Share
Create bookmark
Windows® Internals, Part 1
Notes
Please login to add notes
- + Cover
- Contents at a Glance
- Contents
- + Introduction
-
+
Chapter 1:
Concepts and Tools
-
+
Windows Operating System Versions
- Foundation Concepts and Terms
- Windows API
- Services, Functions, and Routines
- Processes, Threads, and Jobs
- Virtual Memory
- Kernel Mode vs. User Mode
- Terminal Services and Multiple Sessions
- Objects and Handles
- Security
- Registry
- + Unicode
- Performance Monitor
- Kernel Debugging
- Windows Software Development Kit
- Windows Driver Kit
- + Sysinternals Tools
-
+
Windows Operating System Versions
- + Chapter 2: System Architecture
-
+
Chapter 3:
System Mechanisms
-
+
Trap Dispatching
- Interrupt Dispatching
- Timer Processing
- Exception Dispatching
- + System Service Dispatching
- Executive Objects
- + Object Structure
- High-IRQL Synchronization
- + Low-IRQL Synchronization
- Connection Model
- Message Model
- Asynchronous Operation
- Views, Regions, and Sections
- Attributes
- Blobs, Handles, and Resources
- Security
- Performance
- + Debugging and Tracing
- Wow64 Process Address Space Layout
- System Calls
- Exception Dispatching
- User APC Dispatching
- Console Support
- User Callbacks
- File System Redirection
- Registry Redirection
- I/O Control Requests
- 16-Bit Installer Applications
- Printing
- + Restrictions
- Kernel Support
- Native Support
- + Windows Subsystem Support
- Early Process Initialization
- DLL Name Resolution and Redirection
- Loaded Module Database
- Import Parsing
- Post-Import Process Initialization
- SwitchBack
- + API Sets
- Partitions
- Parent Partition
- Child Partitions
- + Hardware Emulation and Support
-
+
Trap Dispatching
-
+
Chapter 4:
Management Mechanisms
-
+
The Registry
- Viewing and Changing the Registry
- Registry Usage
- Registry Data Types
- Registry Logical Structure
- Transactional Registry (TxR)
- Monitoring Registry Activity
- Process Monitor Internals
- + Registry Internals
- Service Applications
- The Service Control Manager
- Service Startup
- Startup Errors
- Accepting the Boot and Last Known Good
- Service Failures
- Service Shutdown
- Shared Service Processes
- + Service Tags
- Initialization
- UBPM API
- Provider Registration
- Consumer Registration
- Task Host
- + Service Control Programs
- Providers
- The Common Information Model and the Managed Object Format Language
- Class Association
- WMI Implementation
- + WMI Security
- WDI Instrumentation
- Diagnostic Policy Service
- + Diagnostic Functionality
-
+
The Registry
-
+
Chapter 5:
Processes, Threads, and Jobs
-
+
Process Internals
- + Data Structures
- Stage 1: Converting and Validating Parameters and Flags
- Stage 2: Opening the Image to Be Executed
- Stage 3: Creating the Windows Executive Process Object (PspAllocateProcess)
- Stage 4: Creating the Initial Thread and Its Stack and Context
- Stage 5: Performing Windows Subsystem–Specific Post-Initialization
- Stage 6: Starting Execution of the Initial Thread
- + Stage 7: Performing Process Initialization in the Context of the New Process
- Data Structures
- + Birth of a Thread
- + Limitations on Protected Process Threads
- Overview of Windows Scheduling
- Priority Levels
- Thread States
- Dispatcher Database
- Quantum
- Priority Boosts
- Context Switching
- Scheduling Scenarios
- Idle Threads
- Thread Selection
- Multiprocessor Systems
- Thread Selection on Multiprocessor Systems
- + Processor Selection
- Distributed Fair Share Scheduling
- + CPU Rate Limits
- Job Limits
- + Job Sets
-
+
Process Internals
-
+
Chapter 6:
Security
-
+
Security Ratings
- Trusted Computer System Evaluation Criteria
- + The Common Criteria
- Access Checks
- Security Identifiers
- Virtual Service Accounts
- + Security Descriptors and Access Control
- Account Rights
- Privileges
- + Super Privileges
- Object Access Auditing
- Global Audit Policy
- + Advanced Audit Policy Settings
- Winlogon Initialization
- User Logon Steps
- Assured Authentication
- + Biometric Framework for User Authentication
- File System and Registry Virtualization
- + Elevation
-
+
Security Ratings
-
+
Chapter 7:
Networking
-
+
Windows Networking Architecture
- The OSI Reference Model
- + Windows Networking Components
- Windows Sockets
- Winsock Kernel
- Remote Procedure Call
- Web Access APIs
- Named Pipes and Mailslots
- NetBIOS
- + Other Networking APIs
- Multiple Provider Router
- Multiple UNC Provider
- Surrogate Providers
- Redirector
- Mini-Redirectors
- + Server Message Block and Sub-Redirectors
- Caching Modes
- Ghosts
- Data Security
- + Cache Structure
- Caching Modes
- BranchCache Optimized Application Retrieval: SMB Sequence
- + BranchCache Optimized Application Retrieval: HTTP Sequence
- Domain Name System
- + Peer Name Resolution Protocol
- Network Location Awareness
- Network Connectivity Status Indicator
- + Link-Layer Topology Discovery
- + Windows Filtering Platform
- Variations on the NDIS Miniport
- Connection-Oriented NDIS
- Remote NDIS
- + QoS
- Remote Access
- Active Directory
- Network Load Balancing
- Network Access Protection
- + Direct Access
-
+
Windows Networking Architecture
- Index
- About the Authors
- Survey
Delve inside Windows architecture and internals--and see how core components work behind the scenes. Led by three renowned internals experts, this classic guide is fully updated for Windows 7 and Windows Server 2008 R2--and now presents its coverage in two volumes.
As always, you get critical insider perspectives on how Windows operates. And through hands-on experiments, you'll experience its internal behavior firsthand--knowledge you can apply to improve application design, debugging, system performance, and support.
In Part 1, you will:
Understand how core system and management mechanisms work--including the object manager, synchronization, Wow64, Hyper-V, and the registry
Examine the data structures and activities behind processes, threads, and jobs
Go inside the Windows security model to see how it manages access, auditing, and authorization
Explore the Windows networking stack from top to bottom--including APIs, BranchCache, protocol and NDIS drivers, and layered services
Dig into internals hands-on using the kernel debugger, performance monitor, and other tools
Test the closed alpha on paperc.com
Book Details
Authors
Alex Ionescu, Mark E. Russinovich, and David A. Solomon
Categories
Computers > System Administration > Windows Administration
Publishers
Publication year : 2012
License: All rights reserved ©
Times read: 1,564
