فهرست
کتاب Windows Internals 7th edition part 1
- Mark E. Russinovich ,…
- 2017
- 801 صفحه
- 24 مگابایت
- انگلیسی
Table of Content
- Title Page
- Copyright Page
- Dedication Page
- Contents
- Introduction
- Chapter 1 Concepts and tools
- Chapter 2 System architecture
- Chapter 3 Processes and jobs
- Creating a process
- Process internals
- Protected processes
- Minimal and Pico processes
- Trustlets (secure processes)
- Flow of CreateProcess
- Stage 1: Converting and validating parameters and flags
- Stage 2: Opening the image to be executed
- Stage 3: Creating the Windows executive process object
- Stage 4: Creating the initial thread and its stack and context
- Stage 5: Performing Windows subsystem–specific initialization
- Stage 6: Starting execution of the initial thread
- Stage 7: Performing process initialization in the context of the new process
- Terminating a process
- Image loader
- Jobs
- Conclusion
- Chapter 4 Threads
- Creating threads
- Thread internals
- Examining thread activity
- Thread scheduling
- Overview of Windows scheduling
- Priority levels
- Thread states
- Dispatcher database
- Quantum
- Priority boosts
- Context switching
- Scheduling scenarios
- Idle threads
- Thread suspension
- (Deep) freeze
- Thread selection
- Multiprocessor systems
- Thread selection on multiprocessor systems
- Processor selection
- Heterogeneous scheduling (big.LITTLE)
- Group-based scheduling
- Worker factories (thread pools)
- Conclusion
- Chapter 5 Memory management
- Introduction to the memory manager
- Services provided by the memory manager
- Kernel-mode heaps (system memory pools)
- Heap manager
- Virtual address space layouts
- Address translation
- Page fault handling
- Stacks
- Virtual address descriptors
- NUMA
- Section objects
- Working sets
- Page frame number database
- Physical memory limits
- Memory compression
- Memory partitions
- Memory combining
- Memory enclaves
- Proactive memory management (SuperFetch)
- Conclusion
- Chapter 6 I/O system
- Chapter 7 Security
- Security ratings
- Security system components
- Virtualization-based security
- Protecting objects
- The AuthZ API
- Account rights and privileges
- Access tokens of processes and threads
- Security auditing
- AppContainers
- Logon
- User Account Control and virtualization
- Exploit mitigations
- Application Identification
- AppLocker
- Software Restriction Policies
- Kernel Patch Protection
- PatchGuard
- HyperGuard
- Conclusion
- Index