深入解析Windows操作系统 英文PDF|Epub|txt|kindle电子书版本网盘下载

深入解析Windows操作系统 英文PDF格式电子书版下载

注意：本站所有压缩包均有解压码： 点击下载压缩包解压工具

1 Concepts and Tools1

Windows Operating System Versions1

Foundation Concepts and Terms2

Windows API2

Services,Functions,and Routines4

Processes,Threads,and Jobs5

Virtual Memory14

Kernel Mode vs.User Mode16

Terminal Services and Multiple Sessions19

Objects and Handles21

Security22

Registry23

Unicode23

Digging into Windows Internals24

Reliability and Performance Monitor25

Kernel Debugging26

Windows Software Development Kit31

Windows Driver Kit31

Sysinternals Tools32

Conclusion32

2 System Architecture33

Requirements and Design Goals33

Operating System Model34

Architecture Overview35

Portability38

Symmetric Multiprocessing39

Scalability43

Differences Between Client and Server Versions43

Checked Build47

Key System Components49

Environment Subsystems and Subsystem DLLs50

Ntdll.dll57

Executive58

Kernel61

Hardware Abstraction Layer65

Device Drivers68

System Processes74

Conclusion83

3 System Mechanisms85

Trap Dispatching85

Interrupt Dispatching87

Exception Dispatching114

System Service Dispatching125

Object Manager133

Executive Objects136

Object Structure138

Synchronization170

High-IRQL Synchronization172

Low-IRQL Synchronization177

System Worker Threads198

Windows Global Flags200

Advanced Local Procedure Calls（ALPCs）202

Kernel Event Tracing207

Wow64211

Wow64 Process Address Space Layout211

System Calls212

Exception Dispatching212

User Callbacks212

File System Redirection212

Registry Redirection and Reflection213

I/O Control Requests214

16-Bit Installer Applications215

Printing215

Restrictions215

User-Mode Debugging216

Kernel Support216

Native Support217

Windows Subsystem Support219

Image Loader220

Early Process Initialization222

Loaded Module Database223

Import Parsing226

Post Import Process Initialization227

Hypervisor（Hyper-V）228

Partitions230

Root Partition230

Child Partitions232

Hardware Emulation and Support234

Kernel Transaction Manager240

Hotpatch Support242

Kernel Patch Protection244

Code Integrity246

Conclusion248

4 Management Mechanisms249

The Registry249

Viewing and Changing the Registry249

Registry Usage250

Registry Data Types251

Registry Logical Structure252

Transactional Registry（TxR）260

Monitoring Registry Activity262

Registry Internals266

Services281

Service Applications282

The Service Control Manager300

Service Startup303

Startup Errors307

Accepting the Boot and Last Known Good308

Service Failures310

Service Shutdown311

Shared Service Processes313

Service Tags316

Service Control Programs317

Windows Management Instrumentation318

Providers319

The Common Information Model and the Managed Object Format Language320

Class Association325

WMI Implementation327

WMI Security329

Windows Diagnostic Infrastructure329

WDI Instrumentation330

Diagnostic Policy Service330

Diagnostic Functionality332

Conclusion333

5 Processes,Threads,and Jobs335

Process Internals335

Data Structures335

Kernel Variables342

Performance Counters343

Relevant Functions344

Protected Processes346

Flow of CreateProcess348

Stage 1:Converting and Validating Parameters and Flags350

Stage 2:Opening the Image to Be Executed351

Stage 3:Creating the Windows Executive Process Object（PspAllocateProcess）354

Stage 4:Creating the Initial Thread and Its Stack and Context359

Stage 5:Performing Windows Subsystem-Specific Post-Initialization360

Stage 6:Starting Execution of the Initial Thread362

Stage 7:Performing Process Initialization in the Context of the New Process363

Thread Internals370

Data Structures370

Kernel Variables379

Performance Counters379

Relevant Functions380

Birth of a Thread380

Examining Thread Activity381

Limitations on Protected Process Threads384

Worker Factories（Thread Pools）386

Thread Scheduling391

Overview of Windows Scheduling391

Priority Levels393

Windows Scheduling APIs395

Relevant Tools396

Real-Time Priorities399

Thread States400

Dispatcher Database404

Quantum406

Scheduling Scenarios413

Context Switching418

Idle Thread418

Priority Boosts419

Multiprocessor Systems434

Multiprocessor Thread-Scheduling Algorithms442

CPU Rate Limits444

Job Objects445

Conclusion450

6 Security451

Security Ratings451

Trusted Computer System Evaluation Criteria451

The Common Criteria453

Security System Components454

Protecting Objects458

Access Checks459

Security Descriptors and Access Control484

Account Rights and Privileges501

Account Rights502

Privileges503

Super Privileges509

Security Auditing511

Logon513

Winlogon Initialization515

User Logon Steps516

User Account Control520

Virtualization521

Elevation528

Software Restriction Policies533

Conclusion535

7 I/O System537

I/O System Components537

The I/O Manager539

Typical I/O Processing540

Device Drivers541

Types of Device Drivers541

Structure of a Driver547

Driver Objects and Device Objects550

Opening Devices555

I/O Processing562

Types of I/O563

I/O Request to a Single-Layered Driver572

I/O Requests to Layered Drivers578

I/O Cancellation587

I/O Completion Ports592

I/O Prioritization598

Driver Verifier604

Kernel-Mode Driver Framework（KMDF）606

Structure and Operation of a KMDF Driver607

KMDF Data Model608

KMDF I/O Model612

User-Mode Driver Framework（UMDF）616

The Plug and Play（PnP）Manager619

Level of Plug and Play Support620

Driver Support for Plug and Play621

Driver Loading,Initialization,and Installation623

Driver Installation632

The Power Manager636

Power Manager Operation638

Driver Power Operation639

Driver and Application Control of Device Power643

Conclusion644

8 Storage Management645

Storage Terminology645

Disk Drivers646

Winload646

Disk Class,Port,and Miniport Drivers647

Disk Device Objects650

Partition Manager651

Volume Management652

Basic Disks653

Dynamic Disks656

Multipartition Volume Management661

The Volume Namespace667

Volume I/O Operations674

Virtual Disk Service675

BitLocker Drive Encryption677

BitLocker Architecture677

Encryption Keys679

Trusted Platform Module（TPM）681

BitLocker Boot Process683

BitLocker Key Recovery684

Full Volume Encryption Driver686

BitLocker Management687

Volume Shadow Copy Service688

Shadow Copies688

VSS Architecture688

VSS Operation689

Uses in Windows692

Conclusion698

9 Memory Management699

Introduction to the Memory Manager699

Memory Manager Components700

Internal Synchronization701

Examining Memory Usage701

Services the Memory Manager Provides704

Large and Small Pages705

Reserving and Committing Pages706

Locking Memory707

Allocation Granularity708

Shared Memory and Mapped Files709

Protecting Memory711

No Execute Page Protection713

Copy-on-Write718

Address Windowing Extensions719

Kernel-Mode Heaps（System Memory Pools）721

Pool Sizes722

Monitoring Pool Usage724

Look-Aside Lists728

Heap Manager729

Types of Heaps730

Heap Manager Structure731

Heap Synchronization732

The Low Fragmentation Heap732

Heap Security Features733

Heap Debugging Features734

Pageheap735

Virtual Address Space Layouts736

x86 Address Space Layouts737

x86 System Address Space Layout740

x86 Session Space740

System Page Table Entries744

64-Bit Address Space Layouts745

64-Bit Virtual Addressing Limitations749

Dynamic System Virtual Address Space Management751

System Virtual Address Space Quotas756

User Address Space Layout757

Address Translation761

x86 Virtual Address Translation762

Translation Look-Aside Buffer768

Physical Address Extension（PAE）769

IA64 Virtual Address Translation772

x64 Virtual Address Translation773

Page Fault Handling774

Invalid PTEs775

Prototype PTEs776

In-Paging I/O778

Collided Page Faults779

Clustered Page Faults779

Page Files780

Stacks784

User Stacks785

Kernel Stacks786

DPC Stack787

Virtual Address Descriptors787

Process VADs788

Rotate VADs790

NUMA791

Section Objects792

Driver Verifier799

Page Frame Number Database803

Page List Dynamics807

Page Priority809

Modified Page Writer812

PFN Data Structures814

Physical Memory Limits818

Windows Client Memory Limits819

Working Sets822

Demand Paging823

Logical Prefetcher823

Placement Policy827

Working Set Management828

Balance Set Manager and Swapper831

System Working Set832

Memory Notification Events833

Proactive Memory Management（SuperFetch）836

Components836

Tracing and Logging838

Scenarios840

Page Priority and Rebalancing840

Robust Performance843

ReadyBoost844

ReadyDrive845

Conclusion847

10 Cache Manager849

Key Features of the Cache Manager849

Single,Centralized System Cache850

The Memory Manager850

Cache Coherency850

Virtual Block Caching852

Stream-Based Caching852

Recoverable File System Support853

Cache Virtual Memory Management854

Cache Size855

Cache Virtual Size855

Cache Working Set Size856

Cache Physical Size858

Cache Data Structures859

Systemwide Cache Data Structures860

Per-File Cache Data Structures862

File System Interfaces868

Copying to and from the Cache869

Caching with the Mapping and Pinning Interfaces870

Caching with the Direct Memory Access Interfaces872

Fast I/O873

Read Ahead and Write Behind875

Intelligent Read-Ahead875

Write-Back Caching and Lazy Writing877

Write Throttling885

System Threads886

Conclusion887

11 File Systems889

Windows File System Formats890

CDFS890

UDF891

FAT12,FAT16,and FAT32891

exFAT894

NTFS895

File System Driver Architecture895

Local FSDs896

Remote FSDs897

File System Operation901

File Svstem Filter Drivers907

Troubleshooting File System Problems908

Process Monitor Basic vs.Advanced Modes908

Process Monitor Troubleshooting Techniques909

Common Log File System910

NTFS Design Goals and Features918

High-End File System Requirements918

Advanced Features of NTFS920

NTFS File System Driver934

NTFS On-Disk Structure937

Volumes937

Clusters937

Master File Table938

File Reference Numbers942

File Records942

File Names945

Resident and Nonresident Attributes948

Data Compression and Sparse Files951

The Change Journal File956

Indexing960

Object IDs961

Quota Tracking962

Consolidated Security963

Reparse Points965

Transaction Support965

NTFS Recovery Support974

Design975

Metadata Logging976

Recovery981

NTFS Bad-Cluster Recovery985

Self-Healing989

Encrypting File System Security990

Encrypting a File for the First Time993

The Decryption Process998

Backing Up Encrypted Files999

Conclusion1000

12　Networking1001

Windows Networking Architecture1001

The OSI Reference Model1001

Windows Networking Components1003

Networking APIs1006

Windows Sockets1006

Winsock Kernel（WSK）1012

Remote Procedure Call1014

Web Access APIs1018

Named Pipes and Mailslots1021

NetBIOS1027

Other Networking APIs1030

Multiple Redirector Support1033

Multiple Provider Router1034

Multiple UNC Provider1037

Name Resolution1039

Domain Name System1039

Windows Internet Name Service1039

Peer Name Resolution Protocol1039

Location and Topology1042

Network Location Awareness（NLA）1042

Link-Layer Topology Discovery（LLTD）1043

Protocol Drivers1044

Windows Filtering Platform（WFP）1047

NDIS Drivers1053

Variations on the NDIS Miniport1057

Connection-Oriented NDIS1057

Remote NDIS1060

QoS1062

Binding1064

Layered Network Services1066

Remote Access1066

Active Directory1066

Network Load Balancing1068

Distributed File System and DFS Replication1069

Conclusion1071

13 Startup and Shutdown1073

Boot Process1073

BIOS Preboot1073

The BIOS Boot Sector and Bootmgr1077

The EFI Boot Process1086

Initializing the Kernel and Executive Subsystems1088

Smss,Csrss,and Wininit1094

ReadyBoot1099

Images That Start Automatically1100

Troubleshooting Boot and Startup Problems1101

Last Known Good1101

Safe Mode1101

Windows Recovery Environment（WinRE）1106

Solving Common Boot Problems1109

Shutdown1115

Conclusion1118

14 Crash Dump Analysis1119

Why Does Windows Crash?1119

The Blue Screen1120

Troubleshooting Crashes1124

Crash Dump Files1125

Crash Dump Generation1130

Windows Error Reporting1131

Online Crash Analysis1133

Basic Crash Dump Analysis1134

Notmyfault1134

Basic Crash Dump Analysis1135

Verbose Analysis1137

Using Crash Troubleshooting Tools1139

Buffer Overrun,Memory Corruptions,and Special Pool1140

Code Overwrite and System Code Write Protection1143

Advanced Crash Dump Analysis1144

Stack Trashes1145

Hung or Unresponsive Systems1147

When There Is No Crash Dump1150

Conclusion1152

Glossary1153

Index1185