Microsoft windows internals, fourth edition : Microsoft Windows Server 2003, Windows XP, and Windows 2000

966 Pages·2004·107.879 MB·English

by  Mark E Russinovich, David A Solomon, Jim Allchin

Nlicrosoft~
Microsoft® Windows® Internals/
Fourth Edition: Microsoft
Windows Server 2003/ Windows
M
X~ and Windows 2000
Mark E. Russinovich
David A. Solomon
PUBLISHEDBY
MicrosoftPress
ADivisionofMicrosoftCorporation
OneMicrosoftWay
Redmond,Washington98052-6399
Copyright©2005byDavidSolomon,MarkRussinovich
Allrightsreserved. Nopartofthecontentsofthisbookmaybereproducedortransmittedinanyformorby
anymeanswithoutthewrittenpermissionofthepublisher.
LibraryofCongressControlNumber2004115221
PrintedandboundintheUnitedStatesofAmerica.
6789 QWT 9876
DistributedinCanadabyH.B.FennandCompanyLtd.
ACIPcataloguerecordforthisbookisavailablefromtheBritishLibrary.
MicrosoftPressbooksareavailablethroughbooksellersanddistributorsworldwide.Forfurtherinformation
aboutinternationaleditions,contactyourlocalMicrosoftCorporationofficeorcontactMicrosoftPressInter
nationaldirectlyatfax(425)936-7329.VisitourWebsiteatwww.microsoft.com/mspress.Sendcomments
[email protected].
Microsoft,ActiveDesktop,ActiveDirectory,ActiveX,DirectX,MicrosoftPress,MSDN,MS-DOS,Outlook,
PowerPoint,VisualBasic,VisualC++,VisualStudio,Win32,Windows,WindowsNT,WindowsServer,and
WinFXareeitherregisteredtrademarksortrademarksofMicrosoftCorporationintheUnitedStatesand/or
othercountries. Otherproductandcompanynamesmentionedhereinmaybethetrademarksoftheirrespec
tiveowners.
Theexamplecompanies,organizations,products,domainnames,e-mailaddresses,logos,people,places,and
eventsdepictedhereinarefictitious. Noassociationwithanyrealcompany,organization,product,domain
name,e-mailaddress,logo,person,place,oreventisintendedorshouldbeinferred.
Thisbookexpressestheauthor'sviewsandopinions.Theinformationcontainedinthisbookisprovidedwith
outanyexpress,statutory,orimpliedwarranties.Neithertheauthors,MicrosoftCorporation,noritsresellers,
ordistributorswillbeheldliableforanydamagescausedorallegedtobecausedeitherdirectlyorindirectly
bythisbook.
AcquisitionsEditors: RobinVanSteenburgh,BenRyan
ProjectEditor: ValerieWoolley
DevelopmentEditor:SallyStickney
CopyEditor:RogerLeBlanc
Indexer:LynnArmstrong
BodyPartNo. XIO-96109
To Dave Cutler,father oftheWindows kernel

ontents at a Glance
1 Concepts and Tools . . . . .. . . . . . .. . . . . .. . . . . . .. . . . . .. . . . . . .. . . . .. 1
2 System Architecture 35
3 System Mechanisms 85
4 Management Mechanisms. . . . . .. . . . . .. . . . . . .. . . . . .. . . . . . .. . . . 183
5 Startup and Shutdown 251
6 Processes, Threads, and Jobs 289
7 Memory Management 375
8 Security 485
9 I/O System 537
10 Storage Management 615
11 Cache Manager 655
12 File Systems 689
13 Networking 787
14 Crash Dump Analysis 845

Table of Contents
Historical Perspective xix
Foreword xxiii
Acknowledgments xxv
Introduction xxvii
1 Concepts and Tools 1
Windows Operating System Versions 1
Foundation Concepts and Terms 3
Windows API 3
Services, Functions, and Routines 5
Processes, Threads, and Jobs 6
Virtual Memory 14
Kernel Modevs. UserMode 16
Terminal Services and Multiple Sessions 21
Objects and Handles 22
Security 23
Registry 24
Unicode 25
Digging into Windows Internals 25
PerformanceTool 27
Windows Support Tools 27
Windows Resource Kits 27
Kernel Debugging 28
Platform Software Development Kit (SDK) 33
Device Driver Kit (DDK) 34
SysinternalsTools 34
Conclusion 34
2 System Architecture 35
Requirements and Design Goals 35
Operating System Model 36
rVlicrosofti.sinterested>inhearingyourfeedbackapcjutthis.pUblicaticn'l)$9i\oV~can
continuallyimproveourbooksandlearningresC;>!Jrcesforyou.Toparticip~tein abrief
.onlinesurvey,.pleasevisit:ltVWJN.microsoft.comlleqrninglbooksurvey/
viii TableofContents
Architecture Overview 37
Portability 40
Symmetric Multiprocessing 41
Scalability 46
Differences Between Client and ServerVersions 47
Checked Build 49
Key System Components 51
Environment Subsystems and Subsystem DLLs 53
Ntdll.dll 63
Executive. ......................................................... 63
Kernel 65
Hardware Abstraction Layer 67
Device Drivers 69
System Processes 75
Conclusion 84
3 System Mechanisms. .. . . .. . . .. . . .. . .. . . .. . . .. . . .. . . .. . . .. . . ... 85
Trap Dispatching 85
Interrupt Dispatching 87
Exception Dispatching 109
System Service Dispatching 119
Object Manager 124
Executive Objects 126
Object Structure 128
Synchronization 149
High-IRQLSynchronization ~ 151
Low-IRQL Synchronization 155
System WorkerThreads 166
Windows Global Flags 168
Local Procedure Calls (LPCs) 171
Kernel Event Tracing 175
Wow64 178
Wow64 Process Address Space Layout 179
System Calls 179
Exception Dispatching 179
UserCallbacks 179
File System Redirection 180
TableofContents ix
Registry Redirection and Reflection 180
I/OControl Requests 181
16-bitInstallerApplications 182
Printing 182
Restrictions 182
Conclusion 182
4 Management Mechanisms. .......... ......................... 183
The Registry 183
Viewing and Changing the Registry 183
Registry Usage 184
Registry Data Types 185
Registry Logical Structure 186
Troubleshooting Registry Problems 192
Registry Internals 197
Services 211
Service Applications 212
Service Accounts 217
The ServiceControl Manager 223
Service Startup 225
Startup Errors 229
Accepting the Boot and Last Known Good 230
Service Failures 231
Service Shutdown 232
Shared Service Processes 233
Service Control Programs 236
Windows Management Instrumentation 237
WMI Architecture 237
Providers 239
The Common Information Model and
the Managed Object Format Language 240
TheWMI Namespace 243
Class Association 244
WMI Implementation 247
WMI Security 248
Conclusion 249