深入解析Windows操作系統(tǒng)

前言

It's both a pleasure and an honor for me to write the foreword for this latest edition ofWindows Internals. Many significant changes have occurred in Windows since the last editionof the book, and David, Mark, and Alex have done an excellent job of updating the book toaddress them. Whether you are new to Windows internals or an old hand at kernel develop-ment, you will find lots of detailed analysis and examples to help improve your understand-ing of the core mechanisms of Windows as well as the general principles of operating systemdesign.Today, Windows enjoys unprecedented breadth and depth in the computing world. Variantsof the original Windows NT design run on everything from Xbox game consoles to desktopand laptop computers to clusters of servers with dozens of processors and petabytes of stor-age. Advances such as hypervisors, 64-bit computing, multicore and many-core processordesigns, flash-based storage, and wireless and peer-to-peer networking continue to provideplenty of interesting and innovative areas for operating system design.One such area of innovation is security. Over the past decade, the entire computing indus-try——and Microsoft in particular——has been confronted with huge new threats, and securityhas become the top issue facing many of our customers. Attacks such as Blaster and Sasserthreatened to bring the entire Internet to its knees, and Windows was at the eye of the hur-ricane. It was obvious to us that we could no longer afford to do business as usual, as manyof the usability and simplicity features designed into Windows were being used to attack itfor nefarious reasons. At first the hackers were teenagers trying to gain notoriety by breakinginto systems or adding graffiti to a corporate Web site, but pretty soon the attacks intensifiedand went underground. The hackers became more sophisticated and evaded inspection. Yourarely see headlines about viruses and worms these days, but make no mistakembotnets andidentity theft are big business today, as are industrial and government espionage throughtargeted attacks.

內(nèi)容概要

　　本書是操作系統(tǒng)內(nèi)核專家Mark Russinovich和David Solomon的Windows操作系統(tǒng)原理的最新版著作，針對Windows Vista和Windows Server 2008進行了全面的更新，主要講述Windows的底層關(guān)鍵機制，Windows的核心組件（包括進程/線程/作業(yè)、安全性、I/O系統(tǒng)、存儲管理、內(nèi)存管理、緩存管理、文件系統(tǒng)和網(wǎng)絡(luò)），并分析了啟動進程、關(guān)機進程以及緩存轉(zhuǎn)儲。書中提供了許多實例，讀者可以借此更好地理解 Windows的內(nèi)部行為?！　”緯鴥?nèi)容豐富、信息全面，適合眾多 Windows平臺開發(fā)人員、系統(tǒng)管理員閱讀。

作者簡介

Mark E.Russlnovich  微軟技術(shù)院士（Technical Fellow）。享譽世界的Windows內(nèi)核技術(shù)專家。他也是Sysinternals的創(chuàng)建者之一。開發(fā)了很多用于Windows管理和診斷的工具。

書籍目錄

1　Concepts and Tools　　　Windows Operating System Versions　　　Foundation Concepts and Terms　　　　Windows API　　　　Services, Functions, and Routines　　　　Processes, Threads, and Jobs　　　　Virtual Memory　　　　Kernel Mode vs User Mode　　　　Terminal Services and Multiple Sessions　　　　Objects and Handles　　　　Security　　　　Registry　　　　Unicode　　　Digging into Windows Internals　　　　Reliability and Performance Monitor　　　　Kernel Debugging　　　　Windows Software Development Kit　　　　Windows Driver Kit　　　　Sysinternals Tools　　　Conclusion　2　System Architecture　　　Requirements and Design Goals　　　Operating System Model　　　Architecture Overview　　　　Portability　　　　Symmetric Multiprocessing　　　　Scalability　　　　Differences Between Client and Server Versions　　　　Checked Build　　　Key System Components　　　　Environment Subsystems and Subsystem DLLs　　　　Ntdll dll　　　　Executive　　　　Kernel　　　　Hardware Abstraction Layer　　　　Device Drivers　　　　System Processes　　　Conclusion　3　System Mechanisms　　　Trap Dispatching　　　　Interrupt Dispatching　　　　Exception Dispatching　　　　System Service Dispatching　　　Object Manager　　　　Executive Objects　　　　Object Structure　　　Synchronization　　　　High-IRQL Synchronization　　　　Low-IRQL Synchronization　　　System Worker Threads　　　Windows Global Flags　　　Advanced Local Procedure Calls (ALPCs)　　　Kernel Event Tracing　　　Wow64　　　　Wow64 Process Address Space Layout　　　　System Calls　　　　Exception Dispatching　　　　User Callbacks　　　　File System Redirection　　　　Registry Redirection and Reflection　　　　I/O Control Requests　　　　16-Bit Installer Applications　　　　Printing　　　　Restrictions　　　User-Mode Debugging　　　　Kernel Support　　　　Native Support　　　　Windows Subsystem Support　　　Image Loader　　　　Early Process Initialization　　　　Loaded Module Database　　　　Import Parsing　　　　Post Import Process Initialization　　　Hypervisor (Hyper-V)　　　　Partitions　　　　Root Partition　　　　Child Partitions　　　　Hardware Emulation and Support　　　Kernel Transaction Manager　　　Hotpatch Support　　　Kernel Patch Protection　　　Code Integrity　　　Conclusion　4　Management Mechanisms　5　Processes, Threads, and Jobs　6　Security　7　I/O System　8　Storage Management9　Memory Management　10　Cache Manager　11　File Systems　12　Networking　13　Startup and Shutdown　14　Crash Dump Analysis　Glossary　Index　

章節(jié)摘錄

插圖：Because the flag responsible for special kernel APC delivery disabling （and the guardedregion functionality） was not added until Windows Server 2003, most drivers do not yettake advantage of guarded mutexes. Doing so would raise compatibility issues with earlierversions of Windows, which require a recompiled driver making use only of fast mutexes.Internally, however, the Windows kernel has replaced almost all uses of fast mutexes withguarded mutexes, as the two have identical semantics and can be easily interchanged.Another problem related to the guarded mutex was the kernel function KeAreApcsDisabled.Prior to Windows Server 2003, this function indicated whether normal APCs were disabled bychecking if the code was running inside a critical section. In Windows Server 2003, this func-tion was changed to indicate whether the code was in a critical, or guarded, region, changingthe functionality to also return TRUE if special kernel APCs are also disabled.Because there are certain operations that drivers should not perform when special ker-nel APCs are disabled, it makes sense to call KeGetCurrentlrql to check whether the IRQLis APC level or not, which is the only way special kernel APCs could have been disabled.However, because the memory manager makes use of guarded mutexes instead, thischeck fails because guarded mutexes do not raise IRQL. Drivers should therefore callKeAreAIIApcsDisabled for this purpose. This function checks whether special kernel APCs aredisabed and/or whether the IRQL is APC level-the sure-fire way to detect both guardedmutexes and fast mutexes.

媒體關(guān)注與評論

“在微軟，我們一直用本書培訓(xùn)新員工……如果你和我一樣，想要深入理解Windows。本書將是一個絕佳的起點?！薄　　猈indows之父Jim AIIchin “每一位真正的操作系統(tǒng)開發(fā)人員都應(yīng)該擁有本書?！?　　——微軟技術(shù)院士、Windows NT首席設(shè)計WDavid Cutler “我想不出還有哪一本書能比本書更具權(quán)威性?！?　　——微軟公司副總裁Ben Fathi

編輯推薦

《深入解析Windows操作系統(tǒng)(第5版.英文版)》：近20年來，無論是開發(fā)人員還是系統(tǒng)管理員。如果想探究Windows核心部件的運作機理或者各種技術(shù)細節(jié)，都會求助于這部毋庸置疑的權(quán)威著作。書中深入透徹地闡述了Windows底層的方方面面，包括系統(tǒng)架構(gòu)，各種系統(tǒng)機制和管理機制，進程、線程和作業(yè)，安全，I/O系統(tǒng)，存儲管理、內(nèi)存管理和緩存管理，文件系統(tǒng)。聯(lián)網(wǎng)。啟動與停機，崩潰轉(zhuǎn)儲分析等內(nèi)容，使Windows的內(nèi)幕一目了然。《深入解析Windows操作系統(tǒng)(第5版.英文版)》作者陣容空前強大，除了Russinovich幣llSolomon兩位大師之外，還新增了年輕一代最具實力的Windows內(nèi)核專家lonescu。與上一版相比，本版修訂篇幅超過25％，除針對Windows Visla和Windows Server 2008新特性《PatchGuard、Hyper-V支持、內(nèi)核事務(wù)管理器、I／O優(yōu)先級等)進行了全面更新外。作者也對之前未涉及或者闡述不夠的既有技術(shù)進行了挖掘，包括映像加載程序、用戶態(tài)調(diào)試框架、64位調(diào)用表和壓縮等。更充分運用了自己編寫的流行工具Process Explorer和Process Monitor更新了大量實驗和示例。這一切都使《深入解析Windows操作系統(tǒng)(第5版.英文版)》更趨完美。Windows之父Allchin，Windows NT首席設(shè)計師Cutler，微軟公司副總裁Fathi聯(lián)袂推薦。微軟官方Windows權(quán)威著作最新版，深入剖析Windows技術(shù)內(nèi)幕，大幅更新，涵蓋Windows內(nèi)核新特性。

圖書封面

圖書標簽Tags

無

評論、評分、閱讀與下載

---

    深入解析Windows操作系統(tǒng) PDF格式下載

---