Windows® Internals, Sixth Edition, Part 1

WW32PROCESS, Data Structures, Data Structures, Data Structures, Stage 5: Performing Windows Subsystem–Specific Post-Initializationallocation, Stage 5: Performing Windows Subsystem–Specific Post-Initializationdumping, Data StructuresW32THREAD, Data Structures, Data Structures, Data Structures, Data Structuresdumping, Data Structuresfields, Data Structureswait blocks, What Signals an Object?, What Signals an Object?, What Signals an Object?, Executive Resourcesfor pushlocks, Executive Resourcesstate information, What Signals an Object?wait information in, What Signals an Object?wait calls, Worker Factories (Thread Pools), Scheduling Scenariosworker factory management, Worker Factories (Thread Pools)wait chain address ordering, Data Structureswait operations, Object Filtering, What Signals an Object?(see also synchronization)data structures for, What Signals an Object?wait queues, Asynchronous Procedure Call Interrupts, Data Structuresreordering, Asynchronous Procedure Call Interruptsviewing, Data Structureswait state, Asynchronous Procedure Call Interrupts, Data Structures, Data Structuresaborted, Data Structuresalertable, Asynchronous Procedure Call Interruptsentering, Data Structureswait status register, Data StructuresWaitForMultipleObjects function, Low-IRQL SynchronizationWaitForSingleObject function, Low-IRQL Synchronizationwaiting threads, Thread States, Unwait Boosts, Scheduling Scenariosboosting, Unwait Boostsvoluntary switching, Scheduling Scenarioswaits, Asynchronous Procedure Call Interrupts, Data Structures, Data Structures, Data Structures, Keyed Eventscommitted state, Data Structureson keyed events, Keyed Eventsresolution, Asynchronous Procedure Call Interruptssatisfied, Data Structurestimed-out, Data Structureswake operations, Keyed EventsWake-on-LAN, NDIS DriversWANs, The OSI Reference Model, Mini-Redirectors, BranchCachecontent caching, BranchCachedatalink layer, The OSI Reference ModelSMB 2.0 for, Mini-RedirectorsWBEM (Web-Based Enterprise Management), Service Control ProgramsWbemTest, viewing WMI class definition, The Common Information Model and the Managed Object Format LanguageWDF (Windows Driver Foundation), Windows Driver Model (WDM)WDI (Windows Diagnostic Infrastructure), Executive, Windows Diagnostic Infrastructure, Windows Diagnostic Infrastructure, Windows Diagnostic Infrastructure, Diagnostic Policy Service, Diagnostic Functionalitydiagnostic functionality, Diagnostic FunctionalityDiagnostic Policy Service, Windows Diagnostic InfrastructureGroup Policy settings, Diagnostic Policy Serviceinstrumentation, Windows Diagnostic InfrastructureWDM (Windows Driver Model), Windows Driver Model (WDM)Web access APIs, Web Access APIsweb servers, Winsock Server Operation (see servers)Web Services, Windows APIWeb-Based Enterprise Management (WBEM), Service Control ProgramsWebDAV mini-redirector, Mini-Redirectorswell-known addresses, Winsock ExtensionsWER (Windows Error Reporting), Unhandled Exceptions, Unhandled Exceptions, Windows Error Reporting, Windows Error Reporting, Protected Processesconfiguring, Unhandled Exceptionsdialog box, Windows Error Reportingprotected mode, Protected Processesregistry configuration options, Windows Error ReportingWerFault.exe process, Unhandled ExceptionsWFP (Windows Filtering Platform), Windows Networking Components, Windows Filtering Platform, Windows Filtering Platform, Internet Protocol Securitycallout drivers, Windows Networking Componentscomponents, Windows Filtering PlatformIPsec WFP callout driver, Internet Protocol Securitywide area networks (WANs), BranchCache (see WANs)Win16 executables, Stage 2: Opening the Image to Be ExecutedWin32 API, Windows Operating System Versions, Windows API, Object Headers and Bodieshistory, Windows APIobjects created through, Object Headers and BodiesWin32 emulation on 64-bit Windows, Wow64 (see Wow64)Win32 subsystem process, Environment Subsystems and Subsystem DLLs (see Csrss.exe (Client/Server Run-Time Subsystem))Win32k.sys, Architecture Overview, Type Objects, Data Structures, Data Structures, Priority Boosts for Foreground Threads After WaitsGUI thread priority boosts, Priority Boosts for Foreground Threads After Waitsper-thread data structure, Data Structuresroutine definition, Type ObjectsW32PROCESS, Data StructuresWin32PrioritySeparation registry value, Quantum Settings Registry ValueWin32StartAddr, Data StructuresWinDbg, Debugging Tools for Windows, Native Support, Loaded Module Database, Examining Thread Activitydebugger objects, viewing, Native Supportloaded modules database, dumping, Loaded Module Databasewindow messages, integrity level and, Determining Accesswindow stations, Service Isolation, Service Isolation, Service Isolation, Logoncreating and opening, LogonService-0x0-3e7$, Service IsolationWinSta0, Service Isolationwindowing and graphics system, Architecture OverviewWindows 7, Concepts and Tools, Scalability, Scalability, Software Interrupt Request Levels (IRQLs), SwitchBack, Trusted Computer System Evaluation Criteria, AppLockerAppLocker, AppLockerclient versions, Scalabilitycontext, SwitchBacksecurity rating, Trusted Computer System Evaluation Criteriasmall-footprint versions, Software Interrupt Request Levels (IRQLs)vs. Windows Server 2008 R2, ScalabilityWindows API, Windows Operating System Versions, Windows Operating System Versions, Asynchronous Procedure Call Interrupts, Overview of Windows Schedulingdescription, Windows Operating System Versionsthread priority assignment, Overview of Windows Schedulinguser-mode APCs, Asynchronous Procedure Call InterruptsWindows API functions, defined, Windows APIWindows authentication, Local Session Manager (Lsm.exe)Windows Biometric API, Biometric Framework for User AuthenticationWindows Biometric Driver Interface, Biometric Framework for User AuthenticationWindows Biometric Framework, Assured AuthenticationWindows Biometric Service, Biometric Framework for User AuthenticationWindows Boot Loader, Stable StorageWindows Clustering, Live MigrationWindows device drivers, Services, Functions, and Routines(see also device drivers; drivers)Windows Diagnostic Infrastructure (WDI), Executive (see WDI (Windows Diagnostic Infrastructure))Windows DLLs, Data StructuresWindows Driver Foundation (WDF), Windows Driver Model (WDM)Windows Driver Kit (WDK), Debugging Tools for Windows, Viewing and Changing the Registry, Lock Ownership Boostsboost value recommendations, Lock Ownership BoostsOffreg.dll, Viewing and Changing the RegistryWindows Driver Model (WDM), Windows Driver Model (WDM)Windows Driver Model Windows Management Instrumentation routines, ExecutiveWindows Embedded Standard 7, Software Interrupt Request Levels (IRQLs)Windows Error Reporting (WER), Unhandled Exceptions (see WER (Windows Error Reporting))Windows executables, Requesting Administrative RightsWindows executive, Architecture Overview (see executive, Windows)Windows File Protection, Diagnostic FunctionalityWindows Filtering Platform (WFP), Windows Filtering PlatformWindows Firewall, Network Address Translation, Internet Protocol SecurityIPsec security and policy configuration, Internet Protocol SecurityWindows Filtering Platform use, Network Address TranslationWindows Firewall with Advanced Security snap-in, Internet Protocol SecurityWindows functions, narrow and wide versions, RegistryWindows GDI services, System Service DispatchingWindows global flags, System Worker ThreadsWindows image, opening, Stage 1: Converting and Validating Parameters and FlagsWindows Initialization Process, Session Manager (Smss)Windows installation image, HKEY_LOCAL_MACHINEWindows internals, Registry, Digging into Windows Internals, Digging into Windows Internals, Digging into Windows Internals, Performance Monitorexploring, Digging into Windows Internalsexposing, Registrykernel debugging, Performance MonitorPerformance Monitor, Digging into Windows Internalstools for viewing, Digging into Windows InternalsWindows logon process, Local Session Manager (Lsm.exe)(see also logon)Windows Management Instrumentation (WMI), Service Control Programs (see WMI (Windows Management Instrumentation))Windows Media Center Extender sessions, Terminal Services and Multiple SessionsWindows Media Center interactive sessions, Terminal Services and Multiple SessionsWindows Media Certificate, Protected ProcessesWindows Networking (WNet) API, UPnP with PnP-XWindows NT, Windows API, System Architecture, Windows Driver Model (WDM)driver model, Windows Driver Model (WDM)requirements of, System ArchitectureWindows operating system, Concepts and Tools, Concepts and Tools, Windows Operating System Versions, Terminal Services and Multiple Sessions, Objects and Handles, Security, Registry, Registry, Debugging Tools for Windows, System Architecture, System Architecture, Requirements and Design Goals, Operating System Model, Architecture Overview, Architecture Overview, Symmetric Multiprocessing, Scalability, Differences Between Client and Server Versions, Checked Build, Checked Build, Executive, Windows Driver Foundation, Security, Post-Import Process Initialization, API Sets, Hypervisor (Hyper-V), Management Mechanisms, Stage 4: Creating the Initial Thread and Its Stack and Context, Thread Scheduling, Thread Scheduling, Overview of Windows Scheduling, Priority Levels, Choosing a Processor for a Thread When There Are No Idle Processors, Security, Trusted Computer System Evaluation Criteria, Trusted Computer System Evaluation Criteria, Protecting Objects, Security Identifiers, Determining Access, Logon, Networkingchecked build version, Checked Buildclient editions, Terminal Services and Multiple Sessionsclient vs. server versions, ScalabilityCommon Criteria certification, Trusted Computer System Evaluation Criteriacore system files, Architecture Overviewcrash dump files, Debugging Tools for Windowsdebug version, Checked Buildedition running, determining, Differences Between Client and Server Versionsenlightenments, Hypervisor (Hyper-V)hardware error architecture, Executiveimpersonation model, Securityintegrity mechanism, Protecting Objectslogon interface, Logonmanagement mechansims, Management MechanismsMinWin version, API Setsmodel, Requirements and Design Goalsnetworking support, Networkingobject-oriented design, Operating System Modelportability, Architecture Overviewpost-initialization operations, Stage 4: Creating the Initial Thread and Its Stack and Contextpriority levels, Overview of Windows Schedulingprocessor share-based scheduling, Choosing a Processor for a Thread When There Are No Idle Processorsregistry, Securityreleases, Concepts and Toolsrequirements and design goals, System Architectureroutine naming conventions, Windows Driver Foundationscalability, Symmetric Multiprocessingscheduling system, Thread Schedulingsecurity, Objects and Handles, Determining Accesssecurity mechanisms, SecuritySIDs, issuing, Security Identifierssystem architecture, System ArchitectureTCSEC rating levels, Trusted Computer System Evaluation Criteriathread priority boosts, Priority Levelsthread-based scheduling, Thread SchedulingUnicode, Registryversion-specific GUID, Post-Import Process Initializationversions, Concepts and ToolsWindows API, Windows Operating System Versionsworldwide application binaries, RegistryWindows PowerShell AppLocker commands, AppLockerWindows Server 2008 R2, Concepts and Tools, Scalability, Scalability, Trusted Computer System Evaluation Criteria, AppLockerAppLocker, AppLockersecurity rating, Trusted Computer System Evaluation Criteriaversions, Scalabilityvs. Windows 7, ScalabilityWindows service control manager, Windows APIWindows services, Windows API, Services, Stage 2: Opening the Image to Be Executed, Virtual Service Accounts, Distributed File System Namespace, BranchCache Optimized Application Retrieval: HTTP Sequence(see also services)defined, Windows APIDFS-R, Distributed File System NamespaceDNS server, BranchCache Optimized Application Retrieval: HTTP Sequencestartup code, debugging, Stage 2: Opening the Image to Be Executedvirtual service accounts, Virtual Service AccountsWindows Services MMC snap-in, The Local Service AccountWindows Sockets, Networking APIsWindows Software Development Kit (SDK), Windows Operating System Versions, Kernel Debugging, Debugging Tools for Windowscontents, Debugging Tools for WindowsDebugging Tools for Windows, Kernel DebuggingWindows API description, Windows Operating System VersionsWindows subsystem, Security, Subsystem Startup, Ntdll.dll, Object Manager, Executive Objects, Protected Processes, Stage 4: Creating the Initial Thread and Its Stack and Context, Data Structures, Birth of a Threadapplications, Data Structuresexecutive objects, Executive ObjectsGDI/User objects, Object Managerobject-based security, Securityprocess communication functions, Ntdll.dllprocess initialization, Stage 4: Creating the Initial Thread and Its Stack and Contextprocesses, creation, Protected Processesthread setup, Birth of a ThreadWindows support images, Stage 2: Opening the Image to Be ExecutedWindows Sysinternals Administrator’s Reference (Russinovich and Margosis), Windows Driver KitWindows System Resource Manager (WSRM), Using Tools to Interact with PriorityWindows Transport Driver Interface standard, The OSI Reference ModelWindows USER services, System Service DispatchingWindows via C/C++ (Richter and Nasarre), Windows Operating System Versions, Timer Coalescing, What Signals an Object?Windows XP, AppLockerwindows, visible, Processes, Threads, and JobsWindowStation objects, Executive Objects, Object Methods, Object Methodsokay-to-close routine, Object Methodsopen method, Object MethodsWinHTTP, Web Access APIsWinInet, Session Manager (Smss), Winlogon Initialization, Web Access APIs, Web Access APIsHTTP API, Web Access APIsinstance of, Session Manager (Smss)Winload startup tasks, Hive Size LimitsWinlogon, Session Manager (Smss), Winlogon, LogonUI, and Userinit, Security System Components, Logon, Logon, Logon, Winlogon Initialization, Winlogon Initialization, Winlogon Initialization, Winlogon Initialization, Winlogon Initialization, User Logon StepsCtrl+Alt+Delete key combination notification, Winlogon Initializationdesktop, Logon, Winlogon Initializationinitialization, Logoninstance of, Session Manager (Smss)logon coordination, Logonlogon failure messages, User Logon StepsLsaAuthenticationPort connection, Winlogon InitializationRPC message server registration, Winlogon Initializationuser logon steps, Winlogon InitializationWinObj, Service Descriptor Tables, Reserve Objects, Object Directories, Message ModelALPC port objects, viewing, Message Modelbase names objects, viewing, Object Directoriesobject ACLs, displaying, Reserve ObjectsWinsider Seminars & Solutions, Differences Between Client and Server VersionsWinsock, Networking APIs, Networking APIs, Windows Sockets, Windows Sockets, Winsock Server Operation, Winsock Server Operation, Winsock Server Operation, Winsock Extensions, Winsock Extensions, Winsock Extensions, Winsock Extensions, Winsock Extensions, Extending Winsock, Extending Winsock, RPC OperationAcceptEx function, Winsock Server Operationclient operation, Windows Socketsconnection-oriented operation, Winsock Server Operationextending, Winsock Extensionsfeatures, Networking APIsHelper libraries, Extending Winsockimplementation, Extending Winsocklayered service providers, Winsock Extensionsnamespace providers, viewing, Winsock Extensionsnetwork communication authentication and encryption, RPC Operationserver operation, Windows Socketsservice provider interface, Winsock ExtensionsTransmitFile function, Winsock Server Operationtransport providers, viewing, Winsock ExtensionsWinsock 2.2, Networking APIsWinsock Kernel (WSK), Windows Networking Components (see WSK (Winsock Kernel))WinSta0, Object Directories, Service Startupopening, Service StartupWMI (Windows Management Instrumentation), Service Control Programs, Service Control Programs, WMI Architecture, WMI Architecture, WMI Architecture, WMI Architecture, WMI Architecture, Providers, The Common Information Model and the Managed Object Format Language, The Common Information Model and the Managed Object Format Language, The WMI Namespace, Class Association, Class Association, WMI Implementation, WMI Implementation, WMI ImplementationActiveX controls, WMI Architecturearchitecture, Service Control ProgramsCIMOM Object Repository, WMI Architectureclass association, The WMI Namespaceclass definitions, The Common Information Model and the Managed Object Format LanguageCommon Information Model, ProvidersControl application, WMI Implementationimplementation, Class Associationnamespace, The Common Information Model and the Managed Object Format Languageprovider classifications, WMI Architectureproviders, WMI Architecturescripting API, WMI Architecturescripting language support, Class Associationsecurity, WMI ImplementationSystem Control commands, WMI ImplementationWMI Administrative Tools, The Common Information Model and the Managed Object Format LanguageWMI CIM Studio, The Common Information Model and the Managed Object Format Language, The Common Information Model and the Managed Object Format Languagenamespaces, viewing, The Common Information Model and the Managed Object Format LanguageWMI COM API, WMI ArchitectureWMI Object Browser, Class AssociationWmic.exe, WMI ImplementationWmiprvse process, Class Association, WMI Implementationcreation, viewing, WMI ImplementationWNet provider, Multiple Provider RouterWNetAddConnection function, Multiple Provider RouterWNetAddConnection2 and WNetAddConnection3 functions, Multiple Provider Routerwork items, Run Once Initializationwork-stealing loop, Thread Selection on Multiprocessor Systemsworker factories, Worker Factories (Thread Pools), Worker Factories (Thread Pools), Worker Factories (Thread Pools), Worker Factories (Thread Pools)thread creation, Worker Factories (Thread Pools)thread termination, Worker Factories (Thread Pools)viewing, Worker Factories (Thread Pools)worker threads, Worker Factories (Thread Pools), Worker Factories (Thread Pools)allocation, Worker Factories (Thread Pools)viewing, Worker Factories (Thread Pools)Workstation service, UPnP with PnP-Xworld SIDs, Service Isolationworldwide application binaries, RegistryWow64, Wow64, Wow64, Wow64, Wow64, Wow64 Process Address Space Layout, Wow64 Process Address Space Layout, Wow64 Process Address Space Layout, Wow64 Process Address Space Layout, User Callbacks, User Callbacks, Registry Redirection, Registry Redirection, I/O Control Requests, I/O Control Requests, I/O Control Requests, DLL Name Redirection, Examining Thread Activity16-bit application support, I/O Control Requests32-bit and 64-bit thread stacks, Examining Thread Activityaddress space for processes, Wow64APC delivery, Wow64 Process Address Space Layoutarchitecture, Wow64console support, Wow64 Process Address Space LayoutDLL versioning check, DLL Name Redirectionexception dispatching, Wow64 Process Address Space Layoutfile system redirection, User CallbacksI/O control functions, Registry Redirectionprinter driver porting, I/O Control Requestsregistry redirection, Registry Redirectionrestrictions, I/O Control Requestssystem calls, Wow64 Process Address Space Layoutuser callbacks, User Callbacksuser-mode DLLs, Wow64Wow64.dll, Wow64Wow6432Node key, Registry RedirectionWow64Cpu.dll, Wow64Wow64GetThreadContext function, Processes, Threads, and JobsWow64Win.dll, Wow64Wowia32x.dll, Wow64write-restricted SIDs, Service Isolationwrite-restricted tokens, Service IsolationWSK (Winsock Kernel), Windows Networking Components, Winsock Kernel, Winsock Kernelimplementation, Winsock KernelWSRM (Windows System Resource Manager), Using Tools to Interact with Priority