windows internals 2c 6th ed 2c vol 2 2012 0241

NOTE Part 2 available Fall 2012 See Table of Contents inside Part 2 Russinovich Solomon Ionescu Operating Systems/ Windows ISBN: 978-0-7356-4873-9 About the Authors Mark Russinovich

NOTE

Part 2 available Fall 2012

See Table of Contents inside

Part 2

Russinovich Solomon

Ionescu

Operating Systems/

Windows

ISBN: 978-0-7356-4873-9

About the Authors Mark Russinovich is a Technical Fellow in

the Windows Azure™ group at Microsoft

He is coauthor of Windows Sysinternals

Administrator’s Reference, co-creator of the

Sysinternals tools available from Microsoft

TechNet, and coauthor of the Windows Internals

book series

David A Solomon is coauthor of the

Windows Internals book series and has taught

his Windows internals class to thousands of developers and IT professionals worldwide,

including Microsoft staff He is a regular speaker

at Microsoft conferences, including TechNet and PDC

Alex Ionescu is a chief software architect and

consultant expert in low-level system software, kernel development, security training, and

reverse engineering He teaches Windows internals courses with David Solomon, and is

active in the security research community

The definitive guide—fully updated for Windows 7

and Windows Server 2008 R2

Delve inside Windows architecture and internals—and see how core

components work behind the scenes Led by a team of internationally

renowned internals experts, this classic guide has been fully updated

for Windows 7 and Windows Server® 2008 R2—and now presents its

coverage in two volumes

As always, you get critical, insider perspectives on how Windows

operates And through hands-on experiments, you’ll experience its

internal behavior firsthand—knowledge you can apply to improve

application design, debugging, system performance, and support

In Part 2, you will:

• Understand how core system and management mechanisms

work—including object manager, synchronization, Wow64,

Hyper-V®, and the registry

• Examine the data structures and activities behind processes,

threads, and jobs

• Go inside the Windows security model to see how it manages

access, auditing, and authorization

• Explore the Windows networking stack from top to bottom—

including APIs, BranchCache, protocol and NDIS drivers, and

layered services

• Dig into internals hands-on using the kernel debugger,

performance monitor, and other tools

PA R T 2

microsoft.com/mspress

U.S.A $39.99

Canada $41.99

[Recommended]

See inside cover

DEVELOPER ROADMAP

Step by Step

• For experienced developers learning a new topic

• Focus on fundamental techniques and tools

• Hands-on tutorial with practice files plus eBook

Start Here!

• Beginner-level instruction

• Easy to follow explanations and examples

• Exercises to build your first projects

Developer Reference

• Professional developers; intermediate to advanced

• Expertly covers essential topics and techniques

• Features extensive, adaptable code examples

S I X T H E D I T I O N

Focused Topics

• For programmers who develop complex or advanced solutions

• Specialized topics; narrow focus; deep coverage

• Features extensive, adaptable code examples

Internals

Part 2

6 S I X T H

E D I T I O N

Mark Russinovich David A Solomon

Alex Ionescu

spine = 1.2”

Cyan Magenta Yellow Black

PUBLISHED BY

Microsoft Press

A Division of Microsoft Corporation

One Microsoft Way

Redmond, Washington 98052-6399

Copyright © 2012 by David Solomon and Mark Russinovich

All rights reserved No part of the contents of this book may be reproduced or transmitted in any form or by any means without the written permission of the publisher

Library of Congress Control Number: 2012933511

ISBN: 978-0-7356-6587-3

Printed and bound in the United States of America

First Printing

Microsoft Press books are available through booksellers and distributors worldwide If you need support related

to this book, email Microsoft Press Book Support at mspinput@microsoft.com Please tell us what you think of this book at http://www.microsoft.com/learning/booksurvey

Microsoft and the trademarks listed at http://www.microsoft.com/about/legal/en/us/IntellectualProperty/ Trademarks/EN-US.aspx are trademarks of the Microsoft group of companies All other marks are property of their respective owners

The example companies, organizations, products, domain names, email addresses, logos, people, places, and events depicted herein are fictitious No association with any real company, organization, product, domain name, email address, logo, person, place, or event is intended or should be inferred

This book expresses the authors’ views and opinions The information contained in this book is provided without any express, statutory, or implied warranties Neither the authors, Microsoft Corporation, nor its resellers, or distributors will be held liable for any damages caused or alleged to be caused either directly or indirectly by this book

Acquisitions Editor: Devon Musgrave

Developmental Editor: Devon Musgrave

Project Editor: Carol Dillingham

Editorial Production: Curtis Philips

Technical Reviewer: Christophe Nasarre; Technical Review services provided by Content Master,

a member of CM Group, Ltd

Copyeditor: John Pierce

Indexer: Jan Wright

Cover: Twist Creative • Seattle

To our parents, who guided and inspired us to follow our dreams

Contents at a Glance

Windows Internals, Sixth Edition, Part 1 (available separately)

Windows Internals, Sixth Edition, Part 2

who literally wrote the book on Windows internals! SIT DOWN WITH THE EXPERTS

“These videos drill into the core of the platform, capture its technical essence and present it in a powerful interactive video format.”–Rob Short, Vice President Core Technologies,

Microsoft Corporation

If you liked their book, you’ll love hearing them in person Get one of their video tutorials

or come to a live class.

LIVE, INSTRUCTOR LED CLASSES

If you’re an IT professional deploying

and supporting Windows servers and

workstations, you need to be able to

dig beneath the surface when things go

wrong In our classes, you’ll gain a deep

understanding of the internals of the

operating system and how to leverage

advanced troubleshooting tools to

solve system and application problems

and understand performance issues

more effectively Attend a public class

or schedule a private on site seminar

at your location For dates, course

de-tails, pricing, and registration

informa-tion, see www.solsem.com.

“The information given

in this class should be

required for all Windows

engineers/administrators.”

“This course holds the

key to understanding

Windows.”

“Should be required

train-ing for anyone responsible

for Windows software

development,

visit www.solsem.com or email videos@solsem.com

INTERACTIVE DVD TUTORIAL

Sit down with the experts who literally wrote the book on Win-dows internals WinWin-dows Internals COMPLETE consists of 12 hours of interactive training taking you under the hood of the operating system to learn how the kernel components work As the ultimate compliment, Microsoft Corporation licensed these videos for their corporate training worldwide

The Sysinternals Video Library (also

12 hours) covers essential Windows troubleshooting topics such as crash dump analysis and memory trouble-shooting as well as how to leverage key Sysinternals tools.

What do

you think of

this book?

We want to hear from you!

To participate in a brief online survey, please visit:

Tell us how well this book meets your needs —what works effectively, and what we can

do better Your feedback will help us continually improve our books and learning

resources for you

Thank you in advance for your input!

microsoft.com/learning/booksurvey

SurvPage_Corp_02.indd 1 5/19/2011 4:18:12 PM