Windows® Internals, Sixth Edition, Part 1

KKd.exe, Debugging Tools for WindowsKeAcquire/ReleaseSpinLockForDpc API, Dispatch or Deferred Procedure Call (DPC) InterruptsKeAcquireInStackQueuedSpinLock function, Instack Queued SpinlocksKeAcquireInterruptSpinLock API, SpinlocksKeAcquireSpinLock function, SpinlocksKeAddSystemServiceTable function, System Service DispatchingKeAreAllApcsDisabled function, Fast Mutexes and Guarded MutexesKeAreApcsDisabled function, Fast Mutexes and Guarded MutexesKeEnterGuardedRegion, Asynchronous Procedure Call InterruptsKeInitializeProcess function, Stage 3B: Creating the Initial Process Address SpaceKePerformGroupConfiguration routine, NUMA SystemsKerberos authentication, Logon, Winlogon Initialization, User Logon StepsTCP/IP port (port 88), User Logon StepsKerberos Key Distribution Center service, User Logon StepsKeReleaseInStackQueuedSpinLock function, Instack Queued SpinlocksKeReleaseInterruptSpinLock API, SpinlocksKeReleaseSpinLock function, Spinlockskernel, Requirements and Design Goals, Architecture Overview, Architecture Overview, Symmetric Multiprocessing, Executive, Executive, Kernel Processor Control Region and Control Block (KPCR and KPRCB), Kernel Processor Control Region and Control Block (KPCR and KPRCB), Kernel Processor Control Region and Control Block (KPCR and KPRCB), Hardware Support, Trap Dispatching, Trap Dispatching, Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Dispatch or Deferred Procedure Call (DPC) Interrupts, Exception Dispatching, Exception Dispatching, Synchronization, Low-IRQL Synchronization, What Signals an Object?, Data Structures, Views, Regions, and Sections, Blobs, Handles, and Resources, User-Mode Debugging, Loaded Module Database, Worker Factories (Thread Pools), Worker Factories (Thread Pools), Overview of Windows Scheduling, Priority Levels, Thread States, Package Sets and SMT Sets, Dynamic Processor Addition and Replacementattributes management, Views, Regions, and Sectionsblob management, Blobs, Handles, and Resourcesdaisy-chain configuration support, Software Interrupt Request Levels (IRQLs)design, Architecture Overviewdispatcher database, Thread Statesdispatcher objects, Low-IRQL Synchronization, What Signals an Object?DPC processing, Dispatch or Deferred Procedure Call (DPC) Interruptsdriver and DLL loader, Loaded Module Databasedynamic thread creation, Worker Factories (Thread Pools)exception trapping and handling, Exception Dispatchingexceptions and interrupts, distinguishing between, Trap Dispatchinghardware support, Kernel Processor Control Region and Control Block (KPCR and KPRCB)interrupt objects, Software Interrupt Request Levels (IRQLs)lock ordering scheme, Data Structuresmutual exclusion functions, SynchronizationNUMA system information, Package Sets and SMT Setsobjects, Executiveportable interfaces, Kernel Processor Control Region and Control Block (KPCR and KPRCB)processor control region, Kernel Processor Control Region and Control Block (KPCR and KPRCB)protection mechanisms, Requirements and Design Goalsreal-time, Software Interrupt Request Levels (IRQLs)scalability features, Symmetric Multiprocessingsoftware interrupts, Software Interrupt Request Levels (IRQLs)structured exception handling, Exception Dispatchingsystem interrupts, Trap Dispatchingthread priority assignment, Priority Levelsthread scheduling, creation, and termination, Worker Factories (Thread Pools)(see also thread scheduling)threaded DPC support for dynamic processors, Dynamic Processor Addition and Replacementuser-mode debugging support, User-Mode DebuggingWindows scheduling code, Overview of Windows Schedulingx86-specific interfaces, Hardware Supportkernel boot process, Viewing and Changing the Registrykernel debugger, Digging into Windows Internals, Debugging Tools for Windows, Debugging Tools for Windows, Executive, Object Handles and the Process Handle Table, Fast Mutexes and Guarded Mutexes, System Worker Threads, Windows Global Flags, The Registry Namespace and Operation, Data Structures, Data Structures, Data Structures, Data Structures, Data Structures, Data Structures, Thread Scheduling, Job Limits, Tokens, Security Descriptors and Access Control, Protocol Drivers, NDIS Drivers!process command, Data Structurescommands, Debugging Tools for WindowsEPROCESS fields, displaying, Data StructuresETHREAD and KTHREAD, displaying, Data Structuresexecutive resources, listing, Fast Mutexes and Guarded Mutexesextension commands, Debugging Tools for Windowshandle table, viewing, Object Handles and the Process Handle Tablejob objects, viewing, Job Limitskey control blocks, viewing, The Registry Namespace and Operationlibrary, ExecutiveNDIS mini-ports, listing, NDIS DriversNtGlobalFlag variable, viewing and setting, Windows Global FlagsPEB, displaying, Data Structuresready threads, viewing, Thread Schedulingsecurity descriptors, viewing, Security Descriptors and Access Controlsystem worker threads, listing, System Worker ThreadsTCP/IP device objects, viewing, Protocol DriversTEB, dumping, Data Structuresthread data structures, dumping, Data Structurestokens, viewing, Tokenskernel debugging, Performance Monitor, Debugging Tools for Windows, Debugging Tools for Windowslocal, Debugging Tools for Windowssystem not booted in debug mode, Debugging Tools for Windowskernel dispatcher, Overview of Windows Scheduling, Thread Statesready queues, Thread Stateskernel event tracing, Kernel Event Tracingkernel handle table, Object Handles and the Process Handle Table, Hive Size Limitsregistry hives, opening, Hive Size Limitskernel handles, Protected Processeskernel image, Differences Between Client and Server Versions, Checked Buildchecked build version, Checked Buildclient and server version, Differences Between Client and Server Versionskernel logger, Kernel Event Tracing, Kernel Event Tracing, Kernel Event TracingTCP/IP activity, tracing, Kernel Event Tracingtrace classes, enabling, Kernel Event Tracingkernel mode, Kernel Mode vs. User Mode, Kernel Mode vs. User Mode, Requirements and Design Goals, Operating System Model, Protected Processes, RPC Implementationprotected processes support, Protected ProcessesRPC support, RPC Implementationtransitioning to user mode, Kernel Mode vs. User ModeKernel Mode Code Signing (KMCS) policy, Kernel Mode vs. User Mode, Kernel Patch Protectionkernel objects, Object ManagerKernel Patch Protection (KPP), Hotpatch Supportkernel processor control block (KPRCB), Kernel Processor Control Region and Control Block (KPCR and KPRCB), Kernel Processor Control Region and Control Block (KPCR and KPRCB)viewing, Kernel Processor Control Region and Control Block (KPCR and KPRCB)Kernel Profiler (Kernrate), Software Interrupt Request Levels (IRQLs)kernel queues, Worker Factories (Thread Pools)Kernel Security Device Driver (KSecDD), Security System Componentskernel stacks, Kernel Patch Protectionkernel streaming filter drivers, Device Driverskernel structures, Debugging Tools for Windows, Debugging Tools for Windowssubstructures, Debugging Tools for Windowstype information, displaying, Debugging Tools for Windowskernel support functions, defined, Windows APIkernel support routines, defined, Windows APIKernel Transaction Manager (KTM), Executive, Live Migrationkernel-mode APCs, Dispatch or Deferred Procedure Call (DPC) Interrupts, Reserve Objectskernel-mode code, System Service Dispatching, Kernel Patch Protection, Protecting Objectssigning, Kernel Patch Protectionsystem calls, System Service Dispatchingtrust level, Protecting Objectskernel-mode components, Architecture Overview, Device Driversdevice drivers, Device DriversKernel-Mode Driver Framework (KMDF), Windows Driver Model (WDM)kernel-mode exceptions, Exception Dispatchingkernel-mode RPC, RPC Implementationkernel-mode system threads, System Processeskernel-mode threads, Interrupt Levels vs. Priority Levelskernel-mode trampolines, System Service DispatchingKernel32.dll, Architecture Overview, Native Support, API Sets, Protected Processes, Stage 4: Creating the Initial Thread and Its Stack and Context, Birth of a Threadprocess-creation tasks, Protected Processesthread creation, Birth of a Threaduser-mode debugging component, Native Supportvirtual DLL files, API SetsWindows subsystem–specific operations, Stage 4: Creating the Initial Thread and Its Stack and ContextKeServiceDescriptorTable, System Service Dispatching, Service Descriptor TablesKeServiceDescriptorTableShadow, System Service Dispatching, Service Descriptor TablesKeStartDynamicProcessor function, Dynamic Processor Addition and ReplacementKeStartThread function, Stage 4: Creating the Initial Thread and Its Stack and ContextKeUpdateRunTime routine, Timer ExpirationKeUpdateSystemTime routine, Timer Expirationkey control blocks, Cell Maps, The Registry Namespace and Operation, The Registry Namespace and Operation, Registry Filtering, Registry Filteringallocation, Cell Mapsdeletion, The Registry Namespace and Operationfast access to, Registry Filteringkey name references, Registry Filteringviewing, The Registry Namespace and Operationkey object allocation, Cell Mapskey object type, Executive Objectskeyboard, logon requests from, Logonkeyed events, Data Structures, Keyed Events, Keyed Events, Keyed Eventsperformance, Keyed Eventssignaling, Keyed Eventswaiter lists, Keyed Eventskeys, registry, Registry Usage, Registry Usage, Process Monitor Internals, Hive Size Limits, Registry Filtering, Service Startup, Startup Errors, Global Audit Policy, File Virtualizationaccess, protecting, Registry FilteringCurrentControlSet, Startup Errorsglobal audit policy, Global Audit Policylinking, Hive Size Limitsmissing, Process Monitor Internalsnaming scheme, Registry Usagesafe mode, Service Startupvirtualized, File Virtualizationkeystrokes, squashing, Winlogon InitializationKiCheckForThreadDispatch function, Choosing a Processor for a Thread When There Are Idle ProcessorsKiCyclesPerClockQuantum value, Quantum, DFSS Idle-Only Queue SchedulingKiDeferredReadyThread function, Logical Processor State, Thread Selection on Multiprocessor SystemsKiFloatingDispatch handler, Software Interrupt Request Levels (IRQLs)KiIdleLoop routine, Idle ThreadsKiInterruptDispatchLBControl handler, Software Interrupt Request Levels (IRQLs)KiInterruptDispatchNoEOI handler, Software Interrupt Request Levels (IRQLs)KiInterruptDispatchNoLock handler, Software Interrupt Request Levels (IRQLs)KiProcessDeferredReadyList function, Logical Processor StateKiSearchForNewThread function, Thread Selection, Ideal and Last Processor, Thread Selection on Multiprocessor Systems, Resuming ExecutionKiSelectCandidateProcessor function, Choosing a Processor for a Thread When There Are No Idle ProcessorsKiSelectNextThread function, Idle ThreadsKiSelectReadyThread function, Thread SelectionKiSystemService routine, System Service DispatchingKiThreadStartup function, Stage 7: Performing Process Initialization in the Context of the New ProcessKMCS (Kernel Mode Code Signing) policy, Kernel Mode vs. User ModeKMDF (Kernel-Mode Driver Framework), Windows Driver Model (WDM)KNODE, Package Sets and SMT SetsKnown DLLs, DLL Name RedirectionKPCR (kernel processor control region), Kernel Processor Control Region and Control Block (KPCR and KPRCB), Kernel Processor Control Region and Control Block (KPCR and KPRCB)viewing, Kernel Processor Control Region and Control Block (KPCR and KPRCB)KPP (Kernel Patch Protection), Hotpatch Support, Kernel Patch Protectionsupported techniques for working around, Kernel Patch ProtectionKPRCB (kernel processor control block), Kernel Processor Control Region and Control Block (KPCR and KPRCB), Kernel Processor Control Region and Control Block (KPCR and KPRCB)viewing, Kernel Processor Control Region and Control Block (KPCR and KPRCB)KPROCESS, Data Structures, Data Structures, Stage 3B: Creating the Initial Process Address Space, Terminationinitializing, Stage 3B: Creating the Initial Process Address Spaceviewing, Data StructuresKQUEUE, Worker Factories (Thread Pools)KSecDD, Security System ComponentsKTHREAD, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structures, Data Structures, Terminationdisplaying, Data StructuresWin32Thread field, Data StructuresKTM (Kernel Transaction Manager), Executive, Live MigrationKTM objects, Object Retention, Kernel Transaction Managerdeferred deletion, Object RetentionKtmutil.exe, Kernel Transaction Manager