Windows® Internals, Sixth Edition, Part 2

Kk command, Advanced Crash Dump AnalysisKd debugger (Kd.exe), The BIOS Boot Sector and Bootmgr, Basic Crash Dump Analysis, Hung or Unresponsive Systems, Hung or Unresponsive Systems, Hung or Unresponsive Systems, When There Is No Crash DumpKdDebuggerInitialize1 routine, Initializing the Kernel and Executive SubsystemsKeAcquireInterruptSpinLock routine, SynchronizationKeBalanceSetManager routine, Memory Manager ComponentsKeBugCheck2 function, 0xC5 - DRIVER_CORRUPTED_EXPOOLKeBugCheckEx function, The Blue ScreenKeExpandKernelStackAndCallout function, Kernel StacksKei386EoiHelper function, Stack TrashesKeInitializeQueue function, I/O Completion Port OperationKeInsertByKeyDeviceQueue function, Disk Class, Port, and Miniport DriversKeInsertQueue function, I/O Completion Port OperationKeLoaderBlock variable, Initializing the Kernel and Executive SubsystemsKeRegisterBugCheckCallback function, The Blue ScreenKeRegisterBugCheckReasonCallback function, The Blue Screen, Crash Dump FilesKeRemoveByKeyDeviceQueue function, Disk Class, Port, and Miniport DriversKeRemoveQueueEx function, I/O Completion Port Operationkernel (Ntoskrnl.exe, Ntkrnlpa.exe), Layered Drivers, Opening Devices, Synchronization, I/O Completion Port Operation, User-Mode Driver Framework (UMDF), Winload, Memory Manager Components–Internal Synchronization, Internal Synchronization, Internal Synchronization, Heap Manager, Page Fault Handling, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Smss, Csrss, and Wininit, Driver Loading in Safe Mode, Why Does Windows Crash?, Verbose Analysis, Code Overwrite and System Code Write Protectionboot process, WinloadDLLs, Layered Driversfile objects, Opening Devicesheap manager, Heap Managerinitializing, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Smss, Csrss, and Wininitlisting modules, Verbose Analysismemory manager components, Memory Manager Components–Internal Synchronization, Internal Synchronization, Internal Synchronizationphase 1 initialization, Initializing the Kernel and Executive Subsystemsqueues, I/O Completion Port Operationsafe mode switch scanning, Driver Loading in Safe Modestack trace database, Initializing the Kernel and Executive Subsystemssubsystem crashes, Why Does Windows Crash?synchronization routines, Synchronizationsystem code write protection, Code Overwrite and System Code Write Protectiontrap handler, Page Fault HandlingUMDF interaction, User-Mode Driver Framework (UMDF)kernel address space, x64 Virtual Addressing Limitations, ASLR in Kernel Address Space, IA64 Virtual Address Translationkernel bumps, I/O Priority Boosts and Bumps–Bandwidth Reservation (Scheduled File I/O), I/O Priority Boosts and Bumps, Bandwidth Reservation (Scheduled File I/O)kernel code, Large and Small Pages, IA64 Virtual Address Translationkernel debugger, Opening Devices–Opening Devices, Opening Devices, Opening Devices, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and Bootmgr, Hung or Unresponsive Systems, When There Is No Crash Dump–When There Is No Crash Dump, When There Is No Crash Dump, When There Is No Crash Dumpattaching, When There Is No Crash Dump–When There Is No Crash Dump, When There Is No Crash DumpBCD elements, The BIOS Boot Sector and Bootmgrbreaking into systems, Hung or Unresponsive Systemstransports, The BIOS Boot Sector and Bootmgrtroubleshooting without crash dumps, When There Is No Crash Dumpviewing file objects, Opening Devices–Opening Devices, Opening Devices, Opening Deviceskernel driver stack, User-Mode Driver Framework (UMDF)kernel element, The BIOS Boot Sector and Bootmgrkernel extensions, Types of Device Driverskernel image file name, The BIOS Boot Sector and Bootmgrkernel memory, Driver Verifier, Internal Synchronization, Examining Memory Usage, No Execute Page Protection, No Execute Page Protection, Driver Verifierdisplaying information, Examining Memory Usagelow resources simulation, Driver Verifiermemory manager, Internal Synchronizationpaged pool execution protection, No Execute Page Protectionpool functions, Driver Verifiersession pool execution protection, No Execute Page Protectionkernel memory dumps, Crash Dump Files, Crash Dump Files, Crash Dump Fileskernel mode, Types of Device Drivers, Layered Drivers, Layered Drivers, Services Provided by the Memory Manager, Kernel-Mode Heaps (System Memory Pools)–Look-Aside Lists, Look-Aside Lists, x86 Virtual Address Translation, Page Fault Handling, Memory Notification Events, Initializing the Kernel and Executive Subsystems, The Blue Screen, Causes of Windows Crashesaccess violations, Causes of Windows CrashesDLLs, Layered Driversdrivers, Types of Device Drivers, Layered Drivers, Memory Notification Events, The Blue Screenheaps, Kernel-Mode Heaps (System Memory Pools)–Look-Aside Lists, Look-Aside Listsmemory manager services in, Services Provided by the Memory Managerpage faults and, Page Fault Handlingpaging, Initializing the Kernel and Executive Subsystemsvirtual addresses, x86 Virtual Address TranslationKernel Mode Code Signing (KMCS), Driver Installation, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and Bootmgrkernel process block (KPROCESS), Page Directorieskernel queues, I/O Completion Port Operationkernel stack, Kernel Stacks–Virtual Address Descriptors, Kernel Stacks, Kernel Stacks, Virtual Address Descriptors, Initializing the Kernel and Executive Subsystemsmemory management, Kernel Stacks–Virtual Address Descriptors, Kernel Stacks, Virtual Address Descriptorsstack trace database, Initializing the Kernel and Executive Subsystemsusage, Kernel StacksKernel Transaction Manager (KTM), Master File Table, Transaction Support, Resource Managers, On-Disk Implementation, Recovery Implementationkernel-mode drivers, Types of Device Drivers, Layered Drivers, Layered Drivers, User-Mode Driver Framework (UMDF), Memory Notification Events, Why Does Windows Crash?, The Blue Screenkernel-mode heaps (system memory pools), Kernel-Mode Heaps (System Memory Pools)–Look-Aside Lists, Look-Aside Listskernel-mode pages, Crash Dump Fileskernel-mode thread exceptions, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED–0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPKERNEL_DATA_INPAGE_ERROR stop code, Causes of Windows CrashesKERNEL_MODE_EXCEPTION_NOT_HANDLED stop code, Stack Trashes, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPKERNEL_MODE_EXCEPTION_NOT_HANDLED with P1… stop code, Causes of Windows CrashesKeStartAllProcessors routine, Initializing the Kernel and Executive SubsystemsKeSwapProcessOrStack routine, Memory Manager ComponentsKeSynchronizeExecution routine, SynchronizationKEVENT structure, Driver Verifierkey entries (encryption), Encrypting a File for the First Timekey escrow services, BitLocker Managementkey number generation, Trusted Platform Module (TPM)key recovery mode (TPM), Trusted Platform Module (TPM)key rings, Encrypting a File for the First Time, The BIOS Boot Sector and Bootmgrkeyboard buffers, The BIOS Boot Sector and Bootmgrkeyboard drivers, Hung or Unresponsive Systems–Hung or Unresponsive Systems, Hung or Unresponsive Systems, Hung or Unresponsive Systemskeyboard ISRs, Hung or Unresponsive Systemskeyboard sequences, The BIOS Boot Sector and Bootmgrkeyringaddress element, The BIOS Boot Sector and BootmgrKiActivateWaiterQueue function, I/O Completion Port OperationKiDispatchException function, When There Is No Crash DumpKiInitializeKernel function, Initializing the Kernel and Executive SubsystemsKiPreBugcheckStackSaveArea function, Stack TrashesKiSystemStartup function, Initializing the Kernel and Executive SubsystemsKiUnwaitThread function, I/O Completion Port OperationKMDF (Kernel-Mode Driver Framework), Structure and Operation of a KMDF Driver–KMDF Data Model, Structure and Operation of a KMDF Driver, Structure and Operation of a KMDF Driver–KMDF Data Model, KMDF Data Model, KMDF Data Model–KMDF I/O Model, KMDF Data Model, KMDF Data Model, KMDF Data Model–KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF Data Model–KMDF I/O Model, KMDF Data Model, KMDF I/O Model–KMDF I/O Model, KMDF I/O Model, KMDF I/O Model, KMDF I/O Model, KMDF I/O Model, KMDF I/O Model, KMDF I/O Model, KMDF I/O Modeldata model, KMDF Data Model–KMDF I/O Model, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF I/O Model, KMDF I/O Modeldriver structure and operation, Structure and Operation of a KMDF Driver–KMDF Data Model, Structure and Operation of a KMDF Driver, KMDF Data ModelI/O model and processes, KMDF I/O Model–KMDF I/O Model, KMDF I/O Model, KMDF I/O Model, KMDF I/O ModelKMDF objects, KMDF Data Model, KMDF Data Model, KMDF Data Model, KMDF I/O Modelobject attributes, KMDF Data Model–KMDF I/O Model, KMDF Data Model, KMDF I/O Modelobject context, KMDF Data Modelobject hierarchy, KMDF Data Modelobject types, KMDF Data Model–KMDF Data Model, KMDF Data Model, KMDF Data Modelviewing drivers, Structure and Operation of a KMDF Driver–KMDF Data Model, KMDF Data Model, KMDF Data ModelKMODE_EXCEPTION_NOT_HANDLED stop code, Causes of Windows Crashes, Stack TrashesKMUTEX structure, Driver VerifierKnowledge Base, The Blue ScreenKPRCB structure, Utility Function, Utility Function, Performance CheckKPROCESS block, Page DirectoriesKSEG0 mapping, The BIOS Boot Sector and BootmgrKseg3 and 4 addresses, IA64 Virtual Address TranslationKSEMAPHORE structure, Driver VerifierKSPIN_LOCK structure, Driver VerifierKTHREAD structure, I/O Completion Port OperationKTIMER structure, Driver VerifierKTM (Kernel Transaction Manager), Resource Managers, Logging Implementation, Logging ImplementationKtmLog stream, Resource Managers, Recovery ImplementationKtmutil.exe utility, IsolationKUSER_SHARED_DATA structure, Software Data Execution Prevention