Windows® Internals, Sixth Edition, Part 2

Aabort records, Logging Implementationabsolute paths, Symbolic (Soft) Links and Junctionsabstraction (I/O system), I/O System Componentsaccess bit tracking (Superfetch), Tracing and Loggingaccess fault trap handler, Memory Manager Componentsaccess violations, Fault Tolerant Heap, Page Fault Handling, Virtual Address Descriptors, Driver Verifier, Crash Dump Analysiscrashes, Crash Dump Analysisheap-related, Fault Tolerant Heappage faults, Page Fault Handlingspecial pool, Driver VerifierVADs and, Virtual Address Descriptorsaccess-denied errors, Process Monitor Troubleshooting TechniquesAccessed bit (PTEs), Page Tables and Page Table Entries, Physical Address Extension (PAE), Working Set ManagementACLs (access control lists), Opening Devices, Protecting Memory, UDF, System File CorruptionI/O process and, Opening Devicessection objects, Protecting MemoryUDF format, UDFWindows Resource Protection, System File CorruptionACPI (Advanced Configuration and Power Interface), Device Stack Driver Loading, The Power Manager, The Power Manager, The BIOS Boot Sector and BootmgrAction Center, Windows Error Reporting, Online Crash AnalysisActive Directory, BitLocker Management, x86 Address Space Layouts, Safe Modeactive pages, Prototype PTEs, PFN Data Structures, ComponentsActive PFN state, Page Frame Number Database, Page Frame Number DatabaseActive Template Library (ATL), No Execute Page Protectionactive threads, The IoCompletion Object, Using Completion Portsactive VACBs, Systemwide Cache Data Structures, Systemwide Cache Data StructuresAdd Recovery Agent Wizard, Encrypting a File for the First Timeadd-device routines, Structure of a Driver, Structure and Operation of a KMDF Driver, Driver Support for Plug and Play, Driver Support for Plug and Play, Driver InstallationAddiSNSSever command, iSCSI Driversaddress space, Internal Synchronization, Internal Synchronization, Kernel-Mode Heaps (System Memory Pools), Virtual Address Space Layouts, x86 Address Space Layouts, x86 System Address Space Layout, x86 Session Space, x86 Session Space–System Page Table Entries, x86 Session Space, x86 Session Space, System Page Table Entries–System Page Table Entries, System Page Table Entries, System Page Table Entries, x64 Virtual Addressing Limitations–Dynamic System Virtual Address Space Management, Windows x64 16-TB Limitation, Dynamic System Virtual Address Space Management, Dynamic System Virtual Address Space Management, System Virtual Address Space Quotas–User Address Space Layout, User Address Space Layout, User Address Space Layout–Controlling Security Mitigations, User Address Space Layout, User Address Space Layout, Controlling Security Mitigations, Commit Charge and the System Commit Limit–Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Process VADs, Cache Virtual Memory Management, Crash Dump Filescommit charge, Commit Charge and the System Commit Limit–Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limitlocks, Internal Synchronizationmemory management, Internal Synchronizationpaged and nonpaged pools, Kernel-Mode Heaps (System Memory Pools)status, Process VADsswitching for processes, Crash Dump Filessystem PTEs, System Page Table Entries–System Page Table Entries, System Page Table Entriesuser layouts, User Address Space Layout–Controlling Security Mitigations, User Address Space Layout, Controlling Security Mitigationsviews, Cache Virtual Memory Managementvirtual address space quotas, System Virtual Address Space Quotas–User Address Space Layout, User Address Space Layout, User Address Space Layoutx64 virtual address limitations, x64 Virtual Addressing Limitations–Dynamic System Virtual Address Space Management, Windows x64 16-TB Limitation, Dynamic System Virtual Address Space Management, Dynamic System Virtual Address Space Managementx86 layouts, Virtual Address Space Layouts, x86 Address Space Layouts, x86 System Address Space Layout, x86 Session Spacex86 session space, x86 Session Space–System Page Table Entries, x86 Session Space, x86 Session Space, System Page Table Entriesaddress translation, Large and Small Pages, x86 Virtual Address Translation–Translation Look-Aside Buffer, x86 Virtual Address Translation, x86 Virtual Address Translation, Page Directories, Page Directories, Page Tables and Page Table Entries, Page Tables and Page Table Entries, Byte Within Page, Translation Look-Aside Buffer–Physical Address Extension (PAE), Translation Look-Aside Buffer, Physical Address Extension (PAE)–Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), x64 Virtual Address Translation–Page Fault Handling, x64 Virtual Address Translation, IA64 Virtual Address Translation–Page Fault Handling, Page Fault Handling, Page Fault Handling, Page Fault HandlingAS64 translation, x64 Virtual Address Translation–Page Fault Handling, Page Fault HandlingIA64 systems, IA64 Virtual Address Translation–Page Fault Handling, Page Fault Handling, Page Fault HandlingPAE, Physical Address Extension (PAE)–Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE), Physical Address Extension (PAE)page sizes and, Large and Small Pagestranslation look-aside buffer, Translation Look-Aside Buffer–Physical Address Extension (PAE), Physical Address Extension (PAE)x64 translation, x64 Virtual Address Translationx86 translation, x86 Virtual Address Translation–Translation Look-Aside Buffer, x86 Virtual Address Translation, x86 Virtual Address Translation, Page Directories, Page Directories, Page Tables and Page Table Entries, Page Tables and Page Table Entries, Byte Within Page, Translation Look-Aside BufferAddress Windowing Extensions (AWE), Address Windowing Extensions, Address Windowing Extensions, Address Windowing Extensions, Commit Charge and the System Commit Limit, PFN Data StructuresAddTarget command, iSCSI DriversAddTargetPortal command, iSCSI DriversAddUsersToEncryptedFile API, Encrypting File System SecurityAdelson-Velskii and Landis (AVL), Process VADsadministrator privileges, Driver InstallationAdvanced Configuration and Power Interface (ACPI), Device Enumeration, The Power Manager, The BIOS Boot Sector and Bootmgradvanced format (disks), Disk Sector Format, Disk Sector Format, Unified Cachingadvanced local procedure calls (ALPC), User-Mode Driver Framework (UMDF), Initializing the Kernel and Executive Subsystemsadvancedoptions element, The BIOS Boot Sector and BootmgrAES (Advanced Encryption Standard), Encryption Keys, Encryption Keys, BitLocker Key Recovery, BitLocker To Go–BitLocker To Go, BitLocker To Go, ReadyDrive, Encrypting File System SecurityAES-CCM keys, BitLocker Key RecoveryAES128-CBC encryption, Encryption KeysAES256-CBC encryption, Encryption KeysBitLocker To Go, BitLocker To Go–BitLocker To Go, BitLocker To GoEFS usage, Encrypting File System SecurityReadyBoost, ReadyDriveaffinitized cores, Performance Checkaffinity counts, Algorithm Overridesaffinity history policies, Thresholds and Policy Settingsaffinity manager, The Low Fragmentation Heapaged pages, Working Set Management, Tracing and Loggingagents (Superfetch), ComponentsAGP ports, Rotate VADsAlgorithm for Recovery and Isolation Exploiting Semantics (ARIES), MarshallingAllocateUserPhysicalPages function, Address Windowing ExtensionsAllocateUserPhysicalPagesNuma function, Address Windowing Extensionsallocation, Monitoring Pool Usage, System Page Table Entries, Master File Table, Buffer Overruns, Memory Corruption, and Special Poolmaster file table entries, Master File Tablepool, Monitoring Pool Usage, Buffer Overruns, Memory Corruption, and Special PoolPTE failures, System Page Table Entriesallocation granularity, Allocation Granularity–Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Files, No Execute Page Protection, Heap Manager, Image Randomization–Image Randomization, Image Randomization, Image Randomizationdefined, Allocation Granularity–Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Filesin load offset number, Image Randomization–Image Randomization, Image Randomization, Image Randomizationno execute page protection, No Execute Page Protectionsmaller blocks (heaps), Heap ManagerALPC (advanced local procedure calls), User-Mode Driver Framework (UMDF), Initializing the Kernel and Executive Subsystems, Smss, Csrss, and Wininitalternate data streams, UDF, Multiple Data Streams, Resource Managers, Copying Encrypted FilesALUA (asymmetrical logical unit arrays), Multipath I/O (MPIO) DriversAlwaysOff or AlwaysOn mode, No Execute Page Protectionanalysis pass (recovery), Analysis Pass–Undo Pass, Analysis Pass, Undo PassAPCs (asynchronous procedure calls), Completing an I/O RequestAPIC (Advanced Programmable Interrupt Controller), The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and BootmgrAPIs, Isolation–Resource Managers, Transactional APIs, Resource Managers, The UEFI Boot Process, Smss, Csrss, and WininitEFI, The UEFI Boot Processtransactions, Isolation–Resource Managers, Transactional APIs, Resource ManagersWindows native, Smss, Csrss, and WininitApple Macintosh machines, The UEFI Boot Processapplication launch agent, Page Priority and Rebalancingapplication threads, The I/O Manager–Device Drivers, Device DriversApplication Verifier, Driver Verifierapplications, The I/O Manager–Device Drivers, Typical I/O Processing, Device Drivers, User-Mode Driver Framework (UMDF), Driver and Application Control of Device Power, Shadow Copy Provider, Introduction to the Memory Manager, Services Provided by the Memory Manager, Large and Small Pages, Locking Memory, Types of Heaps, Components, Cache Coherency, Process Monitor Troubleshooting Techniques, Driver Loading in Safe Modecache coherency, Cache Coherencycalling functions, The I/O Manager–Device Drivers, Typical I/O Processing, Device Driversdefault heap, Types of Heapsfailed, traces, Process Monitor Troubleshooting Techniqueslarge page sizes, Large and Small Pageslarge-address-space aware, Introduction to the Memory Managerlocking pages in memory, Locking Memorymemory management, Services Provided by the Memory Managerpower management control, Driver and Application Control of Device Powersafe mode boots, Driver Loading in Safe Modeshadow copies, Shadow Copy ProviderSuperfetch agents, ComponentsUMDF interaction, User-Mode Driver Framework (UMDF)archival utilities, Multiple Data Streamsarchived files, File Recordsareal density (disk), Disk Sector Format–NAND-Type Flash Memory, NAND-Type Flash MemoryARIES (Algorithm for Recovery and Isolation Exploiting Semantics), MarshallingAS64 address translation, x64 Virtual Address Translation–Page Fault Handling, Page Fault Handling, Page Fault HandlingASLR (Address Space Layout Randomization), Internal Synchronization, User Address Space Layout–Image Randomization, Image Randomization, Image Randomization, Heap Randomization, ASLR in Kernel Address Space, Controlling Security Mitigations, Controlling Security Mitigationsheap randomization, Heap Randomizationkernel address space, ASLR in Kernel Address Spaceload offset numbers, User Address Space Layout–Image Randomization, Image Randomization, Image Randomizationmemory manager, Internal Synchronizationsecurity mitigations, Controlling Security Mitigationsviewing processes, Controlling Security MitigationsASR (Automated System Recovery), Windows Recovery Environment (WinRE)assembly language, Structure of a DriverASSERT macros, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLEDAssign API, KMDF Data Modelassociated IRPs, I/O Requests to Layered Drivers, I/O Requests to Layered Drivers, Volume I/O Operationsasymmetric key pair certificate hashes, Encrypting a File for the First Timeasymmetrical logical unit arrays (ALUA), Multipath I/O (MPIO) Driversasynchronous callbacks, Container Notificationsasynchronous I/O, I/O System Components, Opening Devices, Synchronous and Asynchronous I/O, Scatter/Gather I/O, Completing an I/O Request, Completing an I/O Request, I/O Requests to Layered Drivers–I/O Requests to Layered Drivers, I/O Requests to Layered Drivers, User-Initiated I/O Cancellation, I/O Cancellation for Thread Termination, I/O Completion Port Operation, Write Throttling–Write Throttling, Write ThrottlingAPC calls, Completing an I/O Requestcancellation, User-Initiated I/O Cancellation, I/O Cancellation for Thread Terminationcompletion, Completing an I/O Requestcompletion context, I/O Completion Port Operationfile object attributes, Opening Deviceslayered drivers, I/O Requests to Layered Drivers–I/O Requests to Layered Drivers, I/O Requests to Layered Driverspacket-based I/O, I/O System Componentsscatter/gather I/O, Scatter/Gather I/Otesting status, Synchronous and Asynchronous I/Owrite throttling, Write Throttling–Write Throttling, Write Throttlingasynchronous procedures calls (APCs), Completing an I/O Request, Completing an I/O Request, In-Paging I/Oasynchronous read or write, Fast I/O, Intelligent Read-AheadATA (AT attachment), Prioritization StrategiesATA-8, ReadyDriveATAPI-based IDE devices, Disk Class, Port, and Miniport DriversAtapi.sys driver, Disk Class, Port, and Miniport DriversAtaport.sys driver, Disk Class, Port, and Miniport DriversATL (Active Template Library), No Execute Page ProtectionATL thunk emulation, No Execute Page Protection–Software Data Execution Prevention, No Execute Page Protection, Software Data Execution Preventionatomic transactions, Recoverability–Data Redundancy and Fault Tolerance, Recoverability, Data Redundancy and Fault Toleranceattaching memory to processes, Reserving and Committing PagesAttachment Execution Service, Multiple Data Streamsattachments, web or mail, Multiple Data StreamsATTEMPTED_EXECUTE_OF_NOEXECUTE_MEMORY code, No Execute Page Protectionattribute definition table (AttrDef), Master File Tableattribute streams, File Recordsattributes, File Records–File Names, File Records, File Names, Resident and Nonresident Attributes–Data Compression and Sparse Files, Resident and Nonresident Attributes, Resident and Nonresident Attributes, Data Compression and Sparse Filesfiles, list, File Records–File Names, File Records, File Namesresident and nonresident, Resident and Nonresident Attributes–Data Compression and Sparse Files, Resident and Nonresident Attributes, Resident and Nonresident Attributes, Data Compression and Sparse Filesaudio adapters, Windows Client Memory Limitsauditing, Initializing the Kernel and Executive Subsystemsauthentication schemes (BitLocker), Encryption Keys, BitLocker Managementauthorization (NTFS security), Securityauto-recovery BCD element behavior, The BIOS Boot Sector and Bootmgrauto-start (2) value, The Start Value, Device Enumerationauto-start device drivers, BIOS Preboot, Smss, Csrss, and WininitAutochk.exe, Volume Mountingautomated crash analysis, Online Crash AnalysisAutomated System Recovery (ASR), Windows Recovery Environment (WinRE)automatic rebooting, The BIOS Boot Sector and BootmgrAutoruns tool, Images That Start Automatically, Images That Start Automaticallyauxiliary displays, User-Mode Driver Framework (UMDF)available memory, Examining Memory Usage, Examining Memory Usageavailable pages, Modified Page Writer, PFN Data Structuresaverage frequency (processors), Utility FunctionAVL trees, Process VADsavoidlowmemory element, The BIOS Boot Sector and BootmgrAWE (Address Windowing Extensions), Address Windowing Extensions, Address Windowing Extensions, Commit Charge and the System Commit Limit, PFN Data Structures