深入解析Windows操作系统：微软官方Windows权威著作最新版

图书标准信息

• 作者 [美]拉西诺维奇 著
• 出版社 人民邮电出版社
• 出版时间 2009-09
• 版次 1
• ISBN 9787115211651
• 定价 158.00元
• 装帧 平装
• 开本 大16开
• 纸张 胶版纸
• 页数 1232页
• 字数 1512千字
• 正文语种 英语
• 丛书 图灵程序设计丛书·微软技术系列

【内容简介】

　　《深入解析Windows操作系统(第5版.英文版)》是操作系统内核专家MarkRussinovich和DavidSolomon的Windows操作系统原理的最新版著作，针对WindowsVista和WindowsServer2008进行了全面的更新，主要讲述Windows的底层关键机制，Windows的核心组件（包括进程/线程/作业、安全性、I/O系统、存储管理、内存管理、缓存管理、文件系统和网络），并分析了启动进程、关机进程以及缓存转储。书中提供了许多实例，读者可以借此更好地理解Windows的内部行为。
　　《深入解析Windows操作系统(第5版.英文版)》内容丰富、信息全面，适合众多Windows平台开发人员、系统管理员阅读。

【作者简介】

　　MarkE.Russlnovich，微软技术院士（TechnicalFellow）。享誉世界的Windows内核技术专家。他也是Sysinternals的创建者之一。开发了很多用于Windows管理和诊断的工具。
　　DavidA.Solomon，享誉世界的Windows内核技术专家，曾多次荣获微软MVP称号。
　　Alexlonescu，年轻一代最爱瞩目的Windows内核技术专家，ReactOS开源操作系统核心开发者，开源操作系统项目TinyKRNL创始人。

【目录】

1ConceptsandTools1
WindowsOperatingSystemVersions1
FoundationConceptsandTerms2
WindowsAPI2
Services，Functions，andRoutines4
Processes，Threads，andJobs5
VirtualMemory14
KernelModevsUserMode16
TerminalServicesandMultipleSessions19
ObjectsandHandles21
Security22
Registry23
Unicode23
DiggingintoWindowsInternals24
ReliabilityandPerformanceMonitor25
KernelDebugging26
WindowsSoftwareDevelopmentKit31
WindowsDriverKit31
SysinternalsTools32
Conclusion32

2SystemArchitecture33
RequirementsandDesignGoals33
OperatingSystemModel34
ArchitectureOverview35
Portability38
SymmetricMultiprocessing39
Scalability43
DifferencesBetweenClientandServerVersions43
CheckedBuild47
KeySystemComponents49
EnvironmentSubsystemsandSubsystemDLLs50
Ntdlldll57
Executive58
Kernel61
HardwareAbstractionLayer65
DeviceDrivers68
SystemProcesses74
Conclusion83

3SystemMechanisms85
TrapDispatching85
InterruptDispatching87
ExceptionDispatching114
SystemServiceDispatching125
ObjectManager133
ExecutiveObjects136
ObjectStructure138
Synchronization170
High-IRQLSynchronization172
Low-IRQLSynchronization177
SystemWorkerThreads198
WindowsGlobalFlags200
AdvancedLocalProcedureCalls(ALPCs)202
KernelEventTracing207
Wow64211
Wow64ProcessAddressSpaceLayout211
SystemCalls212
ExceptionDispatching212
UserCallbacks212
FileSystemRedirection212
RegistryRedirectionandReflection213
I/OControlRequests214
16-BitInstallerApplications215
Printing215
Restrictions215
User-ModeDebugging216
KernelSupport216
NativeSupport217
WindowsSubsystemSupport219
ImageLoader220
EarlyProcessInitialization222
LoadedModuleDatabase223
ImportParsing226
PostImportProcessInitialization227
Hypervisor(Hyper-V)228
Partitions230
RootPartition230
ChildPartitions232
HardwareEmulationandSupport234
KernelTransactionManager240
HotpatchSupport242
KernelPatchProtection244
CodeIntegrity246
Conclusion248

4ManagementMechanisms249
TheRegistry249
ViewingandChangingtheRegistry249
RegistryUsage250
RegistryDataTypes251
RegistryLogicalStructure252
TransactionalRegistry(TxR)260
MonitoringRegistryActivity262
RegistryInternals266
Services281
ServiceApplications282
TheServiceControlManager300
ServiceStartup303
StartupErrors307
AcceptingtheBootandLastKnownGood308
ServiceFailures310
ServiceShutdown311
SharedServiceProcesses313
ServiceTags316
ServiceControlPrograms317
WindowsManagementInstrumentation318
Providers319
TheCommonInformationModelandtheManagedObjectFormatLanguage320
ClassAssociation325
WMIImplementation327
WMISecurity329
WindowsDiagnosticInfrastructure329
WDIInstrumentation330
DiagnosticPolicyService330
DiagnosticFunctionality332
Conclusion333

5Processes，Threads，andJobs335
ProcessInternals335
DataStructures335
KernelVariables342
PerformanceCounters343
RelevantFunctions344
ProtectedProcesses346
FlowofCreateProcess348
Stage1：ConvertingandValidatingParametersandFlags350
Stage2：OpeningtheImagetoBeExecuted351
Stage3：CreatingtheWindowsExecutiveProcessObject(PspAllocateProcess)354
Stage4：CreatingtheInitialThreadandItsStackandContext359
Stage5：PerformingWindowsSubsystem–SpecificPost-Initialization360
Stage6：StartingExecutionoftheInitialThread362
Stage7：PerformingProcessInitializationintheContextoftheNewProcess363
ThreadInternals370
DataStructures370
KernelVariables379
PerformanceCounters379
RelevantFunctions380
BirthofaThread380
ExaminingThreadActivity381
LimitationsonProtectedProcessThreads384
WorkerFactories(ThreadPools)386
ThreadScheduling391
OverviewofWindowsScheduling391
PriorityLevels393
WindowsSchedulingAPIs395
RelevantTools396
Real-TimePriorities399
ThreadStates400
DispatcherDatabase404
Quantum406
SchedulingScenarios413
ContextSwitching418
IdleThread418
PriorityBoosts419
MultiprocessorSystems434
MultiprocessorThread-SchedulingAlgorithms442
CPURateLimits444
JobObjects445
Conclusion450

6Security451
SecurityRatings451
TrustedComputerSystemEvaluationCriteria451
TheCommonCriteria453
SecuritySystemComponents454
ProtectingObjects458
AccessChecks459
SecurityDescriptorsandAccessControl484
AccountRightsandPrivileges501
AccountRights502
Privileges503
SuperPrivileges509
SecurityAuditing511
Logon513
WinlogonInitialization515
UserLogonSteps516
UserAccountControl520
Virtualization521
Elevation528
SoftwareRestrictionPolicies533
Conclusion535

7I/OSystem537
I/OSystemComponents537
TheI/OManager539
TypicalI/OProcessing540
DeviceDrivers541
TypesofDeviceDrivers541
StructureofaDriver547
DriverObjectsandDeviceObjects550
OpeningDevices555
I/OProcessing562
TypesofI/O563
I/ORequesttoaSingle-LayeredDriver572
I/ORequeststoLayeredDrivers578
I/OCancellation587
I/OCompletionPorts592
I/OPrioritization598
DriverVerifier604
Kernel-ModeDriverFramework(KMDF)606
StructureandOperationofaKMDFDriver607
KMDFDataModel608
KMDFI/OModel612
User-ModeDriverFramework(UMDF)616
ThePlugandPlay(PnP)Manager619
LevelofPlugandPlaySupport620
DriverSupportforPlugandPlay621
DriverLoading，Initialization，andInstallation623
DriverInstallation632
ThePowerManager636
PowerManagerOperation638
DriverPowerOperation639
DriverandApplicationControlofDevicePower643
Conclusion644

8StorageManagement645
StorageTerminology645
DiskDrivers646
Winload646
DiskClass，Port，andMiniportDrivers647
DiskDeviceObjects650
PartitionManager651
VolumeManagement652
BasicDisks653
DynamicDisks656
MultipartitionVolumeManagement661
TheVolumeNamespace667
VolumeI/OOperations674
VirtualDiskService675
BitLockerDriveEncryption677
BitLockerArchitecture677
EncryptionKeys679
TrustedPlatformModule(TPM)681
BitLockerBootProcess683
BitLockerKeyRecovery684
FullVolumeEncryptionDriver686
BitLockerManagement687
VolumeShadowCopyService688
ShadowCopies688
VSSArchitecture688
VSSOperation689
UsesinWindows692
Conclusion698

9MemoryManagement699
IntroductiontotheMemoryManager699
MemoryManagerComponents700
InternalSynchronization701
ExaminingMemoryUsage701
ServicestheMemoryManagerProvides704
LargeandSmallPages705
ReservingandCommittingPages706
LockingMemory707
AllocationGranularity708
SharedMemoryandMappedFiles709
ProtectingMemory711
NoExecutePageProtection713
Copy-on-Write718
AddressWindowingExtensions719
Kernel-ModeHeaps(SystemMemoryPools)721
PoolSizes722
MonitoringPoolUsage724
Look-AsideLists728
HeapManager729
TypesofHeaps730
HeapManagerStructure731
HeapSynchronization732
TheLowFragmentationHeap732
HeapSecurityFeatures733
HeapDebuggingFeatures734
Pageheap735
VirtualAddressSpaceLayouts736
x86AddressSpaceLayouts737
x86SystemAddressSpaceLayout740
x86SessionSpace740
SystemPageTableEntries744
64-BitAddressSpaceLayouts745
64-BitVirtualAddressingLimitations749
DynamicSystemVirtualAddressSpaceManagement751
SystemVirtualAddressSpaceQuotas756
UserAddressSpaceLayout757
AddressTranslation761
x86VirtualAddressTranslation762
TranslationLook-AsideBuffer768
PhysicalAddressExtension(PAE)769
IA64VirtualAddressTranslation772
x64VirtualAddressTranslation773
PageFaultHandling774
InvalidPTEs775
PrototypePTEs776
In-PagingI/O778
CollidedPageFaults779
ClusteredPageFaults779
PageFiles780
Stacks784
UserStacks785
KernelStacks786
DPCStack787
VirtualAddressDescriptors787
ProcessVADs788
RotateVADs790
NUMA791
SectionObjects792
DriverVerifier799
PageFrameNumberDatabase803
PageListDynamics807
PagePriority809
ModifiedPageWriter812
PFNDataStructures814
PhysicalMemoryLimits818
WindowsClientMemoryLimits819
WorkingSets822
DemandPaging823
LogicalPrefetcher823
PlacementPolicy827
WorkingSetManagement828
BalanceSetManagerandSwapper831
SystemWorkingSet832
MemoryNotificationEvents833
ProactiveMemoryManagement(SuperFetch)836
Components836
TracingandLogging838
Scenarios840
PagePriorityandRebalancing840
RobustPerformance843
ReadyBoost844
ReadyDrive845
Conclusion847

10CacheManager849
KeyFeaturesoftheCacheManager849
Single，CentralizedSystemCache850
TheMemoryManager850
CacheCoherency850
VirtualBlockCaching852
Stream-BasedCaching852
RecoverableFileSystemSupport853
CacheVirtualMemoryManagement854
CacheSize855
CacheVirtualSize855
CacheWorkingSetSize856
CachePhysicalSize858
CacheDataStructures859
SystemwideCacheDataStructures860
Per-FileCacheDataStructures862
FileSystemInterfaces868
CopyingtoandfromtheCache869
CachingwiththeMappingandPinningInterfaces870
CachingwiththeDirectMemoryAccessInterfaces872
FastI/O873
ReadAheadandWriteBehind875
IntelligentRead-Ahead875
Write-BackCachingandLazyWriting877
WriteThrottling885
SystemThreads886
Conclusion887

11FileSystems889
WindowsFileSystemFormats890
CDFS890
UDF891
FAT12，FAT16，andFAT32891
exFAT894
NTFS895
FileSystemDriverArchitecture895
LocalFSDs896
RemoteFSDs897
FileSystemOperation901
FileSystemFilterDrivers907
TroubleshootingFileSystemProblems908
ProcessMonitorBasicvsAdvancedModes908
ProcessMonitorTroubleshootingTechniques909
CommonLogFileSystem910
NTFSDesignGoalsandFeatures918
High-EndFileSystemRequirements918
AdvancedFeaturesofNTFS920
NTFSFileSystemDriver934
NTFSOn-DiskStructure937
Volumes937
Clusters937
MasterFileTable938
FileReferenceNumbers942
FileRecords942
FileNames945
ResidentandNonresidentAttributes948
DataCompressionandSparseFiles951
TheChangeJournalFile956
Indexing960
ObjectIDs961
QuotaTracking962
ConsolidatedSecurity963
ReparsePoints965
TransactionSupport965
NTFSRecoverySupport974
Design975
MetadataLogging976
Recovery981
NTFSBad-ClusterRecovery985
Self-Healing989
EncryptingFileSystemSecurity990
EncryptingaFilefortheFirstTime993
TheDecryptionProcess998
BackingUpEncryptedFiles999
Conclusion1000

12Networking1001
WindowsNetworkingArchitecture1001
TheOSIReferenceModel1001
WindowsNetworkingComponents1003
NetworkingAPIs1006
WindowsSockets1006
WinsockKernel(WSK)1012
RemoteProcedureCall1014
WebAccessAPIs1018
NamedPipesandMailslots1021
NetBIOS1027
OtherNetworkingAPIs1030
MultipleRedirectorSupport1033
MultipleProviderRouter1034
MultipleUNCProvider1037
NameResolution1039
DomainNameSystem1039
WindowsInternetNameService1039
PeerNameResolutionProtocol1039
LocationandTopology1042
NetworkLocationAwareness(NLA)1042
Link-LayerTopologyDiscovery(LLTD)1043
ProtocolDrivers1044
WindowsFilteringPlatform(WFP)1047
NDISDrivers1053
VariationsontheNDISMiniport1057
Connection-OrientedNDIS1057
RemoteNDIS1060
QoS1062
Binding1064
LayeredNetworkServices1066
RemoteAccess1066
ActiveDirectory1066
NetworkLoadBalancing1068
DistributedFileSystemandDFSReplication1069
Conclusion1071

13StartupandShutdown1073
BootProcess1073
BIOSPreboot1073
TheBIOSBootSectorandBootmgr1077
TheEFIBootProcess1086
InitializingtheKernelandExecutiveSubsystems1088
Smss，Csrss，andWininit1094
ReadyBoot1099
ImagesThatStartAutomatically1100
TroubleshootingBootandStartupProblems1101
LastKnownGood1101
SafeMode1101
WindowsRecoveryEnvironment(WinRE)1106
SolvingCommonBootProblems1109
Shutdown1115
Conclusion1118

14CrashDumpAnalysis1119
WhyDoesWindowsCrash?1119
TheBlueScreen1120
TroubleshootingCrashes1124
CrashDumpFiles1125
CrashDumpGeneration1130
WindowsErrorReporting1131
OnlineCrashAnalysis1133
BasicCrashDumpAnalysis1134
Notmyfault1134
BasicCrashDumpAnalysis1135
VerboseAnalysis1137
UsingCrashTroubleshootingTools1139
BufferOverrun，MemoryCorruptions，andSpecialPool1140
CodeOverwriteandSystemCodeWriteProtection1143
AdvancedCrashDumpAnalysis1144
StackTrashes1145
HungorUnresponsiveSystems1147
WhenThereIsNoCrashDump1150
Conclusion1152

Glossary1153
Index1185