深入解析Windows操作系統(tǒng) 卷I（英文版 第7版）

Introduction / 引言\ti
1　Concepts and tools / 第 1章　概念和工具\(yùn)t1
1．1　Windows operating system versions / Windows操作系統(tǒng)版本\t1
1．1．1　Windows 10 and future Windows versions /
Windows 10和后續(xù)Windows版本\t3
1．1．2　Windows 10 and OneCore / Windows 10和Windows系統(tǒng)核心\t3
1．2　Foundation concepts and terms / 基本概念和術(shù)語\t4
1．2．1　Windows API / Windows API\t4
1．2．2　Services， functions， and routines / 服務(wù)、功能和例行程序\t7
1．2．3　Processes / 進(jìn)程\t8
1．2．4　Threads / 線程\t18
1．2．5　Jobs / 作業(yè)\t20
1．2．6　Virtual memory / 虛擬內(nèi)存\t21
1．2．7　Kernel mode vs． user mode / 內(nèi)核模式vs用戶模式\t23
1．2．8　Hypervisor / 虛擬機(jī)管理程序\t27
1．2．9　Firmware / 固件版本\t29
1．3．0　Terminal Services and multiple sessions / 終端服務(wù)和多會話\t29
1．3．1　Objects and handles / 對象和處理\t30
1．3．2　Security / 安全\t31
1．3．3　Registry / 注冊表\t32
1．3．4　Unicode / Unicode編碼\t33
1．3　Digging into Windows internals / 深入挖掘Windows內(nèi)部\t35
1．3．1　Performance Monitor and Resource Monitor /
性能監(jiān)控和資源監(jiān)控\t36
1．3．2　Kernel debugging / 內(nèi)核調(diào)試\t38
1．3．3　Windows Software Development Kit / Windows SDK\t43
1．3．4　Windows Driver Kit / Windows驅(qū)動套件\t43
1．3．5　Sysinternals tools / 五大利器\t44
1．4　結(jié)論\t44
2　System architecture / 第 2章　系統(tǒng)架構(gòu)\t45
2．1　Requirements and design goals / 需求和設(shè)計目標(biāo)\t45
2．2　Operating system model / 操作系統(tǒng)模型\t46
2．3　Architecture overview / 架構(gòu)概述\t47
2．3．1　Portability / 可移植性\t50
2．3．2　Symmetric multiprocessing / 對稱多處理\t51
2．3．3 Scalability / 可擴(kuò)展性\t53
2．3．4　Differences between client and server versions /
客戶端和服務(wù)端版本的差異\t54
2．3．5　Checked build / 已驗證版本\t57
2．4　Virtualization-based security architecture overview /
基于虛擬化技術(shù)的安全架構(gòu)概述\t59
2．5　Key system components / 核心系統(tǒng)組件\t61
2．5．1　Environment subsystems and subsystem DLLs /
環(huán)境子系統(tǒng)和子系統(tǒng)DLL\t62
2．5．2　Other subsystems / 其他子系統(tǒng)\t68
2．5．3　Executive / 執(zhí)行性\t72
2．5．4　Kernel / 內(nèi)核\t75
2．5．5　Hardware abstraction layer / 硬件抽象層\t79
2．5．6　Device drivers / 設(shè)備驅(qū)動\t82
2．5．7　System processes / 系統(tǒng)進(jìn)程\t88
2．6　Conclusion / 結(jié)論\t99
3 Processes and jobs / 第3章　進(jìn)程和作業(yè)\t101
3．1　Creating a process / 創(chuàng)建一個進(jìn)程\t101
3．1．1 CreateProcess* functions arguments / CreateProcess*函數(shù)參數(shù)\t102
3．1．2 Creating Windows modern processes / 創(chuàng)建Windows進(jìn)程\t103
3．1．3 Creating other kinds of processes / 創(chuàng)建其他類型線程\t104
3．2 Process internals / 進(jìn)程核心\t105
3．3 Protected processes / 受保護(hù)的進(jìn)程\t113
3．3．1 Protected Process Light (PPL) / PPL\t115
3．3．2 Third-party PPL support / 第三方PPL支持\t119
3．4 Minimal and Pico processes / 最小進(jìn)程和微進(jìn)程\t120
3．4．1 Minimal processes / 最小進(jìn)程\t120
3．4．2 Pico processes / 微進(jìn)程\t121
3．5 Trustlets (secure processes) / Trustlets（安全進(jìn)程）\t123
3．5．1 Trustlet structure / Trustlet結(jié)構(gòu)\t123
3．5．2 Trustlet policy metadata / Trustlet策略元數(shù)據(jù)\t124
3．5．3 Trustlet attributes / Trustlet屬性\t125
3．5．4 System built-in Trustlets / 系統(tǒng)內(nèi)置Trustlets\t125
3．5．5 Trustlet identity / Trustlet標(biāo)識\t126
3．5．6 Isolated user-mode services / 隔離的用戶模式服務(wù)\t127
3．5．7 Trustlet-accessible system calls / Trustlet可訪問的系統(tǒng)調(diào)用\t128
3．6 Flow of CreateProcess / 創(chuàng)建進(jìn)程流程\t129
3．6．1 Stage 1： Converting and validating parameters andflags /
階段1：轉(zhuǎn)換并驗證參數(shù)和標(biāo)記\t131
3．6．2 Stage 2： Opening the image to be executed /
階段2：打開要執(zhí)行的鏡像\t135
3．6．3 Stage 3： Creating the Windows executive process object /
階段3：創(chuàng)建Windows可執(zhí)行進(jìn)程對象\t138
3．6．4 Stage 4： Creating the initial thread and its stack and context /
階段4：創(chuàng)建初始線程以及它的堆棧和上下文\t144
3．6．5 Stage 5： Performing Windows subsystem–specific initialization /
階段5：執(zhí)行Windows子系統(tǒng)的特殊初始化\t146
3．6．6 Stage 6： Starting execution of the initial thread /
階段6：開始執(zhí)行初始線程\t148
3．6．7 Stage 7： Performing process initialization in the context of the new process /
階段7：在新進(jìn)程中的上下文執(zhí)行進(jìn)程初始化\t148
3．7 Terminating a process / 終止一個進(jìn)程\t154
3．8 Image loader / 鏡像加載器\t155
3．8．1 Early process initialization / 早期進(jìn)程初始化\t157
3．8．2 DLL name resolution and redirection / DLL名稱解析和重定向\t160
3．8．3 Loaded module database / 已加載組件的數(shù)據(jù)庫\t164
3．8．4 Import parsing / 導(dǎo)入解析\t168
3．8．5 Post-import process initialization / 后導(dǎo)入進(jìn)程初始化\t170
3．8．6 SwitchBack / SwitchBack\t171
3．8．7 API Sets / API集\t173
3．9 Jobs / 作業(yè)\t176
3．9．1 Job limits / 作業(yè)限制\t177
3．9．2 Working with a job / 處理一個作業(yè)\t178
3．9．3 Nested jobs / 嵌套作業(yè)\t179
3．9．4 Windows containers (server silos) /
Windows容器（服務(wù)器倉庫）\t183
3．10 Conclusion / 結(jié)論\t191
4 Threads / 第4章　線程\t193
4．1 Creating threads / 創(chuàng)建線程\t193
4．2 Thread internals / 線程內(nèi)部\t194
4．2．1 Data structures / 數(shù)據(jù)結(jié)構(gòu)\t194
4．2．2 Birth of a thread / 線程的產(chǎn)生\t206
4．3 Examining thread activity / 檢查線程活性\t207
4．3．1 Limitations on protected process threads /
受保護(hù)進(jìn)程中線程的限制\t212
4．4 Thread scheduling / 線程調(diào)度\t214
4．4．1 Overview of Windows scheduling / Windows調(diào)度概述\t214
4．4．2 Priority levels / 優(yōu)先級等級\t215
4．4．3 Thread states / 線程狀態(tài)\t223
4．4．4 Dispatcher database / 調(diào)度數(shù)據(jù)庫\t228
4．4．5 Quantum / 量子\t231
4．4．6 Priority boosts / 提高優(yōu)先級\t238
4．4．7 Context switching / 上下文切換\t255
4．4．8 Scheduling scenarios / 調(diào)度場景\t256
4．4．9 Idle threads / 空閑線程\t260
4．4．10 Thread suspension / 線程掛起\t264
4．4．11 (Deep) freeze / （深度）凍結(jié)\t264
4．4．12 Thread selection / 線程選擇\t266
4．4．13 Multiprocessor systems / 多處理器系統(tǒng)\t268
4．4．14 Thread selection on multiprocessor systems /
多處理器系統(tǒng)的線程選擇\t283
4．4．15 Processor selection / 處理器選擇\t284
4．4．16 Heterogeneous scheduling (big．LITTLE) /
多重調(diào)度（big．LITTLE）\t286
4．5 Group-based scheduling / 基于組的調(diào)度\t287
4．5．1 Dynamic fair share scheduling / 動態(tài)公平共享調(diào)度\t289
4．5．2 CPU rate limits / CPU速率限制\t292
4．5．3 Dynamic processor addition and replacement /
動態(tài)處理器添加和替換\t295
4．6 Worker factories (thread pools) / 工人工廠（線程池）\t297
4．6．1 Worker factory creation / 創(chuàng)建工人工廠\t298
4．7 Conclusion / 結(jié)論\t300
5 Memory management / 第5章　內(nèi)存管理\t301
5．1 Introduction to the memory manager / 內(nèi)存管理介紹\t301
5．1．1 Memory manager components / 內(nèi)存管理組件\t302
5．1．2 Large and small pages / 大小頁面\t303
5．1．3 Examining memory usage / 檢查內(nèi)存使用\t305
5．1．4 Internal synchronization / 內(nèi)部同步\t308
5．2 Services provided by the memory manager / 內(nèi)存管理提供的服務(wù)\t309
5．2．1 Page states and memory allocations / 頁面狀態(tài)和內(nèi)存分配\t310
5．2．2 Commit charge and commit limit / 提交調(diào)度和提交限制\t313
5．2．3 Locking memory / 鎖定內(nèi)存\t314
5．2．4 Allocation granularity / 分配粒度\t314
5．2．5 Shared memory and mapped files / 共享內(nèi)存和映射文件\t315
5．2．6 Protecting memory / 內(nèi)存保護(hù)\t317
5．2．7 Data Execution Prevention / 數(shù)據(jù)執(zhí)行保護(hù)\t319
5．2．8 Copy-on-write / 寫時復(fù)制\t321
5．2．9 Address Windowing Extensions / 地址窗口化擴(kuò)展\t232
5．3 Kernel-mode heaps (system memory pools) / 內(nèi)核模式堆（系統(tǒng)內(nèi)存池）\t324
5．3．1 Pool sizes / 池大小\t325
5．3．2 Monitoring pool usage / 監(jiān)控池的使用\t327
5．3．3 Look-aside lists / 旁觀列表\t331
5．4 Heap manager / 堆管理\t332
5．4．1 Process heaps / 堆進(jìn)程\t333
5．4．2 Heap types / 堆類型\t334
5．4．3 The NT heap / NT堆\t334
5．4．4 Heap synchronization / 堆同步\t334
5．4．5 The low-fragmentation heap / 低碎片堆\t335
5．4．6 The segment heap / 分段堆\t336
5．4．7 Heap security features / 堆安全功能\t341
5．4．8 Heap debugging features / 堆調(diào)試功能\t342
5．4．9 Pageheap / 頁面堆\t343
5．4．10 Fault-tolerant heap / 容錯堆\t347
5．5 Virtual address space layouts / 虛擬地址空間布局\t348
5．5．1 x86 address space layouts / X86地址空間布局\t349
5．5．2 x86 system address space layout / X86系統(tǒng)地址空間布局\t352
5．5．3 x86 session space / X86會話空間\t353
5．5．4 System page table entries / 系統(tǒng)頁面表條目\t355
5．5．5 ARM address space layout / ARM地址空間布局\t356
5．5．6 64-bit address space layout / 64bit地址空間布局\t357
5．5．7 x64 virtual addressing limitations / 64虛擬地址限制\t359
5．5．8 Dynamic system virtual address space management /
動態(tài)系統(tǒng)虛擬地址空間管理\t359
5．5．9 System virtual address space quotas / 系統(tǒng)虛擬地址空間配額\t364
5．5．10 User address space layout / 用戶地址空間布局\t365
5．6 Address translation / 地址轉(zhuǎn)化\t371
5．6．1 x86 virtual address translation / X86虛擬地址轉(zhuǎn)化\t371
5．6．2 Translation look-aside buffer / 旁觀緩沖轉(zhuǎn)化\t377
5．6．3 x64 virtual address translation / X64虛擬地址轉(zhuǎn)化\t380
5．6．4 ARM virtual address translation / ARM虛擬地址轉(zhuǎn)化\t381
5．7 Page fault handling / 頁面錯誤處理\t383
5．7．1 Invalid PTEs / 非法PTE\t384
5．7．2 Prototype PTEs / 原型PTE\t385
5．7．3 In-paging I/O / 頁面內(nèi)I/O\t386
5．7．4 Collided page faults / 頁面錯誤沖突\t387
5．7．5 Clustered page faults / 頁面錯誤聚集\t387
5．7．6 Page files / 頁面文件\t389
5．7．7 Commit charge and the system commit limit /
提交調(diào)度和系統(tǒng)提交限制\t394
5．7．8 Commit charge and page file size / 提交調(diào)度和頁面文件大小\t397
5．8 Stacks / 棧\t398
5．8．1 User stacks / 用戶棧\t399
5．8．2 Kernel stacks / 內(nèi)核棧\t400
5．8．3 DPC stack / DPC棧\t401
5．9 Virtual address descriptors / 虛擬地址描述符\t401
5．9．1 Process VADs / VAD進(jìn)程\t402
5．9．2 Rotate VADs / VAD輪詢\t403
5．10 NUMA / NUMA\t404
5．11 Section objects / 段對象\t405
5．12 Working sets / 工作集\t412
5．12．1 Demand paging / 分頁需求\t413
5．12．2 Logical prefetcher and ReadyBoot / 邏輯預(yù)取和啟動準(zhǔn)備\t413
5．12．3 Placement policy / 安置策略\t416
5．12．4 Working set management / 工作集管理\t417
5．12．5 Balance set manager and swapper / 平衡集合管理器和置換器\t421
5．12．6 System working sets / 系統(tǒng)工作集\t422
5．12．7 Memory notification events / 內(nèi)存提醒事件\t423
5．13 Page frame number database / 頁面框架序號數(shù)據(jù)庫\t425
5．13．1 Page list dynamics / 頁面動態(tài)列表\t428
5．13．2 Page priority / 頁面優(yōu)先級\t436
5．13．3 Modified page writer and mapped page writer /
修改和映射頁面寫入\t438
5．13．4 PFN data structures / PFN數(shù)據(jù)結(jié)構(gòu)\t440
5．13．5 Page file reservation / 頁面文件預(yù)定\t443
5．14 Physical memory limits / 物理內(nèi)存限制\t446
5．14．1 Windows client memory limits / Windows客戶端內(nèi)存限制\t447
5．15 Memory compression / 內(nèi)存壓縮\t449
5．15．1 Compression illustration / 壓縮圖表\t450
5．15．2 Compression architecture / 壓縮架構(gòu)\t453
5．16 Memory partitions / 內(nèi)存分割\t456
5．17 Memory combining / 內(nèi)存聯(lián)合\t459
5．17．1 The search phase / 尋找階段\t460
5．17．2 The classifi cation phase / 分類階段\t461
5．17．3 The page combining phase / 頁面聯(lián)合階段\t462
5．17．4 From private to shared PTE / 從私有PTE到共享PTE\t462
5．17．5 Combined pages release / 聯(lián)合頁面釋放\t464
5．18 Memory enclaves / 內(nèi)存區(qū)\t467
5．18．1 Programmatic interface / 編程接口\t468
5．18．2 Memory enclave initializations / 內(nèi)存區(qū)初始化\t469
5．18．3 Enclave construction / 區(qū)結(jié)構(gòu)\t469
5．18．4 Loading data into an enclave / 將數(shù)據(jù)加載到區(qū)\t471
5．18．5 Initializing an enclave / 初始化一個區(qū)\t472
5．19 Proactive memory management (SuperFetch) /
主動內(nèi)存管理（SuperFetch）\t472
5．19．1 Components / 組件\t473
5．19．2 Tracing and logging / 跟蹤和記錄\t474
5．19．3 Scenarios / 場景\t475
5．19．4 Page priority and rebalancing / 頁面優(yōu)先級和平衡調(diào)整\t476
5．19．5 Robust performance / 魯棒性能\t478
5．19．6 ReadyBoost / 啟動準(zhǔn)備\t479
5．19．7 ReadyDrive / 驅(qū)動準(zhǔn)備\t480
5．19．8 Process refl ection / 進(jìn)程反射\t480
5．20 Conclusion / 結(jié)論\t482
6 I/O system / 第6章　I/O系統(tǒng)\t483
6．1 I/O system components / I/O系統(tǒng)組件\t483
6．1．1 The I/O manager / I/O管理器\t485
6．1．2 Typical I/O processing / 典型I/O過程\t486
6．2 Interrupt Request Levels and Deferred Procedure Calls /
中斷請求級別和延遲過程喚醒\t488
6．2．1 Interrupt Request Levels / 中斷請求級別\t488
6．2．2 Deferred Procedure Calls / 延遲過程喚醒\t490
6．3 Device drivers / 設(shè)備驅(qū)動\t492
6．3．1 Types of device drivers / 設(shè)備驅(qū)動類型\t492
6．3．2 Structure of a driver / 驅(qū)動結(jié)構(gòu)\t498
6．3．3 Driver objects and device objects / 驅(qū)動對象和設(shè)備對象\t500
6．3．4 Opening devices / 設(shè)備打開\t507
6．4 I/O processing / I/O過程\t510
6．4．1 Types of I/O / I/O的種類\t511
6．4．2 I/O request packets / I/O請求包\t513
6．4．3 I/O request to a single-layered hardware-based driver /
基于單層硬件驅(qū)動的I/O請求\t525
6．4．4 I/O requests to layered drivers / 分層驅(qū)動I/O請求\t533
6．4．5 Thread-agnostic I/O / 未知線程I/O\t536
6．4．6 I/O cancellation / 取消I/O\t537
6．4．7 I/O completion ports / I/O完成端口\t541
6．4．8 I/O prioritization / I/O優(yōu)先級\t546
6．4．9 Container notifications / 容器提醒\t552
6．5 Driver Verifier / 驅(qū)動驗證\t552
6．5．1 I/O-related verification options / I/O相關(guān)驗證選項\t554
6．5．2 Memory-related verification options / 內(nèi)存相關(guān)驗證選項\t555
6．6 The Plug and Play manager / 即插即用管理器\t559
6．6．1 Level of Plug and Play support / 即插即用支持級別\t560
6．6．2 Device enumeration / 設(shè)備枚舉\t561
6．6．3 Device stacks / 設(shè)備棧\t563
6．6．4 Driver support for Plug and Play / 支持即插即用的設(shè)備\t569
6．65 Plug-and-play driver installation / 即插即用驅(qū)動安裝\t571
6．7 General driver loading and installation / 一般驅(qū)動的加載和安裝\t575
6．7．1 Driver loading / 驅(qū)動加載\t575
6．7．2 Driver installation / 驅(qū)動安裝\t577
6．8 The Windows Driver Foundation / Windows驅(qū)動基礎(chǔ)\t578
6．8．1 Kernel-Mode Driver Framework / 內(nèi)核模式驅(qū)動框架\t579
6．8．2 User-Mode Driver Framework / 用戶模式驅(qū)動框架\t587
6．9 The power manager / 電源管理\t590
6．9．1 Connected Standby and Modern Standby / 連接待機(jī)和新版待機(jī)\t594
6．9．2 Power manager operation / 電源管理操作\t595
6．9．3 Driver power operation / 驅(qū)動電源操作\t596
6．9．4 Driver and application control of device power /
驅(qū)動和設(shè)備電源的應(yīng)用程序控制\t599
6．9．5 Power management framework / 電源管理框架\t600
6．9．6 Power availability requests / 電源可用性請求\t602
6．10 Conclusion / 結(jié)論\t603
7 Security / 第7章　安全\t605
7．1 Security ratings / 安全評級\t605
7．1．1 Trusted Computer System Evaluation Criteria /
可信計算基系統(tǒng)評估標(biāo)準(zhǔn)\t605
7．1．2 The Common Criteria / 普遍標(biāo)準(zhǔn)\t607
7．2 Security system components / 安全系統(tǒng)組件\t608
7．3 Virtualization-based security / 基于虛擬化的安全\t611
7．3．1 Credential Guard / 證書防護(hù)\t612
7．3．2 Device Guard / 設(shè)備防護(hù)\t617
7．4 Protecting objects / 保護(hù)對象\t619
7．4．1 Access checks / 訪問驗證\t621
7．4．2 Security identifiers / 安全標(biāo)識\t625
7．4．3 Virtual service accounts / 虛擬服務(wù)賬戶\t646
7．4．4 Security descriptors and access control / 安全描述符和訪問控制\t650
7．4．5 Dynamic Access Control / 動態(tài)訪問控制\t666
7．5 The AuthZ API / AuthZ API\t666
7．5．1 Conditional ACEs / 條件響應(yīng)ACE\t667
7．6 Account rights and privileges / 賬戶權(quán)限和特權(quán)\t668
7．6．1 Account rights / 賬戶權(quán)限\t669
7．6．2 Privileges / 特權(quán)\t670
7．6．3 Super privileges / 超級特權(quán)\t675
7．7 Access tokens of processes and threads / 進(jìn)程和線程的賬戶口令\t677
7．8 Security auditing / 安全審計\t677
7．8．1 Object access auditing / 對象訪問審計\t679
7．8．2 Global audit policy / 全局審計策略\t682
7．8．3 Advanced Audit Policy settings / 高級審計策略設(shè)置\t683
7．9 AppContainers / 應(yīng)用容器\t684
7．9．1 Overview of UWP apps / UWP應(yīng)用概述\t685
7．9．2 The AppContainer / 應(yīng)用容器\t687
7．10 Logon / 登錄\t710
7．10．1 Winlogon initialization / Winlogon初始化\t711
7．10．2 User logon steps / 用戶登錄步驟\t713
7．10．3 Assured authentication / 確信的認(rèn)證\t718
7．10．4 Windows Biometric Framework / Windows生物識別驗證\t719
7．10．5 Windows Hello / Windows你好\t721
7．11 User Account Control and virtualization / 用戶賬戶控制和虛擬化\t722
7．11．1 File system and registry virtualization /
文件系統(tǒng)和注冊表虛擬化\t722
7．11．2 Elevation / 提升\t729
7．12 Exploit mitigations / 攻擊緩解\t735
7．12．1 Process-mitigation policies / 進(jìn)程緩解策略\t735
7．12．2 Control Flow Integrity / 控制流完整性\t740
7．12．3 Security assertions / 安全斷言\t752
7．13 Application Identifi cation / 應(yīng)用程序標(biāo)識\t756
7．14 AppLocker / 應(yīng)用鎖\t757
7．15 Software Restriction Policies / 軟件限制策略\t762
7．16 Kernel Patch Protection / 內(nèi)核補(bǔ)丁保護(hù)\t764
7．17 PatchGuard / 補(bǔ)丁防護(hù)\t765
7．18 HyperGuard / 高度防護(hù)\t768
7．19 Conclusion / 結(jié)論\t770
Index / 索引\t771