Windows® Internals, Sixth Edition, Part 2

SS0 (fully on) power state, The Power Manager, The Power Manager, Power Manager OperationS1 (sleeping) power state, The Power Manager, The Power Manager, Power Manager OperationS2 (sleeping) power state, The Power Manager, Power Manager OperationS3 (sleeping) power state, The Power Manager, The Power Manager, Power Manager Operation, Power Availability RequestsS4 (hibernating) power state, The Power Manager, The Power Manager, Power Manager OperationS5 (fully off) power state, The Power Manager, Power Manager Operationsafe mode, Driver Verifier, The BIOS Boot Sector and Bootmgr, Initializing the Kernel and Executive Subsystems, Troubleshooting Boot and Startup Problems, Windows Recovery Environment (WinRE)–MBR Corruption, Windows Recovery Environment (WinRE), Windows Recovery Environment (WinRE), MBR Corruptionboot options, The BIOS Boot Sector and BootmgrDriver Verifier settings, Driver Verifierregistry entries, Initializing the Kernel and Executive Subsystemstroubleshooting startup, Troubleshooting Boot and Startup ProblemsWindows RE alternative, Windows Recovery Environment (WinRE)–MBR Corruption, Windows Recovery Environment (WinRE), Windows Recovery Environment (WinRE), MBR CorruptionSafe Mode With Command Prompt, The BIOS Boot Sector and Bootmgr, Safe ModeSafe Mode With Networking, Safe Modesafe save programming, File Namessafe structured exception handling, Software Data Execution Preventionsafeboot element, The BIOS Boot Sector and BootmgrSAFEBOOT variable, Smss, Csrss, and Wininitsafebootalternateshell element, The BIOS Boot Sector and Bootmgrsafemode BCD option, Driver Loading in Safe Modesalt (encryption keys), BitLocker Key RecoverySANs (storage area networks), Storage Management, iSCSI DriversSAS (Serial Attached SCSI), Disk Devices, Disk Class, Port, and Miniport DriversSATA devices, Prioritization Strategies, Bandwidth Reservation (Scheduled File I/O), Disk Devices, Disk Class, Port, and Miniport Driverssaved system states, The Power Managerscalability, I/O System, The Low Fragmentation Heapheap functions, The Low Fragmentation HeapI/O system, I/O Systemscaling (performance states), Thresholds and Policy Settings, Performance Checkscatter/gather I/O, Scatter/Gather I/OSCB (stream control block), NTFS File System Driver, Resource Managersscenario manager, Componentsscenarios, Scenariosscheduled file I/O, Bandwidth Reservation (Scheduled File I/O)scheduled file I/O extension, Opening Devicesscheduled tasks, I/O Prioritiesscheduler, Algorithm Overrides, Initializing the Kernel and Executive SubsystemsSCM (service control manager), IRP Stack LocationsSCM process, IRP Stack Locationsscreen savers, blue screen, Hardware Malfunctionsscripting (BitLocker), BitLocker Drive Encryptionscripts, user, Smss, Csrss, and Wininitscrubbing pages, PFN Data StructuresScsiport.sys driver, Disk Class, Port, and Miniport Drivers, Disk Class, Port, and Miniport DriversSD cards, ReadyBoostSD Client buses, Structure and Operation of a KMDF DriverSD/MMC support, Disk DevicesSDI ramdisks, The BIOS Boot Sector and Bootmgrsearch indexing priorities, I/O PrioritizationSecond Layer Address Translation (SLAT), The BIOS Boot Sector and Bootmgrsecondary dump data, Crash Dump Filessecondary resource managers, Resource Managers, Resource Managers, Resource ManagersSeCreateSymbolicLink privilege, Symbolic (Soft) Links and Junctionssection object pointers, Opening Devices, Section Objects, Section Objects, Per-File Cache Data Structuressection objects (control areas), Introduction to the Memory Manager, Services Provided by the Memory Manager, Allocation Granularity, Shared Memory and Mapped Files–Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Files, Prototype PTEs–Prototype PTEs, Prototype PTEs, Prototype PTEs, Section Objects, Section Objects, Section Objects, Section Objects, Section Objects, Section Objects, The Memory Manager, Smss, Csrss, and Wininit, Causes of Windows Crashescontrol areas, Section Objectscreating, Smss, Csrss, and Wininitfile mapping objects, The Memory Managermemory manager, Allocation Granularity, Shared Memory and Mapped Files, Section Objects, Section Objects, Section Objects, Section Objectsmemory mapped files, Introduction to the Memory Manager, Services Provided by the Memory Manager, Causes of Windows Crashesprototype PTEs, Prototype PTEs–Prototype PTEs, Prototype PTEs, Prototype PTEssection objects, Shared Memory and Mapped Files–Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Filesviewing, Section Objectssections, Reserving and Committing Pages, Invalid PTEssector signatures, Log Blockssector size, Unified Cachingsector to client mapping, Translating Virtual LSNs to Physical LSNssector-level disk I/O, Partition Managersectors, Disk Devices, File Deletion and the Trim Command, File Deletion and the Trim Command, GUID Partition Table Partitioning, The LDM Database, Full-Volume Encryption Driver–BitLocker Management, BitLocker Management, Unified Caching, Log Blocks, Dynamic Bad-Cluster Remapping, Clustersblocks, Disk Devicesencrypting, Full-Volume Encryption Driver–BitLocker Management, BitLocker ManagementGPT bits, GUID Partition Table Partitioninglarger sizes, ClustersLDM database, The LDM Databaseremapping bad clusters, Dynamic Bad-Cluster Remappingsignatures, Log Blockssize, Unified Cachingtrim command, File Deletion and the Trim Commandupdating, File Deletion and the Trim CommandSecure Digital cards, ReadyBoostsecurity, I/O System, BitLocker Drive Encryption–BitLocker To Go, BitLocker Drive Encryption, Encryption Keys, Encryption Keys, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker Boot Process, BitLocker Key Recovery, Full-Volume Encryption Driver, Full-Volume Encryption Driver, BitLocker To Go, BitLocker To Go, Address Windowing Extensions, The Low Fragmentation Heap, Heap Debugging Features, Page Files, Page List Dynamics, Recoverability, Consolidated Security–Transaction Support, Consolidated Security, Consolidated Security, Transaction Support, Encrypting a File for the First TimeAWE memory, Address Windowing ExtensionsBitLocker, BitLocker Drive Encryption–BitLocker To Go, BitLocker Drive Encryption, Encryption Keys, Encryption Keys, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker Boot Process, BitLocker Key Recovery, Full-Volume Encryption Driver, Full-Volume Encryption Driver, BitLocker To Go, BitLocker To Goconsolidated NTFS security, Consolidated Security–Transaction Support, Consolidated Security, Consolidated Security, Transaction Supportencryption recovery agents, Encrypting a File for the First Timeheap manager, The Low Fragmentation Heap, Heap Debugging FeaturesI/O system, I/O SystemNTFS design goals, Recoverabilitypage files, Page Fileszero-initialized pages, Page List Dynamicssecurity contexts, Explicit File I/Osecurity cookies, Stack Trashessecurity descriptor database, Master File TableSecurity Descriptor Hash (, Consolidated Security, Consolidated SecuritySecurity Descriptor Stream (, Security, Consolidated Security, Consolidated Securitysecurity descriptors, Opening Devices, Shared Memory and Mapped Files, General Indexing Facility, File Records, The Change Journal File–Indexing, Indexing, Consolidated Securitychange journal, The Change Journal File–Indexing, Indexingfile attributes, File Recordsfiles, Opening Devicesindexing features, General Indexing Facilitysection objects, Shared Memory and Mapped Filessharing descriptors, Consolidated Securitysecurity files (, Security, Master File Table, Consolidated Security, Consolidated Security, Consolidated SecuritySecurity ID Index (, Consolidated Security, Consolidated Securitysecurity IDs (SIDs), Per-User Volume Quotas, Quota Tracking, Consolidated Security, Consolidated Security, Encrypting File System Securitysecurity mitigations, Controlling Security Mitigationssecurity reference monitor, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive SubsystemsSeDebugPrivilege rights, Reserving and Committing Pages, Protecting Memoryseek times, Logical Prefetcher, ReadyBoostsegment dereference thread, Memory Manager Componentssegment structures, Section Objectssegments, Heap Manager StructureSEH handler, Software Data Execution PreventionSEHOP (Structured Exception Handler Overwrite Protection), Software Data Execution Preventionself-healing, NTFS, Self-Healing–Encrypting File System Security, Self-Healing, Encrypting File System Securitysemaphore object, Initializing the Kernel and Executive SubsystemsSendTarget portals, iSCSI Driverssequential I/O, Opening Devices, Robust Performancesequential read-ahead, Intelligent Read-Aheadsequentially reading files, Cache Virtual Memory ManagementSerial Advanced Technology Attachment (SATA), Disk Devices, Disk Class, Port, and Miniport Driversserial devices, debugging, The BIOS Boot Sector and Bootmgrserial hypervisor debugging, The BIOS Boot Sector and Bootmgrserial ports, Disk Device Objects, The BIOS Boot Sector and Bootmgr, When There Is No Crash Dumpdevice objects, Disk Device Objectshypervisor debugging, The BIOS Boot Sector and Bootmgrkernel debugger, When There Is No Crash Dumpserializing IRPs, Structure of a Driverserver applications, No Execute Page Protection, NTFS File System Drivercache manager, NTFS File System Driverexecution protection, No Execute Page Protectionserver farms (crash analysis), Online Crash AnalysisServer Message Block (SMB) protocol, Remote FSDs, Remote FSDs, Lockingserver-side remote FSDs, Remote FSDs–File System Operation, Remote FSDs, File System Operationservers, VSS Operation, Crash Dump FilesMemory.dmp files, Crash Dump Filesshadow copies, VSS OperationService Hosting Process (Svchost.exe), Driver Installation, Logical Prefetcherservice loading, The Start Value–The Start Value, The Start Valueservice packs, Smss, Csrss, and WininitServices for Unix Applications, Process ReflectionServices registry key, Troubleshooting Crashesservices, shutting down, ShutdownServices.exe, IRP Stack LocationsSession 0 window hook, Smss, Csrss, and WininitSession Manager (Smss.exe), Volume Mounting, Virtual Address Space Layouts, Image Randomization, Page Files–Page Files, Page Files, Page Files, Initializing the Kernel and Executive Subsystems–Smss, Csrss, and Wininit, Smss, Csrss, and Wininit, Smss, Csrss, and Wininit, Smss, Csrss, and Wininit, Boot Logging in Safe Mode, Post–Splash Screen Crash or Hangboot logging in safe mode, Boot Logging in Safe Modeboot logs, Post–Splash Screen Crash or HangDLL order, Image Randomizationinitialization tasks, Initializing the Kernel and Executive Subsystems–Smss, Csrss, and Wininit, Smss, Csrss, and Wininit, Smss, Csrss, and Wininitinitializing, Smss, Csrss, and Wininitpage file setup, Page Files–Page Files, Page Files, Page Filesprocess, Virtual Address Space Layoutsrunning Chkdsk, Volume Mountingsession manager process, Virtual Address Space Layoutssession namespaces, Explicit File I/Osession space, Kernel-Mode Heaps (System Memory Pools), Virtual Address Space Layouts, x86 Session Space–System Page Table Entries, x86 Session Space, System Page Table Entries, 64-Bit Address Space Layouts–64-Bit Address Space Layouts, 64-Bit Address Space Layouts, Page Directories64-bit layouts, 64-Bit Address Space Layouts–64-Bit Address Space Layouts, 64-Bit Address Space Layoutsdefined, Virtual Address Space Layoutspage tables, Page Directoriespool, Kernel-Mode Heaps (System Memory Pools)utilization, x86 Session Spacex86 systems, x86 Session Space–System Page Table Entries, System Page Table Entriessession-private object manager namespace, Virtual Address Space LayoutsSESSION5_INITIALIZATION_FAILED code, Initializing the Kernel and Executive Subsystemssessions, Virtual Address Space Layouts, Virtual Address Space Layouts, Working Setsdefined, Virtual Address Space Layoutssessionwide code and data, Virtual Address Space Layoutsworking sets, Working SetsSet APIs, KMDF Data Model, Transactional APIsSetEndOfFile API, Transactional APIsSetFileBandwidthReservation API, Opening DevicesSetFileCompletionNotificationModes API, I/O Completion Port OperationSetFileInformationByHandle function, Prioritization Strategies, Transactional APIsSetFileIoOverlappedRange API, Opening DevicesSetFileShortName API, Transactional APIsSetFileTime API, Transactional APIsSetPriorityClass function, Prioritization StrategiesSetProcessDEPPolicy function, No Execute Page ProtectionSetProcessShutdownParameters function, ShutdownSetProcessWorkingSetSize function, Working Set ManagementSetProcessWorkingSetSizeEx function, Locking MemorySetThreadExecutionState API, Power Availability RequestsSetThreadPriority function, Prioritization StrategiesSetupapi.dll, Driver InstallationSetupcl.exe, Smss, Csrss, and WininitSetupDiEnumDeviceInterfaces function, Driver Objects and Device ObjectsSetupDiGetDeviceInterfaceDetail function, Driver Objects and Device ObjectsSET_REPAIR flags, Self-HealingSE_LOCK_MEMORY privilege, Thread Agnostic I/Oshadow copies, Volume Shadow Copy Service–Conclusion, VSS Architecture, VSS Operation–Uses in Windows, Shadow Copy Provider, Shadow Copy Provider, Shadow Copy Provider, Shadow Copy Provider, Shadow Copy Provider, Uses in Windows–Previous Versions and System Restore, Uses in Windows, Backup, Backup, Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restore, Conclusionbackup operations, Uses in Windows–Previous Versions and System Restore, Backup, Previous Versions and System Restoreoperations, VSS Operation–Uses in Windows, Shadow Copy Provider, Shadow Copy Provider, Uses in Windowsset IDs, Previous Versions and System RestoreVolume Shadow Copy Service, Volume Shadow Copy Service–Conclusion, VSS Architecture, Shadow Copy Provider, Shadow Copy Provider, Shadow Copy Provider, Backup, Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restore, ConclusionShadow Copies for Shared Folders, Previous Versions and System Restoreshadow copy device objects, Previous Versions and System RestoreShadow Copy Provider, Shadow Copy Provider–Uses in Windows, Shadow Copy Provider, Shadow Copy Provider, Uses in Windowsshadow copy volumes, Previous Versions and System Restoreshare counts, Modified Page Writer, PFN Data Structures, PFN Data Structures, PFN Data Structuresshare modes (file objects), Opening Devicesshare-access checks, Opening Devicesshareable address space, User Address Space Layoutshareable pages, Reserving and Committing Pages, Reserving and Committing Pagesshared access leases, Lockingshared access locks, Lockingshared cache maps, Per-File Cache Data Structures, Per-File Cache Data Structures, Per-File Cache Data Structures, Per-File Cache Data Structures, Explicit File I/Oshared encrypted files, Encrypting File System Securityshared heaps, read-only, Types of Heapsshared memory, Shared Memory and Mapped Files, Shared Memory and Mapped Files, Shared Memory and Mapped Files, Protecting Memory, Virtual Address Space Layoutsshared pages, Address Windowing Extensions, Prototype PTEs, Prototype PTEs, Prototype PTEsshell, Link Tracking, Link Tracking, Smss, Csrss, and Wininit, Online Crash Analysisshell namespace, Link Tracking–Encryption, Link Tracking, Encryptionshim mechanisms, Fault Tolerant Heapshort names, File Records, File Names, File Names, File NamesShrinkAbort request, Dynamic PartitioningShrinkCommit request, Dynamic Partitioningshrinking engine (partitions), Dynamic PartitioningShrinkPrepare request, Dynamic Partitioningshutdown, Driver Verifier, Windows Recovery Environment (WinRE), Shutdown, Shutdown, Shutdown, ShutdownSideShow-compatible devices, User-Mode Driver Framework (UMDF)SIDs (security IDs), Per-User Volume Quotas, Quota Tracking, Consolidated Securitysignatures, Driver Installation, Driver Installation, Driver Installation, Driver Installation, Driver Installation, Heap Security Featuresdriver signing, Driver Installation, Driver Installation, Driver Installation, Driver Installationheap tail checking, Heap Security Featuresverification, Driver Installationsimple volumes, Storage Terminology, Mirrored Volumessingle bit corruption, Buffer Overruns, Memory Corruption, and Special Poolsingle-layered drivers, I/O Request to a Single-Layered Driver–Synchronization, Completing an I/O Request, Synchronization, Synchronization, Synchronizationsingle-level cell (SLC) memory, NAND-Type Flash Memorysingle-page granularity, Allocation Granularitysingly linked lists, Windows x64 16-TB Limitationsleep states, Level of Plug and Play Support, The Power Manager, Power Manager Operation, Power Manager Operation, Driver and Application Control of Device Power, Power Availability Requests, Processor Power Management (PPM)SLIST_HEADER data structure, Windows x64 16-TB Limitation, Windows x64 16-TB Limitationsmall memory dumps (minidumps), Process Reflection, Crash Dump Files, Crash Dump Files, Crash Dump Files, Hung or Unresponsive Systemssmall pages, Large and Small Pages, Large and Small Pages, Large and Small Pagessmall-IRP look-aside lists, I/O Request PacketsSMB Server Message Block (SMB) protocol, Remote FSDs, Remote FSDs, LockingSMP system processors, Initializing the Kernel and Executive SubsystemsSmpCheckForCrashDump function, Causes of Windows CrashesSmpConfigureSharedSession­­Data function, Smss, Csrss, and WininitSmpCreateDynamicEnvironment­Variables function, Smss, Csrss, and WininitSmpCreateInitialSession function, Smss, Csrss, and WininitSmpCreatePagingFiles function, Smss, Csrss, and WininitSmpExecuteCommand function, Smss, Csrss, and WininitSmpInit function, Smss, Csrss, and WininitSmpInitializeDosDevices function, Smss, Csrss, and WininitSmpInitializeKnownDlls function, Smss, Csrss, and WininitSmpLoadDataFromRegistry function, Smss, Csrss, and WininitSmpProcessFileRenames function, Smss, Csrss, and WininitSmpStartCsr function, Smss, Csrss, and WininitSMT cores, Core Parking Policies, Utility Functionsnapshot devices, VSS Operationsnapshots, Volume Shadow Copy Service–Conclusion, Previous Versions and System Restore, Conclusionsoft faults, Logical Prefetchersoft links, Symbolic (Soft) Links and Junctions–Compression and Sparse Files, Symbolic (Soft) Links and Junctions, Symbolic (Soft) Links and Junctions, Compression and Sparse Filessoft page faults, NUMAsoft partitions, The LDM Database, The LDM Database, LDM and GPT or MBR-Style Partitioningsoftware attacks, Encryption Keyssoftware data execution prevention, Software Data Execution Prevention–Copy-on-Write, Software Data Execution Prevention, Copy-on-Writesoftware DEP, Software Data Execution Prevention–Copy-on-Write, Software Data Execution Prevention, Copy-on-Writesoftware mirroring, Clone Shadow Copiessoftware PTEs, Invalid PTEs–Invalid PTEs, Invalid PTEs, Prototype PTEssoftware resumption from power states, The Power Managersoftware Write bits, Hardware vs. Software Write Bits in Page Table Entriessos element, The BIOS Boot Sector and Bootmgrspace quotas, Dynamic System Virtual Address Space Management–User Address Space Layout, User Address Space Layout, User Address Space Layoutspaces (file names), File Namesspanned volumes, Spanned Volumesspare bits, NAND-Type Flash Memorysparse files, UDF, Compression and Sparse Files, Compression and Sparse Files, Data Compression and Sparse Files, Data Compression and Sparse Files, Compressing Sparse Datasparse matrix, Compressing Sparse Datasparse multilevel VACB arrays, Per-File Cache Data Structuresspatial locality (cache), Cache Manager’s Read-Ahead Threadspecial agents (prefetch), Page Priority and Rebalancingspecial pool, Dynamic System Virtual Address Space Management, Driver Verifier–Driver Verifier, Driver Verifier, Driver Verifier, Buffer Overruns, Memory Corruption, and Special Pool, Buffer Overruns, Memory Corruption, and Special Pool–Buffer Overruns, Memory Corruption, and Special Pool, Buffer Overruns, Memory Corruption, and Special Pool, 0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLDriver Verifier option, Buffer Overruns, Memory Corruption, and Special Pool, 0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLenabling, Buffer Overruns, Memory Corruption, and Special Pool–Buffer Overruns, Memory Corruption, and Special Pool, Buffer Overruns, Memory Corruption, and Special Poolexpanding, Dynamic System Virtual Address Space Managementregistry settings, Driver Verifierverification, Driver Verifier–Driver Verifier, Driver Verifierspeed, cluster size and, Clustersspinlocks, Synchronization, KMDF Data Model, KMDF Data Model, Look-Aside Lists, Windows x64 16-TB Limitationaccessing directly, Synchronizationcontext areas, KMDF Data Modeleliminating need for, Windows x64 16-TB LimitationKMDF objects, KMDF Data Modelpools and, Look-Aside Listssplash screens, hangs and, Post–Splash Screen Crash or Hangsplit log blocks, Owner Pagessplit mirrors (clone shadow copies), Clone Shadow CopiesSpoolsvc.exe, Power Availability RequestsSRTM (Static Root of Trust Measurement), Trusted Platform Module (TPM)SSDs (solid state disks), NAND-Type Flash Memory, NAND-Type Flash Memory, NAND-Type Flash Memory–File Deletion and the Trim Command, File Deletion and the Trim Command–File Deletion and the Trim Command, File Deletion and the Trim Command, File Deletion and the Trim Command, File Deletion and the Trim Command, Disk Drivers, ReadyBoost, Unified Cachingfile deletion and trim, File Deletion and the Trim Command–File Deletion and the Trim Command, File Deletion and the Trim Command, Disk DriversReadyBoost, ReadyBoost, Unified Cachingslowing down, NAND-Type Flash Memorywear-leveling, NAND-Type Flash Memory–File Deletion and the Trim Command, File Deletion and the Trim Command, File Deletion and the Trim Commandwearing out, NAND-Type Flash Memorystack bases, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPstack cookies, Software Data Execution Preventionstack limits, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPstack locations, I/O Request Packets, IRP Stack Locations–IRP Stack Locations, IRP Stack Locations, IRP Stack Locations, IRP Stack Locations, Completing an I/O Request–Synchronization, Completing an I/O Request, Completing an I/O Request, Synchronization, I/O Requests to Layered DriversI/O request packets (IRPs), IRP Stack Locations–IRP Stack Locations, IRP Stack Locations, IRP Stack Locations, IRP Stack LocationsIRP reuse and, I/O Requests to Layered Driverslarge-IRP look-aside list, I/O Request Packetsrequest completion, Completing an I/O Request–Synchronization, Completing an I/O Request, Completing an I/O Request, Synchronizationstack overruns (stack trashes), Stack Trashes–Hung or Unresponsive Systems, Stack Trashes, Stack Trashes, Hung or Unresponsive Systemsstack pointer register, Stack Trashes, Stack Trashes, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPstack randomization, Stack Randomization, Stack Randomizationstack traces, Heap Debugging Features, Write-Back Caching and Lazy Writing, Write-Back Caching and Lazy Writing, Verbose Analysis–Verbose Analysis, Verbose Analysis, Advanced Crash Dump Analysis, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL, 0xC5 - DRIVER_CORRUPTED_EXPOOL–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLdisplaying device driver, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUALheap debugging, Heap Debugging Featurespool corruption, 0xC5 - DRIVER_CORRUPTED_EXPOOL–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLprocessors, Advanced Crash Dump Analysisread-ahead operations, Write-Back Caching and Lazy Writingverbose analysis, Verbose Analysis–Verbose Analysis, Verbose Analysiswrite-behind operations, Write-Back Caching and Lazy Writingstack trashes, Stack Trashes–Hung or Unresponsive Systems, Hung or Unresponsive SystemsStackRandomizationDisabled, Stack Randomizationstacks, Software Data Execution Prevention, User Address Space Layout, Stack Randomization–ASLR in Kernel Address Space, Heap Randomization, ASLR in Kernel Address Space, Stacks–Virtual Address Descriptors, Stacks, Stacks, Kernel Stacks–Virtual Address Descriptors, Kernel Stacks, Kernel Stacks, DPC Stack, Virtual Address Descriptors–Process VADs, Virtual Address Descriptors, Virtual Address Descriptors, Process VADs, Stack Trashes–Hung or Unresponsive Systems, Stack Trashes, Stack Trashes–Hung or Unresponsive Systems, Stack Trashes, Hung or Unresponsive Systems, Hung or Unresponsive Systemsaddress space, User Address Space Layoutanalyzing, Stack Trashes–Hung or Unresponsive Systems, Hung or Unresponsive Systemscrash dump analysis, Stack Trashes–Hung or Unresponsive Systems, Stack Trashes, Hung or Unresponsive SystemsDEP stack cookies, Software Data Execution PreventionDPC, DPC Stackkernel, Stacks, Kernel Stacks–Virtual Address Descriptors, Kernel Stacks, Virtual Address Descriptorsmemory manager, Stacks–Virtual Address Descriptors, Stacks, Kernel Stacks, Virtual Address Descriptors–Process VADs, Virtual Address Descriptors, Process VADspointer register, Stack Trashesrandomization, Stack Randomization–ASLR in Kernel Address Space, Heap Randomization, ASLR in Kernel Address Spacestampdisks element, The BIOS Boot Sector and Bootmgrstandard BitLocker operation, BitLocker Drive Encryptionstandby cache, Examining Memory Usagestandby lists, Clustered Page Faults, Page Priority, Page Priority, Components, Components, Cache Size, Cache Physical Sizeprefetched pages, Clustered Page Faultsprioritized, Page Priority, Page Priorityrebalancer, ComponentsSuperfetch service, Componentssystem cache, Cache Size, Cache Physical Sizestandby mode, Driver Power Operation, Componentsstandby page lists, Examining Memory Usage, Page Fault Handlingstandby pages, PFN Data StructuresStandby PFN state, Page Frame Number Database, Page Frame Number Databasestandby scenario, Scenariosstart I/O routines, Structure of a DriverStart values, The Start Value, The Start Value, Device Enumerationstart-device command, Driver Support for Plug and Playstart-device IRPs, Driver Objects and Device ObjectsStartup Repair tool, Windows Recovery Environment (WinRE), Windows Recovery Environment (WinRE)Startup.com, The BIOS Boot Sector and Bootmgrstate-transition table, Driver Support for Plug and Play–The Start Value, The Start Valuestatic physical NVRAM cache, Unified CachingStatic Root of Trust Measurement (SRTM), Trusted Platform Module (TPM)STATUS_ACCESS_ VIOLATION exception, No Execute Page Protection, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLEDSTATUS_BREAKPOINT exception, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED–0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPSTATUS_INVALID_DEVICE_REQUEST exception, KMDF I/O ModelSTATUS_REPARSE code, Symbolic (Soft) Links and Junctionsstep model (PPM), Increase/Decrease Actions, Performance Checkstolen USB keys, Encryption Keysstop code analysis, Causes of Windows Crashes, Verbose Analysis–Verbose Analysis, Verbose Analysis, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL–0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED–0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0xC5 - DRIVER_CORRUPTED_EXPOOL–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLDRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOL–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLDRIVER_IRQL_NOT_LESS_OR_EQUAL, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL–0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLEDIRQL_NOT_LESS_OR_EQUAL, Causes of Windows CrashesKERNEL_MODE_EXCEPTION_NOT_HANDLED, 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED–0x7F - UNEXPECTED_KERNEL_MODE_TRAP, 0x7F - UNEXPECTED_KERNEL_MODE_TRAPUNEXPECTED_KERNEL_MODE_TRAP, 0x7F - UNEXPECTED_KERNEL_MODE_TRAP–0xC5 - DRIVER_CORRUPTED_EXPOOL, 0xC5 - DRIVER_CORRUPTED_EXPOOLverbose analysis, Verbose Analysis–Verbose Analysis, Verbose Analysisstop codes (bugchecks), Initializing the Kernel and Executive Subsystems, The Blue Screen, Basic Crash Dump Analysis, Basic Crash Dump Analysis, Code Overwrite and System Code Write Protection–Advanced Crash Dump Analysis, Advanced Crash Dump Analysis, Advanced Crash Dump Analysis, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUALbugcheck parameters, Basic Crash Dump Analysis, 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUALbugcheck screens, Initializing the Kernel and Executive Subsystemsillegal instruction fault crashes, Code Overwrite and System Code Write Protection–Advanced Crash Dump Analysis, Advanced Crash Dump Analysis, Advanced Crash Dump Analysismanual crashes, Basic Crash Dump Analysisnumeric identifiers, The Blue Screenstorage area networks (SANs), Storage Management, iSCSI Driversstorage device states, The Plug and Play (PnP) Managerstorage devices, ReadyBoost, Unified Caching, Unified Caching, Booting from iSCSIstorage drivers, Prioritization Strategies, Storage Management, Winload–Multipath I/O (MPIO) Drivers, iSCSI Drivers, iSCSI Drivers, Multipath I/O (MPIO) Drivers, Local FSDs, Local FSDsdevice drivers, Storage Management, Local FSDs, Local FSDsmanagement, Winload–Multipath I/O (MPIO) Drivers, iSCSI Drivers, iSCSI Drivers, Multipath I/O (MPIO) Driversport drivers, Prioritization Strategiesstorage management, Storage Terminology–Disk Sector Format, Disk Sector Format, Multipath I/O (MPIO) Drivers, Volume Management, Volume Management, Basic Disks, GUID Partition Table Partitioning, GUID Partition Table Partitioning, Basic Disk Volume Manager, Basic Disk Volume Manager, Dynamic Disks, The LDM Database, The LDM Database, The LDM Database, The LDM Database, The LDM Database, LDM and GPT or MBR-Style Partitioning, Dynamic Disk Volume Manager–Multipartition Volume Management, Dynamic Disk Volume Manager, Multipartition Volume Management–RAID-5 Volumes, Multipartition Volume Management, Spanned Volumes, Striped Volumes, Mirrored Volumes, Mirrored Volumes, RAID-5 Volumes, RAID-5 Volumes, The Mount Manager, The Mount Manager, Mount Points, Volume Mounting, Volume Mounting, Volume Mounting, Volume I/O Operations–Virtual Disk Service, Volume I/O Operations, Virtual Disk Service, Virtual Disk Service, Virtual Disk Service, Virtual Disk Service, Virtual Hard Disk Support–BitLocker Drive Encryption, Virtual Hard Disk Support, BitLocker Drive Encryption–BitLocker To Go, BitLocker Drive Encryption, BitLocker Drive Encryption, Encryption Keys, Encryption Keys, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker Boot Process, BitLocker Key Recovery, Full-Volume Encryption Driver, Full-Volume Encryption Driver, Full-Volume Encryption Driver, BitLocker To Go, BitLocker To Go, BitLocker To Go, Volume Shadow Copy Servicebasic disks, Volume Management, GUID Partition Table Partitioning, Basic Disk Volume ManagerBitLocker, BitLocker Drive Encryption–BitLocker To Go, BitLocker Drive Encryption, Encryption Keys, Encryption Keys, Encryption Keys, Trusted Platform Module (TPM), Trusted Platform Module (TPM), BitLocker Boot Process, BitLocker Key Recovery, Full-Volume Encryption Driver, Full-Volume Encryption Driver, BitLocker To Go, BitLocker To GoBitLocker To Go, BitLocker To Godisk drivers, Multipath I/O (MPIO) Driversdynamic disks, Dynamic Disks, The LDM Database, LDM and GPT or MBR-Style Partitioning, Dynamic Disk Volume Manager–Multipartition Volume Management, Multipartition Volume Managementfull-volume encryption driver, Full-Volume Encryption Drivermultipartition volume management, Multipartition Volume Management–RAID-5 Volumes, Spanned Volumes, Striped Volumes, Mirrored Volumes, Mirrored Volumes, RAID-5 Volumes, RAID-5 Volumesterminology, Storage Terminology–Disk Sector Format, Disk Sector Formatvirtual hard disk support, Virtual Hard Disk Support–BitLocker Drive Encryption, BitLocker Drive Encryptionvolume I/O operations, Volume I/O Operations–Virtual Disk Service, Virtual Disk Service, Virtual Disk Servicevolume management, Volume Management, Basic Disks, GUID Partition Table Partitioning, Basic Disk Volume Manager, The LDM Database, The LDM Database, The LDM Database, The LDM Database, Dynamic Disk Volume Manager, The Mount Manager, The Mount Manager, Mount Points, Volume Mounting, Volume Mounting, Volume Mounting, Volume I/O Operations, Virtual Disk Service, Virtual Disk Service, Virtual Hard Disk SupportVolume Shadow Copy Service, Volume Shadow Copy Servicestorage stacks, Prioritization Strategies, I/O Priority Inversion Avoidance (I/O Priority Inheritance), Disk Drivers, Multipath I/O (MPIO) Drivers, Multipath I/O (MPIO) Driversstore keys, Unified CachingStore Manager (unified caching), Unified Caching, Unified Caching, Initializing the Kernel and Executive Subsystemsstore pages, Unified CachingStorport minidriver, Attaching VHDsStorport.sys driver, Disk Class, Port, and Miniport Drivers, Disk Class, Port, and Miniport Driversstream names, Stream-Based Cachingstream-based caching, Stream-Based Cachingstream-controlled block (SCB), NTFS File System Driverstreaming playback, I/O Prioritizationstreams, Tracing and Logging, Stream-Based Caching, Common Log File System, Multiple Data Streams, Multiple Data Streams–Multiple Data Streams, Multiple Data Streams, Multiple Data Streams, Multiple Data Streams, The Change Journal File, The Change Journal File, Resource Managersassociated with file names, Tracing and Loggingattributes, Multiple Data Streamscaching, Stream-Based Cachingchange journal, The Change Journal File, The Change Journal FileCLFS, Common Log File Systemmultiple, NTFS design goals, Multiple Data Streams–Multiple Data Streams, Multiple Data Streams, Multiple Data Streams, Multiple Data StreamsTxF, Resource Managersstrings, Buffer Overruns, Memory Corruption, and Special PoolStrings utility, Monitoring Pool Usage, Logical Prefetcher, Buffer Overruns, Memory Corruption, and Special Poolstriped arrays, Dynamic Disksstriped volumes, The LDM Database, Volume I/O Operations, Data Redundancy and Fault Tolerancedata redundancy, Data Redundancy and Fault ToleranceI/O operations, Volume I/O OperationsLDM partition entries, The LDM DatabaseStructured Exception Handler Overwrite Protection (SEHOP), Software Data Execution Preventionsubkeys, Device Enumerationsubst command, Opening DevicesSubst.exe utility, Previous Versions and System Restoresubsystem DLLs, I/O Request to a Single-Layered Driver, Smss, Csrss, and Wininitsuccess codes, I/O Completion Port Operation, KMDF I/O Modelsuccessful boots, Troubleshooting CrashesSuperfetch service (proactive memory management), I/O Priorities, I/O Priority Boosts and Bumps, Logical Prefetcher, Logical Prefetcher, Components–Components, Components, Components, Tracing and Logging, Scenarios, Page Priority and Rebalancing–Robust Performance, Page Priority and Rebalancing–Robust Performance, Page Priority and Rebalancing, Robust Performance, Robust Performance, Robust Performance, ReadyBoost, ReadyDrive, Unified Caching, Unified Caching–Unified Caching, Unified Caching, Unified Caching, Process Reflection, Process Reflectioncomponents, Components–Components, Components, ComponentsI/O priorities, I/O Prioritiesidle I/O, I/O Priority Boosts and Bumpslogical prefetcher, Logical Prefetcherorganizing files, Logical Prefetcherpage priority, Page Priority and Rebalancing–Robust Performance, Robust Performanceprocess reflection, Process Reflection, Process ReflectionReadyBoost, ReadyBoost, Unified CachingReadyDrive, ReadyDriverebalancing, Page Priority and Rebalancing–Robust Performance, Page Priority and Rebalancing, Robust Performancerobust performance, Robust Performancescenarios, Scenariostracing and logging, Tracing and Loggingunified caching, Unified Caching–Unified Caching, Unified Caching, Unified Cachingsurprise-remove command, Driver Support for Plug and Playsuspending, BitLocker Boot ProcessBitLocker, BitLocker Boot ProcessSvchost.exe (Service Hosting Process), Logical Prefetcherswapper thread, Balance Set Manager and Swapperswitching CPU contexts, Hung or Unresponsive SystemsSwprov.dll (shadow copy provider), Shadow Copy Provider–Uses in Windows, Uses in Windowssymbol files, Basic Crash Dump Analysis, 0xC5 - DRIVER_CORRUPTED_EXPOOLsymbol server, Crash Dump Filessymbol-file paths, Basic Crash Dump Analysissymbolic exception registration records, Software Data Execution Preventionsymbolic links, Driver Objects and Device Objects, Opening Devices, Opening Devices, Opening Devices, Disk Device Objects, The Mount Manager, Mount Points, Previous Versions and System Restore, Explicit File I/O, Symbolic (Soft) Links and Junctions–Compression and Sparse Files, Symbolic (Soft) Links and Junctions, Compression and Sparse Files, Compression and Sparse Files, The Change Journal File, Smss, Csrss, and Wininitchange journal, The Change Journal Filedevice names, Opening Devicesdevice objects, Driver Objects and Device Objectsfile object extensions, Opening DevicesMS-DOS devices, Smss, Csrss, and Wininitnaming conventions, Disk Device ObjectsNTFS design goals, Symbolic (Soft) Links and Junctions–Compression and Sparse Files, Symbolic (Soft) Links and Junctions, Compression and Sparse Files, Compression and Sparse Filesreparse points, Mount Pointsshadow copies, Previous Versions and System Restoreviewing, Opening Devicesvolumes, The Mount Manager, Explicit File I/Osymbols, kernel, Pool SizesSymLinkEvaluation option, Symbolic (Soft) Links and Junctionssymmetric encryption, Encrypting File System Securitysynchronization, I/O Requests to Layered Drivers, KMDF I/O Model, KMDF I/O Model, Internal Synchronization, Types of Heaps, Heap Synchronizationheap manager, Heap SynchronizationI/O requests, I/O Requests to Layered Driversinternal memory, Internal SynchronizationKMDF callbacks, KMDF I/O ModelKMDF queues, KMDF I/O Modelnot supported by heap functions, Types of Heapssynchronization objects, Synchronous and Asynchronous I/O, In-Paging I/O, Driver Verifier, Driver Verifiersynchronization scope object attribute, KMDF I/O Modelsynchronous I/O, Opening Devices, Completing an I/O Request, User-Initiated I/O Cancellation, Fast I/O, Fast I/Ocancellation, User-Initiated I/O Cancellationcompletion, Completing an I/O Requestfast I/O, Fast I/O, Fast I/Ofile object attributes, Opening DevicesSynchronous Paging I/O, Write-Back Caching and Lazy WritingSYSCALL instruction, DPC StackSYSENTER instruction, DPC Stacksysptes command, System Page Table Entries–System Page Table Entries, System Page Table Entries, System Page Table Entriessystem address space, Virtual Address Space Layouts, Virtual Address Space Layouts, 64-Bit Address Space Layouts, Kernel Stackssystem cache, 64-Bit Address Space Layouts, Dynamic System Virtual Address Space Management, Clustered Page Faultsaddress space, 64-Bit Address Space Layoutsexpanding, Dynamic System Virtual Address Space Managementprefetching pages, Clustered Page Faultssystem cache working sets, Virtual Address Space Layouts, System Working Sets, Cache Size, Cache Working Set Sizesystem code write protection, Code Overwrite and System Code Write Protection–Advanced Crash Dump Analysis, Code Overwrite and System Code Write Protection, Advanced Crash Dump Analysissystem code, in system space, Virtual Address Space Layouts–x86 Address Space Layouts, Virtual Address Space Layouts, x86 Address Space Layoutssystem commit limit, Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit Limit, Commit Charge and the System Commit LimitSystem Deployment Image (SDI), The BIOS Boot Sector and Bootmgrsystem environment variables, Smss, Csrss, and Wininitsystem failures, Recoverable File System SupportSystem File Checker (Sfc.exe), System File Corruptionsystem files, Boot Sector Corruption–System Hive Corruption, System File Corruption, System File Corruption, System Hive Corruptionbackup copies, System File Corruptionrepairing corruption, Boot Sector Corruption–System Hive Corruption, System File Corruption, System Hive CorruptionSYSTEM hive, The BIOS Boot Sector and Bootmgr, The BIOS Boot Sector and Bootmgr, Initializing the Kernel and Executive Subsystems, Initializing the Kernel and Executive Subsystems, System Hive Corruptionsystem identifiers (TPM), Encryption KeysSystem Image Recover (Windows RE), Windows Recovery Environment (WinRE)System Image Recovery images, System File Corruptionsystem images, x86 Address Space Layouts, x86 Address Space Layouts, Boot Logging in Safe Mode, System File CorruptionSystem Information tool, Troubleshooting Crashessystem integrity checks (TPM), Trusted Platform Module (TPM)system mapped views, Virtual Address Space Layouts, x86 System Address Space Layout, x86 System Address Space Layoutsystem memory pools (kernel-mode heaps), Kernel-Mode Heaps (System Memory Pools)–Look-Aside Lists, Kernel-Mode Heaps (System Memory Pools), Pool Sizes, Pool Sizes, Monitoring Pool Usage, Monitoring Pool Usage, Monitoring Pool Usage, Look-Aside Lists, Look-Aside Listssystem partitions, BIOS Preboot, Smss, Csrss, and Wininitsystem paths, Booting from iSCSIsystem power policies, Power Manager Operation, Driver Power Operation, Driver Power Operationsystem power requests, Power Availability RequestsSystem process, Memory Manager Components, Internal Synchronization, Process Monitor Basic vs. Advanced Modessystem process shutdowns, Shutdown–Shutdown, Shutdown, ShutdownSystem Properties tool, Crash Dump Filessystem PTE working sets, Virtual Address Space Layouts, Balance Set Manager and Swappersystem PTEs, Virtual Address Space Layouts, x86 Address Space Layouts, System Page Table Entries, System Page Table Entries, 64-Bit Address Space Layouts, Dynamic System Virtual Address Space ManagementSystem Recovery Options dialog box, Windows Recovery Environment (WinRE)system resources, releasing, Structure of a Driver–Driver Objects and Device Objects, Structure of a Driver, Driver Objects and Device ObjectsSystem Restore, VSS Architecture, Previous Versions and System Restore, Previous Versions and System Restore, Previous Versions and System Restore, Windows Recovery Environment (WinRE), System Hive Corruption, Post–Splash Screen Crash or HangSystem Restore Wizard, Post–Splash Screen Crash or Hangsystem root paths, Initializing the Kernel and Executive Subsystemssystem service dispatch tables, Initializing the Kernel and Executive Subsystemssystem shutdown notification routines, Structure of a Driversystem start (1) value, Driver Support for Plug and Play, The Start Valuesystem start device drivers, Causes of Windows Crashessystem storage class device drivers, Prioritization Strategiessystem threads, Modified Page Writer, Modified Page Writersystem time, Initializing the Kernel and Executive Subsystems, Advanced Crash Dump Analysissystem variables, PFN Data Structuressystem virtual address spaces, Internal Synchronization, Dynamic System Virtual Address Space Management, System Virtual Address Space Quotas, The Memory Managersystem virtual memory limits, Physical Memory Limits–32-Bit Client Effective Memory Limits, Windows Client Memory Limits, 32-Bit Client Effective Memory Limits, 32-Bit Client Effective Memory Limits, 32-Bit Client Effective Memory LimitsSystem Volume Information directory, Shadow Copy Providersystem volumes, LDM and GPT or MBR-Style Partitioning, Mirrored Volumes, BIOS Preboot, Smss, Csrss, and Wininitsystem worker threads, System Threads, Initializing the Kernel and Executive Subsystemssystem working set lists, PFN Data Structuressystem working sets, Driver Verifier, System Working Setsforcing code out of, Driver Verifierworking sets, System Working Setssystem-managed paging files, Page Filessystem-managed shared resources, Commit Charge and the System Commit Limitsystem-start values, Device EnumerationSystemLowPriorityIoInformation class, I/O Priority Boosts and Bumpssystemroot element, The BIOS Boot Sector and BootmgrSystemSuperFetchInformation class, Scenariossystemwide code and data, Virtual Address Space Layoutssystemwide environment variables, When There Is No Crash DumpSYSTEM_SERVICE_EXCEPTION stop code, Causes of Windows CrashesSYSTEM_THREAD_EXCEPTION_NOT_HANDLED stop code, Causes of Windows Crashes