具体描述
《深入解析Windows操作系统(卷2)(英文版•第6版)》是操作系统内核专家Russinovich等人的Windows操作系统原理的最新版著作,针对Windows 7和Windows Server 2008 R2进行了全面的更新,主要讲述Windows的底层关键机制、Windows的核心组件(包括进程/线程/作业,安全性,I/O系统,存储管理、内存管理、缓存管理、文件系统和网络),并分析了启动进程、关机进程以及缓存转储。书中提供了许多实例,读者可以借此更好地理解Windows的内部行为。
作者简介
目录信息
Windows Internals, Sixth Edition, Part 1
(See appendix for Part 1’s table of contents)
Chapter 8 I/O System 1
I/O System Components 1
The I/O Manager 3
Typical I/O Processing 4
Device Drivers 5
Types of Device Drivers 5
Structure of a Driver 12
Driver Objects and Device Objects 14
Opening Devices 19
I/O Processing 25
Types of I/O 25
I/O Request to a Single-Layered Driver 33
I/O Requests to Layered Drivers 40
I/O Cancellation 48
I/O Completion Ports 53
I/O Prioritization 58
Container Notifications 65
Driver Verifier 65
Kernel-Mode Driver Framework (KMDF) 68
Structure and Operation of a KMDF Driver 68
KMDF Data Model 70
KMDF I/O Model 74
User-Mode Driver Framework (UMDF) 78
The Plug and Play (PnP) Manager 81
Level of Plug and Play Support 82
Driver Support for Plug and Play 82
Driver Loading, Initialization, and Installation 84
Driver Installation 94
The Power Manager 98
Power Manager Operation 100
Driver Power Operation 101
Driver and Application Control of Device Power 105
Power Availability Requests 105
Processor Power Management (PPM) 108
Conclusion 123
Chapter 9 Storage Management 125
Storage Terminology 125
Disk Devices 126
Rotating Magnetic Disks 126
Solid State Disks 128
Disk Drivers 131
Winload 132
Disk Class, Port, and Miniport Drivers 132
Disk Device Objects 136
Partition Manager 138
Volume Management 138
Basic Disks 139
Dynamic Disks 141
Multipartition Volume Management 147
The Volume Namespace 153
Volume I/O Operations 159
Virtual Disk Service 160
Virtual Hard Disk Support 162
Attaching VHDs 163
Nested File Systems 163
BitLocker Drive Encryption 163
Encryption Keys 165
Trusted Platform Module (TPM) 168
BitLocker Boot Process 170
BitLocker Key Recovery 172
Full-Volume Encryption Driver 173
BitLocker Management 174
BitLocker To Go 175
Volume Shadow Copy Service 177
Shadow Copies 177
VSS Architecture 177
VSS Operation 178
Uses in Windows 181
Conclusion 186
Chapter 10 Memory Management 187
Introduction to the Memory Manager 187
Memory Manager Components 188
Internal Synchronization 189
Examining Memory Usage 190
Services Provided by the Memory Manager 193
Large and Small Pages 193
Reserving and Committing Pages 195
Commit Limit 199
Locking Memory 199
Allocation Granularity 199
Shared Memory and Mapped Files 200
Protecting Memory 203
No Execute Page Protection 204
Copy-on-Write 209
Address Windowing Extensions 210
Kernel-Mode Heaps (System Memory Pools) 212
Pool Sizes 213
Monitoring Pool Usage 215
Look-Aside Lists 219
Heap Manager 220
Types of Heaps 221
Heap Manager Structure 222
Heap Synchronization 223
The Low Fragmentation Heap 223
Heap Security Features 224
Heap Debugging Features 225
Pageheap 226
Fault Tolerant Heap 227
Virtual Address Space Layouts 228
x86 Address Space Layouts 229
x86 System Address Space Layout 232
x86 Session Space 233
System Page Table Entries 235
64-Bit Address Space Layouts 237
x64 Virtual Addressing Limitations 240
Dynamic System Virtual Address Space Management 242
System Virtual Address Space Quotas 245
User Address Space Layout 246
Address Translation 251
x86 Virtual Address Translation 252
Translation Look-Aside Buffer 259
Physical Address Extension (PAE) 260
x64 Virtual Address Translation 265
IA64 Virtual Address Translation 266
Page Fault Handling 267
Invalid PTEs 268
Prototype PTEs 269
In-Paging I/O 271
Collided Page Faults 272
Clustered Page Faults 272
Page Files 273
Commit Charge and the System Commit Limit 275
Commit Charge and Page File Size 278
Stacks 279
User Stacks 280
Kernel Stacks 281
DPC Stack 282
Virtual Address Descriptors 282
Process VADs 283
Rotate VADs 284
NUMA 285
Section Objects 286
Driver Verifier 292
Page Frame Number Database 297
Page List Dynamics 300
Page Priority 310
Modified Page Writer 314
PFN Data Structures 315
Physical Memory Limits 320
Windows Client Memory Limits 321
Working Sets 324
Demand Paging 324
Logical Prefetcher 324
Placement Policy 328
Working Set Management 329
Balance Set Manager and Swapper 333
System Working Sets 334
Memory Notification Events 335
Proactive Memory Management (Superfetch) 338
Components 338
Tracing and Logging 341
Scenarios 342
Page Priority and Rebalancing 342
Robust Performance 344
ReadyBoost 346
ReadyDrive 348
Unified Caching 348
Process Reflection 351
Conclusion 354
Chapter 11 Cache Manager 355
Key Features of the Cache Manager 355
Single, Centralized System Cache 356
The Memory Manager 356
Cache Coherency 356
Virtual Block Caching 358
Stream-Based Caching 358
Recoverable File System Support 359
Cache Virtual Memory Management 360
Cache Size 361
Cache Virtual Size 361
Cache Working Set Size 361
Cache Physical Size 363
Cache Data Structures 364
Systemwide Cache Data Structures 365
Per-File Cache Data Structures 368
File System Interfaces 373
Copying to and from the Cache 374
Caching with the Mapping and Pinning Interfaces 374
Caching with the Direct Memory Access Interfaces 375
Fast I/O 375
Read-Ahead and Write-Behind 377
Intelligent Read-Ahead 378
Write-Back Caching and Lazy Writing 379
Write Throttling 388
System Threads 390
Conclusion 390
Chapter 12 File Systems 391
Windows File System Formats 392
CDFS 392
UDF 393
FAT12, FAT16, and FAT32 393
exFAT 396
NTFS 397
File System Driver Architecture 398
Local FSDs 398
Remote FSDs 400
File System Operation 407
File System Filter Drivers 413
Troubleshooting File System Problems 415
Process Monitor Basic vs Advanced Modes 415
Process Monitor Troubleshooting Techniques 416
Common Log File System 416
NTFS Design Goals and Features 424
High-End File System Requirements 424
Advanced Features of NTFS 426
NTFS File System Driver 439
NTFS On-Disk Structure 442
Volumes 442
Clusters 442
Master File Table 443
File Record Numbers 447
File Records 447
File Names 449
Resident and Nonresident Attributes 453
Data Compression and Sparse Files 456
The Change Journal File 461
Indexing 464
Object IDs 466
Quota Tracking 466
Consolidated Security 467
Reparse Points 469
Transaction Support 469
NTFS Recovery Support 477
Design 478
Metadata Logging 479
Recovery 483
NTFS Bad-Cluster Recovery 487
Self-Healing 490
Encrypting File System Security 491
Encrypting a File for the First Time 494
The Decryption Process 496
Backing Up Encrypted Files 497
Copying Encrypted Files 497
Conclusion 498
Chapter 13 Startup and Shutdown 499
Boot Process 499
BIOS Preboot 499
The BIOS Boot Sector and Bootmgr 502
The UEFI Boot Process 512
Booting from iSCSI 514
Initializing the Kernel and Executive Subsystems 514
Smss, Csrss, and Wininit 522
ReadyBoot 527
Images That Start Automatically 528
Troubleshooting Boot and Startup Problems 529
Last Known Good 530
Safe Mode 530
Windows Recovery Environment (WinRE) 534
Solving Common Boot Problems 537
Shutdown 542
Conclusion 545
Chapter 14 Crash Dump Analysis 547
Why Does Windows Crash? 547
The Blue Screen 548
Causes of Windows Crashes 549
Troubleshooting Crashes 551
Crash Dump Files 553
Crash Dump Generation 559
Windows Error Reporting 561
Online Crash Analysis 563
Basic Crash Dump Analysis 564
Notmyfault 564
Basic Crash Dump Analysis 565
Verbose Analysis 567
Using Crash Troubleshooting Tools 569
Buffer Overruns, Memory Corruption, and Special Pool 569
Code Overwrite and System Code Write Protection 573
Advanced Crash Dump Analysis 574
Stack Trashes 575
Hung or Unresponsive Systems 577
When There Is No Crash Dump 581
Analysis of Common Stop Codes 585
0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL 585
0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED 586
0x7F - UNEXPECTED_KERNEL_MODE_TRAP 588
0xC5 - DRIVER_CORRUPTED_EXPOOL 590
Hardware Malfunctions 593
Conclusion 594
Appendix: Contents of Windows Internals, Sixth Edition, Part 1 595
Index 599
· · · · · · (收起)
读后感
用户评价
这本书最让我印象深刻的一点,在于它对“抽象层”的解构能力。它没有被表面的抽象所迷惑,而是层层剥开,直达最底层的硬件交互和固件支持。特别是关于安全子系统和权限模型的探讨,作者深入剖析了安全描述符、访问令牌和 SID 的形成与验证过程,这部分内容对于理解现代操作系统的安全边界至关重要。我发现自己对于“信任链”这个概念有了更深刻的认识,理解了为什么某些操作需要内核级别的特权。这本书的语言组织非常精炼,没有多余的修饰词,所有的篇幅都聚焦于知识的传递和逻辑的构建,这对于需要高效吸收信息的专业人士来说,是一种极大的友好。它不是一本让你“读起来很开心”的书,而是一本让你“读完后能力发生质变”的书。它要求你投入专注力,但回报是巨大的——你将获得对一个复杂、庞大系统运行机制的透彻掌控感。
这本书的深度和广度简直是技术爱好者的一场盛宴。我记得我当初翻开第一页的时候,就被作者那种深入骨髓的理解力所折服。他没有停留在表面的API调用或者简单的功能介绍上,而是直接钻进了Windows内核的迷宫,用极其精妙的方式剖析了诸如进程间通信、内存管理和线程调度这些核心机制。读起来,感觉就像是拿到了微软内部的架构蓝图,每一个细节的呈现都充满了逻辑性和洞察力。特别是关于虚拟内存和分页机制的讲解,以前那些模糊不清的概念,经过作者的梳理后,变得清晰无比,甚至让我对操作系统的工作方式有了一种全新的敬畏感。这本书的行文风格是那种老派技术专著的严谨,每一个论点都有详实的上下文支撑,绝不含糊其辞。对于那些想真正弄明白“为什么会这样”的工程师来说,这本书提供的知识深度是无与伦比的,它不仅仅是知识的传递,更是一种思维方式的引导,教会你如何像系统架构师一样去思考问题。
我必须强调这本书在细节处理上的偏执程度。很多作者可能会忽略一些“边缘情况”或者认为读者可以自行查阅文档的地方,但这位作者却选择将这些“犄角旮旯”里的玄机也一并揭示出来。例如,关于系统错误码的解析,或者不同 Windows 版本在特定内核函数行为上的细微差别,这些都是在日常开发中容易被忽略,但在调试深层系统故障时至关重要的信息。作者的写作风格有一种沉稳的力量感,不张扬,但每一句话都掷地有声,充满了技术上的自信。阅读过程中,我常常停下来,思考作者是如何获取到这些底层信息和内部工作流程的。它让我感觉到,技术知识的获取并非易事,需要极强的求真精神和对底层原理的尊重。这本书更像是一份长期研究的结晶,而不是短时间内编撰出来的速成指南,这使得它在众多快速迭代的技术书籍中显得尤为珍贵和耐读。
说实话,这本书的阅读体验简直是酣畅淋漓,尤其是在处理那些晦涩难懂的系统调用细节时。作者的叙述方式极其富有感染力,他仿佛一位经验老到的向导,领着你在错综复杂的代码和数据结构中穿行,总能在最关键的地方提供必要的上下文和背景知识。我特别欣赏他那种“追本溯源”的写作态度,每当我们接触到一个看似复杂的子系统时,他总能回溯到更底层的设计哲学和历史演进,让读者明白这些设计决策背后的权衡取舍。这种历史观和架构观的结合,让这本书的知识体系异常稳固。我花了好几周时间,对照着虚拟机里的实际操作来验证书中的描述,每一次对照都能发现新的乐趣和更深一层的理解。这本书对初学者可能不太友好,因为它要求你有一定的编程基础和对计算机体系结构的基本概念,但对于有志于成为系统级专家的读者而言,它简直就是一本“圣经”,提供了从宏观到微观的完整视角,让你不再是孤立地看一块代码或一个现象,而是将其置于整个操作系统的大图景之中去理解。
这本书的结构安排简直是教科书级别的范例。它不是简单地罗列技术点,而是遵循着一种非常清晰的逻辑递进关系。从基础的数据结构构建开始,逐步过渡到复杂的同步机制,再到对 I/O 模型的深入剖析,每一步都像搭建乐高积木一样,前一个模块为后一个模块的理解打下坚实的基础。我注意到作者在描述一些高并发场景下的竞态条件和死锁问题时,引入了大量的图示和伪代码,这些辅助材料极大地降低了理解复杂逻辑的难度。很多其他书籍在处理并发问题时往往流于表面,但这里,作者毫不留情地展示了底层是如何通过自旋锁、内核信号量等机制来确保数据一致性的。读完关于线程调度策略的那几章后,我甚至开始重新审视我们团队在优化应用性能时的一些假设和策略,这表明书中的内容不仅停留在理论层面,而是具有极强的实践指导意义。它强迫你跳出应用程序的舒适区,去直面操作系统的残酷现实。