Windows® Internals, Sixth Edition, Part 1

EECN (Explicit Congestion Notification), Protocol Driverselevation shims, Stage 5: Performing Windows Subsystem–Specific Post-Initializationelevation, UAC, Registry Virtualization, Running with Administrator Rights, Running with Administrator Rights, Running with Administrator Rights, Requesting Administrative Rights, Requesting Administrative Rights, Controlling UAC Behaviorauto-elevation, Requesting Administrative Rightsdeclining, Running with Administrator Rightsdefined, Running with Administrator Rightselevation prompts, Controlling UAC Behaviorover-the-shoulder, Running with Administrator Rightsrequested levels, Requesting Administrative Rightsemulation, device, Virtual Machine Manager Service and Worker Processes, Emulated DevicesEnableCpuQuota registry value, Distributed Fair Share Schedulingencryption of network communication, RPC Operationend nodes, data transfer between, The OSI Reference Modelenergy-report.html, Timer ProcessingEnforcement Client (EC), Network Access Protectionenlightened I/O, Enlightenmentsenlightenments, Hypervisor (Hyper-V), Child Partitions, Kernel Patch Protectionkernel patch protection, Kernel Patch Protectionenlistment objects, Kernel Transaction ManagerEnterCriticalSection function, Data Structuresenvironment subsystem, Architecture Overview, Environment Subsystems and Subsystem DLLs, Executive Objectsexcutive objects and object services, Executive Objectsserver processes, Architecture Overviewenvironment variables, creation, Session Manager (Smss)EPROCESS, Processes, Threads, and Jobs, Data Structures, Data Structures, Data Structures, Data Structures, Protected Processes, Termination, Per-Session CPU Quota Blocksaccessing, Data StructuresCPU quota block pointer, Per-Session CPU Quota Blocksexecutive routines in, Data Structuresfields, displaying, Data Structureskey fields, Data Structuresprotected process flag, Protected ProcessesEPROCESS object, setting up, Stage 2: Opening the Image to Be ExecutedERESOURCE, Unwait Boosts, Priority Boosting After I/O Completionerrata manager, Executiveerror port, Exception Dispatching, Windows Error Reportingerror recovery, Executive, Live Migration, Live Migration, HKEY_PERFORMANCE_DATA, Service Failureskernel transaction manager, Executive, Live Migrationservice recovery options, Service Failurestransactional modification of registry, HKEY_PERFORMANCE_DATAerror reports, Unhandled Exceptions, Windows Error Reporting, Windows Error Reportingcrash analysis server, sending to, Windows Error Reportingdestination, configuring, Windows Error ReportingWindows Error Reporting, Unhandled ExceptionsErrorControl parameter, Service Applications, Service Startuperrors, Exception Dispatching, Process Monitor Troubleshooting Techniques, Service Startup, Startup Errors, Windows Diagnostic Infrastructure, The OSI Reference Modelaccess-denied, Process Monitor Troubleshooting Techniquesautomated detection and resolution, Windows Diagnostic Infrastructure(see also WDI (Windows Diagnostic Infrastructure))fatal, Exception Dispatchingservice startup, Service Startupsystem startup, Startup Errorstransmit and receive, The OSI Reference ModelEthernet frames, header-data split, NDIS DriversETHREAD, Processes, Threads, and Jobs, Stage 7: Performing Process Initialization in the Context of the New Process, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structures, Terminationdisplaying, Data Structuresexecutive thread object encapsulation, Stage 7: Performing Process Initialization in the Context of the New ProcessETW (Event Tracing for Windows), Executive, Timer Processing, Debugging and Tracing, Kernel Event Tracing, Kernel Event Tracing, Kernel Event Tracing, Kernel Event Tracing, Windows Diagnostic Infrastructureclock interval change requests, Timer ProcessingDiagLog session, Windows Diagnostic Infrastructurefor ALPC messages, Debugging and TracingTCP/IP activity, tracing, Kernel Event Tracingtrace classes, Kernel Event Tracingtrace event header, Kernel Event TracingEtwConsumer objects, Executive ObjectsEtwRegistration objects, Executive ObjectsEvaluation Assurance Levels (EALs), Trusted Computer System Evaluation Criteriaevent classes, Kernel Event Tracingevent handles, Object MethodsEvent Log provider, WMI Architecture, The Common Information Model and the Managed Object Format Language, Class Associationassociation class, Class Associationinheritance, The Common Information Model and the Managed Object Format LanguageEvent Log, service startup error entries, Service Startupevent objects, Executive Objects, What Signals an Object?signaled state, What Signals an Object?Event Tracing for Windows (ETW), Executive (see ETW (Event Tracing for Windows))event tracing, kernel, Kernel Event Tracingevent unwait operations, Fast Mutexes and Guarded MutexesEvent Viewer, AppLockerevent-based problem diagnosis, Windows Diagnostic Infrastructureevents, Trap Dispatching, Trap Dispatching, Intercepts, Access Checks, WSK Implementationasynchronous, Trap Dispatchingdefault security, Access Checksintercepts for, Interceptsnetwork-status, WSK Implementationsynchronous, Trap DispatchingEveryone SID, Security Identifiers, Security IdentifiersEx APIs, Object Securityexception dispatcher, Exception Dispatchingexception dispatching, Timer Coalescing, Unhandled Exceptions, Wow64 Process Address Space LayoutWindows Error Reporting, Unhandled ExceptionsWow64, Wow64 Process Address Space Layoutexception handlers, Exception Dispatching, Exception Dispatchingframe-based, Exception Dispatchingvectored, Exception Dispatchingexception ports, Exception Dispatchingexceptions, System Mechanisms, Trap Dispatching, Trap Dispatching, Exception Dispatching, Exception Dispatching, Exception Dispatching, Exception Dispatching, Condition Variablesaborts, Trap Dispatchingarchitecture-independent, Exception Dispatchingdefined, System Mechanismsfrom SRW Lock failure, Condition Variablesinterrupt numbers, Exception Dispatchingkernel-mode, Exception Dispatchingreproducing, Trap Dispatchingunhandled, Exception Dispatchingexclusive access, Fast Mutexes and Guarded Mutexesexecutable images, Kernel Patch Protection, Stage 1: Converting and Validating Parameters and Flags, Stage 2: Opening the Image to Be Executedintegrity of, Kernel Patch Protectionopening, Stage 1: Converting and Validating Parameters and Flagsrunning, decision tree, Stage 2: Opening the Image to Be Executedexecutable pages, integrity of, Code Integrityexecutables, Services, File System and Registry Virtualization, Running with Administrator Rights, Requesting Administrative Rights, Requesting Administrative Rights, Requesting Administrative Rightsadministrative rights requests, Running with Administrator Rightsauto-elevation, Requesting Administrative Rightsdefault configuration, Requesting Administrative Rightsservice applications, Servicesvirtualization and, File System and Registry VirtualizationWindows, Requesting Administrative Rightsexecution, Kernel Mode vs. User Mode, Software Interrupt Request Levels (IRQLs)modes, Kernel Mode vs. User Modeprofiling, Software Interrupt Request Levels (IRQLs)executive components, Object Handles and the Process Handle Table, Run Once Initializationobject access, Object Handles and the Process Handle Tablesystem worker thread use, Run Once Initializationexecutive interlocked functions, Instack Queued Spinlocksexecutive LUID, Tokens, Tokensexecutive mutexes, Keyed Eventsexecutive objects, Executive, Object Manager, Executive Objects, Executive Objects, Executive Objects, Protecting Objects, Protecting Objectsaccess methods, Protecting Objectscreation, Executive Objectsobject types, viewing, Executive Objectsprimary, Executive Objectssecurity descriptor, Protecting Objectsexecutive process object, Flow of CreateProcess, Stage 2: Opening the Image to Be Executed, Stage 2: Opening the Image to Be Executed, Stage 3A: Setting Up the EPROCESS Object, Stage 3D: Concluding the Setup of the Process Address Space, Stage 3E: Setting Up the PEB, Stage 3E: Setting Up the PEBcreation, Flow of CreateProcess, Stage 2: Opening the Image to Be ExecutedEPROCESS object setup, Stage 2: Opening the Image to Be Executedfinal setup, Stage 3E: Setting Up the PEBinitial thread creation, Stage 3E: Setting Up the PEBPEB setup, Stage 3D: Concluding the Setup of the Process Address Spaceprocess address space setup, Stage 3A: Setting Up the EPROCESS Objectexecutive resources, Low-IRQL Synchronization, Fast Mutexes and Guarded Mutexes, Fast Mutexes and Guarded Mutexes, Priority Boosting After I/O Completionlisting, Fast Mutexes and Guarded Mutexesthread waits on, Priority Boosting After I/O Completionexecutive thread object, Stage 3E: Setting Up the PEB, Stage 4: Creating the Initial Thread and Its Stack and Context, Stage 5: Performing Windows Subsystem–Specific Post-Initialization, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structurescreation, Stage 3E: Setting Up the PEBexecution, starting, Stage 5: Performing Windows Subsystem–Specific Post-Initializationfields of, Data Structuresthread parameter, Stage 4: Creating the Initial Thread and Its Stack and Contextthread representation, Stage 7: Performing Process Initialization in the Context of the New Processexecutive, Windows, Architecture Overview, Subsystem for Unix-based Applications, Ntdll.dll, Ntdll.dll, Ntdll.dll, Executive, Executive, Windows Driver Foundation, Asynchronous Procedure Call Interrupts, Object Directories, System Worker Threads, User-Mode Debugging, Data Structures, Protected Processes, User Logon Stepsabstraction layer, Data Structuresaccess token creation, User Logon Stepscomponents, Ntdll.dllfunctions, Ntdll.dllinfrastructure routines, Executivekernel-mode APCs, Asynchronous Procedure Call Interruptsprefixes, Windows Driver Foundationprocess-creation routines, Protected Processessupport functions, Executivesymbolic link objects, Object Directoriessystem service stubs, Subsystem for Unix-based Applicationssystem worker thread management, System Worker Threadsuser-mode debugging module, User-Mode DebuggingExitWindowsEx function, Service Shutdownexperiments, Digging into Windows Internalsexpiration time, token, TokensExplicit Congestion Notification (ECN), Protocol DriversExplorer, User Logon Steps, File Virtualizationdisplay of virtualized files, File Virtualizationexport tables, parsing by image loader, Image Loaderextended-model classes, Providersextensibility, System Architectureextension interfaces, WSK Implementationextensions, virtualization exceptions, File System and Registry Virtualization