Windows® Internals, Sixth Edition, Part 1

TTag parameter, Service Applicationstagged TLB, Memory Virtualizationtake ownership privilege, Super Privilegestargeted DPCs, Dispatch or Deferred Procedure Call (DPC) InterruptsTask (Process) List, Digging into Windows InternalsTask Manager, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Kernel Mode vs. User Mode, Digging into Windows Internals, Protected Processes, Using Tools to Interact with Priority, File System and Registry Virtualizationaccess rights, Protected ProcessesApplications tab, Processes, Threads, and Jobskernel mode vs. user mode counter, Kernel Mode vs. User Modepriority levels, changing, Using Tools to Interact with Priorityprocess activity, viewing, Processes, Threads, and JobsProcesses tab, Processes, Threads, and Jobsvirtualization status, viewing, File System and Registry Virtualizationtask offloading, NDIS DriversTaskeng.exe, Processes, Threads, and JobsTaskHost, Consumer RegistrationTCB (thread control block), Data Structures, Extended Affinity MaskCPU numbers, Extended Affinity MaskTCP/IP, Kernel Event Tracing, Windows Networking Components, Winsock Extensions, Protocol Drivers, Protocol Drivers, Protocol Drivers, Protocol Drivers, Windows Filtering Platform, NDIS Driversactivity, tracing, Kernel Event Tracingdevice objects, viewing, Protocol DriversNext Generation TCP/IP Stack, Protocol Driversoffloading, NDIS Driversreceive window auto tuning, Protocol DriversWAN-friendly charactersitics, Protocol Driverswell-known addresses, Winsock ExtensionsWFP integration, Windows Filtering PlatformTCP/IP port (port 88), User Logon StepsTCP/IP protocol stack, The OSI Reference ModelTDI (Transport Driver Interface), Windows Networking Components, Winsock Kernel, Surrogate Providerstransports, Windows Networking ComponentsTDI (Transport Driver Interface) clients, The OSI Reference ModelTDI Extension (TDX) Driver, Windows Networking ComponentsTEB (thread environment block), Shared Service Processes, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structures, Data Structures, Data Structuresdumping, Data Structuresfields, Data Structuresservice tags, Shared Service Processestemporary objects, Object Securityterminal server sessions, Terminal Services and Multiple Sessions, Service Control Manager (SCM)detecting, Terminal Services and Multiple Sessionsmanagement, Service Control Manager (SCM)terminal-services environments, Kernel Mode vs. User Mode, Service Isolation, Choosing a Processor for a Thread When There Are No Idle Processorsprocessor share-based scheduling, Choosing a Processor for a Thread When There Are No Idle Processorswindow stations, Service Isolationterminated threads, Thread States, Terminationterms, definitions of, Windows APITestlimit tool, Object Handles and the Process Handle Tablethird-party device drivers, verification, Kernel Mode vs. User Modethread context, Processes, Threads, and Jobs, Processes, Threads, and Jobs32-bit and 64-bit, Processes, Threads, and Jobsthread data structures, Data Structures, Data Structuresdumping, Data Structuresthread dispatcher, activating, Software Interrupt Request Levels (IRQLs)thread environment block (TEB), Stage 7: Performing Process Initialization in the Context of the New Process (see TEB (thread environment block))thread IDs, Processes, Threads, and JobsThread Information Block (TIB), Data Structuresthread objects, Executive Objects, Keyed EventsKeyedWaitSemaphore, Keyed Eventsthread parameter, Stage 4: Creating the Initial Thread and Its Stack and Contextthread pools, Worker Factories (Thread Pools), Worker Factories (Thread Pools), Worker Factories (Thread Pools)shutting down, Worker Factories (Thread Pools)viewing, Worker Factories (Thread Pools)thread scheduling, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Thread Scheduling, Thread Scheduling, Overview of Windows Scheduling, Using Tools to Interact with Priority, Thread States, Dispatcher Database, Priority Boosts, Priority Boosts, Priority Boosts for Multimedia Applications and Games, Scheduling Scenarios, Scheduling Scenarios, Preemption, Quantum End, Termination, Termination, Idle Threads, Thread Selection, Thread Selection, Ideal and Last Processor, Thread Selection on Multiprocessor Systems, Thread Selection on Multiprocessor Systems, Choosing a Processor for a Thread When There Are No Idle Processors, Resuming Executioncontext switches, Priority Boosts for Multimedia Applications and GamesDFSS scheduling and, Resuming Executiondispatcher database, Thread Statesfibers, Processes, Threads, and Jobsidle scheduling, Thread Selectionidle threads, Terminationlimitations, Choosing a Processor for a Thread When There Are No Idle Processorson multiprocessor systems, Thread Selectionpreemption, Scheduling Scenariospriority boosts, Priority Boostspriority levels, Overview of Windows Schedulingpriority-driven, preemptive, Thread Schedulingprocessor selection, Thread Selection on Multiprocessor Systemsquantum, Dispatcher Databasequantum end, Preemptionthread execution states, Using Tools to Interact with Prioritythread selection, Idle Threadsthread selection on multiprocessor systems, Ideal and Last Processorthread termination, Terminationthreads in real-time range, Priority Booststime slicing, Quantum EndUMS, Processes, Threads, and Jobsvoluntary switching, Scheduling Scenarioswork-stealing loop, Thread Selection on Multiprocessor Systemsthread stack, Examining Thread Activity, Examining Thread Activity32-bit and 64-bit, Examining Thread Activitythread-local storage (TLS), Processes, Threads, and Jobsthreaded DPCs, Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interruptsdisabling, Dispatch or Deferred Procedure Call (DPC) Interruptsthreads, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Processes, Threads, and Jobs, Trap Dispatching, Hardware Interrupt Processing, Software Interrupt Request Levels (IRQLs), Software Interrupt Request Levels (IRQLs), Dispatch or Deferred Procedure Call (DPC) Interrupts, Dispatch or Deferred Procedure Call (DPC) Interrupts, Asynchronous Procedure Call Interrupts, Asynchronous Procedure Call Interrupts, Asynchronous Procedure Call Interrupts, Exception Dispatching, Unhandled Exceptions, System Service Dispatching, Type Objects, Object Filtering, Low-IRQL Synchronization, Low-IRQL Synchronization, What Signals an Object?, Data Structures, Fast Mutexes and Guarded Mutexes, Executive Resources, User-Mode Resources, Run Once Initialization, System Worker Threads, Kernel Support, DLL Name Redirection, Stage 3B: Creating the Initial Process Address Space, Stage 7: Performing Process Initialization in the Context of the New Process, Stage 7: Performing Process Initialization in the Context of the New Process, Stage 7: Performing Process Initialization in the Context of the New Process, Stage 7: Performing Process Initialization in the Context of the New Process, Stage 7: Performing Process Initialization in the Context of the New Process, Data Structures, Data Structures, Data Structures, Data Structures, Birth of a Thread, Birth of a Thread, Birth of a Thread, Birth of a Thread, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Examining Thread Activity, Thread Scheduling, Thread Scheduling, Thread Scheduling, Overview of Windows Scheduling, Overview of Windows Scheduling, Overview of Windows Scheduling, Overview of Windows Scheduling, Priority Levels, Interrupt Levels vs. Priority Levels, Using Tools to Interact with Priority, Using Tools to Interact with Priority, Using Tools to Interact with Priority, Using Tools to Interact with Priority, Thread States, Thread States, Thread States, Thread States, Thread States, Thread States, Thread States, Dispatcher Database, Quantum, Priority Boosting After I/O Completion, Priority Boosts for Multimedia Applications and Games, Scheduling Scenarios, Termination, Idle Threads, Thread Selection, Logical Processor State, Extended Affinity Mask, Extended Affinity Mask, Ideal and Last Processor, Choosing a Processor for a Thread When There Are No Idle Processors, Per-Session CPU Quota Blocks, CPU Rate Limits, Protecting Objects, Access Checks, Access Checks, Tokens, Impersonation, Determining Access, Super Privilegesaccess tokens, Processes, Threads, and Jobs, Super Privilegesactivation context stack, DLL Name Redirectionactivity, examining, Birth of a Threadaffinity mask, Logical Processor Statealertable wait state, Asynchronous Procedure Call InterruptsAPC queue, Dispatch or Deferred Procedure Call (DPC) Interruptsartificially waiting, CPU Rate Limitsclock cycle count, Examining Thread Activityclock cycles charged to, Per-Session CPU Quota Blockscomponents, Processes, Threads, and Jobscontention count, Executive Resourcescontext switching, Priority Boosts for Multimedia Applications and Games(see also context switches)CPU consumption, Examining Thread ActivityCPU numbers, Extended Affinity MaskCreateThread function, Birth of a Threadcreation, Birth of a Threadcreation time, Data Structuresdata structures, Stage 7: Performing Process Initialization in the Context of the New Processdebug objects associated with, Kernel Supportdeferred ready state, Using Tools to Interact with Prioritydefined, Processes, Threads, and Jobsdispatching, Overview of Windows Schedulingdistribution of, Choosing a Processor for a Thread When There Are No Idle Processorsexecution, Stage 7: Performing Process Initialization in the Context of the New Process, Birth of a Threadexecution state transitions, Thread Statesexecution state transitions, viewing, Thread Statesexecution states, Using Tools to Interact with Priorityexecutive resources, waiting on, Priority Boosting After I/O Completionfibers, converting, Processes, Threads, and Jobshousekeeping, Extended Affinity Maskidle thread, Terminationimpersonation, Protecting Objectsimpersonation tokens, Impersonationinformation fields, Data Structuresinformation, displaying, Data Structuresinitialized state, Thread Statesintegrity levels, Determining Accessinternal start functions code, Unhandled Exceptionsinternal structures, Stage 7: Performing Process Initialization in the Context of the New Processkilling, Examining Thread Activitymutual exclusion, Object Filteringobjects, waiting for, Low-IRQL Synchronizationpassive interrupt level, Interrupt Levels vs. Priority Levelspreempted, Overview of Windows Scheduling, Scheduling Scenariosprevious mode, System Service Dispatchingpriority boosts, Priority Levelspriority levels, Overview of Windows Scheduling(see also priority levels)processor affinity, Thread Scheduling(see also affinity masks; processor affinity)quantum, Hardware Interrupt Processing, Overview of Windows Scheduling, Dispatcher Databasequantum expiration, Dispatch or Deferred Procedure Call (DPC) Interruptsquorums, Stage 3B: Creating the Initial Process Address Spaceready state, Thread Scheduling, Using Tools to Interact with Priorityreaper function, System Worker Threadsrun-time accounting, Examining Thread Activity, Quantumrunning state, Thread Statesscheduling, Software Interrupt Request Levels (IRQLs), Thread Schedulingscheduling on multiprocessor systems, Thread Selectionscheduling priorities, Software Interrupt Request Levels (IRQLs)security access validation, Access Checkssecurity contexts, Tokenssecurity descriptors, Examining Thread Activityselection, Idle Threadsselection on multiprocessor systems, Ideal and Last Processorshared and exclusive access, Fast Mutexes and Guarded Mutexes, User-Mode Resourcesshared memory sections, Processes, Threads, and JobsSIDs, Access Checksstack, Examining Thread Activitystandby state, Using Tools to Interact with Prioritystart address, Data Structures, Examining Thread Activitystart address, viewing, Exception Dispatchingstartup in common routine, Stage 7: Performing Process Initialization in the Context of the New Processstartup wrapper function, Examining Thread Activitysuspension, Asynchronous Procedure Call Interrupts, Examining Thread Activitysynchronization, Type Objects, Low-IRQL Synchronizationsystem worker, Run Once Initializationterminated state, Thread Statestermination, Asynchronous Procedure Call Interrupts, Stage 7: Performing Process Initialization in the Context of the New Processtransition state, Thread Statestrap frame, Trap Dispatchingvirtual address space, Processes, Threads, and Jobswait blocks list, What Signals an Object?wait queues, viewing, Data Structureswaiting state, Thread Statesthrottling, Stage 4: Creating the Initial Thread and Its Stack and Context (see CPU throttling)thunking, Wow64 Process Address Space Layout, Stage 7: Performing Process Initialization in the Context of the New ProcessTIB (Thread Information Block), Data Structurestime-keeping processor, Processor Selection, Processor SelectionCPU 0, Processor Selectiondesignating, Processor Selectiontimer coalescing, Intelligent Timer Tick Distributiontimer expirations, Timer Expiration, Intelligent Timer Tick Distributionminimizing, Intelligent Timer Tick Distributiontimer object type, Executive Objectstimer processing, Asynchronous Procedure Call Interrupts, Timer Expiration, Processor Selection, Processor Selection, Intelligent Timer Tick Distributionintelligent timer tick distribution, Processor Selectionlisting timers, Processor Selectiontimer coalescing, Intelligent Timer Tick Distributiontimer expiration, Timer Expirationtimer table, Timer Expirationtimers, Timer Processing, Timer Expiration, Timer Expiration, Processor Selection, Processor Selection, Processor Selection, Processor Selection, Intelligent Timer Tick Distribution, Intelligent Timer Tick Distribution, Timer Coalescingcoalescable, Intelligent Timer Tick Distributionhigh-frequency, Timer Processingintelligent timer tick distribution, Processor Selectionlisting, Processor Selectionprocessing KPRCB fields, Timer Expirationprocessor selection, Processor Selectionqueuing behaviors, Processor Selectionshifting, Timer Coalescingtolerance, Intelligent Timer Tick Distributiontypes, Timer ExpirationTlist.exe tool, Processes, Threads, and Jobs, Shared Service Processes, Data Structuresservices running in processes, viewing, Shared Service Processesthread information, displaying, Data StructuresTLNPI (Transport Layer Network Provider Interface), Windows Networking Components, Extending WinsockAFD client, Extending WinsockTLS (thread-local storage), Processes, Threads, and JobsTLS initializers, Post-Import Process InitializationTM (Transaction Manager), Kernel Transaction ManagerTmEn objects, Executive ObjectsTmRm objects, Executive ObjectsTmTm objects, Executive ObjectsTmTx objects, Executive Objectstoken object type, Executive Objectstokens, Service Isolation, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Tokens, Impersonation, Impersonation, User Account Control and VirtualizationAppLocker attributes, Tokensauthentication ID, Tokenscontents of, Tokensexpiration time, Tokensfiltered admin, Tokens, User Account Control and Virtualizationgenerating, Tokensimpersonation, Impersonationinformational fields, TokensLUID, Tokensmandatory policies, Tokensprivilege arrays, Tokensrestricted, Tokens, Impersonationsecurity information in, Tokenstypes, Tokensviewing, Tokenswrite-restricted, Service IsolationTOKEN_MANDATORY_NEW_PROCESS_MIN policy, TokensTOKEN_MANDATORY_NO_WRITE_UP policy, Tokenstopology, network, Location and Topology, Active Probediscovery and mapping, Location and TopologyLink-Layer Topology Discovery, Active ProbeTpWorkerFactory, Executive Objects, Worker Factories (Thread Pools)trace data, kernel, Kernel Event Tracingtransaction handles, Transactional Registry (TxR)Transaction Manager (TM), Kernel Transaction Managertransaction managers, Kernel Transaction Managertransaction objects, Kernel Transaction Managertransactions, Transactional Registry (TxR), Transactional Registry (TxR)isolation level, Transactional Registry (TxR)transfer jobs, Background Intelligent Transfer Service, Background Intelligent Transfer Service, Background Intelligent Transfer Servicepriority, Background Intelligent Transfer Servicesecurity context, Background Intelligent Transfer Servicetransition threads, Thread StatesTransmitFile function, Winsock Server OperationTransmitPackets API, Winsock Server OperationTransport Driver Interface (TDI) clients, The OSI Reference Modeltransport layer in OSI reference model, The OSI Reference ModelTransport Layer Network Provider Interface (TLNPI), Windows Networking Componentstransport provider interfaces, RPC Operationtransport service providers, Winsock Extensionstransport, the, Windows Networking Componentstransports, Windows Networking Componentstrap dispatching, System Mechanisms, Trap Dispatching, Asynchronous Procedure Call Interrupts, Timer Coalescing, Windows Error Reportingexception dispatching, Timer Coalescinginterrupt dispatching, Trap Dispatchingsystem service dispatchng, Windows Error Reportingtimer processing, Asynchronous Procedure Call Interruptstrap frames, Trap Dispatchingtrap handlers, Trap Dispatching, Trap Dispatching, Exception Dispatchingtrap, defined, System Mechanismstrigger consumers, registration, Provider Registrationtrigger information, Provider Registration, Consumer Registrationviewing, Consumer Registrationtrigger providers, registration, UBPM APItriggers, WDI, Windows Diagnostic InfrastructureTrojan horse prevention, Trusted Computer System Evaluation Criteriatroubleshooting, Process Monitor Internals, Diagnostic Policy Servicemodules, Diagnostic Policy Serviceregistry-related problems, Process Monitor InternalsTrusted Computer System Evaluation Criteria (TCSEC), Security, Trusted Computer System Evaluation Criteriarating levels, Trusted Computer System Evaluation Criteriatrusted facility management, Trusted Computer System Evaluation Criteriatrusted path functionality, Trusted Computer System Evaluation Criteriatunneling, Protocol Drivers, Remote AccessTxF, Kernel Transaction ManagerTxR, Kernel Transaction Manager, HKEY_PERFORMANCE_DATA, Transactional Registry (TxR)common logging file system support, Transactional Registry (TxR)type initializers, information in, Type Objectstype objects, Object Structure, Object Headers and Bodies, Type Objects, Data StructuresProcess, Data Structuresviewing, Type ObjectsType parameter, Service Applications, Service Applications