出版時(shí)間:2009.9 出版社:人民郵電出版社 作者:Mark Russinovich,David A. Solomon,Alex Ionescu 頁數(shù):1232
Tag標(biāo)簽:無
前言
It's both a pleasure and an honor for me to write the foreword for this latest edition ofWindows Internals. Many significant changes have occurred in Windows since the last editionof the book, and David, Mark, and Alex have done an excellent job of updating the book toaddress them. Whether you are new to Windows internals or an old hand at kernel develop-ment, you will find lots of detailed analysis and examples to help improve your understand-ing of the core mechanisms of Windows as well as the general principles of operating systemdesign.Today, Windows enjoys unprecedented breadth and depth in the computing world. Variantsof the original Windows NT design run on everything from Xbox game consoles to desktopand laptop computers to clusters of servers with dozens of processors and petabytes of stor-age. Advances such as hypervisors, 64-bit computing, multicore and many-core processordesigns, flash-based storage, and wireless and peer-to-peer networking continue to provideplenty of interesting and innovative areas for operating system design.One such area of innovation is security. Over the past decade, the entire computing indus-try——and Microsoft in particular——has been confronted with huge new threats, and securityhas become the top issue facing many of our customers. Attacks such as Blaster and Sasserthreatened to bring the entire Internet to its knees, and Windows was at the eye of the hur-ricane. It was obvious to us that we could no longer afford to do business as usual, as manyof the usability and simplicity features designed into Windows were being used to attack itfor nefarious reasons. At first the hackers were teenagers trying to gain notoriety by breakinginto systems or adding graffiti to a corporate Web site, but pretty soon the attacks intensifiedand went underground. The hackers became more sophisticated and evaded inspection. Yourarely see headlines about viruses and worms these days, but make no mistakembotnets andidentity theft are big business today, as are industrial and government espionage throughtargeted attacks.
內(nèi)容概要
本書是操作系統(tǒng)內(nèi)核專家Mark Russinovich和David Solomon的Windows操作系統(tǒng)原理的最新版著作,針對(duì)Windows Vista和Windows Server 2008進(jìn)行了全面的更新,主要講述Windows的底層關(guān)鍵機(jī)制,Windows的核心組件(包括進(jìn)程/線程/作業(yè)、安全性、I/O系統(tǒng)、存儲(chǔ)管理、內(nèi)存管理、緩存管理、文件系統(tǒng)和網(wǎng)絡(luò)),并分析了啟動(dòng)進(jìn)程、關(guān)機(jī)進(jìn)程以及緩存轉(zhuǎn)儲(chǔ)。書中提供了許多實(shí)例,讀者可以借此更好地理解 Windows的內(nèi)部行為?! ”緯鴥?nèi)容豐富、信息全面,適合眾多 Windows平臺(tái)開發(fā)人員、系統(tǒng)管理員閱讀。
作者簡(jiǎn)介
Mark E.Russlnovich 微軟技術(shù)院士(Technical Fellow)。享譽(yù)世界的Windows內(nèi)核技術(shù)專家。他也是Sysinternals的創(chuàng)建者之一。開發(fā)了很多用于Windows管理和診斷的工具。
書籍目錄
1 Concepts and Tools Windows Operating System Versions Foundation Concepts and Terms Windows API Services, Functions, and Routines Processes, Threads, and Jobs Virtual Memory Kernel Mode vs User Mode Terminal Services and Multiple Sessions Objects and Handles Security Registry Unicode Digging into Windows Internals Reliability and Performance Monitor Kernel Debugging Windows Software Development Kit Windows Driver Kit Sysinternals Tools Conclusion 2 System Architecture Requirements and Design Goals Operating System Model Architecture Overview Portability Symmetric Multiprocessing Scalability Differences Between Client and Server Versions Checked Build Key System Components Environment Subsystems and Subsystem DLLs Ntdll dll Executive Kernel Hardware Abstraction Layer Device Drivers System Processes Conclusion 3 System Mechanisms Trap Dispatching Interrupt Dispatching Exception Dispatching System Service Dispatching Object Manager Executive Objects Object Structure Synchronization High-IRQL Synchronization Low-IRQL Synchronization System Worker Threads Windows Global Flags Advanced Local Procedure Calls (ALPCs) Kernel Event Tracing Wow64 Wow64 Process Address Space Layout System Calls Exception Dispatching User Callbacks File System Redirection Registry Redirection and Reflection I/O Control Requests 16-Bit Installer Applications Printing Restrictions User-Mode Debugging Kernel Support Native Support Windows Subsystem Support Image Loader Early Process Initialization Loaded Module Database Import Parsing Post Import Process Initialization Hypervisor (Hyper-V) Partitions Root Partition Child Partitions Hardware Emulation and Support Kernel Transaction Manager Hotpatch Support Kernel Patch Protection Code Integrity Conclusion 4 Management Mechanisms 5 Processes, Threads, and Jobs 6 Security 7 I/O System 8 Storage Management9 Memory Management 10 Cache Manager 11 File Systems 12 Networking 13 Startup and Shutdown 14 Crash Dump Analysis Glossary Index
章節(jié)摘錄
插圖:Because the flag responsible for special kernel APC delivery disabling (and the guardedregion functionality) was not added until Windows Server 2003, most drivers do not yettake advantage of guarded mutexes. Doing so would raise compatibility issues with earlierversions of Windows, which require a recompiled driver making use only of fast mutexes.Internally, however, the Windows kernel has replaced almost all uses of fast mutexes withguarded mutexes, as the two have identical semantics and can be easily interchanged.Another problem related to the guarded mutex was the kernel function KeAreApcsDisabled.Prior to Windows Server 2003, this function indicated whether normal APCs were disabled bychecking if the code was running inside a critical section. In Windows Server 2003, this func-tion was changed to indicate whether the code was in a critical, or guarded, region, changingthe functionality to also return TRUE if special kernel APCs are also disabled.Because there are certain operations that drivers should not perform when special ker-nel APCs are disabled, it makes sense to call KeGetCurrentlrql to check whether the IRQLis APC level or not, which is the only way special kernel APCs could have been disabled.However, because the memory manager makes use of guarded mutexes instead, thischeck fails because guarded mutexes do not raise IRQL. Drivers should therefore callKeAreAIIApcsDisabled for this purpose. This function checks whether special kernel APCs aredisabed and/or whether the IRQL is APC level-the sure-fire way to detect both guardedmutexes and fast mutexes.
媒體關(guān)注與評(píng)論
“在微軟,我們一直用本書培訓(xùn)新員工……如果你和我一樣,想要深入理解Windows。本書將是一個(gè)絕佳的起點(diǎn)?!薄 猈indows之父Jim AIIchin “每一位真正的操作系統(tǒng)開發(fā)人員都應(yīng)該擁有本書。” ——微軟技術(shù)院士、Windows NT首席設(shè)計(jì)WDavid Cutler “我想不出還有哪一本書能比本書更具權(quán)威性?!? ——微軟公司副總裁Ben Fathi
編輯推薦
《深入解析Windows操作系統(tǒng)(第5版.英文版)》:近20年來,無論是開發(fā)人員還是系統(tǒng)管理員。如果想探究Windows核心部件的運(yùn)作機(jī)理或者各種技術(shù)細(xì)節(jié),都會(huì)求助于這部毋庸置疑的權(quán)威著作。書中深入透徹地闡述了Windows底層的方方面面,包括系統(tǒng)架構(gòu),各種系統(tǒng)機(jī)制和管理機(jī)制,進(jìn)程、線程和作業(yè),安全,I/O系統(tǒng),存儲(chǔ)管理、內(nèi)存管理和緩存管理,文件系統(tǒng)。聯(lián)網(wǎng)。啟動(dòng)與停機(jī),崩潰轉(zhuǎn)儲(chǔ)分析等內(nèi)容,使Windows的內(nèi)幕一目了然。《深入解析Windows操作系統(tǒng)(第5版.英文版)》作者陣容空前強(qiáng)大,除了Russinovich幣llSolomon兩位大師之外,還新增了年輕一代最具實(shí)力的Windows內(nèi)核專家lonescu。與上一版相比,本版修訂篇幅超過25%,除針對(duì)Windows Visla和Windows Server 2008新特性《PatchGuard、Hyper-V支持、內(nèi)核事務(wù)管理器、I/O優(yōu)先級(jí)等)進(jìn)行了全面更新外。作者也對(duì)之前未涉及或者闡述不夠的既有技術(shù)進(jìn)行了挖掘,包括映像加載程序、用戶態(tài)調(diào)試框架、64位調(diào)用表和壓縮等。更充分運(yùn)用了自己編寫的流行工具Process Explorer和Process Monitor更新了大量實(shí)驗(yàn)和示例。這一切都使《深入解析Windows操作系統(tǒng)(第5版.英文版)》更趨完美。Windows之父Allchin,Windows NT首席設(shè)計(jì)師Cutler,微軟公司副總裁Fathi聯(lián)袂推薦。微軟官方Windows權(quán)威著作最新版,深入剖析Windows技術(shù)內(nèi)幕,大幅更新,涵蓋Windows內(nèi)核新特性。
圖書封面
圖書標(biāo)簽Tags
無
評(píng)論、評(píng)分、閱讀與下載