Windows® Internals, Sixth Edition, Part 1

DDA (DirectAccess), Direct AccessDACLs (discretionary access control lists), Object Security, Protecting Objects, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, Security Descriptors and Access Control, Determining Access, Determining Accessaccess checks, Determining Access, Determining AccessACEs in, Security Descriptors and Access Controlassigning, Security Descriptors and Access Controlnull, Security Descriptors and Access Controldaisy-chain configurations, Software Interrupt Request Levels (IRQLs)dangling dependencies, API Setsdata execution prevention (DEP), Import Parsingdata formatting for transmission, The OSI Reference Modeldata structures, Objects and Handles, Object Filtering, What Signals an Object?, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Data Structures, Data Structures, Data Structures, Data Structures, Data Structures, Data Structures, Data Structures, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structures, Data Structures, Data Structures, Data Structures, Thread States, Termination, Distributed Fair Share Schedulingabstraction layer, Data StructuresCSR_PROCESS, Data StructuresCSR_THREAD, Data Structuresdispatcher database, Thread StatesEPROCESS, Processes, Threads, and Jobsfields, displaying, Data Structuresidle process and idle thread, TerminationKPROCESS, Data StructuresKTHREAD, Data Structuresof wait operations, What Signals an Object?PEB, Data Structuresprocess, Processes, Threads, and JobsPspCpuQuotaControl, Distributed Fair Share Schedulingsynchronization of access, Object FilteringTEB, Data Structuresthread, Data Structures, Stage 7: Performing Process Initialization in the Context of the New Processvs. objects, Objects and HandlesW32PROCESS, Data StructuresW32THREAD, Data Structuresdata transfer, The OSI Reference Model, Networking APIs, Background Intelligent Transfer Service, Background Intelligent Transfer Service, Background Intelligent Transfer Service, Background Intelligent Transfer Service, Background Intelligent Transfer Service, Background Intelligent Transfer Service, Protocol Drivers, Protocol DriversBITS management, Background Intelligent Transfer Servicecongestion, Protocol Driversdownloading, Background Intelligent Transfer Servicehigh-loss scenarios, Protocol Driversprioritization, Background Intelligent Transfer Servicereliable transfer, The OSI Reference Model, Networking APIsseamless, Background Intelligent Transfer Servicetransfer types, Background Intelligent Transfer Serviceuploading, Background Intelligent Transfer Servicedata transmission, The OSI Reference Model, HTTP, Mailslot Operationbidirectional, HTTPformatting for, The OSI Reference Modelunreliable, unidirectional, Mailslot Operationdata view attribute, Views, Regions, and Sectionsdatagram sockets, WSK Implementationdatagrams, Winsock Server Operationdatalink layer in OSI reference model, The OSI Reference Model, The OSI Reference Model, The OSI Reference ModelLogical Link Control, The OSI Reference ModelMedium Access Control, The OSI Reference ModelDbgkCreateThread, Stage 7: Performing Process Initialization in the Context of the New ProcessDbgUi APIs, User-Mode Debugging, Kernel Support, Native SupportDCE (distributed computing environment), WSK ImplementationDCOM (Distributed Component Object Model), Peer-to-Peer InfrastructureDdeImpersonateClient function, Impersonationdeadline requirements, Software Interrupt Request Levels (IRQLs)deadlocks, Pushlocks, Message Model, Priority Boosting After I/O Completionavoiding, Message Modeldetection, Pushlockslimiting, Priority Boosting After I/O Completiondebug events, kernel-mode, User-Mode Debuggingdebug object, User-Mode Debuggingdebug programs privilege, Super Privilegesdebug version of Windows, Checked Builddebugger, Digging into Windows Internals, Debugging Tools for Windows, Checked Build, Timer Processing, Processor Selection, Exception Dispatching, Exception Dispatching, Exception Dispatching, Kernel Support, Kernel Support, Native Support, Image Loader, Stage 7: Performing Process Initialization in the Context of the New Process(see also kernel debugger; user-mode debugger)breakpoints, Exception Dispatching, Exception Dispatchingdebug event requests, Kernel Supportextension commands, Debugging Tools for Windowsimage loader, watching, Image Loadernotifications, Checked Build, Stage 7: Performing Process Initialization in the Context of the New Processobjects, viewing, Native Supportports, Exception Dispatchingprocesses, breaking into, Kernel Supportsystem timers, listing, Processor Selectiontimer resolution information, Timer Processingdebugger-based attacks, Protected ProcessesDebugger.chm help file, Debugging Tools for Windowsdebugging, Performance Monitor, Kernel Debugging, Unhandled Exceptions, Object Retention, User-Mode Debugging, User-Mode Debugging, Image Loader, Image Loaderapplication startup, Image Loadercrashing processes, Unhandled Exceptionshandles and object, Object Retentionkernel, Performance Monitorkernel support, User-Mode Debuggingloader snaps, Image Loaderuser-mode, Kernel Debugging, User-Mode Debuggingdebugging mode, booting in, Debugging Tools for WindowsDebugging Tools for Windows, Processes, Threads, and Jobs, Kernel Debugging, Kernel Debugging, Debugging Tools for Windowshelp file, Debugging Tools for WindowsTlist.exe tool, Processes, Threads, and Jobsupdates, Kernel Debuggingdefault security, Access Checks(see also security)Defense Advanced Research Projects Agency (DARPA), Protocol Driversdeferred delete operations, Object Retentiondeferred procedure calls (DPCs), Software Interrupt Request Levels (IRQLs) (see DPCs (deferred procedure calls))deferred ready threads, Stage 4: Creating the Initial Thread and Its Stack and Context, Using Tools to Interact with Priority, Priority Boosts for CPU Starvationprocessing, Priority Boosts for CPU Starvationdelay load, Import Parsingdelayed auto-start services, Service Startup, Service Startupstartup, Service Startupdelayed worker threads, Run Once InitializationDelayedAutoStart parameter, Service Applicationsdelete method, Object Methodsdelete operations, deferred, Object RetentionDEP (data execution prevention), Import Parsingdependencies, Import Parsing, API Sets, Service Startup, Service Startup, QoSbinding, QoSdangling, API Setsdefining and fulfilling, Import Parsingof auto-start services, Service Startupof services, Service StartupDependency Walker, Digging into Windows Internals, Environment Subsystems and Subsystem DLLs, Hardware Abstraction Layerimage type, viewing, Environment Subsystems and Subsystem DLLskernel and HAL images, viewing, Hardware Abstraction LayerDependOnGroup parameter, Service Applications, Service StartupDependOnService parameter, Service ApplicationsDescription parameter, Service Applicationsdesktop, Stage 1: Converting and Validating Parameters and Flags, Logon, Winlogon Initialization, Winlogon Initialization, Controlling UAC Behaviorcreating and opening, Logonlocking or unlocking, Winlogon Initializationprocess association with, Stage 1: Converting and Validating Parameters and Flagsprotecting access to, Winlogon InitializationUAC prompts, Controlling UAC Behaviordesktop object, Executive Objects, Object Methods, Object Methodsokay-to-close routine, Object Methodsopen method, Object MethodsDesktops tool, Processes, Threads, and JobsDeveloping Drivers with the Windows Driver Foundation (Orwick and Smith), Windows Driver Kitdevelopment environment, Windows APIdevice drivers, Kernel Mode vs. User Mode, Architecture Overview, Device Drivers, Device Drivers, Device Drivers, Device Drivers, Windows Driver Model (WDM), Windows Driver Model (WDM), Windows Driver Foundation, System Process and System Threads, Software Interrupt Request Levels (IRQLs), Dispatch or Deferred Procedure Call (DPC) Interrupts, Asynchronous Procedure Call Interrupts, Asynchronous Procedure Call Interrupts, Exception Dispatching, System Service Dispatching, Object Handles and the Process Handle Table, Spinlocks, Instack Queued Spinlocks, Keyed Events, Run Once Initialization, Registry Redirection, Hotpatch Support, Kernel Patch Protection, Registry Usage, Service Applications, Service Applications, The Service Control Manager, The Service Control Manager, The Service Control Manager, Lock Ownership Boosts, Priority Boosting After I/O Completion, Biometric Framework for User Authentication, The OSI Reference Model(see also drivers)32-bit, Hotpatch SupportAPC blocking, Asynchronous Procedure Call Interruptsauto-start, The Service Control Managerbiometric scanner, Biometric Framework for User Authenticationcharacteristics, Service Applicationsdevelopment frameworks, Windows Driver Model (WDM)DPCs, Dispatch or Deferred Procedure Call (DPC) Interruptsdynamically allocated queued spinlocks, Instack Queued Spinlocksfast mutexes, Keyed EventsI/O control functions, Registry Redirectioninstalled, viewing, Windows Driver Foundationintegrity of code, Kernel Patch Protectioninterrupt request restriction violations, Software Interrupt Request Levels (IRQLs)kernel-mode APCs, Asynchronous Procedure Call Interruptskernel-mode contexts, Device Driversloading, The Service Control Managerminidrivers, Priority Boosting After I/O Completionobject access, Object Handles and the Process Handle Tableparameters, Service Applicationspriority boost specification, Lock Ownership Boostsregistry settings, Registry Usagespinlocks, Spinlocksstartup failures, The Service Control Managerstructured exception handling, Exception Dispatchingsystem calls access, System Service Dispatchingsystem threads, mapping to, System Process and System Threadssystem worker thread use, Run Once InitializationTDI clients, The OSI Reference Modeltypes, Device Driversverification of, Kernel Mode vs. User ModeWDM environment, Windows Driver Model (WDM)Windows internals, accessing with, Device Driversdevice interrupts, Trap Dispatching, Software Interrupt Request Levels (IRQLs)Device Manager, HKEY_LOCAL_MACHINEDevice Profile for Web Services (DPWS), Message Queuingdevice-to-driver mappings, HKEY_LOCAL_MACHINEdevices, Session Manager (Smss), Virtual Machine Manager Service and Worker Processesemulation, Virtual Machine Manager Service and Worker Processessymbolic link creation, Session Manager (Smss)DFS-N (Distributed File System Namespace), Distributed File System NamespaceDFS-R (Distributed File System Replication), Distributed File System Namespace, Distributed File System NamespaceDFSS (Distributed Fair Share Scheduler), Distributed Fair Share Scheduling, Distributed Fair Share Scheduling, Distributed Fair Share Scheduling, Distributed Fair Share Scheduling, Per-Session CPU Quota Blocks, Charging of Cycles to Throttled Threads, Resuming Execution, Resuming Execution, DFSS Idle-Only Queue Schedulingclock cycles, charging to threads, Per-Session CPU Quota Blocksidle-only queue thread management, Resuming Executioninitialization, Distributed Fair Share Schedulingper-session CPU quota blocks, Distributed Fair Share Schedulingquota enforcement, Charging of Cycles to Throttled Threadsscheduler, Resuming Executionsession weight management, DFSS Idle-Only Queue Schedulingturning off, Distributed Fair Share SchedulingDhcp service, Running with Least PrivilegeDiagLog session, Windows Diagnostic InfrastructureDiagnostic Policy Service (DPS), Windows Diagnostic Infrastructurediagnostic scenarios, Diagnostic Policy Service, Diagnostic Functionalitybuilt-in, Diagnostic FunctionalityGroup Policy settings, Diagnostic Policy Servicediagnostics instrumentation, Windows Diagnostic Infrastructuredial-up remote access, BindingDifferentiated Services Code Point (DSCP), QoSDigital Equipment Corporation Alpha AXP, Architecture Overviewdigital rights management, protected processes and, Protected ProcessesDirect2D, Kernel Mode vs. User ModeDirectAccess (DA), Direct Accessdirected context switches, Processes, Threads, and Jobsdirectory object type, Executive ObjectsDisconnectEx API, Winsock Server Operationdiscretionary access checks, ACL Assignmentdiscretionary access control, Security, Trusted Computer System Evaluation Criteria, Protecting Objects, Protecting Objectsaccess logging, Protecting Objectsobject protection, Protecting Objectsdiscretionary access control lists (DACLs), Object Security (see DACLs (discretionary access control lists))disk diagnostics, Diagnostic Functionalitydisk, paging data to, Virtual Memorydispatch code, Software Interrupt Request Levels (IRQLs)dispatch events, thread priority boosts, Priority Boostsdispatch interrupts, Software Interrupt Request Levels (IRQLs), Interrupt Levels vs. Priority Levelsdispatcher, Overview of Windows Scheduling, Thread Statesdispatcher database, Thread States, Dispatcher Databasesynchronization, Dispatcher Databasedispatcher headers, What Signals an Object?, Data Structures, Data Structuresflags, Data Structuresinterpreting, Data Structuresdispatcher objects, Executive, Type Objects, Low-IRQL Synchronization, Low-IRQL Synchronization, What Signals an Object?, What Signals an Object?thread state changes, What Signals an Object?waiting for, Low-IRQL Synchronizationdispatcher synchronization objects, Timer Expirationdispatching, System Mechanisms, Trap Dispatchinginterrupt, Trap Dispatchingtrap, System Mechanismsdisplay I/O functionality, Windows SubsystemDisplayName parameter, Service Applicationsdistributed applications, loosely coupled messaging, Peer-to-Peer InfrastructureDistributed Cache caching mode, BranchCacheDistributed Component Object Model (DCOM), Peer-to-Peer Infrastructuredistributed computing environment (DCE), WSK ImplementationDistributed Fair Share Scheduler (DFSS), Distributed Fair Share Scheduling (see DFSS (Distributed Fair Share Scheduler))Distributed File System Client, Surrogate ProvidersDistributed File System Namespace (DFS-N), Distributed File System NamespaceDistributed File System Replication (DFS-R), Distributed File System NamespaceDistributed Management Task Force (DMTF), Service Control ProgramsDLL restriction, AppLockerDllhost.exe, Processes, Threads, and JobsDllMain routines, Post-Import Process InitializationDLLs, Services, Functions, and Routines, Architecture Overview, Session Manager (Smss), Local Session Manager (Lsm.exe), Image Loader, Early Process Initialization, Early Process Initialization, DLL Name Resolution and Redirection, DLL Name Resolution and Redirection, Import Parsing, Post-Import Process Initialization, SwitchBack, Hotpatch Supportcredential providers, Local Session Manager (Lsm.exe)defined, Services, Functions, and Routinesimporting and loading, Import Parsinginitialization tasks, Post-Import Process InitializationKPP-protected, Hotpatch Supportloading and unloading by image loader, Image Loader, Early Process Initializationname redirection rules, DLL Name Resolution and Redirectionname resolution by image loader, Early Process Initializationopening, Session Manager (Smss)search path, DLL Name Resolution and Redirectionsub-DLLs, SwitchBacksubsystem, Architecture OverviewDMTF (Distributed Management Task Force), Service Control ProgramsDNS (Domain Name System), BranchCache Optimized Application Retrieval: HTTP Sequence, BranchCache Optimized Application Retrieval: HTTP Sequencelookup requests, BranchCache Optimized Application Retrieval: HTTP SequenceDNS servers, BranchCache Optimized Application Retrieval: HTTP Sequencedomain accounts, SIDs, Security IdentifiersDomain Name System (DNS), BranchCache Optimized Application Retrieval: HTTP Sequencedownloads, Background Intelligent Transfer ServiceDPC objects, Dispatch or Deferred Procedure Call (DPC) InterruptsDPC queues, Dispatch or Deferred Procedure Call (DPC) InterruptsDPC/dispatch interrupts, Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Spinlocksfor spinlocks, Spinlocksgeneration rules, Dispatch or Deferred Procedure Call (DPC) Interruptstriggering, Dispatch or Deferred Procedure Call (DPC) InterruptsDPCs (deferred procedure calls), Software Interrupt Request Levels (IRQLs), Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Processor Selection, Priority Boosts for Multimedia Applications and Games, Resuming Execution, DFSS Idle-Only Queue Schedulingcapabilities, Dispatch or Deferred Procedure Call (DPC) Interruptsmonitoring, Dispatch or Deferred Procedure Call (DPC) Interruptsprioritization, Dispatch or Deferred Procedure Call (DPC) Interruptsprocessing, Dispatch or Deferred Procedure Call (DPC) Interruptsqueuing, Resuming Executiontarget processor, Processor Selectiontargeted, Dispatch or Deferred Procedure Call (DPC) Interruptsthread wake-up calls, DFSS Idle-Only Queue Schedulingthreaded, Dispatch or Deferred Procedure Call (DPC) InterruptsDPS (Diagnostic Policy Service), Windows Diagnostic InfrastructureDPWS (Device Profile for Web Services), Message Queuingdrive-letter assignment, The Service Control Managerdrive-letter mapping, Multiple Provider RouterDriver directory, The Service Control ManagerDriver Verifier, Kernel Mode vs. User Mode, Executive, Pushlocksdeadlock detection, Pushlocksdrivers, Kernel Mode vs. User Mode, Architecture Overview, Object Filtering, Kernel Patch Protection, Registry Filtering, Interactive Services and Session 0 Isolation, Internet Protocol Security(see also device drivers)boot-start and system-start, Interactive Services and Session 0 Isolationcontext data, assigning and creating, Registry Filteringnetwork adapter-protocol driver communication, Internet Protocol Securityobject filtering, Object Filteringsignature enforcement, Kernel Mode vs. User Modesigning policies, Kernel Patch ProtectionDSCP (Differentiated Services Code Point), QoSdt command, Debugging Tools for Windows, Data Structures, Data Structures, Package Sets and SMT SetsKNODE structure, viewing, Package Sets and SMT SetsDynamic Memory, Memory Virtualization, Memory Virtualization, Memory Virtualization, Memory Virtualization, Memory Virtualizationarchitecture, Memory Virtualizationcalculating, Memory Virtualizationconfiguring, Memory Virtualizationwatching, Memory Virtualizationdynamic processors, Session Manager (Smss), Dynamic Processor Addition and Replacement, Dynamic Processor Addition and Replacementadding, Session Manager (Smss)threaded DPC support, Dynamic Processor Addition and Replacementdynamic providers, The Common Information Model and the Managed Object Format Languagedynamic runtime compatibility mitigations, Image Loaderdynamic worker threads, System Worker Threadsdynamic-link libraries, Local Session Manager (Lsm.exe) (see DLLs)