 Security Ratings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451 Trusted Computer System Evaluation Criteria. . . . . . . . . . . . . . . . . . . . . . 451 The Common Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 453 Security System Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 454 Protecting Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458 Access Checks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459 Security Descriptors and Access Control . . . . . . . . . . . . . . . . . . . . . . . . . . 484 Account Rights and Privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501 Account Rights . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502 ix x Table of Contents Privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 503 Super Privileges . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 509 Security Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511 Logon . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 513 Winlogon Initialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 515 User Logon Steps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 516 User Account Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 520 Virtualization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521 Elevation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 528 Software Restriction Policies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 533 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535 7 I/O System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 I/O System Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 537 The I/O Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539 Typical I/O Processing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 540 Device Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541 Types of Device Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 541 Structure of a Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 547 Driver Objects and Device Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 550 Opening Devices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 555 I/O Processing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 562 Types of I/O. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 563 I/O Request to a Single-Layered Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . 572 I/O Requests to Layered Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 578 I/O Cancellation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587 I/O Completion Ports . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 592 I/O Prioritization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 598 Driver Verifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 604 Kernel-Mode Driver Framework (KMDF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606 Structure and Operation of a KMDF Driver. . . . . . . . . . . . . . . . . . . . . . . . 607 KMDF Data Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608 KMDF I/O Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 612 User-Mode Driver Framework (UMDF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 616 The Plug and Play (PnP) Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619 Level of Plug and Play Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 620 Driver Support for Plug and Play . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 621 Table of Contents Driver Loading, Initialization, and Installation . . . . . . . . . . . . . . . . . . . . . 623 Driver Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 632 The Power Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 636 Power Manager Operation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638 Driver Power Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 639 Driver and Application Control of Device Power . . . . . . . . . . . . . . . . . . . 643 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .644 8 Storage Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645 Storage Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645 Disk Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 646 Winload . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 646 Disk Class, Port, and Miniport Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 647 Disk Device Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 650 Partition Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 651 Volume Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652 Basic Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 653 Dynamic Disks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 656 Multipartition Volume Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 661 The Volume Namespace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 667 Volume I/O Operations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 674 Virtual Disk Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 675 BitLocker Drive Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 BitLocker Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 677 Encryption Keys . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 679 Trusted Platform Module (TPM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 681 BitLocker Boot Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 683 BitLocker Key Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 684 Full Volume Encryption Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 686 BitLocker Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 687 Volume Shadow Copy Service . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 Shadow Copies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 VSS Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 688 VSS Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 689 Uses in Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 692 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 698 xi xii Table of Contents 9 Memory Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699 Introduction to the Memory Manager. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 699 Memory Manager Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 700 Internal Synchronization. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701 Examining Memory Usage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 701 Services the Memory Manager Provides . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 704 Large and Small Pages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 705 Reserving and Committing Pages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 706 Locking Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 707 Allocation Granularity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 708 Shared Memory and Mapped Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 709 Protecting Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 711 No Execute Page Protection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 713 Copy-on-Write . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 718 Address Windowing Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 719 Kernel-Mode Heaps (System Memory Pools) . . . . . . . . . . . . . . . . . . . . . . . . . . . 721 Pool Sizes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 722 Monitoring Pool Usage. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 724 Look-Aside Lists . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 728 Heap Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 729 Types of Heaps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 730 Heap Manager Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 731 Heap Synchronization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 732 The Low Fragmentation Heap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 732 Heap Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 733 Heap Debugging Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 734 Pageheap. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 735 Virtual Address Space Layouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 736 x86 Address Space Layouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 737 x86 System Address Space Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 x86 Session Space . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 740 System Page Table Entries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 744 64-Bit Address Space Layouts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 745 64-Bit Virtual Addressing Limitations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 749 Dynamic System Virtual Address Space Management . . . . . . . . . . . . . . 751 System Virtual Address Space Quotas . . . . . . . . . . . . . . . . . . . . . . . . . . . . 756 User Address Space Layout . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 757 Table of Contents Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 761 x86 Virtual Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 762 Translation Look-Aside Buffer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 768 Physical Address Extension (PAE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 769 IA64 Virtual Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 772 x64 Virtual Address Translation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 773 Page Fault Handling. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 774 Invalid PTEs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 775 Prototype PTEs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 776 In-Paging I/O . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 778 Collided Page Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779 Clustered Page Faults . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 779 Page Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 780 Stacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 784 User Stacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 785 Kernel Stacks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 786 DPC Stack . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 Virtual Address Descriptors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 787 Process VADs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 788 Rotate VADs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 790 NUMA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 791 Section Objects. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 792 Driver Verifier . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 799 Page Frame Number Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 803 Page List Dynamics . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 807 Page Priority . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 809 Modified Page Writer . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 812 PFN Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 814 Physical Memory Limits. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 818 Windows Client Memory Limits . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 819 Working Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 822 Demand Paging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823 Logical Prefetcher . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 823 Placement Policy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 827 Working Set Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 828 Balance Set Manager and Swapper . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 831 System Working Set. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 832 Memory Notification Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 833 xiii xiv Table of Contents Proactive Memory Management (SuperFetch) . . . . . . . . . . . . . . . . . . . . . . . . . . 836 Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 836 Tracing and Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 838 Scenarios . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 840 Page Priority and Rebalancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 840 Robust Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 843 ReadyBoost . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .844 ReadyDrive . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 845 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 847 10 Cache Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849 Key Features of the Cache Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 849 Single, Centralized System Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850 The Memory Manager . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850 Cache Coherency . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 850 Virtual Block Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852 Stream-Based Caching . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 852 Recoverable File System Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 853 Cache Virtual Memory Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 854 Cache Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 855 Cache Virtual Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 855 Cache Working Set Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 856 Cache Physical Size . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 858 Cache Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 859 Systemwide Cache Data Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 860 Per-File Cache Data Structures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 862 File System Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 868 Copying to and from the Cache . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 869 Caching with the Mapping and Pinning Interfaces . . . . . . . . . . . . . . . . . 870 Caching with the Direct Memory Access Interfaces . . . . . . . . . . . . . . . . 872 Fast I/O. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 873 Read Ahead and Write Behind. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875 Intelligent Read-Ahead . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 875 Write-Back Caching and Lazy Writing . . . . . . . . . . . . . . . . . . . . . . . . . . . . 877 Write Throttling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 885 System Threads. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 886 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 887 Table of Contents 11 File Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 889 Windows File System Formats . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 CDFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 890 UDF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 FAT12, FAT16, and FAT32 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 891 exFAT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 894 NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895 File System Driver Architecture . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 895 Local FSDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 896 Remote FSDs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 897 File System Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 901 File System Filter Drivers. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 907 Troubleshooting File System Problems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 908 Process Monitor Basic vs. Advanced Modes . . . . . . . . . . . . . . . . . . . . . . . 908 Process Monitor Troubleshooting Techniques . . . . . . . . . . . . . . . . . . . . . 909 Common Log File System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 910 NTFS Design Goals and Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 918 High-End File System Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 918 Advanced Features of NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 920 NTFS File System Driver. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 934 NTFS On-Disk Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 937 Volumes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 937 Clusters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 937 Master File Table . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 938 File Reference Numbers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 942 File Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 942 File Names. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 945 Resident and Nonresident Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 948 Data Compression and Sparse Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 951 The Change Journal File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 956 Indexing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 960 Object IDs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 961 Quota Tracking. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 962 Consolidated Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 963 Reparse Points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 965 Transaction Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 965 xv xvi Table of Contents NTFS Recovery Support . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 974 Design . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 975 Metadata Logging . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 976 Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 981 NTFS Bad-Cluster Recovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 985 Self-Healing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 989 Encrypting File System Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 990 Encrypting a File for the First Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 993 The Decryption Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 998 Backing Up Encrypted Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 999 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1000 12 Networking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1001 Windows Networking Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1001 The OSI Reference Model. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1001 Windows Networking Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1003 Networking APIs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1006 Windows Sockets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1006 Winsock Kernel (WSK). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1012 Remote Procedure Call . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1014 Web Access APIs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1018 Named Pipes and Mailslots . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1021 NetBIOS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1027 Other Networking APIs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1030 Multiple Redirector Support. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1033 Multiple Provider Router . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1034 Multiple UNC Provider . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1037 Name Resolution . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039 Domain Name System. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039 Windows Internet Name Service. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039 Peer Name Resolution Protocol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1039 Location and Topology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042 Network Location Awareness (NLA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1042 Link-Layer Topology Discovery (LLTD) . . . . . . . . . . . . . . . . . . . . . . . . . . . 1043 Protocol Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1044 Windows Filtering Platform (WFP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1047 NDIS Drivers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1053 Variations on the NDIS Miniport . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1057 Connection-Oriented NDIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1057 Table of Contents Remote NDIS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1060 QoS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1062 Binding. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1064 Layered Network Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1066 Remote Access . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1066 Active Directory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1066 Network Load Balancing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1068 Distributed File System and DFS Replication. . . . . . . . . . . . . . . . . . . . . . 1069 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1071 13 Startup and Shutdown . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 Boot Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 BIOS Preboot . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1073 The BIOS Boot Sector and Bootmgr . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1077 The EFI Boot Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1086 Initializing the Kernel and Executive Subsystems . . . . . . . . . . . . . . . . . . 1088 Smss, Csrss, and Wininit . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .1094 ReadyBoot. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1099 Images That Start Automatically . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1100 Troubleshooting Boot and Startup Problems . . . . . . . . . . . . . . . . . . . . . . . . . . 1101 Last Known Good. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101 Safe Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1101 Windows Recovery Environment (WinRE) . . . . . . . . . . . . . . . . . . . . . . . . 1106 Solving Common Boot Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1109 Shutdown. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1115 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1118 14 Crash Dump Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119 Why Does Windows Crash? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1119 The Blue Screen . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1120 Troubleshooting Crashes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1124 Crash Dump Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1125 Crash Dump Generation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1130 Windows Error Reporting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1131 Online Crash Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1133 Basic Crash Dump Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134 Notmyfault . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1134 Basic Crash Dump Analysis. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1135 Verbose Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1137 xvii xviii Table of Contents Using Crash Troubleshooting Tools. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1139 Buffer Overrun, Memory Corruptions, and Special Pool . . . . . . . . . . . 1140 Code Overwrite and System Code Write Protection . . . . . . . . . . . . . . . 1143 Advanced Crash Dump Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1144 Stack Trashes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1145 Hung or Unresponsive Systems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1147 When There Is No Crash Dump. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1150 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1152 Glossary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1153 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1185 What do you think of this book? We want to hear from you! www.microsoft.com/learning/booksurvey/ Foreword It’s both a pleasure and an honor for me to write the foreword for this latest edition of Windows Internals. Many significant changes have occurred in Windows since the last edition of the book, and David, Mark, and Alex have done an excellent job of updating the book to address them. Whether you are new to Windows internals or an old hand at kernel development, you will find lots of detailed analysis and examples to help improve your understanding of the core mechanisms of Windows as well as the general principles of operating system design. Today, Windows enjoys unprecedented breadth and depth in the computing world. Variants of the original Windows NT design run on everything from Xbox game consoles to desktop and laptop computers to clusters of servers with dozens of processors and petabytes of storage. Advances such as hypervisors, 64-bit computing, multicore and many-core processor designs, flash-based storage, and wireless and peer-to-peer networking continue to provide plenty of interesting and innovative areas for operating system design. One such area of innovation is security. Over the past decade, the entire computing industry—and Microsoft in particular—has been confronted with huge new threats, and security has become the top issue facing many of our customers. Attacks such as Blaster and Sasser threatened to bring the entire Internet to its knees, and Windows was at the eye of the hurricane. It was obvious to us that we could no longer afford to do business as usual, as many of the usability and simplicity features designed into Windows were being used to attack it for nefarious reasons. At first the hackers were teenagers trying to gain notoriety by breaking into systems or adding graffiti to a corporate Web site, but pretty soon the attacks intensified and went underground. The hackers became more sophisticated and evaded inspection. You rarely see headlines about viruses and worms these days, but make no mistake—botnets and identity theft are big business today, as are industrial and government espionage through targeted attacks. In January 2002, Bill Gates sent his now-famous “Trustworthy Computing” memorandum to all Microsoft employees. It was a call to action that resonated well and charted the course for how we would build software and conduct business over the coming years. Nearly the entire Windows engineering team was diverted to work on Windows XP SP2, a service pack dedicated almost entirely to improving the security of the operating system. The Security Development Lifecycle (SDL) was developed and applied to all Microsoft products, with particular emphasis on Windows Vista as the first version of the operating system designed from the ground up to be secure. SDL specifies strict guidelines and processes for secure software development. Sophisticated tools have been developed to scan everything from source code to system binaries to network protocols for common security vulnerabilities. Every time a new security vulnerability is discovered, it is analyzed, and mitigations are developed to address that potential attack vector. Windows Vista has now been in the market for xix xx Foreword two years, and it is by far the most secure version of Windows. Some industry analysts have pointed out that it is, in fact, the most secure general purpose operating system shipping today. The Windows team has continued to innovate over the past few years. Windows XP, Windows Server 2003, Windows Server 2003 R2, Windows XP SP2, Windows Vista, Windows Server 2008, and Hyper-V are all major accomplishments and great successes—as well as great additions to the Windows family of products. Frankly, I can’t think of a more exciting and challenging topic. Nor can I think of a more authoritative and well-written book. David, Mark, and Alex have done a thorough job of dissecting the Windows architecture and providing diagnostic tools for hands-on learning. I hope you enjoy reading and learning about Windows as much as we all enjoy working on it. Ben Fathi Corporate Vice President, Windows Core Development Microsoft Corporation Acknowledgments We dedicate this edition to Jim Allchin, our executive sponsor and champion before he retired from Microsoft. Jim supported our book work on this and earlier editions and was instrumental in bringing Mark Russinovich to Microsoft. In addition to shepherding Windows Vista out the door, Jim also oversaw the delivery of Windows 2000, Windows XP, and Windows Server 2003. Each edition of this book has to acknowledge Dave Cutler, Senior Technical Fellow and the original architect of Windows NT. Dave originally approved David Solomon’s source code access and has been supportive of his work to explain the internals of Windows through his training business as well as during the writing of the editions of this book. We also thank three developers at Microsoft for contributing content that was incorporated into this edition: N Christian Allred, who wrote detailed descriptions on transactional NTFS (TxF) internals, data structures, and behaviors N Stone Cong, who wrote content and created diagrams about the Common Log File System (CLFS) N Adrian Marinescu, who updated his heap manager section in the memory management chapter This book wouldn’t contain the depth of technical detail or the level of accuracy it has without the input, and support of key members of the Windows development team. We want to thank the following people, who provided technical review and input to the book: Dmitry Anipko Kwan Hyun Ravi Mumulla Jon Schwartz Eugene Bak Mehmet Iyigun Adi Oltean Valerie See Karlito Bonnevie Philippe Joubert Vince Orgovan Matt Setzer Jon Cargille Kwan Hyun Kim Bernard Ourghanlian Andrey Shedel Dean DeWhitt Kinshuman Kinshumann Alexey Pakhunov Neeraj Singh Apurva Doshi Alex Kirshenbaum Milos Petrbok Vikram Singh Joseph East Norbert Kusters Daniel Pravat Paul Sliwowicz Tahsin Erdogan Jeff Lambert Ravi Pudipeddi John Stephens Cenk Ergan Paul Leach Melur Raghuraman Deepu Thomas Osman Ertugay Scott Lee Ramu Ramanathan J. R. Tipton Tom Fout Mark Lloyd Vlad Sadovsky Davis Walker Nar Ganapathy Karan Mehra Dragos Sambotin Brad Waters Robin Giese Derek Moore Jamie Schwartz Bruce Worthington xxi xxii Acknowledgments Thanks also to Daniel Pearson (who teaches Windows internals for Dave Solomon) for his review and input. Others might have contributed by answering questions in the hallway or cafeteria or by providing technical material—if we missed you, please forgive us! The authors would like to thank Ilfak Guilfanov of Hex-Rays (www.hex-rays.com) for the IDA Pro Advanced and Hex-Rays licenses for Alex Ionescu for his use in speeding his reverse engineering of the Windows kernel. Alex chose not to have Windows source code access (as did Mark Russinovich before he joined Microsoft) to research the information for his work on this book, and these tools greatly facilitated his work. IDA’s features turn reverse engineering into a powerful tool for understanding Windows internals. Combined with the Hex-Rays Decompiler, this analysis becomes even faster and more refined, as C code is directly presented instead of assembler, including all the right types. Thanks also to Matt Ginzton of VMware, who arranged for Alex and David to receive VMware Workstation to use in their research for the book. VMware Workstation was used instead of Microsoft Virtual PC because of its support for 64-bit guests and multiple snapshots with nonpersisent disks. (These features are now supported by Hyper-V, Microsoft’s new server virtualization offering, but at the time of writing, this support was not available). Thanks to Mike Vance of AMD for providing Dave Solomon’s AMD64 laptop for use in his book research and live classes. Finally, we want to thank the team at Microsoft Press who helped turn this book from idea into reality: N Ben Ryan (acquisitions editor at Microsoft Press) for shepherding another edition of this great book N Kathleen Atkins (project editor) and Devon Musgrave (developmental editor) for launching and overseeing the project N Andrea Fox (proofreader), Curtis Philips (project and production manager), and John Pierce (project editor and copyeditor) for laboriously going through all our chapters to tighten up text, find inconsistencies, and keep the manuscript to the high standards of Microsoft Press Alex Ionescu, Mark Russinovich, and David Solomon May 2009 Introduction Windows Internals, Fifth Edition is intended for advanced computer professionals (both developers and system administrators) who want to understand how the core components of the Windows Vista and Windows Server 2008 operating systems work internally. With this knowledge, developers can better comprehend the rationale behind design choices when building applications specific to the Windows platform. Such knowledge can also help developers debug complex problems. System administrators can benefit from this information as well, because understanding how the operating system works “under the covers” facilitates understanding the performance behavior of the system and makes troubleshooting system problems much easier when things go wrong. After reading this book, you should have a better understanding of how Windows works and why it behaves as it does. Structure of the Book The first two chapters (“Concepts and Tools” and “System Architecture”) lay the foundation with definitions and explanations of terms and concepts used throughout the rest of the book. The next two chapters—“System Mechanisms” and “Management Mechanisms”— describe key underlying mechanisms in the system. The next eight chapters explain the core components of the operating system: processes, threads, and jobs; security; the I/O system; storage management; memory management; the cache manager; file systems; and networking. The last two chapters cover startup and shutdown process and crash dump analysis. History of the Book This is the fifth edition of a book that was originally called Inside Windows NT (Microsoft Press, 1992), written by Helen Custer (prior to the initial release of Microsoft Windows NT 3.1). Inside Windows NT was the first book ever published about Windows NT and provided key insights into the architecture and design of the system. Inside Windows NT, Second Edition (Microsoft Press, 1998) was written by David Solomon. It updated the original book to cover Windows NT 4.0 and had a greatly increased level of technical depth. Inside Windows 2000, Third Edition (Microsoft Press, 2000) was authored by David Solomon and Mark Russinovich. It added many new topics, such as startup and shutdown, service internals, registry internals, file system drivers, and networking. It also covered kernel changes in Windows 2000, such as the Windows Driver Model (WDM), Plug and Play, power management, Windows Management Instrumentation (WMI), encryption, the job object, and Terminal Services. Windows Internals, Fourth Edition was the Windows XP and Windows Server 2003 update xxiii xxiv Introduction and added more content focused on helping IT professionals make use of their knowledge of Windows internals, such as using key tools from Windows Sysinternals (www.microsoft.com/ technet/sysinternals) and analyzing crash dumps. Fifth Edition Changes This latest edition has been updated to cover the kernel changes made in Windows Vista and Windows Server 2008. Hands-on experiments have been updated to reflect changes in tools, and newly added experiments use tools not available when the fourth edition was written. Additionally, content has been added to cover mechanisms that were not previously described, such as the image loader and user-mode debugging facility, and information about previously covered subjects has been expanded as well. Hands-On Experiments Even without access to the Windows source code, you can glean much about Windows internals from tools such as the kernel debugger and tools from Sysinternals and Winsider Seminars & Solutions (www.winsiderss.com). When a tool can be used to expose or demonstrate some aspect of the internal behavior of Windows, the steps for trying the tool yourself are listed in “Experiment” boxes. These appear throughout the book, and we encourage you to try these as you’re reading—seeing visible proof of how Windows works internally will make much more of an impression on you than just reading about it will. Topics Not Covered Windows is a large and complex operating system. This book doesn’t cover everything relevant to Windows internals but instead focuses on the base system components. For example, this book doesn’t describe COM+, the Windows distributed object-oriented programming infrastructure, or the .NET Framework, the foundation of managed code applications. Because this is an internals book and not a user, programming, or system administration book, it doesn’t describe how to use, program, or configure Windows. A Warning and a Caveat Because this book describes undocumented behavior of the internal architecture and operation of the Windows operating system (such as internal kernel structures and functions), this Introduction xxv content is subject to change between releases. (External interfaces, such as the Windows API, are not subject to incompatible changes.) By “subject to change,” we don’t necessarily mean that details described in this book will change between releases, but you can’t count on them not changing. Any software that uses these undocumented interfaces might not work on future releases of Windows. Even worse, software that runs in kernel mode (such as device drivers) and uses these undocumented interfaces might experience a system crash when running on a newer release of Windows. Find Additional Content Online As new or updated material becomes available that complements this book, it will be posted online on the Microsoft Press Online Developer Tools Web site. The type of material you might find includes updates to book content, articles, links to companion content, errata, sample chapters, and more. This Web content is available at www.microsoft.com/learning/ books/online/developer and is updated periodically. Support Every effort has been made to ensure the accuracy of this book. Should you run into any problems or issues, please refer to the sources listed below. From the Authors This book isn’t perfect. No doubt it contains some inaccuracies, or possibly we’ve omitted some topics we should have covered. If you find anything you think is incorrect, or if you believe we should have included material that isn’t here, please feel free to send e-mail to [email protected] Updates and corrections will be posted on the Web site http://technet. microsoft.com/en-us/sysinternals/bb963901.aspx. From Microsoft Press Microsoft Press provides corrections for books through the World Wide Web at the following address: www.microsoft.com/mspress/support xxvi Introduction Questions and Comments In addition to sending feedback directly to the authors, if you have comments, questions, or ideas regarding the presentation or use of this book, you can send them to Microsoft using either of the following methods: Postal mail: Microsoft Press Attn: Windows Internals Editor One Microsoft Way Redmond, WA 98052-6399 E-mail: [email protected]