Вы находитесь на странице: 1из 672

. , . , .

Microsoft Windows. 6- .

-
. , .
.
.
.
.
.
. , .
.

32.973.2-018.2
004.451
. , . , .
89  Microsoft Windows. 6- . .
.: , 2014. 672 .: . ( -).
ISBN 978-5-496-00791-7

Microsoft Windows 7, Windows Server 2008 R2.
Windows: -, , -
, .
. , -
, , Windows.
12+ ( 12 . 29 2010 . 436-.)

ISBN 978-0735665873 . Authorized Russian translation of the English edition of


Windows Internals, 6th Edition. Part 2 2012 by David A.
Solomon and Mark Russinovich (ISBN 9780735665873).
Thistranslation is published and sold by permission of OReilly
Media, Inc., which owns or controls all rights to publish and sell
the same.
ISBN 978-5-496-00791-7 , 2014
 ,
, 2014

OReilly Media, Inc. .


.
, , , -
. , , -
,
.

, 192102, -, . (. ), . 3, , . 7.
005-93, 2; 95 3005 .
24.03.14. 70100/16. . . . 54,180. 1200.

. 142300, , , . , . , . 1.
! ,
. .
2013 .
:
1.
2.
3.
4.
5. ,
6.
7.

. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 15

8. - . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. ..21
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .21
- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .24
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .26
WDM- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .27
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .32
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 35
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .40
-. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 47
- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 47
-. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 47
- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .48
- , , . .. .. .. .. .. 49
-. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 50
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .50
IRP- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 52
IRP-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .54
6

- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .55
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .57
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .59
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .61
- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .62
-. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 69
- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .70
-, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .71
- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. 72
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .74
IoCompletion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .75
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .77
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .80
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 80
- (
-) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .83
- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 84
( -). . . . .86
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .87
Driver Verifier . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 87
KMDF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
KMDF-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .90
KMDF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .92
- KMDF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .97
UMDF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100
PnP-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104
Plug and Play. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 105
Plug and Play . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105
, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107
Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 119
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 125
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126
. .. .. .. .. 130
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 130
. . . . . . . . . . . . . . . . . . . . . . . 133
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 134
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 138
/ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
7

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 139
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 149

9. . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 151
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 151
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 152
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 152
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 152
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 154
- NAND. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155
Trim. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 156
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 158
Winload. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 158
, -. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159
iSCSI- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 160
MPIO- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 163
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 165
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
MBR . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166
GPT . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 167
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 168
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 169
LDM. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 169
LDM GPT MBR. .. .. .. .. .. .. .. .. .. .. .. .. .. 173
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 175
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 175
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 176
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 177
RAID-5. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 179
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 180
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 181
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 182
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 183
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 187
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 188
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 190
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 191
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
BitLocker. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 192
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 197
BitLocker . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
8

BitLocker . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 201
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 202
BitLocker . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 204
BitLocker To Go. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 205
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 207
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 207
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 207
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 207
VSS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
VSS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 208
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 210
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 212
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 212
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 213
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 216

10. . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 217
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 217
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 218
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 220
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 224
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 224
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 227
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 230
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 231
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 232
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 235
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 237
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 242
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 244
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 245
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 248
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 249
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 251
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 255
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 258
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 259
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 260
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 261
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 262
pageheap . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 265
9

x86 . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 267
x86. . . . . . . . . . . . . . . . . . . . . . . . . . . 270
x86. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273
64- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 274
x64. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278
16- Windows x64 . .. .. .. .. .. .. .. .. .. .. .. .. .. 278
. . . . . . . . . 281
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 284
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 286
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
ASLR . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 290
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 290
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 292
x86. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 292
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 296
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 297
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 299
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 300
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 300
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 302
x64. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 306
IA64 . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 308
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 309
PTE- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 310
PTE-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 312
- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 315
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 315
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 316
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 318
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 319
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 323
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 325
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 326
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 327
DPC-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 328
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 328
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 329
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
NUMA. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 331
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 333
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 340
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 345
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 349
10

. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 359
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 362
PFN-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 364
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 370
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 371
32- . . . . . . . . . . . . . . . . . 372
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 375
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 376
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 380
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 381
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 385
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 386
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 387
() . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 390
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 390
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 393
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 394
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 395
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . 397
ReadyBoost. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 400
ReadyDrive. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 402
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 405
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 409

11. . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 410
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 410
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 411
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 411
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 412
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 413
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 414
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 415
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 417
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 417
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 418
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 419
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 421
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 422
, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 425
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 431
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 432
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . 433
11

-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 433
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 435
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 436
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 437
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
. . . . . . . . . . . . . . . . . 445
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 445
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 446
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 448
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 449

12. . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 450
Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 451
CDFS. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 451
UDF. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
FAT12, FAT16 FAT32. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 452
exFAT. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 456
NTFS . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 456
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 457
FSD-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 458
FSD-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 459
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 461
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 467
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 468
. . . . . . . . . . . . . . . . . . . . . 472
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 473
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . 473
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 474
Process Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 474
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 476
ProcessMonitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 476
Process Monitor. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 477
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 478
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 478
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 479
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 481
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 482
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 483
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 484
LSN- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 485
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 486
NTFS . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 487
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 487
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487
12

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
NTFS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 488
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 489
Unicode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 491
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 492
() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 493
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 495
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 496
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 498
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 498
POSIX. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 499
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 501
NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 502
NTFS- . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 505
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 506
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 507
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 511
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 514
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 518
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 521
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 522
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 524
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 526
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 526
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 529
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 531
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 531
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 533
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 535
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 536
API- . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 538
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 539
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 541
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 543
NTFS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 544
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 545
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 546
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 546
13

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 548
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 551
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 551
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 552
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 553
NTFS. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. . 555
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 559
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 560
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 563
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 564
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 565
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 566
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 567

13. . .. .. .. .. .. .. .. .. .. .. .. .. 568
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568
BIOS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 568
BIOS Bootmgr. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 572
UEFI-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 587
iSCSI-. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 588
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 589
Smss, Csrss Wininit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 597
ReadyBoot. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 603
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 603
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 605
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 606
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 608
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 608
Windows . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 609
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 613
MBR. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 613
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614
BCD. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 614
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 615
System. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 617
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 617
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 619
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 622

14. . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 623
Windows ?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 623
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 624
Windows. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 625
14

. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 627
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 629
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 635
Microsoft . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 638
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 639
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 640
Notmyfault . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 641
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 642
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 643
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 645
, . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 646
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 649
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 651
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 652
, . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 654
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 659
-. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662
0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 662
0x8E KERNEL_MODE_EXCEPTION_NOT_HANDLED. .. .. .. .. .. .. .. .. .. .. .. .. .. 664
0x7F UNEXPECTED_KERNEL_MODE_TRAP. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 665
0xC5 DRIVER_CORRUPTED_EXPOOL . .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 667
. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 670
. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 671

. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. .. 672

IT (-
), -
Microsoft Windows7
Windows Server2008R2.
Windows.
,
, -
-
. ,
Windows , .


. ,
, -
Windows .
1 , ,
, -
.
. -
: -, ,
, -, , -, .
, -,
, -
, .
, -
.

, Inside Windows NT
(Microsoft Press,1992) (Helen Custer)
Microsoft Windows NT3.1. WindowsNT


1
., . Microsoft Windows. 6- . .: ,
2013. I. . .
16

. , Inside Win-
dowsNT (Microsoft Press, 1998), .
WindowsNT4.0, .
, Inside Windows 2000 (Microsoft Press, 2000),
. -
,
, ,
.
Windows2000, Windows (WDM), Plug and
Play, , Windows (WMI),
, . ,
Windows Internals (
Windows, , 2008), , -
, IT-
Windows. ,
, Windows Sysinternals (www.microsoft.com/
technet/sysinternals), . , Windows
Internals, Windows Vista Windows Server2008.
, ,
Hyper-V.


Win-
dows7 Windows Server2008R2.
.

,
, , Sysinternals Winsider Seminars&
Solutions, Windows. B
, - Windows
,
. , -
: , Windows
, .


Windows . , -
.
17

, COM+, -
Windows,
.NET Framework, .
Windows, ,
, -
, ,
, Windows.

B ,
Windows,
-
. (, Windows API
.)
, ,
, ,
.
-
Windows. , ,
(, , ),
Windows.

(Jamie Hanrahan)
(Brian Catlin) Azius, LLC
.
, , -
, ,
. Azius Win-
dows . www.azius.com.
(Alex Ionescu),
. -
.
(Daniel Pearson), -
.
.
(Eric Traut) (Jon DeVaan) -
Windows
Windows, .
, (Arun Kishan),
(Landy Wang) (Aaron Margosis),
18

. !
.

, -
Microsoft Windows.
, :
(Greg Cottingham);
(Joe Hamburg);
(Jeff Lambert);
(Pavel Lebedinsky);
(Joseph East);
(Adi Oltean);
(Alexey Pakhunov);
(Valerie See);
(Brad Waters);
(Bruce Worthington);
(Robin Alexander);
(Bernard Ourghanlian).
(Scott Lee), (Tim Shoultz)
(Eric Kratzer) .

(Gianluigi Nusca) (Tom Jolly),
. ,
BranchCache ( -
). ,
( ), .
, :
(Roopesh Battepati);
(Molly Brown);
(Greg Cottingham);
(Dotan Elharrar);
(Eric Hanson);
(Tom Jolly);
(Manoj Kadam);
(Greg Kramer);
(David Kruse);
19

(Jeff Lambert);
(Darene Lewis);
(Dan Lovinger);
(Gianluigi Nusca);
(Amos Ortal);
(Ivan Pashov);
(Ganesh Prasad);
(Paul Swan);
(Shiva Kumar Thangapandi).
-
NAP, EAP.
(Gerard Murphy)
Windows7 .
(Tristan Brown) Power Management Mi-
crosoft ,
, .
(Apurva Doshi) -
, Windows7 .
,
.
(Matthieu Suiche) ,
-
, , .
(Cenk Ergan), (Michel Fortin)
(Mehmet Iyigun) .
, (Christophe Nasarre), -
,
.
(Ilfak Guilfanov) Hex-
Rays (www.hex-rays.com) IDAProAdvanced
Hex-Rays, Windows.
, Microsoft
Press, . (Devon Musgrave)
,
(Carol Dillingham) -
.
(Curtis Philips), (John Pierce),
(Andrea Fox).
,
(Ben Ryan), Microsoft Press,
Windows!
20


, .
, ,
Microsoft Press:
http://go.microsoft.com/FWLink/?Linkid=258649


, ,
comp@piter.com ( , ).
!
- http://www.piter.com
.
1
8 . -

- Windows
, -
.
, , -,
. ,
-, ,
Plug and Play (PnP), .
- .
, ,
. -
. ,
.

-
- Windows
() (, -
) , :

( Windows 6
I).
- -
.

.

,
.

, .
Plug and Play
,
.

! , .

1

.
2013 .
22 8 . -


.
, FAT, CDFS,
UDF NTFS (
12).
WMI (Windows Management Instrumenta-
tion Windows)
WMI-
WMI- ( WMI 4 I).
- Windows
(.8.1).

Windows-


WMI- PnP-

(Setupapi.dll)



-
WDM WMI PnP -
-

. 8.1. -

- ; -
,
,
.
- 23

, ,
-. ,
, read write, -
, , .
- , -
,
.
- ,
.
PnP- - -
, .
, -
. PnP-
.
, ,
PnP,
PnP- .
- PnP-
.
, .
Windows (WMI),
WMI- Windows (Windows Driver Model, WDM),
,
WMI- WDMWMI (
WMI 4 I).
-
,
( 4 I).
( .inf)
, . -
, ,
,
.
, WHQL (Microsoft Windows
Hardware Quality Lab), .cat.
INF-.
(Hardware Abstraction Layer, HAL)

, ,
. B , HAL
,
.
24 8 . -

-
- -
(I/Omanager), -
. .
- (I/ORequest Packets,
IRP), . (
- , IRP-
.) -

. , IRP-, ,
(
).
- IRP-
. IRP
. , IRP, -
-,
, .
IRP- -
,
-. -
. , - ,
.
,
. --
, .
- -, -
(, Windows POSIX)
. ,
-,
.
- -
.
,
;
. ( -), -
.
, , -
Windows ,
, , -.
- .

-
-
-. , ,
- 25

(, );
-,
HAL.
, Windows
.
-,
( , , ).

, -
. (open, close, read, write) -
. -
.
( Windows, POSIX) ,
, , --
, . -

. 8.2
-.

API


-(Ntxxx)


 - (Ioxxx)


(Io,Ex,Ke,
Mm,Hal, 
FsRtl 
..)

HAL-
-

. 8.2. -

,
, , , ,
26 8 . -

-. PnP-
.


-
,
-
. Windows
.


Windows -
.
. , -
. ,
. Windows
:
Windows -
,
. ,
(USB) Usbprint.sys.
, UMDF (User-Mode Driver Frame-
work), ,
. UMDF
ALPC. UMDF.
, .
:
(file system drivers)
- -
.
PnP- (Plug and Play drivers) -
PnP-.
, ,
.
, Plug and Play (Non-Plug
and Play drivers),
. , PnP-
,
. -
27

, 4 I
Process Monitor.

.

WDM-
WDM- , WDM
(Windows Driver Model). WDM , -
Plug and Play Windows.
PnP- WDM.
:
(bus drivers) .
PCMCIA, PCI, USB IEEE1394. -
PnP-,
.
(function drivers) -
.
PnP-. ,
.
.
(filter drivers) ,
.
. ,

, .
WDM- -
. (
), PnP- -
,
.
.


,
, -
. WDM- ,
,
:
(class drivers) -
, , -
, ,
.
28 8 . -

- (miniclass drivers) -, -
. ,
Microsoft,
(Uninterruptible Power Supplies, UPS) -

, -.

(DLL) IRP- -
.



DLL



1

2
-


-


3 



(-)

4 



5 



. 8.3.

29

(port drivers) -
-, SATA. -
, .
Microsoft, , ,
, -
.
.
- . -
, NDIS , Dxgport/Videoprt
DirectX/video.
- (miniport drivers) -
. ,
, .
-
. -, -
(DLL)
IRP-.
,
.
.

. ( -)
.
. -
.8.3.
.
- , ,
, -
( )
.
-,
.
-
,
-.
, , .

, , .8.4.
( .9.3 9.) -
9.
30 8 . -



DLL


1

2
-


-

3 



(-)

4 





5 




6

3

7
3

. 8.4.
31

:

Msinfo32.exe Run (),
Start (). Software Environment ( )
System Drivers ( )
. Yes () Started ().

-
Process Explorer, Windows Sysinternals (http://www.microsoft.
com/technet/sysinternals). System
Process View Lower Pane ViewDLLs.
32 8 . -

Process Explorer , ,
( ),
(, -
Process Explorer).

, , ( )
lmkv:

lkd> lm kv
start end module name
82007000 823c0000 nt (pdb symbols)
c:\programming\symbols\ntkrpamp.pdb\37D328E3BAE5460F8E662756ED80951D2\ntkrpamp.
pdb
Loaded symbol image file: ntkrpamp.exe
Image path: ntkrpamp.exe
Image name: ntkrpamp.exe
Timestamp: Fri Jan 18 21:30:58 2008 (47918B12)
CheckSum: 00372038
ImageSize: 003B9000
File version: 6.0.6001.18000
Product version: 6.0.6001.18000
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Windows Operating System
InternalName: ntkrpamp.exe
OriginalFilename: ntkrpamp.exe
ProductVersion: 6.0.6001.18000
FileVersion: 6.0.6001.18000 (longhorn_rtm.080118-1840)
FileDescription: NT Kernel & System
LegalCopyright: Microsoft Corporation. All rights reserved.
823c0000 823f3000 hal (deferred)
Image path: halmacpi.dll
Image name: halmacpi.dll
Timestamp: Fri Jan 18 21:27:20 2008 (47918A38)
CheckSum: 0003859F
ImageSize: 00033000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0
82600000 82671000 ksecdd (deferred)
Image path: \SystemRoot\System32\Drivers\ksecdd.sys
Image name: ksecdd.sys
Timestamp: Fri Jan 18 21:41:20 2008 (47918D80)
CheckSum: 0006E742
ImageSize: 00071000
Translations: 0000.04b0 0000.04e0 0409.04b0 0409.04e0


-. -
,
. .8.5.
33


- 
-

-


-

. 8.5.

. -
- ,
GSDriverEntry WDK.
( cookie),
DriverEntry, .
-
.
. PnP-
. PnP- ,
, .
, ,
, .
. .
, , ,
, .
-, , -
IRP- .
-. -
, . -
, -
-. IRP-
, , .
, ,

, .
34 8 . -

. -
, -
(Interrupt Service Routine, ISR). - Windows
(Device
Interrupt Request Level, DIRQL),
. IRQL-
3 I. ISR- -
(DPC) IRQL-
( DPC/dispatch). (
, ,
.)
. , -
ISR-, . DPC-
IRQL- ( DPC/dispatch),
ISR-,
. DPC-
-
.
,
.8.5:
-.
- (I/O completion routines),
IRP- -
. , - --
,
.

, .
-. - -
, --
(cancel I/O routines). IRP- , ,
IRP-,
,
.

(, CancelIo), - -
IRP , .
, IRP,
IRP .
. ,
( 11),
, (fast
dispatch routines),
35

-. , , ,
,
-, . -

.
,
.
. , ,
(unload routine), --
. ,
, (DriverEntry).
,
,
.
.
.
. (,
)
(error-logging routines) -,
.


, , C.
Windows Driver Kit8.0
C++ C++ . -
,
,
x86, x64 IA64.


(
-) -
, -
. , -
,
. :
.
- ( )
.

,
36 8 . -

IRP-.
-, -
.
-
(DriverEntry),
.
IoCreateDevice IoCreateDevice
Secure ,
. -
PnP-
, , PnP-
. ,
Plug and Play,
- .
- -
.
.
(
3 I). -
-.
\Device ,
WindowsAPI.


, \Device. -
, IDE- IDE- IDE-
\Device\Ide.
9.

,
\Global?? \Device.
( \?? 3 I.) ,
Plug and Play, -
(, \Device\Hardware2).
,
PnP- IoRegisterDeviceInterface -
.
(GUID), . 128-
GUID- Uuidgen, -
WDK WindowsSDK. 128 ,
, GUID-
.
IoRegisterDeviceInterface ,
. - -
, , -
37

.
PnP- , ,
IRP_MJ_PNP, IRP_MN_START_DEVICE.
, , -
GUID-, PnP- -
, SetupDiEnumDeviceInterfaces
GUID- -
.
, ,
SetupDiGetDeviceInterfaceDetail
SetupDiEnumDeviceInterfaces . ,
Windows- CreateFile,
.

:
\Device
WinObj Sysinternals !object -
. -
, .

!object \Device :

lkd> !object \Device


Object: 8b611b88 Type: (84d10d40) Directory
ObjectHeader: 8b611b70 (old version)
HandleCount: 0 PointerCount: 365
Directory Object: 8b602470 Name: Device
Hash Address Type Name
---- ------- ---- ----
00 85557a00 Device KsecDD
855589d8 Device Ndis
8b6151b0 SymbolicLink {941D252A-0BDA-4772-B3CB-30697579BD4A}
86859030 Device 0000009b

38 8 . -

88c92da8 Device SrvNet


886723f0 Device Beep
8b71fb90 SymbolicLink ScsiPort2
84d17a98 Device 00000032
84d15f00 Device 00000025
84d13030 Device 00000019
01 86d44030 Device NDMP10
8d291eb0 SymbolicLink {E85EEE75-32E3-4A94-8905-52709C2C9BCC}
886da3c8 Device Netbios
86862030 Device 0000009c
84d177c8 Device 00000033
84d15c70 Device 00000026
02 86de9030 Device NDMP11
84d19320 Device 00000040
88633ca0 Device NetBT_Tcpip_{033C65A4-C1D6-4824-B420-DDAEADFF873E}
8b7dcdd0 SymbolicLink Ip
84d17500 Device 00000034
84d159a8 Device 00000027
03 86df3380 Device NDMP12
8515ede0 Device WMIAdminDevice
84d1a030 Device 00000041
8862e040 Device Video0
86eaec28 Device KeyboardClass0
84d03b00 Device KMDF0
84d17230 Device 00000035
84d156e0 Device 00000028
04 86e0d030 Device NDMP13
86e65030 Device NDMP20
85541030 Device VolMgrControl
86e6c358 Device Tun0
84d1ad68 Device 00000042
8862ec48 Device Video1
88e15158 Device 0000009f
9badd848 SymbolicLink MailslotRedirector
86e1d488 Device KeyboardClass1
...

!object - ,
,
. -,
. ,
- .

.8.6, ,
- ,
.
,
.
.
. ( .8.6
IRP-.)
.
, -
39

. ,
, .
.
-
, , .



1

2

-

,
- - -


() ( (
) )

. 8.6.

:

!drvobj !devobj .
:

lkd> !drvobj kbdclass


Driver object (86e379a0) is for:
\Driver\kbdclass
Driver Extension List: (id , addr)

Device Object list:


86e1d488 86eaec28

lkd> !devobj 86eaec28


Device object (86eaec28) is for:
KeyboardClass0 \Driver\kbdclass DriverObject 86e379a0
Current Irp 00000000 RefCount 0 Type 0000000b Flags 00002044
DevExt 86eaece0 DevObjExt 86eaedc0

40 8 . -

ExtensionFlags (0x00000800)
Unknown flags 0x00000800
AttachedDevice (Upper) 86e15a40 \Driver\ctrl2cap
AttachedTo (Lower) 86e15020 \Driver\i8042prt
Device queue is not busy

, !devobj
, (-
AttachedTo), , (
AttachedDevice).

-
.
, .


, , -
Windows
, ,
, ,
, .
-,
Windows, . (
3 I, 6 I -
.)
,
, -
. .8.1 -
.
FILE_OBJECT WDM.h.

8.1.

, -
, CreateFileAPI
(
-)
- ,
, , -

- ,
,
..
,

41


,

(Volume Parameter
Block, VPB)
- , -
- / .
,
, (, , -
)
- -
,
. -
10
- (.-
)
(IRP) ( .)
-
- -,
-
- (.)
,

,


,
, -
. .8.2.

8.2.

- -
. IoGetTransac-
tionParameterBlock
,
.
IoCreateFileEx IoCreateFileSpecifyDeviceObjectHint
-
- -
(
-). SetFileIoOverlappedRange
,
-
. IoCreateFileEx


42 8 . -

8.2 ()


- (.), -
, -
. SetFileBand-
widthReservation
-
(
).
,
, -
.
NTFS,
12


- .
.8.7.
C -
fopen (1), , , Windows- CreateFile (2).
DLL ( Kernel32.dll) Windows
Ntdll.dll NtCreateFile (3). ,
,
NtCreateFile Ntoskrnl.exe (4). (
3 I.)
, IoCreateFile -
.


, .
UNIX-,
(vnodes), Windows .
.

, , -
, (Access Control
List, ACL). - ,
, ACL ,
.
(5, 6).

, ,
43

. -
. (
6 I.)

Windows-
1
Windows
DLL-
- Windows
C DLL

4
5
-




- -


. 8.7.

:
, , -
. Process Explorer.
View Lower Pane ViewHandles.
Type
, . File.
44 8 . -

Csrss ,
(Ksecdd.sys) .
.
( -
0xD4), Csrss.exe 512(0x200):

lkd> !handle d4 f 200

Searching for Process with Cid == 200


PROCESS fffffa800bf35b30
SessionId: 0 Cid: 0200 Peb: 7fffffd8000 ParentCid: 0188
DirBase: 1dba50000 ObjectTable: fffff8a000f28d80 HandleCount: 630.
Image: csrss.exe

Handle table at fffff8a000f28d80 with 630 entries in use

00d4: Object: fffffa800c9cc9f0 GrantedAccess: 00100001 Entry: fffff8a001409350


Object: fffffa800c9cc9f0 Type: (fffffa800737a080) File
ObjectHeader: fffffa800c9cc9c0 (new version)
HandleCount: 1 PointerCount: 1

,
!fileobj:

lkd> !fileobj fffffa800c9cc9f0

Device Object: 0xfffffa8007da1550 \Driver\KSecDD


Vpb is NULL
Event signalled

Flags: 0x40002
Synchronous IO
Handle Created
CurrentByteOffset: 0
45


, , .
, ,
.

. , -

.
, .
, .
, (
Windows- DuplicateHandle)
. -
, .
,
. , , -

, . , ,
,
-
. Windows-
LockFile.
, -
. , \Device\HarddiskVolume1\Myfile.dat
Myfile.dat C. \Device\HarddiskVolume1
, . Myfile.dat
-
HarddiskVolume1.
. ,
, -
HarddiskVolume1. , -
Windows-,
, \Global??.
Windows.
, ,
Windows- . -
Windows-,
QueryDosDevice DefineDosDevice.

: Windows-

, Win-
dows, WinObj, Sysinternals.
\Global??.

46 8 . -

.
C Properties.
.

, C
\Device\HarddiskVolume3, .
WinObj COM1
\Device\Serial0 ..
subst.
- 47

-
, ,
, ,
. -
.
,
, . , ,
- .
-.

-
. , -
-,
IRP-.
.

-
-, , -
( ); ,

.
. Windows-
ReadFile WriteFile . -
, -.
-
, . -
,
-. -
Windows- CreateFile FILE_FLAG_OVERLAPPED.
, -
, -
.
-, (
, -
), .
, --
, , ;

-. -
, , -
. -
.8.8. ,
48 8 . -

FILE_FLAG_OVERLAPPED
NtReadFile .

NTReadFile()

NTReadFile()

SYSENTER (x86)
SYSCALL (x64)


NtReadFile()

. 8.8. -

-
HasOverlappedIoCompleted. -
- GetQueuedCompletionStatus
GetQueuedCompletionStatusEx.

-
- -
IRP-
. - 11 12.
-, -
, PFAST_IO_DISPATCH .
- 49

:
-
!drvobj -, -
.
,
, .
- -
NTFS:

lkd> !drvobj \FileSystem\Ntfs 2


Driver object (fffffa8007d9fbe0) is for:
\FileSystem\Ntfs
DriverEntry: fffff880017d406c Ntfs!GsDriverEntry
DriverStartIo: 00000000
DriverUnload: 00000000
AddDevice: 00000000
Dispatch routines:
...

Fast I/O routines:


FastIoCheckIfPossible fffff88001782230 Ntfs!NtfsFastIoCheckIfPossible
FastIoRead fffff880016efd60 Ntfs!NtfsCopyReadA
FastIoWrite fffff880016f2a10 Ntfs!NtfsCopyWriteA
FastIoQueryBasicInfo fffff880016e42e8 Ntfs!NtfsFastQueryBasicInfo
...

ReleaseForModWrite fffff8800166fee4 Ntfs!NtfsReleaseFileForModWrite


AcquireForCcFlush fffff8800167133c Ntfs!NtfsAcquireFileForCcFlush
ReleaseForCcFlush fffff880016713a0 Ntfs!NtfsReleaseFileForCcFlush

, NTFS NtfsCopyReadA
FastIoRead -. -
, -
, . ,
IRP-.

- , ,

- ,
. - ,
. (, , -
10.) - ,
(mapped file I/O),
.
, -.

.
,
.
50 8 . -

- , , -
Windows- CreateFileMapping MapViewOfFile. -
- ,
(
). - .

, ,
. ,
.
,
Windows . -
,
( ) .
10.
, -
. (
11.)

-
Windows -,
(scatter/gather I/O).
Windows- ReadFileScatter WriteFileGather. -

,
.
-,
- . ,
- (). -

, .


- (I/O Request Packet, IRP) , -
- ,
.
- - IRP-,
-. -
- IRP-
,
. IRP- -
( , , ). IRP-
(
IRP-, ), IRP-
IRP- .
IRP- 10 ,

20. ,
- 51

, IRP-
. IRP- ,
IRP-, -
. IRP-
- .


DWORD- HKLM\System\CurrentControlSet\
SessionManager\I/OSystem\LargeIrpStackLocations, ,
IRP-, IRP-.

-, IRP -
, , .8.9. -
,
-
. ( .)



1  DLL
,



-
-

2 -
IRP


IRP
- -
-
IRP
WRITE

3 -


WRITE
,
IRP-
DPC-
ISP
-


. 8.9. , -,

52 8 . -

IRP-
IRP- : ( -
IRP-) . -
, ,
, -
, . IRP-
( ),
.
(major function code) , -
- IRP-
. (minor function code)
.
PnP-.

,
(), , , - ,
PnP-, ( WMI-), -
. (
.)
, .
USB-, ,
, , , -.
- -
IopInvalidDeviceRequest. IRP-,
, ,
.

:
,
, 7 ( )
!drvobj.
, 28 .

lkd> !drvobj \Driver\kbdclass 7


Driver object (fffffa800adc2e70) is for:
\Driver\kbdclass
Driver Extension List: (id , addr)

Device Object list:


fffffa800b04fce0 fffffa800abde560

DriverEntry: fffff880071c8ecc kbdclass!GsDriverEntry


DriverStartIo: 00000000
DriverUnload: 00000000
AddDevice: fffff880071c53b4 kbdclass!KeyboardAddDevice

Dispatch routines:
[00] IRP_MJ_CREATE fffff880071bedd4 kbdclass!KeyboardClassCreate
- 53

[01] IRP_MJ_CREATE_NAMED_PIPE fffff800036abc0c nt!IopInvalidDeviceRequest


[02] IRP_MJ_CLOSE fffff880071bf17c kbdclass!KeyboardClassClose
[03] IRP_MJ_READ fffff880071bf804 kbdclass!KeyboardClassRead
...
[19] IRP_MJ_QUERY_QUOTA fffff800036abc0c nt!IopInvalidDeviceRequest
[1a] IRP_MJ_SET_QUOTA fffff800036abc0c nt!IopInvalidDeviceRequest
[1b] IRP_MJ_PNP fffff880071c0368 kbdclass!KeyboardPnP

IRP- IRP-,
. ( , ,
,
.) -
IRP- .
, -
( ). Windows
- ,
-
(Asynchronous Procedure Call, APC).
APC-.

: IRP-

!thread IRP-.
,
!process, (Services.exe):

lkd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
...
PROCESS 8623b840 SessionId: 0 Cid: 0270 Peb: 7ffd6000 ParentCid: 0210
DirBase: ce21e080 ObjectTable: 964c06a0 HandleCount: 198.
Image: services.exe
...

, -
!process. ,
IRP-. IRPList
( , 17IRP- ,
17):

lkd> !process 8623b840


PROCESS 8623b840 SessionId: 0 Cid: 0270 Peb: 7ffd6000 ParentCid: 0210
DirBase: ce21e080 ObjectTable: 964c06a0 HandleCount: 198.
Image: services.exe
VadRoot 862b1358 Vads 71 Clone 0 Private 466. Modified 14. Locked 2.
DeviceMap 8b0087d8
...
THREAD 86a1d248 Cid 0270.053c Teb: 7ffdc000 Win32Thread: 00000000
WAIT: (UserRequest) UserMode Alertable
86a40ca0 NotificationEvent
86a40490 NotificationEvent

54 8 . -

IRP List:
86a81190: (0006,0094) Flags: 00060900 Mdl: 00000000
...

IRP- !irp:

lkd> !irp 86a81190


Irp is active with 1 stacks 1 is current (= 0x86a81200)
No Mdl: No System Buffer: Thread 86a1d248: Irp stack trace.
cmd flg cl Device File Completion-Context
>[ 3, 0] 0 1 86156328 86a4e7a0 00000000-00000000 pending
\FileSystem\Npfs
Args: 00000800 00000000 00000000 00000000

IRP- 3, IRP_
MJ_READ, , , WDM.h.
, Npfs (Named Pipe File System).
7 I.

IRP-
IRP-
NtReadFile, NtWriteFile NtDeviceIoControlFile ( -
API- Windows, ReadFile, WriteFile
DeviceIoControl) - ,
.
:
-. -
,
. IRP- , -
.
IRP- , -
, .
AssociatedIrp.SystemBuffer
IRP-.
-. IRP-, - -
( ).
IRP- . -
(Memory Descriptor List, MDL).
MDL , ( MDL
WDK). ,
(Direct Memory Access, DMA), -
,
. (, DMA,
DMA-, .)

.
- 55

- . -
.
, , -
.
-
IRP- . -
,
.
.
( NtDeviceIoControlFile)
- .
, -.
(4 x86)
, DMA, , , -
-. -
DMA -.
,

.
,
.
, -
, ,
. , ,
.
, ,
,
. ProbeForRead ProbeForWrite -
,
. - ,

( try/except),
-
. ,
, .
, , -
.

-
-
. :
1. DLL-.
2. DLL- NtWriteFile -.
56 8 . -

3. - IRP-
( ),
IoCallDriver.
4. IRP- -
-.
5. , .
6. .
7. IoCompleteRequest -,
IRP-,
- .
.8.10.

IRP-
-

DLL IRP-



IRP





,

IRP-
-

. 8.10.

, , -, -
-.
- 57


, - ,
Windows, - .
.8.11. ,
DPC, 3 I,
, -
, .

DPC-

-

3 ISP
DPC

2 -

DPC 
,


. 8.11. ( 1)

-
, -
ISR . Windows ISR -
. ISR, ,
IRQL ,
. DPC
58 8 . -

, . , DPC-
2, -
, IRP-.
.
DPC
device IRQL
DPC/dispatch , DPC .
, -
. 8.12 -
(DPC).

() DPC-
-
- ()

3 DPC-




2

DPC-

1 IRQL ,

DPC

DPC

. 8.12. (2)
- 59

-
DPC- ,
.
, ,
IoCompleteRequest - -
IRP- ( ).
-. ,
- --
, IRP -
.
-
-.
-
. -
IRP- -
, -
IRP-
. -
, -
(,
, ).
- ,
(APC) . .8.13.

2 - 1 DPC-
APC
-

() DPC-
-
- ()

APC-
. 8.13. - (1)
60 8 . -

3 I, APC
, DPC . ,
DPC- -
. , (IRQL) DPC
, APC.
, IRQL- (
DISPATCH_LEVEL), APC-.
APC- -,
( ) -
, IRP-
(
) -
, -
. - .
, -
( ), -
. 8.14
-.



DLL


-
3 APC-
ACP-- -
-

,


-
-
, -
1 
 APC-
 IRP-
APC-

2


APC-

-
APC-

. 8.14. - (2)
- 61

-,
, , Windows
. APC (
Windows,
),
- .
, - ReadFileEx
WriteFileEx
APC . -
APC- -
.
, .
APC -
,
(, Windows SleepEx,
WaitForSingleObjectEx WaitForMultipleObjectsEx).


:
-
,
IRQL-.
Windows
.
,
- , , IRQL- (pas-
sive),
. ISR-
. - ,
ISR, , -
, ISR .
.8.15.
, Windows
,
IRQL-. -
(
),
.
Windows KeSynchronize
Execution, ISR .
ISR-, -
. KeAcquireInterruptSpinLock
,
62 8 . -

, ISR
KeSynchronizeExecution. , PASSIVE_
LEVEL KEVENT ,
IRQL-.

3 ISR-


,,
(ISR) 
2

-
() - 1
-

. 8.15.
ISR-

, , ISR-
. -
,
. -
( -
). ISR-
, KeSynchronizeExecution
KeAcquireInterruptSpinLock.
( IRQL-
DISPATCH_LEVEL).

-
-,
, . -
- , ,
. -
.
.8.16
-.
, .
- 63



DLL 


- -



-
-
IRP,




 -





IRP-
 


 -



IRP-

(IRP-
)


. 8.16.

- -
. -
,
-. ,
, IRP-
IRP- .
-
, , IRP-
. ,
512 NTFS
64 8 . -

, -
.

, IRP (stack locations)
,
.
, -
, ,
. .8.16,
IRP .
IRP- .
.
- - IRP
.


, -
. IRP -
, , -
IRP (,
).
- API- IoAdjustStackSizeForRedirection,
.

:
!devstack
. -
\device\keyboardclass0, :

lkd> !devstack keyboardclass0


!DevObj !DrvObj !DevExt ObjectName
fffffa800a5e2040 \Driver\Ctrl2cap fffffa800a5e2190
> fffffa800a612ce0 \Driver\kbdclass fffffa800a612e30 KeyboardClass0
fffffa800a612040 \Driver\i8042prt fffffa800a612190
fffffa80076e0a00 \Driver\ACPI fffffa80076f3a90 0000005c
!DevNode fffffa800770f750 :
DeviceInst is "ACPI\PNP0303\4&b0a2531&0"
ServiceName is "i8042prt"

, KeyboardClass0, > .
,
, , .
, IRP- .

: IRP-
IRP-
, , , , -
IRP- , , .

IRP-,
, IRP-
- 65

, ,
. ,
. IRP-
!irpfind :

lkd> !irpfind

Scanning large pool allocation table for Tag: Irp? (86c16000 : 86d16000)
Searching NonPaged pool (80000000 : ffc00000) for Tag: Irp?

Irp [ Thread ] irpStack: (Mj,Mn) DevObj [Driver] MDL Process


862d2380 [8666dc68] irpStack: ( c, 2) 84a6f020 [ \FileSystem\Ntfs]
862d2bb0 [864e3d78] irpStack: ( e,20) 86171348 [ \Driver\AFD] 0x864dbd90
862d4518 [865f7600] irpStack: ( d, 0) 86156328 [ \FileSystem\Npfs]
862d4688 [867133f0] irpStack: ( 3, 0) 86156328 [ \FileSystem\Npfs]
862dd008 [00000000] Irp is complete (CurrentLocation 4 > StackCount 3)
0x00420000
862dee28 [864fc030] irpStack: ( 3, 0) 84baf030 [ \Driver\kbdclass]

IRP-, Kbdclass, -
, , Windows, -
. IRP- !irp:

lkd> !irp 862dee28


Irp is active with 3 stacks 3 is current (= 0x862deee0)
No Mdl: System buffer=864f5108: Thread 864fc030: Irp stack trace.
cmd flg cl Device File Completion-Context
[ 0, 0] 0 0 00000000 00000000 00000000-00000000

Args: 00000000 00000000 00000000 00000000


[ 0, 0] 0 0 00000000 00000000 00000000-00000000
Args: 00000000 00000000 00000000 00000000
>[ 3, 0] 0 1 84baf030 864f52f8 00000000-00000000 pending
\Driver\kbdclass
Args: 00000078 00000000 00000000 00000000

. ( >
.) 3, IRP_MJ_READ.

, IRP-.
!devobj,
:

lkd> !devobj 84baf030


Device object (84baf030) is for:
KeyboardClass1 \Driver\kbdclass DriverObject 84b706b8
Current Irp 00000000 RefCount 0 Type 0000000b Flags 00002044
Dacl 8b0538b8 DevExt 84baf0e8 DevObjExt 84baf1c8
ExtensionFlags (0x00000800)
Unknown flags 0x00000800

AttachedTo (Lower) 84badaa0 \Driver\TermDD


Device queue is not busy.

, IRP- KeyboardClass1.
, Termdd, ,
Terminal Server, .
66 8 . -

IRP- -
!thread !process:

lkd> !thread 864fc030


THREAD 864fc030 Cid 01d4.0234 Teb: 7ffd9000 Win32Thread: ffac4008
WAIT: (WrUserRequest) KernelMode Alertable
8623c620 SynchronizationEvent
864fc3a8 NotificationTimer
864fc378 SynchronizationTimer
864fc360 SynchronizationEvent
IRP List:
86af0e28: (0006,01d8) Flags: 00060970 Mdl: 00000000
86503958: (0006,0268) Flags: 00060970 Mdl: 00000000
862dee28: (0006,01d8) Flags: 00060970 Mdl: 00000000
Not impersonating
DeviceMap 8b0087d8
Owning Process 0 Image: <Unknown>
Attached Process 864d2d90 Image: csrss.exe
Wait Start TickCount 171909 Ticks: 29 (0:00:00:00.452)
Context Switch Count 121222
UserTime 00:00:00.000
KernelTime 00:00:00.717
Win32 Start Address 0x764d9a30
Stack Init 96f46000 Current 96f45c28 Base 96f46000 Limit 96f43000 Call 0
Priority 15 BasePriority 13 PriorityDecrement 0 IoPriority 2 PagePriority 5

lkd> !process 864d2d90


PROCESS 864d2d90 SessionId: 1 Cid: 0208 Peb: 7ffdf000 ParentCid: 0200
DirBase: ce21e0a0 ObjectTable: 964a6e68 HandleCount: 284.
Image: csrss.exe

Process Explorer, Csrss.exe -


Properties Threads. ,
Windows.
- 67

DMA- ,
, ISR-,
DPC-, IRP-, .8.17.




DLL




.

-
DPC- ,

IRP-

. 8.17. -

IRP-
IRP-,
. , ,
68 8 . -

, ,
IRP-,
. .8.18.



DLL

- -





-

IRP- 
 
 -





IRP- 



-


IRP-



. 8.18. IRP-

IRP- ,
. -
. ,
. IRP-
- IRP-
, .8.19.
- 69


1

IRP-n-,
DLL



2IRP-
n-,






IRP-IRP-



IRP-
.

DPC-,
IRP-
-
IRP-

. 8.19. IRP-


, Windows ,
, , .
, , -
.
. -
.
9.

-
- IRP- -
, , -
70 8 . -

- .
.
-, ,
, Windows
- (thread agnostic
I/O), :
- (.);
-
.
- -
,
, .
IRP- -
, .


, .
SE_LOCK_MEMORY
SetFileIoOverlappedRange.
-, - -
SetFileIoOverlappedRange , -
IRP- , -
. !fileobj WinDbg
IRP- , .
,
- Windows-.

-
, IRP-
, - -
, . , IRP-
;
, , . , -
-
. ,
.
-
, .
-
( , , ) -
, -.
-
, . ,
. Process Explorer.
( 5 I.)
- 71

-,
(User
Interface, UI) ,
, -
. UI
-.
, , -
,
, Windows ,
.
, CancelIo.
- ,
, CancelIoEx.
, -. Windows
--
, . -
-, ,
.
-
CancelSynchronousIo, ()
. -
Windows, ,
( , MUP, DFS SMB),
.
- .8.20 8.21. (
.)

2
1 1

-.

( 2) -
-
- 1

-




STATUS_CANCELLED

. 8.20. -
72 8 . -





,

-,
 - -
-
, --
,
-

- ()
()
STATUS_CANCELLED

. 8.21. -

-
, -,
, , -
(
). IRP-,
- -
. CancelIoEx, ,
IRP-,
-. , IRP-
, .
.8.22.



()
-

-

IRP-

()
()

-
() ()

. 8.22.
- 73

IRP-,
.
-.

: ,
Notmyfault, -
Sysinternals (
14). Myfault.sys (
Notmyfault.exe) IRP- -
.

Notmyfault.exe, Hang -
Hang with IRP, , Hang.

, Cancel -
. Process Explorer
Notmyfault. , Windows -
IRP-, Myfault
.

WinDbg, , .
!process
Notmyfault.exe:

lkd> !process 0 7 notmyfault.exe


PROCESS 86843ab0 SessionId: 1 Cid: 0594 Peb: 7ffd8000 ParentCid: 05c8
DirBase: ce21f380 ObjectTable: 9cfb5070 HandleCount: 33.
Image: NotMyfault.exe
VadRoot 86658138 Vads 44 Clone 0 Private 210. Modified 5. Locked 0.
DeviceMap 987545a8
...

74 8 . -

THREAD 868139b8 Cid 0594.0230 Teb: 7ffde000 Win32Thread: 00000000


WAIT: (Executive) KernelMode Non-Alertable
86797c64 NotificationEvent
IRP List:
86a51228: (0006,0094) Flags: 00060000 Mdl: 00000000
...
ChildEBP RetAddr Args to Child
88ae4b78 81cf23bf 868139b8 86813a40 00000000 nt!KiSwapContext+0x26
88ae4bbc 81c8fcf8 868139b8 86797c08 86797c64 nt!KiSwapThread+0x44f
88ae4c14 81e8a356 86797c64 00000000 00000000 nt!KeWaitForSingleObject+0x492
88ae4c40 81e875a3 86a51228 86797c08 86a51228 nt!IopCancelAlertedRequest+0x6d
88ae4c64 81e87cba 00000103 86797c08 00000000 nt!IopSynchronousServiceTail+0x267
88ae4d00 81e7198e 86727920 86a51228 00000000 nt!IopXxxControlFile+0x6b7
88ae4d34 81c92a7a 0000007c 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
88ae4d34 77139a94 0000007c 00000000 00000000 nt!KiFastCallEntry+0x12a
01d5fecc 00000000 00000000 00000000 00000000 ntdll!KiFastSystemCallRet
...

, - -
IRP- ( IopSynchronousServiceTail
IopCancelAlertedRequest) .

!irp . -
IRP- !irp:

lkd> !irp 86a51228


Irp is active with 1 stacks 1 is current (= 0x86a51298)
No Mdl: No System Buffer: Thread 868139b8: Irp stack trace.
cmd flg cl Device File Completion-Context
>[ e, 0] 5 0 86727920 86797c08 00000000-00000000
\Driver\MYFAULT
Args: 00000000 00000000 83360020 00000000

, \Driver\MYFAULT, Myfault.sys.
( ) , -
, - . ,
, Windows
, -
. IRP-
. , -
. , .

-
-
.
- , -
. , -
, , -
. ,
, - ,

- 75

.
,
. -
: ,
-, -
.
, - ,
.
, , ,
,
. ,

, ,
.
, ,
, (,
) .

IoCompletion
IoCompletion ,
WindowsAPI (completion port) -
-,
. ,
- ,
. -

. WindowsAPI Wait-
ForMultipleObjects, , ,
,
, .
, -
, .
,
. Windows
.
,
.
.
, .
,
.


.8.23 . -
Windows API- CreateIoCompletionPort.
76 8 . -

-
LIFO (Last In, First Out -
, ), , -
. ,
c ,
, ,
.


( )

-
( ;
)


( )

. 8.23. -

,
. Win-
dows Sockets2 (Winsock2) .
,
, GetQueuedCompletionStatus.
, .
, -
-
. , Windows ,
.
, , ,
.
Microsoft,
. ,
. , -
- 77

1.
. ,
, , ,
. - -
, . -
. - ,
. -
1.
.


.
PostQueuedCompletionStatus. -
,
.

-, ,
-,
. -
, , -
. -
, , ,
, - -
.

-
Windows- , API-
CreateIoCompletionPort -
NULL. NtCreateIoCompletion.
IoCompletion
, (kernel queue). ,

. ( , -
.)
.
CreateIoCompletionPort. -
NtCreateIoCompletion
KeInitializeQueue.
CreateIoCompletionPort
NtSetInformationFile
.
FileCompletionInformation,
CompletionKey CreateIoCompletionPort .
NtSetInformationFile
.
78 8 . -

NtSetInformationFile
CompletionContext .
- - ,
CompletionContext NULL.
, -
KeInsertQueue. ,
, . ( ,
.)
GetQueuedCompletionStatus
NtRemoveIoCompletion. -
-
IoRemoveIoCompletion, , ,
KeRemoveQueueEx. -
,
. API- GetQueuedCompletionStatus
GetQueuedCompletionStatusEx -
- ,
.
NtRemoveIoCompletionEx, -
IoRemoveIoCompletion,
KeRemoveQueueEx.
, KeRemoveQueueEx
KeInsertQueue. , ,
-.
.
KeRemoveQueueEx
, ( LIFO) , .
.
(KTHREAD) , ;
NULL, .
Windows , - ,
,
. , -
(, KeWaitForSingleObject,
KeDelayExecutionThread ..). NULL,
KiActivateWaiterQueue,
.
, -
. -
,
KiUnwaitThread, .
API- PostQueuedCompletionStatus -
NtSetIoCompletion, KeInsertQueue
.
.8.24. -
, 1
- 79

.
.



-


- : 1

. 8.24. -

, , - -
API- SetFileCompletionNotificationModes,
, -
, .
(.8.3).
, .

8.3. -


-
, . -,

; -, -
-; -, -
ERROR_PENDING
-
,
ERROR_PENDING, -
. -
,
- ,
- ,
-

ERROR_PENDING,

80 8 . -

-
-, ,
, , -
.
,
,
.
, .
Windows -, -
:
- -
.

-
. 8.4, - Windows -
-, . (,
Windows High Low.)

8.4. -

Critical
High
Normal -
Low
Very Low , Superfetch, , -
,

- Normal ,
,
, Critical.
Very Low.
, . -
, Windows Defender,
.


- , -
(strategies.).
(hierarchy prioritization) (idle prioritization).
, Very Low.
:
- Critical -
High;
- 81

- High
Normal;
- Normal
Low;
- Low
.
IRP-, ,
,
.

- .
,
-
.
, (
-),

- ( -
). , , ,
,
, , -
. -
, , -
50.
,
.
-
-, , , ,
.8.25. ,
FIFO (First-In, First-Out , ).
.

-
-

. 8.25. -

- -
. SetPriorityClass SetThreadPriority
82 8 . -

-,
( IRP- ).
SetFileInformationByHandle
( ). ,
- IRP-, API-
IoSetIoPriorityHint.


- IRP- ()
. , -
. ,
.


. ,
- . -
, ATA, SCSI USB.
ATA (%SystemRoot%\System32\Ataport.sys) USB (%SystemRoot%\System32\
Usbstor.sys) , SCSI
(%SystemRoot%\System32\Scsiport.sys %SystemRoot%\System32\Storport.sys) .


- Critical
,
.
- , , -
.

, , IDE- SATA-
, USB- - -
-, SCSI, Fibre Channel
iSCSI .

(%SystemRoot%\System32\Classpnp.sys),
-, ,
SCSI-. , -
,
-,
, , .
Microsoft ,
-
.
8.26
.
9.
- 83

/
-



-

. 8.26. -

-
( -)
- (-
),
(ERESOURCE) .
-,
,
.
ERESOURCE -

,
API- PsBoostThreadIo, -
IoBoostCount ETHREAD.
API- IoBoostThreadIoPriority,
IRP- (,
IRP-) ,
( ).
IRP-
-. ,
IRP-, - ,
, -
API- IoRegisterPriorityCallback DO_PRIOR-
ITY_CALLBACK_ENABLED . ,
IRP- - ,
(threaded boost) (paging boost).
, IRP-, ,
IRP- -
-
(blanket boosting).
84 8 . -

-
,
- Windows -
-. ,
, .
.
IRP-,
, Windows , ,
,
-.
( IoPageRead
IoPageWrite) Windows , -
Superfetch ( -
). IRP- ,
.
Very Low
Process Monitor.

: - .
Very Low Normal
-
- IO Priority (
). IoPriority.exe, ,
Thread1 Low priority, StartIO.
,
.

, Thread1 -
, 2/. , IOPriority
- 2/ -
, , ,
. Thread2
Thread1 .

,
-
-. ,

- .
- 85

Process Monitor -, -
IOPriority, .
Process Monitor, IoPriority.exe .
Thread1 File_1, Thread2
File_2. , File_1, -
.

, File_1 - Very Low.


Time Of Day, , - -
0,5 .

, Process Explorer Thread1


IoPriority -
Threads Properties . ,
8
(), . -
, .
86 8 . -

, IO Priority File_1,
, .
Process Monitor -.

: .
/ -
,
SystemLowPriorityIoInformation,
NtQuerySystemInformation. ,
, .
:

IoLowPriorityReadOperationCount IoLowPriorityWriteOperationCount;
IoKernelIssuedIoBoostedCount;
IoPagingReadLowPriorityCount IoPagingWriteLowPriorityCount;
IoPagingReadLowPriorityBumpedCount IoPagingWriteHighPriorityBumpedCount;
IoBoostedThreadedIrpCount IoBoostedPagingIrpCount;
IoBlanketBoostCount.

dd, .


( -)
- Windows
, -.
SetFileBandwidthReservation,
- -
.
,
- ,
- .
- -,
,
. 8.27 -,
.
. - ,
.

- - - - - -

- - - - - -

. 8.27.

- 87

, -
,
IDE-, SATA- USB-.


,
.
API- IoRegisterContainerNotification
. Windows
IoSessionStateNotification. -
. -
:
;
;
.
, ,
. -
.
.
,
PnP- (, ),
PnP-
. ,
, , -
.

Driver Verifier
Driver Verifier
. Microsoft
Driver Verifier -
Microsoft, -
Windows Hardware Quality Labs (WHQL).
Windows . (
Application Verifier, -
Windows, .)
, Driver Verifier , -
,
.
14.
Driver Verifier :
, , -
, - HAL. -
(%SystemRoot%\System32\Verifier.exe).
88 8 . -

Driver Verifier
, .8.28.

. 8.28. Driver Verifier Manager

Driver Verifier -
.
verifier/?.
, Driver Verifier
, .
, , -
IRQL-, ,
NonPagedPoolSession,
,
20 .
, -
- (.8.29). , ,

Driver Verifier 10.
:
I/O Verification ( -).
- IRP-
- 89

. 8.29. Driver Verifier,


-

. , -
IRP-
- Driver Verifier
. -
IRP-
,
. -
, IRP-,
WMI,
IRP-WMI PnP-
. ,
. , Driver
Verifier ,
- :
DMA Checking ( DMA). DMA (Direct Memory Access
) , -

. - ,
90 8 . -

DMA- . -

, -
DMA-.
Force Pending I/O Requests ( -
).
,
-.
- IoCallDriver -
STATUS_PENDING,
-.
IRP Logging ( IRP-). -
, IRP-.
WMI-. Dc2wmiparser.exe
WDK . ,
20 IRP- . IRP-
. -
,
, Dc2wmiparser.exe.

KMDF
Windows Driver Foundation (WDF)
2 I. -
, ,
KMDF (Kernel-Mode Driver Framework). ,
KMDF.
http://msdn.microsoft.com/en-us/library/windows/hardware/gg463370.aspx.

KMDF-
, KMDF.
WDM- ,
- IRP-. KMDF
, API- Windows,
.
KMDF,
WDM-, -.
KMDF,
, IEEE 1394 ISA,
PCI, PCMCIA SD Client ( Secure Digital).
KMDF WDM,
KMDF-. , KMDF-
:
KMDF 91

. , KMDF-
DriverEntry. KMDF-
-
. , PnP,
.
. KMDF-
( ).
PnP- EvtDriverDeviceAdd,
, PnP-
.
EvtIo*.
WDM-,
- . ,
, KMDF
.
.
KMDF- -
,
- . KMDF
,
. -
( 3 I),
.
,
, .
KMDF
. , (EvtDeviceEject)
,
KMDF-, ,
. ,
, .
EvtDriverDeviceAdd,
PnP-.

: KMDF-
Wdfkd.dll, Windows,
KMDF
( WDM,
). KMDF- -
!wdfkd.wdfldr. -

Windows:

lkd> !wdfkd.wdfldr
LoadedModuleList 0xfffff880010682d8
----------------------------------
92 8 . -

LIBRARY_MODULE fffffa8002776120
Version v1.9 build(7600)
Service \Registry\Machine\System\CurrentControlSet\Services\Wdf01000
ImageName Wdf01000.sys
ImageAddress 0xfffff88000c00000
ImageSize 0xa4000
Associated Clients: 16
ImageName Version WdfGlobals FxGlobals
ImageAddress ImageSize
peauth.sys v1.7(6001) 0xfffffa8004754210 0xfffffa80047540c0
0xfffff880074cc000 0x000a6000
scfilter.sys v1.5(6000) 0xfffffa8002ef34e0 0xfffffa8002ef3390
0xfffff880040b3000 0x0000e000
WinUSB.sys v1.9(7600) 0xfffffa8002eefd20 0xfffffa8002eefbd0
0xfffff88004000000 0x00011000
monitor.sys v1.9(7600) 0xfffffa8004854a10 0xfffffa80048548c0
0xfffff8800412a000 0x0000e000
vmswitch.sys v1.5(6000) 0xfffffa8002de5d60 0xfffffa8002de5c10
0xfffff88003e9b000 0x00068000
vmbus.sys v1.5(6000) 0xfffffa8002d7fcf0 0xfffffa8002d7fba0
0xfffff88003e5f000 0x0003c000
Vid.sys v1.5(6000) 0xfffffa8002ddacf0 0xfffffa8002ddaba0
0xfffff88002a00000 0x00033000
umbus.sys v1.9(7600) 0xfffffa8002e57e70 0xfffffa8002e57d20
0xfffff880035db000 0x00012000
storvsp.sys v1.5(6000) 0xfffffa8002e48b10 0xfffffa8002e489c0
0xfffff88003575000 0x00023000
CompositeBus.sys v1.9(7600) 0xfffffa8002d79160 0xfffffa8002d79010
0xfffff88002936000 0x00010000
HDAudBus.sys v1.7(6001) 0xfffffa8002e357f0 0xfffffa8002e356a0
0xfffff880037a9000 0x00024000
intelppm.sys v1.9(7600) 0xfffffa8002c518f0 0xfffffa8002c517a0
0xfffff880027e7000 0x00016000
cdrom.sys v1.9(7600) 0xfffffa80028bf8f0 0xfffffa80028bf7a0
0xfffff880011c4000 0x0002a000
vmstorfl.sys v1.5(6000) 0xfffffa8002b2cdd0 0xfffffa8002b2cc80
0xfffff8800144a000 0x00010000
vdrvroot.sys v1.9(7600) 0xfffffa80027887c0 0xfffffa8002788670
0xfffff8800139c000 0x0000d000
msisadrv.sys v1.9(7600) 0xfffffa80029c5430 0xfffffa80029c52e0
0xfffff8800135f000 0x0000a000
----------------------------------
Total: 1 library loaded

KMDF
KMDF, , ,
. KMDF -
, , -
. ,
, WdfDeviceCreate
. ,
, API Get/Set ( ,
KMDF 93

) Assign/Retrieve ( ,
). , WdfInterruptGetInfo
(WDFINTERRUPT).
, KMDF- -
.
WDFDRIVER, . -
-
DRIVER_OBJECT, KMDF- .
WDFDEVICE, -
WdfDeviceCreate.
, DEVICE_OBJECT, WDM
-. KMDF
.8.5.

8.5. KMDF-

WDFCHILDLIST -
WDFDEVICE. -

WDFCOLLECTION , -

WDFDEVICE
- WDFDPC DPC- (-
DPC-
3 I)
WDFDEVICE
DMA- WDFCOMMONBUFFER , -
-

- WDFDMAENABLER
DMA
DMA- WDFDMATRANSACTION DMA-
WDFDRIVER ; -
,
-

WDFFILEOBJECT ,
-

WDFOBJECT

-


94 8 . -

8.5 ()

WDFINTERRUPT ,

- WDFQUEUE
-
- WDFREQUEST
WDFQUEUE
- WDFIOTARGET ,

WDFREQUEST
WDFLOOKASIDE -

WDFMEMORY

WDFKEY
WDFCMRESLIST ,
WDFDEVICE
- WDFIORESLIST -

WDFDEVICE
- WDFIORESREQLIST WDFIO-
RESLIST, -

WDFDEVICE
- WDFSPINLOCK -
(
3 I)
WDFSTRING Unicode-
WDFTIMER
(.3 I)
USB- WDFUSBDEVICE USB-

USB- WDFUSBINTERFACE
WDFUSBDEVICE
USB- WDFUSBPIPE
WDFUSBINTER-
FACE
- WDFWAITLOCK -

WMI- WDFWMIINSTANCE
WDFWMIPROVIDER
KMDF 95


WMI- WDFWMIPROVIDER WMI -

WDFWMIINSTANCE
WDFWORKITEM

KMDF-
. ,
. , -
WDFINTERRUPT WDFDEVICE,
WDFSPINLOCK WDFSTRING ,
-
. .8.30 KMDF-.

( )


,
,
(
)

. 8.30. KMDF-
96 8 . -

, -
. -
(hierarchy chain).
, .
. ,
.
, WDFSTRING WDFMEMORY,
WDFDRIVER,
.
KMDF (object
context). , KMDF- ,
, -
,
.
KMDF- ,
, ,
.
WDM
, KMDF -
- .
-
, ,
, , .
, KMDF- (.8.6). -
, ,
. WDF_OBJECT_ATTRIBUTES
( OBJECT_ATTRIBUTES ,
).

8.6. KMDF-

ContextSizeOverride
ContextTypeInfo
EvtCleanupCallback ,
( )
EvtDestroyCallback ,
( 0)
ExecutionLevel IRQL-, KMDF

ParentObject
Size
SynchronizationScope , -
,
KMDF 97

- KMDF
- KMDF WDM
(Windows Driver Model). ,
WDM-,
,
WDM. KMDF
IRP- WDM
IRP-. KMDF- -
( )
KMDF-, ,
, .
- KMDF .8.31.


-,

-


-
PnP- -
/


-,

-


WMI-

. 8.31. - IRP- KMDF

IRP- WDM-, -
, KMDF :
98 8 . -

IRP- -,
.
IRP- PnP- , -
.
IRP- WMI-, -
.
,
,
, -
. KMDF
IRP-, ,
:
IRP-
STATUS_INVALID_DEVICE_REQUEST.
.
- KMDF (
WDFQUEUE, KQUEUE, , , -
-, 3 I). KMDF
(
WDFREQUEST). , -
. ,

-, - (
- ) - ( -
.8.6). KMDF- ,
,
:
, -
.
. KMDF
, , .
- , (
), ,
-, -
.
. KMDF
, . -
(KMDF
),
.
.
KMDF 99




?
?


WDFREQUEST





-
?


PnP-
/-
,

. 8.32. KMDF - , IOCTL


100 8 . -

, -
, .


-
. , -
.
. ,

.

, - KMDF -
, , , ,
(IOCTL) :

EvtDeviceFileCreate,
.
, KMDF , ,
KMDF-,
.

EvtFileCleanup EvtFileClose, -
.
.
, .8.32 -
KMDF- ( ,
-).

UMDF
, Windows -
,
UMDF (User-Mode Driver Framework), WDF.
-
UMDF.
http://msdn.microsoft.com/en-us/library/windows/hardware/gg463370.aspx.
UMDF
(protocol device classes). ,
, -
.
IEEE1394 (FireWire), USB, Bluetooth TCP/IP. ,
( ),
UMDF. -
UMDF 101

, PDA, , - ..
UMDF- SideShow- (-
) Windows Portable Device (WPD),
USB-. , KMDF, UMDF
, .

UMDF
, KMDF, , -
. , KMDF ,
, UMDF ,
. UMDF ,
DMA, , .
, UMDF-
.
KMDF-, , -
( .sys), UMDF- -
, - . -
( COM-),
( -
, UMDF- COM- )
( -, ,
, ).
, UMDF- ,
.
, UMDF -
-
. UMDF ,
(Advanced Local Procedure Call,
ALPC), -
(ALPC 3 I). UMDF-
.8.33.
, -
, UMDF-, -.
, -
:
. Windows-
, - API-,
KMDF- WDM-. ,
UMDF,
- .
Windows ( -) IRP- ,
.
WDM-, -
, UMDF-.
102 8 . -

-
. , PnP- -
-IRP- ALPC -.
UMDF- -
, PnP,
PnP-, PnP-. ,
- , -
.

- -



() Windows ()

. 8.33. UMDF-

- -
UMDF-,
. -
- (
).
Windows-
UMDF- . - -
,
UMDF-.
-
. ,
Windows- -
(SCM). . -
UMDF 103


, . UMDF
,
-.
-. - -
.
. , UMDF-,
,
.
UMDF-, KMDF- ( WDM-).
, UMDF, USB- -
- . Process Explorer,
WUDFHost.exe, - .
DLL- , ,
.8.34.

. 8.34. DLL - UMDF

, -
:
WUDFx.dll ;
WUDFPlatform.dll ;
WpdRapi2.dll COM-, WPD-, -
USB- Windows- -.
104 8 . -

PnP-
PnP- ,
Windows .

. , PnP-
Windows
-
.
Plug and Play -
, . Windows
-
. , USB -
, USB. Windows
PnP-:
PnP- . -

, .
PnP- ,
(, -, -
- , ).
(resource arbitration) PnP-
.
, PnP- -
.
PnP- -
. ,
.
PnP- - .
, PnP-
PnP- , -
.
PnP- , -
.
, Windows
, , -
.
PnP- -
, , -
.
PnP- , ,
. -
.
PnP- 105

Plug and Play


Windows Plug and
Play,
. -
Plug and Play, Plug and Play
. ,
. .8.7
, -
Plug and Play, .

8.7. Plug and Play



Plug and Play Plug and Play
PnP-
PnP-

PnP ,
ISA, . -
, , ,
,
, .
PnP-, , , ,
PnP-.
PnP , , ,
WindowsNT4.
Windows, PnP-
. ,
A B, PnP- -
A. ,
A, PnP-
B.
, . ,
. ( -
.)

Plug and Play


Plug and Play
PnP-,
( ) .
, PnP-, -
. , -
( )
PnP-
106 8 . -

. ,
, .
PnP-
, .
.

,
. PnP- start-device ,
.
PnP- , -
. start-device .
start-device, -
. ,
, , ,
.
PnP- -
PnP-,
. ,
/ (
USBconnector Eject USB Mass Storage
Device), .8.35, - USB-
PnP- query-remove , -
PnP- . ,
,
query-remove.
query-remove , PnP-
query-remove , .
,
-
. ,
, PnP- -
remove,
.

. 8.35. /

, PnP-
, -
, query-stop.
, .
PnP- 107

. query-remove,
, -
. -
,
. PnP-
stop.
, start-device.
, PnP-
, ,
.8.36. ( PnP-
. , -
. .)
,
surprise-remove. , -
,
PCMCIA / . -
surprise-remove
, . -
.

. 8.36. PnP-

,
Windows :
. HKLM\
108 8 . -

SYSTEM\CurrentControlSet\Services, -
4 I. , PnP-
, .

Start
4 I, Windows
Services .
, (, Windows-,
) ,
.
Windows- :
Start: 0 -
; 1 .
Group Tag
, -
DependOnGroup DependOnService.
13 ,
Start .
, -
. -

. Windows-,
Group , ; -
HKLM\SYSTEM\
CurrentControlSet\Control\ServiceGroupOrder\List.

Tag, . --
,
.
. , - -
Tag,
. Tag HKLM\SYSTEM\
CurrentControlSet\Control\GroupOrderList. -
Microsoft
.
, Start:
Plug and Play
,
.
, -
, Start 0.
.
PnP- 109

, -
, , Start
1. ,
PnP-
, .
, Plug and Play,
, , Start 2.
UNC-
(Multiple UNC Provider), UNC- (,
\\REMOTECOMPUTERNAME\SHARE).
PnP-, ,
Start 3 ( ).
.
Start PnP-

, .
PnP-, ,
PnP-.


PnP-
Root,
, Plug and Play,
(HAL). , -
,
. ( PCI)
, HAL -
, .
, -
, PnP-.
, , , -
. , ,

.

PnP- , (device
tree) . -
(devnodes). -
, , ,
PnP- PnP-.
.8.37. ACPI-, -
,
ACPI (Advanced Configuration and Power Interface -
110 8 . -

).
PCI, USB, ISA SCSI.


PnP-

PnP-- -
USB--
-

ISA

USB-- SCSI-
PCHSA

ACPI- PCI ACPI-


ACPI

. 8.37.

Device Manager ( ), -
Computer Management ( ),
ProgramsAdministrative Tools () Start (),
Device Manager ( ) , -
, . ,
View () Devices By Connection
( ) ,
.8.38.

:
1. - , -
.
- , PnP-.
,
.
PnP- 111

, PnP- ,
.

. 8.38.

2. PnP-
, ,
, .
PnP- ,
.
. PnP-

Start. ( disabled.)
PnP- .
.
3. PnP-
Start, 1.
. PnP-
, .
4. .
112 8 . -

PnP-, -
IRP-, -
. , IRP-
,
IRP- ( ). -
IRP- .
, , -
HKLM\SYSTEM\CurrentControlSet\Enum.
<>\<ID>\<ID>.
, ID , ID-
.

:
, ,
!devnode . 01,
. ,
:

lkd> !devnode 0 1
Dumping IopRootDeviceNode (= 0x85161a98)
DevNode 0x85161a98 for PDO 0x84d10390
InstancePath is "HTREE\ROOT\0"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x8515bea8 for PDO 0x8515b030
DevNode 0x8515c698 for PDO 0x8515c820
InstancePath is "Root\ACPI_HAL\0000"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x84d1c5b0 for PDO 0x84d1c738
InstancePath is "ACPI_HAL\PNP0C08\0"
ServiceName is "ACPI"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85ebf1b0 for PDO 0x85ec0210
InstancePath is "ACPI\GenuineIntel_-_x86_Family_6_Model_15\_0"
ServiceName is "intelppm"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85ed6970 for PDO 0x8515e618
InstancePath is "ACPI\GenuineIntel_-_x86_Family_6_Model_15\_1"
ServiceName is "intelppm"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85ed75c8 for PDO 0x85ed79e8
InstancePath is "ACPI\ThermalZone\THM_"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85ed6cd8 for PDO 0x85ed6858
InstancePath is "ACPI\pnp0c14\0"
ServiceName is "WmiAcpi"
State = DeviceNodeStarted (0x308)
PnP- 113

Previous State = DeviceNodeEnumerateCompletion (0x30d)


DevNode 0x85ed7008 for PDO 0x85ed6730
InstancePath is "ACPI\ACPI0003\2&daba3ff&2"
ServiceName is "CmBatt"
State = DeviceNodeStarted (0x308)
Previous State = DeviceNodeEnumerateCompletion (0x30d)
DevNode 0x85ed7e60 for PDO 0x84d2e030
InstancePath is "ACPI\PNP0C0A\1"
ServiceName is "CmBatt"
...

InstancePath,
,
HKLM\SYSTEM\CurrentControlSet\Enum, ServiceName, -
HKLM\SYSTEM\CurrentCon-
trolSet\Services. , ,
, , !devnode
03.


PnP-,
-
. (device stack)
/.
, , .8.39, ,
.





(FDO)


(PDO)



(FDO)


(FDO)


(PDO)

. 8.39.
114 8 . -

(Physical Device Object, PDO)


PnP-, ,
, - . PDO -
.
(Filter
Device Objects, FiDO), PDO FDO (. ),
.
(FiDO),
PDO FDO, ,
,
.
( ) (Functional Device
Object, FDO) ,
PnP- . FDO -
.
, ,
, .
,
, -
.
, -,
- FDO.
(FiDO),
FDO,
.
-
, IRP- .
IRP-
. , ,
IRP- . IRP-
, ,
.


: PnP- ,

, -
?
. ,
PnP- ,
. , USB
(Product ID, PID), , -
(Vendor ID, VID). (
PnP- 115

WDK.) -
, Plug and Play
(deviceID). PnP- -
(instanceID),
.
(, USB),
( , ).
-
(Device Instance ID, DIID), PnP-
(HKLM\SYSTEM\CurrentControlSet\Enum).
.8.40. -
, , INF- Service
ClassGUID, PnP- .

. 8.40.

(, -
) Windows
(container ID),
. -
(GUID),
, .8.41.
, , -
.
PDO- -
. Windows
, PnP-X, Bluetooth USB,
,
Windows .

.
116 8 . -


: -
-
-

:

PnP-


-
-
-

. 8.41.
PnP-

. 8.42.
PnP- 117

, ,
, Windows ,
, ACPI. ,
, ,
( , ,
), Windows
, -
.
-
Devices And Printers (
) Windows. ,
,
. , .8.42 HPPSC1500series
.

: .

Device Manager ( ),
Hardware () ,
Details ().
, ,
, , .

Details (),
.
118 8 . -

ClassGUID PnP- -
HKLM\SYSTEM\CurrentControlSet\Control\Class.
.8.43.

. 8.43.

, ,
PnP- ,
, . :
1. , LowerFilters
, .
2. , LowerFilters
.
3. , Service ,
.
HKLM\SYSTEM\CurrentControlSet\Services.
4. , UpperFilters
, .
5. , UpperFilters
.
HKLM\
SYSTEM\CurrentControlSet\Services.
PnP- 119


WDK , , -
(hardware key), (software key).

, .8.40 8.43, -
. i8042prt,
: kbdclass
vmkbd2.


PnP- , ,
, PnP- .

, PnP- -
, %SystemRoot%\System32\Umpnpmgr.dll
- (Svchost.exe).
.8.44. -
, ,
.
PnP- (1),
DIID. PnP- , -
. PnP-
(2) DIID.
PnP-
. ,
,
, PnP- -
(3) Rundll32.exe ( -
) (%SystemRoot%\System32\
Newdev.dll). -
( ),
, PnP-
,
. API- Setupapi.dll
CfgMgr32.dll ( ) INF-,
.
INF- .
, INF-
(%SystemRoot%\System32\DriverStore), , -
Windows Windows Update.
.
,
%SystemRoot%\System32\Drvinst.exe.
120 8 . -

API- 4
Setup

CfgMgr

3 PnP-


.inf-,
.cat-.

2
5
PnP-

. 8.44. ,


-
. ,
(.inf).
,
. INF-, -
, INF- ,
.

,
.
INF- -
,
. INF- (4)
DLL ,
. , ,
.

: INF-
,
INF-, %SystemRoot%\Inf.
Keyboard.inf, INF-
. Notepad, :
PnP- 121

; Copyright (c) Microsoft Corporation. All rights reserved.

[Version]
Signature="$Windows NT$"
Class=Keyboard
ClassGUID={4D36E96B-E325-11CE-BFC1-08002BE10318}
Provider=%MS%
DriverVer=06/21/2006,6.1.7601.17514

[SourceDisksNames]
3426=windows cd
...

.sys, , PnP-
, i8042prt.
sys kbdclass.sys:

...
[STANDARD_CopyFiles]
i8042prt.sys,,,0x100
kbdclass.sys,,,0x100
...

PnP-
. , ,

, PnP- INF- -
, ( .cat),
.
Microsoft WHQL , Windows
. WHQL-
Microsoft. , WHQL
, .
Microsoft, -
CAT- Windows
.

: Cat-
- , CAT-,
, Windows %SystemRoot%\System32\
Catroot. CAT-. ,
Nt5.cat Nt5ph.cat Windows.

CAT-, .
General () . Security
Catalog ( ) ,
CAT-. CAT-
NVIDIA - .
DLL-,
.
122 8 . -

PnP-
CAT- ,
Microsoft .
-
WHQL. , PnP-

. ,
, , .


, ,
, , -
, .
(KMCS),
3 I.
, INF-.

PnP- (5 .8.44) -
,
, .
, .
123


PnP- , -
(protected driver list),
Windows Update.
, . -
, .


Plug and Play,
, ACPI (
http://www.acpi.info).
. .8.8 , S0 (
, , ) S5 ( ).
:
(power consumption). , -
.
(software resumption). -
.
(hardware latency). ,
.
(S1S4) ,
.
, S0. S1S3
,
S0 ( )
.

8.8.


S0 ( -
)
S1() S0, - 2 -
S2 (-
S0)
S2 () S1, - 2 -
S3 (-
S0)
S3 () S2; -
(- -
S0) S2


124 8 . -

8.8 ()



S4 ()
- -
-
(-
S0)
S5 ( -
) -

S4 -
Hiberfil.sys, .
, ,
. (
-, .)
, . -
, ,
Bootmgr
. , Bootmgr -
Winresume, -
, .
( -
)
S3 S4: ,
.
, , -
, .
( ).
S4,

. , .
, , S4
, Windows
.
S1 S4. -
S0. .8.45,
S1S5 S0 (waking), S0
S1S5 (sleeping).
,
ACPI D0 D3. D0
, D3 .
ACPI -
D1 D2, D1
125

, D0, D2
, D1.
Microsoft
, -
( ,
, , SCSI ..).
, , ,
.

S0 ( S1S4 ()
) S5 ( )

. 8.45.


Windows -
.
. ,
-
. ( )
( ) ,
, .

:
;
;

;
, ;
, .
PnP-
.
, D1 D2, ,
D3D0 D1 (
126 8 . -

).
,
(S0S5) , -
.

, -
.
, .8.9 ,
. -
(D3) S0,
. -
, ,
.
.

8.9.


S0 ( ) D0 ( )
S1 () D1
S2 () D2
S3 () D2
S4 () D3 ( )
S5 ( ) D3 ( )


, -
, .
,
. -
.
, S0 S1 -
D0 D1.
-
, , ,
, PoRequestPowerIrp. -

.
-
. ,
. ,
.
127

:


. Properties (-
) Power Data ( )
Details ().

,
, .

-
-. , -
. ,
-
, , .

:


!pocaps .
ACPI- :

lkd> !pocaps
PopCapabilities @ 0x82114d80
Misc Supported Features: PwrButton SlpButton Lid S3 S4 S5 HiberFile
FullWake VideoDim
Processor Features: Thermal

128 8 . -

Disk Features: SpinDown


Battery Features: BatteriesPresent
Battery 0 - Capacity: 0 Granularity: 0
Battery 1 - Capacity: 0 Granularity: 0
Battery 2 - Capacity: 0 Granularity: 0
Wake Caps
Ac OnLine Wake: Sx
Soft Lid Wake: Sx
RTC Wake: S4
Min Device Wake: Sx
Default Wake: Sx

Misc Supported Features , S0 -


S1, S3, S4 S5 ( S2 )
,
(S4).

Power Options (),


,
. -

, .

,
, ,
, (S1) (S4)
. , Change Plan Settings ( )

, .
129

, , Change
Advanced Power Settings ( ), -
.
!popolicy .
, :

lkd> !popolicy
SYSTEM_POWER_POLICY (R.1) @ 0x82107994
PowerButton: Sleep Flags: 00000000 Event: 00000000
SleepButton: Sleep Flags: 00000000 Event: 00000000
LidClose: Sleep Flags: 00000000 Event: 00000000
Idle: Sleep Flags: 00000000 Event: 00000000
OverThrottled: None Flags: 00000000 Event: 00000000
IdleTimeout: 384 IdleSensitivity: 90%
MinSleep: S3 MaxSleep: S3
LidOpenWake: S0 FastSleep: S0
WinLogonFlags: 1 S4Timeout: fd20
VideoTimeout: 300 VideoDim: 0
SpinTimeout: 258 OptForPower: 0
FanTolerance: 0% ForcedThrottle: 0%
SpinTimeout: 258 OptForPower: 0
MinThrottle: 0% DyanmicThrottle: None

-
. ,
, .

- -
. Power Options
() ( ).
, - 300, 300-
, 5, . -0x258,
600, 10.
130 8 . -



, -
,
. -
, .
,
. -
, , -
.
, PoRegisterDeviceForIdleDetection.

, .
-: ,
. PoRegisterDeviceFor
IdleDetection
PoSetDeviceBusy PoSetDeviceBusyEx, -
, -
. API- PoStartDeviceBusy PoEndDeviceBusy
Windows, ,
.
,

. , -
,
,
.
, .
,
.
-
, , (DC)
(AC) .
, .
, .


-
,
. -
, (
15 ),
-
. ,
131

, , -
. Windows API-
SetThreadExecutionState ,
,
. -
. ,
,
,
, .
Windows ,
, -
. WinObj,
3 I, PowerRequest \ObjectTypes,

!object , \ObjectTypes\PowerRequest.
-
API- PowerCreateRequest,
API- PowerSetRequest PowerClearRequest .
PoCreatePowerRequest, PoSetPowerRequest
PoClearPowerRequest. ,
PoDeletePowerRequest, (
CloseHandle).
API- : ,
. ,
(
, ,
). .

(S3). ,
, ,
. , ,
, -

. Windows
.

:


, ,
API- PowerCreateRequest. Process
Explorer, DLL/, -
.
PowerRequest, -
, . (
, API- .)

132 8 . -

, , ,
Print Spooler (Spoolsvc.exe) Windows Media Player Network Sharing Service
(Wmpntwk.exe).

Poavltst.exe Book Tools


Process Explorer, , .
0x8544ABF8.

, , -
. ,
,
. : -
( ), ,
. .

kd> dc 8544ABF8
855d01a8 819586c0 85448ea0 00000001 00000007 ......D.........
855d01b8 00000000 00000000 00000000 00000000 ................
855d01c8 b13e9b50

,
: Computation in progress ( ).

kd> dc b13e9b50
b13e9b50 00000001 8556b030 00000000 00000044 ....0.V.....D...
b13e9b60 00000001 00000014 00000000 80080001 ................
b13e9b70 00000000 006f0043 0070006d 00740075 ....C.o.m.p.u.t.
b13e9b80 00740061 006f0069 0020006e 006e0069 a.t.i.o.n. .i.n.
b13e9b90 00700020 006f0072 00720067 00730065 .p.r.o.g.r.e.s

dl ,
, -
PopPowerRequestObjectList . ,
Process Explorer, .
133

:
Powercfg
, -
. ,
Powercfg . ,
,
, MP- Poavltst.exe:

C:\Users\Administrator>powercfg -requests
DISPLAY:
[PROCESS] \Device\HarddiskVolume1\Users\Administrator\PoAvlTst.exe
Computation in progress
[PROCESS] \Device\HarddiskVolume1\Program Files\Windows Media Player\wmplayer.
exe

SYSTEM:
[DRIVER] Parallels Audio Controller (x32) (PCI\VEN_8086&DEV_2445&SUBSYS_04001AB8
&REV_02\3&11583659&0&FC)
An audio stream is currently in use.
[DRIVER] \FileSystem\srvnet
An active remote client has recently sent requests to this machine.
[PROCESS] \Device\HarddiskVolume1\Program Files\Windows Media Player\wmplayer.
exe

AWAYMODE:
None.

Computation in progress, ,
SMB-
, . Windows Media Player
API-, -
.

, -
,
.
Windows (Processor
Power Manager, PPM), C- P- (
), ACPI-

(, Intel Intelppm.sys). -
-
Windows, OEM-
.
.
PPM , -
PPM ,
Windows : (core parking). ,
134 8 . -

, PPM
:
P-
.
,
( ),
, , , .
, SMT-
.
( 5 I)
,
. (parked cores).
, -
. .



, , , .

,
.


-
, -
.
(core parking override) .
, (
), , , SMT-
. ,
Hyper-Threading Intel, .
.8.46: CPU1 CPU3 ,
SMT- CPU0 CPU2.
, -
, , ,
SMT-. ,
,
,
.
, , -
.
,
,
, NUMA
135


. ( 5 I.) ,
, -
,
.
NUMA-,
,
, NUMA
.

. 8.46. SMT-


PPM -
, ,
136 8 . -

.
PPM
( )
( ).
, 10000.
PPM (
) .



, ,
(, Intelppm.sys).
.

, , ,
PPM , -
. PPM , ,
, .

:
PPM , ,
, KPRCB. ,
.

!ppm , LP0:

lkd> !ppm

Processor 0

Idle States (3)


0: C1 - intelppm
1: C2 - intelppm
2: C3 - intelppm
Last Used Idle State: 2

Current Frequency: 100%


HardwareFeedback: 55%
Maximum Policy: 100%
Platform Cap: 100%
Minimum Policy: 5%
Minimum Performace: 44%
Minimum Throttle: 5%

Utility: 5400

. -
5400, 100%
. HardwareFeedback
. PPM-
55%.
137

PPM- .

~ ().
KPRCB .PowerState, .
PPM- LP1:

lkd> !running -i

System Processors: (0000000f)


Idle Processors: (0000000a)

Prcbs Current (pri) Next (pri) Idle


0 8376cd20 87f0b030 (12) 83776380 ................
1 8b404120 8b409800 ( 0) 8b409800 ................
2 8b43a120 86e6ed48 (11) 8b43f800 ................
3 8b470120 8b475800 ( 0) 8b475800 ................

lkd> dt nt!_KPRCB 8b404120 PowerState.


+0x33a0 PowerState :
+0x000 IdleStates : 0x877ff890 _PPM_IDLE_STATES
+0x008 IdleTimeLast : 0xed
+0x010 IdleTimeTotal : 0xadae7baa
...

:
(
), ,
.
!ppmstate.

-
:

lkd> !ppmstate

Prcb.PowerState - 0x837700c0

IdleStates: 0x877fe1b0
IdleTimeLast: 0.000.006us (0x860 )
IdleTimeTotal: 11:35.968.474us (0x6bc4ae5f )
IdleAccounting: 0x874d8008

Hypervisor State: 0x0


LastPerfCheck: 13:20.311.497us (0x7becdf55)
PerfDomain: 0x874d9c50
PerfConstraint: 0x874d9cc8
Utility: 0xf6c

PerfHistory: 0x88604300
PerfHistory contents (3 slots, oldest to newest)

Slot Utility Frequency


0 3435 82%
1 10800 108%
2 10900 109%

138 8 . -

ThermalConstraint: 100%
PerfActionDPC: 0x83770120
PerfActionMask: 0x0
WmiDispatchPtr: nt!PpmWmiDispatch
WmiInterfaceEnabled: 0x1
CurrentKernelUserTime: 0xc59e
CurrentIdleThreadKTime: 0xb556

!ppm !ppmstate
,
PowerState KPRCB.


, (generic utility).
, -
.
( -
). ,
, (
), -
.


( -
), ,
. -, .
5 I ,
,
, .
,
KPRCB .
( ), -
.
, ,
( , ).
, ( -
),
.
. , , -
,
, .
-
. , ,
, ,
, .
.8.46 Resource Monitor,
, 1 3, , -
139

- .
.

/
, PPM -
,
:

(PERFSTATE_POLICY_CHANGE_IDEAL) ()
.
,
-
(CORE_PARKING_POLICY_CHANGE_IDEAL).

() ( ACPI) 5%
(PERFSTATE_POLICY_CHANGE_STEP).
(CORE_PARKING_POLICY_CHANGE_STEP).

() (PERFSTATE_POLICY_CHANGE_ROCKET).
(
),
(CORE_PARKING_POLICY_CHANGE_ROCKET).
,
.


,
, -
,
(, High
Performance, Balanced Low Power).
.8.108.14.

8.10.
(GUID_PROCESSOR_PERF)
GUID
INCREASE/DECREASE_THRESHOLD , -

INCREASE/DECREASE_POLICY
, -



140 8 . -

8.10 ()
GUID
INCREASE/DECREASE_TIME
-
,


TIME_CHECK
-
( )
BOOST_POLICY , , -
,


ALLOW_THROTTLING -
(T-) -

HISTORY -
,
-

8.11. (GUID_PROCESSOR_IDLE)
GUID
ALLOW_SCALING , -

, -

DISABLE ,

TIME_CHECK -

, -
( )
DEMOTE/PROMOTE_THRESHOLD ,

8.12. (GUID_PROCESSOR_CORE_PARKING)
GUID
INCREASE/DECREASE_THRESHOLD , -

141

GUID
INCREASE/DECREASE_POLICY ,


MAX/MIN_CORES
( )
INCREASE/DECREASE_TIME
,
-

CORE_OVERRIDE

PERF_STATE , -

8.13.
(GUID_PROCESSOR_CORE_PARKING_AFFINITY_HISTORY)
GUID
DECREASE_FACTOR ,
-

THRESHOLD , , -


WEIGHTING

8.14.
(GUID_PROCESSOR_CORE_PARKING_OVER_UTILIZATION)
GUID
HISTORY_DECREASE_FACTOR ,


HISTORY_THRESHOLD , ,


WEIGHTING -

THRESHOLD , -

142 8 . -

:
!popolicy
. , PPM,
. dt PPM-
, GUID- .
4,
4 !popolicy .

lkd> !popolicy
SYSTEM_POWER_POLICY (R.1) @ 0x8377a6c4

lkd> dt nt!_POP_POWER_SETTING_VALUES 8377a6c0


...
+0x10c AllowThrottling : 0 ''
+0x10d PerfHistoryCount : 0x20 ' '
+0x110 PerfTimeCheck : 0xf
+0x114 PerfIncreaseTime : 1
+0x118 PerfDecreaseTime : 1
+0x11c PerfIncreaseThreshold : 0x1e ''
+0x11d PerfDecreaseThreshold : 0xa ''
+0x11e PerfIncreasePolicy : 0x2 ''
+0x11f PerfDecreasePolicy : 0x1 ''
+0x120 PerfMinPolicy : 0x5 ''
+0x121 PerfMaxPolicy : 0x64 'd'
+0x124 PerfBoostPolicy : 0x64
+0x128 CoreParkingIncreaseThreshold : 0x55 'U'
+0x129 CoreParkingDecreaseThreshold : 0x32 '2'
+0x12a CoreParkingMaxCores : 0x64 'd'
+0x12b CoreParkingMinCores : 0xa ''
+0x12c CoreParkingIncreasePolicy : 0 ''
+0x12d CoreParkingDecreasePolicy : 0 ''
+0x130 CoreParkingIncreaseTime : 7
+0x134 CoreParkingDecreaseTime : 0x14
+0x138 CoreParkingAffinityHistoryDecreaseFactor : 0x2 ''
+0x13a CoreParkingAffinityHistoryThreshold : 0x96
+0x13c CoreParkingAffinityWeighting : 0x64
+0x13e CoreParkingOverUtilizationHistoryDecreaseFactor : 0x2 ''
+0x140 CoreParkingOverUtilizationHistoryThreshold : 0x28
+0x142 CoreParkingOverUtilizationWeighting : 0x64
+0x144 CoreParkingOverUtilizationThreshold : 0x3c '<'
+0x145 ParkingCoreOverride : 0x1 ''
+0x146 ParkingPerfState : 0 ''

,
!ppmperfpolicy,
:

lkd> !ppmperfpolicy

MaxPerf: 100%
MinPerf: 5%
TimeCheck: 15 ms
IncreaseTime: 1 time check period(s)
DecreaseTime: 1 time check period(s)
IncreaseThreshold: 30%
DecreaseThreshold: 10%
IncreasePolicy: 2
DecreasePolicy: 1
HistoryCount: 1
BoostPolicy: 100
143


, PPM, -
(performance check). PpmCheckStart,
, . -

PpmCheckPhaseInitiate, PpmCheckRun,
.


PpmCheck PPM- (n - DPC-
(pcc) )
(n )



(

)

Utility (
)
RecordUtility ( )

(

DPC- )
(
)

(
( )

) (
)

( )


( (
)
DPC- ) (
) ApplyProcessorState
(
)



( )
(
( )

) (
)
144 8 . -

PPM_CHECK_PHASE
.8.15.

8.15. PPM

PpmCheckPhaseInitiate -
, -
,

PpmCheckPhaseRecordUtility ,

PpmCheckPhaseCalculateCoreParkingMask ,
, -

, ,
,
.

PpmCheckPhaseReportUnparkedCores -
,

PpmCheckPhaseSelectProcessorState -
( )
,

PpmCheckPhaseSelectDomainState
-
,
-

PpmCheckPhaseCommitDomainState

-

PpmCheckPhaseReportParkedCores
-
.
-

PpmCheckPhaseEnd -

PpmCheckPhaseNotRunning , -

.
145

2. . PpmCheckRecordAllUtility
,
, ,
( , ); DPC-
.
PpmPerfRecordUtility -
. ,
( ),
.
, .
,
, PPM
( -
, ).
-
, ,
, .
4. . . ,
PpmPerfCalculateCoreParkingMask, , -
, ,
:
.
, .
. , -
,
.
. ,
,
.
. , .
.
.
(. -
) ,
, (
, ). ,
, ,
/ .
-
PpmPerfChooseCoresToUnpark, ,

. ,
146 8 . -

.
.
, -
. ,
, , ,
, .
. -
( ):
, -
;
,
;
, ;
, ;
,
.
, -
, ,
. , , -
.
,
.
, -
,
( ) .
5. . PpmPerfSelectProcessorStates
, , -
PpmPerfSelectProcessorState.
( DPC- ),
KPRCB. ,
,
.
, 3 .

. :
. -
.
. -
.
. ,
.
147

, ,
.
, , ,
. -
/ , ,
, , (.-
/ ).
(
)
, .
6. . , -
. -,
PpmPerfSelectDomainStates,
PpmPerfSelectDomainState.

( ). -
.
PpmPerfSelectDomainStates, -
DPC- ,
PpmPerfApplyDomainState. .
P- ( T-,
), ,
,
. -
( )
DPC- ,
.
, DPC- PpmPerfApplyProcessorState,
-
. , PpmScaleIdleStateValues.
, C- -
( )
/.

: PPM-
!ppmcheck, ,
, , .
, -
. :

lkd> !ppmcheck

PpmCheckArmed: TRUE
PpmCheckStartDpc: 0x8377aa58
PpmCheckDpc: 0x8377aa78
PpmCheckTimer: 0x8377aa30
PpmCheckMakeupCount: -

148 8 . -

PpmCheckLastExecutionTime: -
PpmCheckTime: 08:40.738.783us (0x50a26d3d)
PpmCheckPhase: 9
PpmCheckRegistered: 0x8376b408
{[0000000F]}
PpmPerfStatesRegistered: 0x8376b390
{[0000000F]}
CoreParkingEnabled: TRUE
CoreParkingMask: 0x8376b35c
{[0000000A]}

PPM- , -
PowerState PRCB Domain PerfConstraint.
, -
( ) .
PRCB, dt nt!_KPRCB
@$prcb PowerState:

+0x33a0 PowerState :
+0x000 IdleStates : 0x877fe1b0 _PPM_IDLE_STATES
+0x008 IdleTimeLast : 0xa6
+0x010 IdleTimeTotal : 0x97789fc9
+0x018 IdleTimeEntry : 0
+0x020 IdleAccounting : 0x874d8008 _PROC_IDLE_ACCOUNTING
+0x024 Hypervisor : 0 ( ProcHypervisorNone )
+0x028 PerfHistoryTotal : 0
+0x02c ThermalConstraint : 0x64 'd'
+0x02d PerfHistoryCount : 0x1 ''
+0x02e PerfHistorySlot : 0 ''
+0x02f Reserved : 0 ''
+0x030 LastSysTime : 0xfa86
+0x034 WmiDispatchPtr : 0x837c5464
+0x038 WmiInterfaceEnabled : 0n1
+0x040 FFHThrottleStateInfo : _PPM_FFH_THROTTLE_STATE_INFO
+0x060 PerfActionDpc : _KDPC
+0x080 PerfActionMask : 0n0
+0x088 IdleCheck : _PROC_IDLE_SNAP
+0x098 PerfCheck : _PROC_IDLE_SNAP
+0x0a8 Domain : 0x874d9c50 _PROC_PERF_DOMAIN
+0x0ac PerfConstraint : 0x874d9cc8 _PROC_PERF_CONSTRAINT
+0x0b0 Load : (null)
+0x0b4 PerfHistory : (null)
+0x0b8 Utility : 0xba8
+0x0bc OverUtilizedHistory : 0
+0x0c0 AffinityCount : 0
+0x0c4 AffinityHistory : 0

lkd> dt 0x874d9c50 _PROC_PERF_DOMAIN


nt!_PROC_PERF_DOMAIN
+0x000 Link : _LIST_ENTRY [ 0x8376b39c - 0x8376b39c ]
+0x008 Master : 0x8b470120 _KPRCB
+0x00c Members : _KAFFINITY_EX
+0x018 FeedbackHandler : 0x93d19d08 unsigned char +0
+0x01c GetFFHThrottleState : 0x93d1804e void +0
+0x020 BoostPolicyHandler : 0x93d18104 void +0
+0x024 PerfSelectionHandler : 0x93d19bee unsigned long +0
149

+0x028 PerfHandler : 0x93d19d40 void +0


+0x02c Processors : 0x874d9cc8 _PROC_PERF_CONSTRAINT
+0x030 PerfChangeTime : 0xaa90c1ed
+0x038 ProcessorCount : 4
+0x03c PreviousFrequencyMhz : 0x532
+0x040 CurrentFrequencyMhz : 0xa65
+0x044 PreviousFrequency : 0x31
+0x048 CurrentFrequency : 0x64
+0x04c CurrentPerfContext : 0
+0x050 DesiredFrequency : 0x64
+0x054 MaxFrequency : 0xa65
+0x058 MinPerfPercent : 0x2c
+0x05c MinThrottlePercent : 5
+0x060 MaxPercent : 0x64
+0x064 MinPercent : 5
+0x068 ConstrainedMaxPercent : 0x64
+0x06c ConstrainedMinPercent : 0x2c
+0x070 Coordination : 0x1 ''
+0x074 PerfChangeIntervalCount : 0n0

lkd> dt 0x874d9cc8 _PROC_PERF_CONSTRAINT


ntdll!_PROC_PERF_CONSTRAINT
+0x000 Prcb : 0x8376cd20 _KPRCB
+0x004 PerfContext : 0x877febe0
+0x008 PercentageCap : 0x64
+0x00c ThermalCap : 0x64
+0x010 TargetFrequency : 0x36
+0x014 AcumulatedFullFrequency : 0x46c3df
+0x018 AcumulatedZeroFrequency : 0xd51828
+0x01c FrequencyHistoryTotal : 0
+0x020 AverageFrequency : 0x36

- - Windows -
.
IRP-, ,

-. - -
-,
. -
Windows ,
, -.
,
, , ,
.

-. -
, .
150 8 . -

,
.
, Windows
.
, PnP- ,

, .


.
,
-: , (-
, NTFS) .
9.


.
(storage) , -
, - USB-,
, (Solid State Disks, SSD), ,
iSCSI, (Storage Area Networks, SAN) -
, (Virtual Hard Disks, VHD).
Windows
. Windows,
-
, -.
( )
Windows .

, ,
, -
. ,
, -
,
. ,
, -
, Windows
.


:
(disk) ,
, -, DVD-, Blu-ray,
(SSD) -.
(sectors) . -
. , -
, , 512 ( 4096),
CD-ROM 2048.
4096- http://support.microsoft.com/
kb/2510009/ru.
152 9.

(partitions) .
,
.
.
(simple volumes) ,
, .
(multipartition volumes) ,
, -
. , ,
, .


Windows ,

. ,
, . -
-
(
). ,
( , )
(-, -).
Windows -
, SCSI, SAS (Serial Attached SCSI), SATA (Serial
Advanced Technology Attachment), USB, SD/MMC iSCSI.


( ) -
, .
,
, .


1956
IBM , , ,
,
( ). -
512.
, 1956 2000
, 2011 650 ,
15.
153

,
: 512 4096,
, (Error Correcting Code, ECC), 50
100. .
x86 -
NTFS. 10%

( , )
. ( ECC 100 , -
ECC 50 .)
, 12
, NTFS ,
.
( 512e)
, -
512.
, 4096; -
512 (
).
. ,
6
512,
6, .9.1.

. 9.1. 512e

,
--, .9.2.
1. 6.
2. 6 0
.
3. 6
.
4. 4096 .
154 9.


6

6

. 9.2. -- 512e

,
,
.
Windows
4096, -- .
12 , NTFS -
, 512, -
4096. Windows
( 11) ,
512- ; ,
( - IOCTL_
STORAGE_QUERY_PROPERTY BytesPerPhysicalSector)
- 512. -
-
,
.


- , -
,
(SSD), -. Windows,
.
, .
- (Random
Access Memory, RAM),
, .
- NOR NAND. RAM,
, NAND
, . - NOR
BIOS , NAND
.
155

, -
, - 100000.
( - 1000.)
- , -
(, ), RAM
. - ;
( -
NOR). - ( 100000;
, 50, 5,
), , RAM (
50). -
, , -
. -
, ,
- 1000 -
,
SSD.

- NAND
- NAND,
. :
(Single-Level Cell, SLC) 1 -
, (100000),
, MLC,
.
(Multilevel Cell, MLC) -
, , SLC. MLC-
ECC-, , SLC,
( 5000) .
- NAND 4096 (
512 4096),
.
( 64 1024), -
. ,
ECC .
,
. ( -
.) , ,
, :
1. .
2. -.
3. RAM, .
4. -.
156 9.

, (512)
. , 128 ,
1023 ( 1024),
. ,
,
SSD: SSD- ,
.
. ,
, Trim.
.
, , (
-). ,

. , - MLC 1
128 ( 2048)
23,7 (, -
1000 , -).
16,6!
( 20%
), . ,
- , -
.
- -
(wear-leveling), -
. , , ,
; , ( ,
). , (,
). , -
,
. ,

-, .
- , ,
, . ,

, ,
.

Trim
, ,

, , -
, .

( ; 12).
157

,
(,
, , , -
).

. , -
, , . -

,
. , (
) .
. .
trim. , -
, - IOCTL_STORAGE_
QUERY_PROPERTY StorageDeviceTrimProperty
( ). ,
trim, -
, .
- IOCTL_STORAGE_MANAGE_DATA_SET_ATTRIBUTES -
DeviceDsmAction_Trim.
trim, ,
.
-
, . ,
trim ,
, .
Windows , Microsoft
,
. -
, -.
Windows SSD. (
,
, .)
12, NTFS -
(-) ,
, , -
-. SSD C, -
, ,
.



, ,
,
Windows.
158 9.


, , -
(storage stack). .9.3
, , .
,
. ( 12.)

-
-

(C:, D:) -
;
(RAID)


,

: - -: -
- - -
;
;
( Storport -
RAID, FC, SCSI
. .)

. 9.3. Windows

Winload
(.4 I), Windows
Winload. -
, ,
,
- Windows. Winload ;
Bootmgr, -
(Boot
159

Configuration Database, BCD) EFI


. Bootmgr
Winload
Windows ( , Ntoskrnl.exe
). Winload
.

, -
-
. Windows /
/-. Microsoft -
, ,
, ,
, SATA (Serial Advanced Technology Attachment), SAS
(Serial Attached SCSI) Fibre Channel. -
-, Windows
.
-
Windows . -
,
,
Windows -.
-, Microsoft -
,
, . Windows ,
(%SystemRoot%\System32\
Drivers\Disk.sys). Windows
. , %SystemRoot%\System32\Drivers\Scsiport.sys
SCSI (Scsiport -
), %SystemRoot%\System32\Drivers\Ataport.sys
IDE.
%SystemRoot%\System32\Drivers\Storport.sys Scsiport.sys. Storport.sys

RAID- Fibre Channel. Storport -
Scsiport,
- Scsiport Storport. -,
Storport, Storport,
,
- , -
-
IRQL
. Storport
( -
) NUMA ( NUMAI/O).
160 9.

, Scsiport.sys Ataport.sys,
C-LOOK.
, , -
(Logical Block Address, LBA), .
KeInsertByKeyDeviceQueue KeRemoveByKeyDeviceQueue (
Windows Driver Kit), ,

. ,
. , ,
. -

. Storport.sys ,
,
, .
Windows -.
IDE ATAPI - -
%SystemRoot%\System32\Drivers\Atapi.sys, %SystemRoot%\System32\
Drivers\Pciidex.sys %SystemRoot%\System32\Drivers\Pciide.sys.
Windows .

iSCSI-
iSCSI
SCSI TCP/IP. -
, ,
IP-. (SAN) Fibre Channel,
iSCSI
, , Gigabit Ethernet.
, , -
. iSCSI Windows
iSCSI- Microsoft,
Windows.
:
(initiator). ,
Storport - iSCSI (%SystemRoot%\System32\Drivers\Msiscsi.
sys). iSCSI -
Ethernet TCP/IP
TCP/IP.
(initiator service). ,
%SystemRoot%\System32\Iscsicli.exe ,
iSCSI-, .
%SystemRoot%\System32\Iscsium.dll.
iSCSI- -
-, -
.
HBA- ( ; iSCSI,
161

, -Stor-
port). iSCSI Win32 WMI
. iSCSI-
:
iSNS (Internet Storage Name Service ).
iSNS-, iSCSI-,
iscsicli AddiSNSServer.
SendTargets. SendTarget -
iscsicli AddTargetPortal.
. iSCSI-, -
iSCSI-,
iSCSI-.
. iSCSI- -
iscsicli AddTarget
iSCSI-.
. Iscsicli.exe (
iSCSI- )
.
iSCSI-
iSCSI. , -
iSNS (RFC4171), iSCSI-,
iSCSI- iSCSI-,
Windows.

MPIO-

, . , -
, (Multipath
I/O, MPIO).
,
.

. Windows -
, .
,
(Device-Specific Modules, DSM).
, ,
, -
, Windows . Windows
DSM- (%SystemRoot%\System32\Drivers\Msdsm.sys),
,
(T10SPC4),
(Asymmetric Logical Unit Arrays, ALUA).
162 9.

DSM- ALUA . -
DSM Windows Driver Kit.
MPIO Windows Server2008/R2
. Windows
MPIO .
.9.4 Windows MPIO-
MPIO-,
Windows (Mpdev.sys).

(FDO) (FDO) (FDO)

:
FDO =
PDO =
1 2

. 9.4. MPIO- Windows

Disk.sys (-
, ,
) -
DSM-, .
163

(%SystemRoot%\System32\Drivers\Mpio.sys) -
, .
Disk.sys Mpio.sys ,
. ( -)
MPIO
. , -
( ), (
MPIO-). DSM
, . DSM
,
. , , .
-
(
).
MPIO, . ,
Windows ,
-.
MPIO- MP-
Claim (%SystemRoot%\System32\Mpclaim.exe) .

:
Diskmon, Windows Sysinternals (www.microsoft.
com/technet/sysinternals), Windows (Event
Tracing for Windows, ETW), 3 I,
.
. , -
, , , , .


Windows
. \Device\HarddiskX\DRX, X
164 9.

. , -
,
WindowsNT4, . ,
\Device\Harddisk0\Partition0
\Device\Harddisk0\DR0 \Device\Harddisk0\Partition1
. -
, ,
, ,
WindowsNT4. , ,
\GLOBAL??\PhysicalDrive0 \Device\Harddisk0\DR0. 9.5
WinObj Sysinternals,
Harddisk .
.

. 9.5. WinObj
Harddisk

3 I, Windows API -
. -
, \Global??. (
\BaseNamedObjects,
165

3.) Windows -
, , COM-
. , ,
, Windows
\Global?? , .
-
\Global??\PhysicalDriveX, \Device\HarddiskX\DRX,
X 0. Windows-,
, CreateFile,
\\.\PhysicalDriveX, X . ( ,
.)
Windows \Global??\PhysicalDriveX
.


(%SystemRoot%\System32\Drivers\Partmgr.sys) -
, , . -

, .
IoReadPartitionTableEx -
.
-
,
IoReadPartitionTableEx. - -
, , - -
(Master Boot Record, MBR) GUID
(GUID Partition Table, GPT), ,
PDRIVE_LAYOUT_INFORMATION_EX.

( ),
IoReadPartitionTableEx.
\Device\HarddiskVolumeY, Y .

, MBR , GPT GUID (Global
Unique Identifier ).
, (
), , -
(
MPIO-).

,
. -
,
.
166 9.

(, read-only
offline), ,
. -
Hyper-V. ,
, -
, .
, .


Windows (basic) (dynamic) .
, MBR GPT, . -
.
.
,
, , -
. Windows .
( -
). ,
Microsoft .


Windows . -
, , ,
, Windows
. , .
, IEEE1394 USB, , -
, .


, MBR GPT.
Windows . ,
, .
Windows .

MBR
BIOS, , -
BIOS ( EFI) x86 ( x64),
Windows
(MBR). x86
BIOS
. ,
BIOS . -
167

Microsoft, Windows, MBR


(partition table). ,
(primary partitions).
. , ,
. ,
FAT32 NTFS.
(extended partition).
.
(logical drive).
Microsoft
,
. , -
, ,
.
Windows.
(). ,
MBR,
( ) . - ,
, Windows
. 13,
,
.

GPT
, -
,
, Intel EFI (Extensible
Firmware Interface). Itanium.
Intel EFI Unified EFI Forum, -
x86, x64 ARM. UEFI
-, (
-).
. UEFI
, GPT (GUID Partition Table GUID ).
MBR. -
, , GPT-, 32-
64-. 32- 2
, GPT .
GPT
(Cyclic Redundancy Checksums, CRC), -
, . GPT -
, 36- Unicode-,
(GUID).
GPT- .9.6. MBR,
GPT- ,
168 9.

, GPT (
).
GPT- ,
. GPT
, MBR.

-
1



: LBA

. 9.6. GPT-


Windows ,
. Disk Management -
MMC , ,
(partition).


( %SystemRoot%\System32\Drivers\Volmgr.sys )
, ,
, .
\Device\HarddiskVolumeX,
X ( 1).
, -
PnP-
. PnP-
(Partmgr.sys),
. PnP-,
Windows ,
.
,
169

.
Windows
, , ,
.
, Disk Management MMC.
,
,
, .
Windows \Global?? -
, , .

,
, ,
. ( .)


, Windows -
, , RAID-5 (
).
(Logical Disk Manager, LDM),
Virtual Disk Service (VDS).
.
MBR GPT, LDM -
, ,
.

LDM

1, (LDM).
Windows -
. LDM
.9.7 : , (private
header), , (-
.9.7 ).
1
. Windows,
, GUID ,
, .
128- , Windows
. LDM
,
GUID , .
, .

, Dg0
170 9.

( , Daryl Daryl-Dg0).
LDM
.

Private Header
(Private Header)

. 9.7. LDM

16
. , ,
. ,
, GUID ,
. , LDM
.
(128),
.
: , , -
. LDM
. LDM .
(partition entries) (
),
; , , -
. (disk entry)
GUID. (component
entry)
, . (volume entry)
GUID, , .
178 .
, .
LDM : ,
.
LDM 200, :
Disk Entry Volume Entry Component Entry Partition Entry
Name: Disk1 Name: Volume1 Name: Volume1-01 Name: Disk1-01
GUID: XXX-XX... ID: 0x408 ID: 0x409 ID: 0x407
Disk ID: 0x404 State: ACTIVE Parent ID: 0x408 Parent ID: 0x409
Size: 200MB Disk ID: 0x404
GUID: XXX-XX... Start: 300MB
Drive Hint: H: Size: 200MB
171

, ,
, -
(GUID), Windows
.
. , (
) , , ,
. ,
, ,
. LDM
,
, .
LDM ,

. -
,
.

: LDM .
LDMDump
LDMDump, Sysinternals, -
LDM.
,
,
, ldmdump /d0 > disk.txt.
, LDMDump. -
LDM, ,
12 4.
Volume1. LDMDump -
.

C:\>ldmdump /d0
Logical Disk Manager Configuration Dump v1.03
Copyright (C) 2000-2002 Mark Russinovich

PRIVATE HEAD:
Signature : PRIVHEAD
Version : 2.12
Disk Id : b5f4a801-758d-11dd-b7f0-000c297f0108
Host Id : 1b77da20-c717-11d0-a5be-00a0c91db73c
Disk Group Id : b5f4a7fd-758d-11dd-b7f0-000c297f0108
Disk Group Name : WIN-SL5V78KD01W-Dg0
Logical disk start : 3F
Logical disk size : 7FF7C1 (4094 MB)
Configuration start: 7FF800
Configuration size : 800 (1 MB)
Number of TOCs : 2
TOC size : 7FD (1022 KB)
Number of Configs : 1
Config size : 5C9 (740 KB)
Number of Logs : 1
Log size : E0 (112 KB)

172 9.

TOC 1:
Signature : TOCBLOCK
Sequence : 0x1
Config bitmap start: 0x11
Config bitmap size : 0x5C9
Log bitmap start : 0x5DA
Log bitmap size : 0xE0
...
VBLK DATABASE:
0x000004: [000001] <DiskGroup>
Name : WIN-SL5V78KD01W-Dg0
Object Id : 0x0001
GUID : b5f4a7fd-758d-11dd-b7f0-000c297f010
0x000006: [000003] <Disk>
Name : Disk1
Object Id : 0x0002
Disk Id : b5f4a7fe-758d-11dd-b7f0-000c297f010
0x000007: [000005] <Disk>
Name : Disk2
Object Id : 0x0003
Disk Id : b5f4a801-758d-11dd-b7f0-000c297f010
0x000008: [000007] <Disk>
Name : Disk3
Object Id : 0x0004
Disk Id : b5f4a804-758d-11dd-b7f0-000c297f010
0x000009: [000009] <Component>
Name : Volume1-01
Object Id : 0x0006
Parent Id : 0x0005
0x00000A: [00000A] <Partition>
Name : Disk1-01
Object Id : 0x0007
Parent Id : 0x3157
Disk Id : 0x0000
Start : 0x7C100
Size : 0x0 (0 MB)
Volume Off : 0x3 (0 MB)
0x00000B: [00000B] <Partition>
Name : Disk2-01
Object Id : 0x0008
Parent Id : 0x3157
Disk Id : 0x0000
Start : 0x7C100
Size : 0x0 (0 MB)
Volume Off : 0x7FE80003 (1047808 MB)
0x00000C: [00000C] <Partition>
Name : Disk3-01
Object Id : 0x0009
Parent Id : 0x3157
Disk Id : 0x0000
Start : 0x7C100
Size : 0x0 (0 MB)
Volume Off : 0xFFD00003 (2095616 MB)
0x00000D: [00000F] <Volume>
Name : Volume1
Object Id : 0x0005
Volume state: ACTIVE
173

Size : 0x017FB800 (12279 MB)


GUID : b5f4a806-758d-11dd-b7f0-c297f0108
Drive Hint : E:

LDM GPT MBR


, Windows, -
( BIOS UEFI ,
). BitLocker, Windows Setup
( 100) , -
(system volume) (Bootmgr),
(BCD)
. ( ,
,
Disk Management MMC,
%SystemRoot%\System32\Diskmgmt.msc.) , Windows Setup
, Windows
(\Windows). -
, Microsoft, .
, Windows , ,
, Windows -
, Ntoskrnl.exe ( ).


BitLocker ,
.

-
, LDM MBR GPT,
Windows -
. ( , Winload Itanium
LDM-.) ,
MBR GPT.
. LDM
LDM. , MBR GPT, -
, .
MBR LDM
, GPT
LDM, . .
, LDM MBR GPT, -
, -
, , .
LDM- MBR- GPT-, -
(soft partitions); MBR GPT
(hard partitions). MBR .9.8.
174 9.

LCDM-
LDM

. 9.8.


. 9.9 Disk Management MMC (-
DMDiskManager, %SystemRoot%\System32\Dmdskmgr.
dll) LDM.
Disk Management
LDM. .
,
, ,
.
DMDiskManager .
DMDiskManager VolMgrX
(%SystemRoot%\System32\Drivers\Volmgrx.sys). VolMgrX -
(Dynamic Link Library, DLL) , -
VolMgr.
, -
. Disk Management
DMDiskManager.

. 9.9. Disk Management


175


VolMgr ,
,
, .
,
.
, -

. , -
. , VolMgr
VolMgrX
, ,
.
Windows :
;
;
;
RAID-5.

, VolMgr
IRP-, .

DLL- VolMgr VolMgrX.


(spanned volume) , -
( 32) . Disk
Management MMC ,
Windows .
.9.10 100- , D
. WindowsNT4
(volume sets).

C: D:
100 50
2
1

D: E:
50 100 3
2

. 9.10.
176 9.

-
,
. NTFS
, ,
. -
NTFS- .
NTFS ,
-
. ,
. FAT-
FAT,
.
Windows -
. , .9.10 NTFS D
100. ,
, NTFS . -

, .


. ,
.


(striped volume) (
32),
.
RAID-0 (RAID-0). 9.11 ,
. (
;
.)

-

(150 ) (150 ) (150 )

. 9.11.


450,
, .
177

,
, .9.12.

(150 ) (150 ) (150 )

. 9.12.

64 ( -
,
), - .
, , -

. ,
- , -
.
, -
- .
.
:
RAID-5. Windows
Disk Management.


(mirrored volume)
, .9.13.
RAID-1 (RAID-1).

C:

C:
()

. 9.13.
178 9.

C, -
. C
- ,
.
Windows .
,
.

- . -

( -
).
.
, -
,
.
, -
, . ,
Windows, MBR Winload, , -
. ,
,
, MBR
. -
,
.
OS \Boot\BootStat.dat . -
,
.

: -

Performance Monitor , -
,
, ,
. .
,
, .

Disk Management MMC


:

1. Computer Management ( ),
Storage ( ) Disk
Management ( ). Disk Management
MMC.
2.
New Simple Volume ( ).
179

3. (New Simple Volume Wizard). -


,
.
4.
Add Mirror ( ).
Performance Monitor (
) PhysicalDisk ( )
, .
Disk Writes/sec ( /). (
) -
.
.


Disk Writes/sec . ,
( VolMgr)
.

RAID-5
RAID-5
. RAID 5,
, -
(striped volumes with rotated parity).

. RAID-5 .9.14.
180 9.

1 2 3
-

. 9.14. RAID-5

, 1
1. (XOR) -
2 3. 2
2, 3 3. -

. , -
, .
, ,
.
RAID-5
: n
n1, . ,
x+y=z, z ,
zy x; y, zx.

. RAID-5
, XOR (-
).
1 2 5 -
3
2. 3
6 1 , -
2
3. RAID-5
(, ).


, -
, , Windows-
,
, .
181


(%SystemRoot%\System32\Drivers\Mountmgr.sys)
Windows -
, CD-ROM, .
Windows HKLM\SYSTEM\MountedDevices
. , \??\Volume{X}
(X GUID) , \DosDevices\C:.
, ( , -
). .9.15
. , MountedDevices
-
. (
13.)

. 9.15. , ,

, -
,
.
,
VolMgr.
Plug and Play,
, . -
GUID

, MountedDevices .
, -
. ,
182 9.

VolMgr .
VolMgr ,
.
, -
( ),
(, \Global??\D:).
MountedDevices .
.
( \Global??\Volume{X}),
, .
, VolMgr.


(mount points) NTFS-
, ,
. , NTFS-, C:\Projects, -
(NTFS FAT), .
\CurrentProject\Description.txt,
C:\Projects\CurrentProject\Description.txt.
,
12.
(reparse point)
, Windows NTFS-
NTFS-.
, , -

. (
16.) , ,

,
NTFS-. ,
. NTFS
,
( ).
NTFS, -
. -
,
-,
, -
. - -
,
, NTFS
.
,
, Microsoft.
183


, Windows -
NTFS ( NTFS -
12). , - NTFS
,
, , -
. -
file cannot be accessed by the system (
), .
,
(\Global??\Volume{X}) . -
Disk Management MMC,
.
Mountvol.exe (%SystemRoot%\
System32\Mountvol.exe).
NTFS-
, -
. System Volume Information NTFS-.

(, Windows)
( ).
, NTFS
\$Extend\$Reparse. ( .)
NTFS , Windows
, ,
( )
Windows-, , Disk Management.


, Windows ,
, Windows -
. , -
; ,
.
-
, -
IRP- . Windows
: , (Volume Parameter
Blocks, VPB) .


SAN-, DiskPart,
, , -
. Windows Server2008 Enterprise Datacenter
, .
184 9.

-
,
. -
( )
IoRegisterFileSystem. -
,
.
VPB- , -
VPB . VPB
, -
,
. VPB- (VPB->DeviceObject
== NULL) , . -
- VPB
,
.
, -
D, \Global??\D:, \Device\
HarddiskVolume2. Windows-, \Temp\Test.txt
D, D:\Temp\Test.txt, Windows -
NtCreateFile \Global??\D:\
Temp\Test.txt.
, \Device\
HarddiskVolume2 \Temp\Test.txt.
- , VPB \Device\HarddiskVolume2
. -
,
,
.

:
VPB !vpb . VPB -
, .
,
, Vpb.

lkd> !drvobj volmgr


Driver object (84905030) is for:
\Driver\volmgr
Driver Extension List: (id , addr)

Device Object list:


84a64780 849d5b28 84a64518 84a64030
84905e00

!drvobj , .
. (-
) ,
185

. -
, , ,
, . !devobj,
:

lkd> !devobj 84a64780


Device object (84a64780) is for:
HarddiskVolume4 \Driver\volmgr DriverObject 84905030
Current Irp 00000000 RefCount 0 Type 00000007 Flags 00001050
Vpb 84a64228 Dacl 8b1a8674 DevExt 84a64838 DevObjExt 84a64930 Dope
849fd838 DevNode 849d5938
ExtensionFlags (0x00000800)
Unknown flags 0x00000800
AttachedDevice (Upper) 84a66020 \Driver\volsnap
Device queue is not busy

!devobj VPB . ( -
HarddiskVolume4.) !vpb:

lkd> !vpb 84a64228


Vpb at 0x84a64228
Flags: 0x1 mounted
DeviceObject: 0x84a6b020
RealDevice: 0x849d5b28
RefCount: 4311
Volume Label: OS

,
, OS. RealDevice
, DeviceObject
, .

!devobj, , -

, NTFS:

lkd> !devobj 0x84a6b020


Device object (84a6b020) is for:
\FileSystem\Ntfs DriverObject 84a02ad0
Current Irp 00000000 RefCount 0 Type 00000008 Flags 00040000
DevExt 84a6b0d8 DevObjExt 84a6bc00
ExtensionFlags (0x00000800)
Unknown flags 0x00000800

AttachedDevice (Upper) 84a63ac0 \FileSystem\FltMgr


Device queue is not busy


(Volume Boot Record, VBR),
. -
Microsoft , .

,
186 9.

,
. , NTFS ,
MBR- Type NTFS (0x07), Name "NTFS", -
.
, --
VPB (
\Temp\Test.txt) , , , ,

. VPB
-
.
, Raw, Ntoskrnl.exe,
. , Raw
- ,
,
. .9.16 ,
(
).

-

-
(, D:temp\test.txt),
\Device\HarddiskVolume2


NTFS
NTFS -

-


-
, -
VPB-
- -

-

VPB-

-




. 9.16. -


Windows , -

File System Recognizer (%SystemRoot%\System32\Drivers\Fs_rec.sys).
Windows ,
-
187

Windows. File System Recognizer -


, -
,
, VBR
. File System Recognizer IRP
.
,
,
Chkdsk .
Chkdsk ( Win32-
) Autochk.exe (%SystemRoot%\System32\Autochk.exe). -
(%SystemRoot%\System32\Smss.exe) ,
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute.
Autochk , ,
.
,
, . Windows
. ,
, .


, -

.
, -
.
, -
. , ,
.
, -
(
IRP-), - ,
. , ( -
)
( ), \\.\HarddiskVolume2 -
ReadFile 512,
. ( ,
.) - IRP-
, , ,
HarddiskVolume2.
, Windows
, -
, ,
. 2 ,
4096 , -
IRP.
188 9.


IRP -.

. (1 2),
VolMgr - , -
, VolMgr
, .

1 2. - , VolMgr
-
. .9.17.


- -
IRP- VolMgr


VolMgr

VolMgr ,

IRP-,
IRP-
,

- IRP-


-

1

. 9.17. - VolMgr

VolMgr ,
.
VolMgr , ,
.


, , , -
RAID-, ,
189

.

-
. , , -

Windows-.
Windows (Virtual Disk Service, VDS).
(%SystemRoot%\System32\Vds.exe)
.

. VDS .9.18.
COM, -
,
RAID-. , VDSAPI, -
, (Logical
Unit Number, LUN) RAID-. Windows,
Disk Management MMC DiskPart Disk
RAID, VDSAPI.




Disk
Management



-
-

, RAID-
Microsoft

. 9.18. VDS
190 9.

VDS , , -
:
(software providers)
, ,
. , ,
, , -
, . -
VDS HKLM\SYSTEM\CurrentControlSet\Services\
Vds\SoftwareProviders ,
(GUID).
ClsId, COM-.
HKEY_CLASSES_ROOT\CLSID\<ClsId>. Windows
VDS- (VDSDynamic Provider),
(%SystemRoot%\System32\Vdsdyn.dll), VDS-
(VDSBasic Provider),
(%SystemRoot%\System32\Vdsbas.dll).

(hardware providers) (DLL), -
HKLM\SYSTEM\CurrentControlSet\Services\Vds\
HardwareProviders - VDS-
, . -
, RAID-
, , , ,
, LUN.
VDSAPI,
, -RPC Svchost VDS
(%SystemRoot%\System32\Vdsldr.exe). VDS .
VDSAPI VDS- .


Windows VHD (Virtual Hard
Disk) Microsoft .
,
, . Windows
Windows, NTFS
VHD.
, -
VHD Windows:
(dynamic) .
.
, VHD
( ).
191

(fixed) .
( ).
(differencing) . -
, ,
( ).
.
-
. ,
. -
(Virtual Machines, VM),
.
,
, .
,
, -
Windows-
VHD .
, Windows
.
HKLM\System\CurrentControlSet\Services\
FsDepends\Parameters\VirtualDiskMaxTreeDepth . -
, HKLM\System\CurrentControlSet\Services\
FsDepends\Parameters\VirtualDiskNoLocalMount 1.
Windows .
( -
Windows) -
, ImageX Disk2VHD Sysinternals.
VirtualPC
Hyper-V ( Windows Server), Windows Ultimate Enterprise
.
Windows VHD, -
. , VHD
Windows Disk Management MMC
(%SystemRoot%\System32\Diskmgmt.msc) DiskPart
(%SystemRoot%\System32\Diskpart.exe). -
(VDS),
VHD .


Vdrvroot (%SystemRoot%\System32\
Drivers\Vdrvroot.sys) (Physical Device Object,
PDO) . PnP-
- Storport, Vhdmp
(%SystemRoot%\System32\Drivers\Vhdmp.sys),
192 9.

, .
- (
, , )
(DevStack), Vhdmp.
, Vhdmp VHD-
, VHD-.


, -
, .
,
( -
), ( ) -
( ).
-
(%SystemRoot%\System32\Drivers\Fsdepends.sys),
. , -
, ,
. ( ,
,
.)
Windows- VHD-
, , -
, , .
, VHD 2.

BitLocker

,
.
, -
, ,
: BIOS- .
Windows (Encrypting File
System, EFS), ,
. , -
,
. ,
,
.
EFS- (,
EFS- -).
BitLocker 193

, , Windows -
, BitLocker Drive Encryption ( BitLocker).
:
Standard ;
BitLocker To Go ( - USB-
), FAT.
BitLocker -
,
:
Windows ;
-
.
BitLocker
Trusted Platform Module (TPM) 1.2.
TPM , -
. ,
. , TPM,
http://www.TrustedComputingGroup.org/. BitLocker
TPM -
Windows , .
TPM 1.2, BitLocker
Windows.

- USB-, ,
, TPM.
BitLocker
, . BitLocker
:
Trusted Platform Module (%SystemRoot%\System32\Drivers\Tpm.sys), -
TPM .
TPM, , -
TPM (%SystemRoot%\System32\
Tbssvc.dll), WMI MMC (%SystemRoot%\
System32\Tpm.msc).
BitLocker (\Bootmgr, ),
, -
.
BitLocker (%SystemRoot%\System32\Drivers\Fvevol.sys), -
.
BitLocker WMI , -
BitLocker .
194 9.


. BitLocker .9.19.

-

-
- -
BitLocker
TPM MMC
TPM BitLocker
BitLocker BitLocker (manage-bde)

WMI-- WMI--
TPM BitLocker


TPM-
(TBS)





BitLocker (fvevol.sys)

-

/
OS (pre-OS)

. 9.19. BitLocker


BitLocker
(Full-Volume Encryption Key, FVEK) AES128-CBC ( )
AES256-CBC Microsoft, .
, FVEK (Volume Master Key,
VMK) , .
: -

BitLocker 195

, ,
.
BitLocker -
VMK . TPM
VMK TPM, VMK,
TPM, - USB-, -
VMK TPM PIN, .
PIN - USB-
. , TPM, BitLocker
VMK USB-.
NTFS-
100, BCD, MBR
16- -
( 13).
, . ,
, BIOS
, Bootmgr.
, -
Windows , BitLocker .
( ),
.
VMK .9.20 .9.1.

9.1. VMK


TPM -
,
-

TPM + PIN + PIN-

TPM + USB- + USB-
,

USB-
TPM + USB- + -
+ PIN + PIN-
USB-
USB- USB-

, -
TPM,

196 9.

PCR-

2048

TPM PIN

(420 ) 2048
PCR-

AuthData

TPM

2048 256

256


256

- -
1 2
256 256


-
256


-

256


- -
128

- -

- -
1 2
256 256

. 9.20. BitLocker

BitLocker
.
AES
, -

BitLocker 197

, . ,
,
, .
BitLocker -
(diffuser) Elephant. ,

. .
, (
3 I) -
, .


(Trusted Platform Module, TPM)
,
, -
, .
TPM Windows BitLocker.
TPM- (TPM Base Services, TBS)
- TPM- -
WMI TPM. , Win-
dows TPM ,
,
(
).
-
, Windows . :
-
1.2 ;
TCG BIOS,
,
(Static Root of Trust Measurement, SRTM).
TPM, -
TPM- MMC (%SystemRoot%\System32\
Tpm.msc). TPM ,
.9.21. .
, BitLocker TPM

. TPM

, ( -
) .
160- (Platform Configuration Register,
PCR). BitLocker
198 9.

(VMK), . BitLocker
, (FVEK), -
.

. 9.21. TPM- MMC TPM

,
BIOS MBR,
, TPM BitLocker
VMK, Windows (
). PCR-
, ,
BitLocker ,
. Windows
.
TPM 16,
24 , -
TPM (
). PCR ,
. .9.2.
BitLocker 199

9.2.

0 (Core Root of Trust of Measurement, CRTM),
BIOS
1 ,
(BIOS CPU)
2 BIOS (Option ROM code)
3 Option ROM
4 (MBR)
5 MBR-
6 ,
7
8 NTFS ( )
9 NTFS ( )
10
11 BitLocker
12
13
14
15
16
17 CRTM
18
19
20
21
22
23

VMK, , Bit-
Locker 0, 2, 4, 5, 8, 9, 10 11.
(platform validation profile), -
(Computer Configuration\Administrative Templates\Windows Components\
BitLocker Drive Encryption\Operating System Drives\Configure TPM platform validation profile)
, .9.2.
BitLocker- PCR11.


, PCR -
, . -
, BIOS, BitLocker,
BitLocker Drive Encryption ( BitLocker).
200 9.

BitLocker
TPM
TPM, TPM BIOS Windows.
TPM,
CRTM BIOS PCR -
TPM-. CRTM BIOS
BIOS
PCR. , BIOS -
, MBR , ,
.
-
TPM-PCR.
, , -
, (Bootmgr) VMK
TPM . ,
, VMK,
PIN- (), TPM VMK.
,
, ,
. ,
Windows, ,
, Bootmgr VMK
(
).
, -
TPM . TPM
12 ,
2160. TPM , PCR- ,
BitLocker. BitLocker -
,
,
.
9.22 , ,
Winload .
BitLocker
,
(, BIOS, ,
..). -
BitLocker Drive Encryption ( BitLocker)
BitLocker
Suspend Protection ( ). -
,
, BitLocker- .
BitLocker -
BitLocker 201

. BitLocker
.


-
-
TPM

. 9.22. BitLocker



,
FVEK. BitLocker
, .

BitLocker
BitLocker ( USB-)
() , .9.20.
BitLocker . VMK
256- AES-CCM,
, . -
48 , 6,
:
6 11.
, .
6 216 11. -
16 . ,
128 .
.
202 9.

-

. .9.23
.

. 9.23. BitLocker

-
, . -
BCD, , debug.
Bootmgr ,
. ,
, .
(foreign
volumes). ,
BitLocker Windows. -
, .


(EFS), NTFS-
, BitLocker
, (%SystemRoot%\System32\Drivers\
Fvevol.sys), .9.24.
BitLocker 203

FVE-

. 9.24. BitLocker

(Full-Volume Encryption, FVE) -


, , -
-
FVEK, BitLocker.
-,
NTFS, NTFS . ,
, BitLocker.
- Windows, .
, BitLocker ,
,
,
.
FVEK ,
, Elephant, Bit-
Locker ,
.
.
BitLocker ( ) ,
, VMK -
BitLocker .
.
204 9.

BitLocker
BitLocker ,
. BitLocker -
WMI
( TPM-), ,
,
Active Directory (%SystemRoot%\
System32\Manage-bde.exe).
, ,
Win32_Tpm Win32_EncryptableVolume -
, , , PCR
BitLocker,
.
%SystemRoot%\System32 Manage-bde.exe
BitLocker .

,
-
. , BitLocker
. Local Group Policy
Editor ( ),
Computer Configuration ( ), Administrative Templates
( ), Windows Components ( Windows), BitLocker
Drive Encryption ( BitLocker). , .9.25 ,
Active Directory.

. 9.25. BitLocker
BitLocker 205

TPM -
, TPM Key Backup ( TPM-),
Trusted Platform Module Services ( )
Windows Components ( Windows).
, BitLocker
(Data Recovery Agent, DRA). -

. ( -,
) , BitLocker. -
DRA http://technet.microsoft.com/en-us/library/
dd875560(WS.10).aspx.

BitLocker To Go
, -
USB- .
. -
, ,
. BitLocker
NTFS-, - USB-
FAT.
BitLocker To Go (BTG).
Windows, Enterprise, Ultimate Server.
Windows,
, WindowsXP WindowsVista, Windows7
Windows Server2008/R2. BTG,
.
BitLocker, BTG -
AES, ,
Active Directory. BTG
BitLocker TPM, .
-
-.
BTG , -
Turn On BitLocker ( BitLocker),
. BTG -
(discovery volume) FAT32, ,
.9.26. BitLockerToGo,
MUI- ( )
.
-
(cover files) COV0000.ER COV9999.ER.
4, .9.26 9.27.
- (padding files),
.
206 9.

. 9.26. BitLocker To Go



BitLockerToGo

. 9.27. BitLocker To Go

BitLocker-
ToGo .
.
207


(Volume Shadow Copy Service, VSS) -
Windows ,
,
(shadow copies), (snapshots).
VSS , , -
,
.


(clone) -
(copy-on-write). VSS-
( ).
. , -
: ,
.


(clone shadow copy),
(split mirror),
, -
. ,
.
. -
,
.



(differential copy) , -
. , -
.
,
.

.


Windows VSS-
.
208 9.

VSS
(%SystemRoot%\System32\Vssvc.exe) -
(VSSwriters), (VSSproviders) -
(VSSrequestors). ,
,
Microsoft SQL Server, Microsoft Exchange Server Active Directory,
,
. VSS-

, ,
. ,
. -
,
-
. (VSS),
, .9.28.

. 9.28. VSS

VSS
, ,
, .9.29.
, VSS
, (1). VSS

XML(2).
, -
.
(3).
VSS (commit) (4).
VSS -
( ). VSS

209

-
- IOCTL_VOLSNAP_FLUSH_AND_HOLD_WRITES.
(5).
, VSS (6).
10. , -
. VSS
, IOCTL_VOLSNAP_RELEASE_WRITES.
,
(7).

- -
- -

. 9.29. VSS

VSS ,
- ,
. -
, VSS .
VSS ,
1 , .
, VSS
.

, , TxF (NTFS -
),
.
.


VSS
(transportable shadow copy).
210 9.


(%SystemRoot%\System32\Drivers\Swprov.dll)
(%SystemRoot%\
System32\Drivers\Volsnap.sys).
, -
- .
VSS ,
-
System Volume Information.
. ,
,
. ,
\Device\HarddiskVolume1,
\Device\HarddiskVolumeShadowCopyN, N .


C:

. 9.30.

,
,
, . -
, .

. ,
System Volume Information ( -
),
API
.
211

.9.30 , , ,
, .
,
, , a, b
C. , , -
C,
,
.
, d, .



, , System Vol-
ume Information. .

:
Microsoft
-
Microsoft, .
,
:

1: kd> !devobj \device\harddiskvolume1


Device object (88cfd908) is for:
HarddiskVolume1 \Driver\volmgr DriverObject 8861a550
Current Irp 00000000 RefCount 3274 Type 00000007 Flags 00201150
Vpb 88cfc3f8 Dacl 8bbcf7ec DevExt 88cfd9c0 DevObjExt 88cfdaa8 Dope
88cfdb38 DevNode 88cfc008
ExtensionFlags (0x00000800) DOE_DEFAULT_SD_PRESENT
Characteristics (0000000000)
AttachedDevice (Upper) 88cfd3b8 \Driver\fvevol
Device queue is not busy.
1: kd> !devstack 88cfd908
!DevObj !DrvObj !DevExt ObjectName
88d015a0 \Driver\volsnap 88d01658
88cfc478 \Driver\rdyboost 88cfc530
88cfd3b8 \Driver\fvevol 88cfd470
> 88cfd908 \Driver\volmgr 88cfd9c0 HarddiskVolume1
!DevNode 88cfc008 :
DeviceInst is "STORAGE\Volume\{53ffaec4-5e9c-11e1-a633-
806e6f6e6963}#0000000000100000"
ServiceName is "volsnap"

HarddiskVolume1 (88cfd908) !devstack,


.

:

, .
Start () Accessories ()System Tools
()WinObj \Device,
.
212 9.

Windows
Windows , -
, ,
.
VSS, , -
.


.
,
.

. , , .

,
, .
, , , -
, ,
, .
.
,
.
213

, .
.

Windows
. .
Properties ().
.
,
.
, Windows -

. -
,

.
Windows7, , ,
.

:
, , Windows -
, .

. -
, C, Restore Previous Versions
( ). .
214 9.

Open (). -
,
. localhost\C$\< > (<>:)
(<>, <>). -
. ( C$ ,
, Windows,
7 I.) , -
.
, .


,
. .

.
,
. -
, . , A B,
, New.txt,
. VSS
, ,
.

. 9.31.
215

(, ,
Windows ),
. , ,
,
, . -
Computer ()
Start () , Properties () -
System Protection ( ). ,
System And Maintenance (
), System (). ,
.9.31, , -
( ),
.

: .

,
, . -
Windows Vssadmin (%SystemRoot%\System32\Vssadmin.
exe)
. :

1. list shadows:
vssadmin list shadows

.
,
.

vssadmin 1.1 - Volume Shadow Copy Service administrative command-line tool


(C) Copyright 2001-2005 Microsoft Corp.
Contents of shadow copy set ID: {dfe617b7-ef2b-4280-9f4e-ddf94c2ccfac}
Contained 1 shadow copies at creation time: 8/27/2008 1:59:58 PM
Shadow Copy ID: {f455a794-6b0c-49e4-9ae5-e54647fd1f31}
Original Volume: (C:)\\?\Volume{f5f9d9c3-7466-11dd-9ba5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1
Originating Machine: WIN-SL5V78KD01W
Service Machine: WIN-SL5V78KD01W
Provider: 'Microsoft Software Shadow Copy provider 1.0'
Type: ClientAccessibleWriters
Attributes: Persistent, Client-accessible, No auto release,
Differential, Auto recovered
Contents of shadow copy set ID: {02dad996-e7b0-4d2d-9fb9-7e692be8fe3c}
Contained 1 shadow copies at creation time: 8/29/2008 1:51:14 AM
Shadow Copy ID: {79c9ee14-ca1f-4e46-b3f0-0dc98f8eb0d4}
Original Volume: (C:)\\?\Volume{f5f9d9c3-7466-11dd-9ba5-806e6f6e6963}\
Shadow Copy Volume: \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2.
...

,
C$ ,
216 9.

( / ). -
,
, WinObj.

2. Mklink.exe -
(
12), .
/d , -
.
:
mklink /d c:\old \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\

3. , Subst.exe c:\old
:
subst g: c:\old


, c:\old, ,
g:\. , dir g: .

Win-
dows, . 11 -
, ,
,
.
Windows .
10.

, Windows
Windows .
, -
, .
, -
, ,
.


32- Windows -
2.
, (.
), 32- Windows
3, 64- 4.
64- Windows IA64 7,152,
x64 8,192. ( .)
2 I (., , .2.2),
, Windows, -
2 2,048 Windows.
,
, :
, ,
,
( ) -
. (

. .)

(, -
, )
.
, -
, Windows.
218 10.

,
(section objects),
,
. , -
,
,
(, 32- ,
, 3).
.


,
, ,
( ) , .
.
, , Windows -
.
.


Windows
Ntoskrnl.exe. HAL . -
:
, -
, ;
Windows API
.
,

.
,
System
(. 2
I, , ):
(KeBalanceSetManager, 16) -
(
) ,
(MmWorkingSetManager).
,
, .
(KeSwapProcessOrStack, 23)
,
219

.
,
.
(MiModifiedPageWriter, 17)
-
. ,
.
(MiMappedPageWriter, 17)
( -
). ,

5.
,
, .
-

.
(MiDereferenceSegmentThread, 18)
,
. (,
, -
, ,
.)
(MmZeroPageThread, 0)
, -

.
, ,
Phase1Initialization.
MmZeroPageThread
, Phase1
Initialization .

MiZeroInParallel.
.
.


Windows,
, -
.
,
.
220 10.

-
, -. (
3 I.)
, -
, :
;
;
;
;
( );
;
(
ASLR);
(Page Frame
Number, PFN).
, -
, (,
) (-
).
-.


-
.
, -
, . -
. ,
, ,
, .
. (, ,
.)

:
Performance () -
.
, .
, .
221



Memory
() Windows ( -
). -

Available () Physical
Memory ( ).
,
, -
BIOS, ..
PhysicalMemory , Windows
( ), -
Total ()
PhysicalMemory -
( ), - Memory: Cache Bytes,
Cached () Modified Page List Bytes, Standby Cache Core Bytes,
Standby Cache Normal Priority Bytes Standby Cache
Reserve Bytes ( Memory)
PhysicalMemory , -
( ), - ,
Available () .
,

222 10.



PhysicalMemory
( ), -
Free ()
Kernel Memory (- .
), Paged ,
()
Kernel Memory . -
( ), , -
Nonpaged ()
System (),
Commit (- Committed Bytes Commit Limit
)

,
Poolmon (. ).

Process Explorer Windows Sysinternals (http://www.microsoft.com/


technet/sysinternals)
. ViewSystem Information
( ) Memory (). 32-
Windows .

-
.
223

Sysinternals -
, :
VMMap
;
RAMMap .

, !vm
, ,
. -
. ,
Windows 4:

1: kd> !vm
*** Virtual Memory Usage ***
Physical Memory: 851757 ( 3407028 Kb)
Page File: \??\C:\pagefile.sys
Current: 3407028 Kb Free Space: 3407024 Kb
Minimum: 3407028 Kb Maximum: 4193280 Kb
Available Pages: 699186 ( 2796744 Kb)
ResAvail Pages: 757454 ( 3029816 Kb)
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 370673 ( 1482692 Kb)
Modified Pages: 9799 ( 39196 Kb)
Modified PF Pages: 9798 ( 39192 Kb)
NonPagedPool Usage: 0 ( 0 Kb)
NonPagedPoolNx Usage: 8735 ( 34940 Kb)
NonPagedPool Max: 522368 ( 2089472 Kb)
PagedPool 0 Usage: 17573 ( 70292 Kb)
PagedPool 1 Usage: 2417 ( 9668 Kb)
PagedPool 2 Usage: 0 ( 0 Kb)
PagedPool 3 Usage: 0 ( 0 Kb)
PagedPool 4 Usage: 28 ( 112 Kb)
PagedPool Usage: 20018 ( 80072 Kb)
PagedPool Maximum: 523264 ( 2093056 Kb)
Session Commit: 6218 ( 24872 Kb)
Shared Commit: 18591 ( 74364 Kb)
Special Pool: 0 ( 0 Kb)
Shared Process: 2151 ( 8604 Kb)
PagedPool Commit: 20031 ( 80124 Kb)
Driver Commit: 4531 ( 18124 Kb)
Committed pages: 179178 ( 716712 Kb)
Commit limit: 1702548 ( 6810192 Kb)

Total Private: 66073 ( 264292 Kb)


0a30 CCC.exe 11078 ( 44312 Kb)
0548 dwm.exe 6548 ( 26192 Kb)
091c MOM.exe 6103 ( 24412 Kb)
...

, , .
224 10.


,
, -
, , , -
,
.
Windows,
,
, .
,
, ( ) .
, ,
. ,
, ,
,
. -
.
,
.

Windows API. Windows API
: (Heapxxx Localxxx
Global xxx, API- Heapxxx),
;
, (Virtualxxx),
, , (CreateFileMapping,
CreateFileMappingNuma, MapViewOfFile, MapViewOfFileEx MapViewOfFileExNuma). (-
.)

, , .


(Direct Memory Access, DMA).
Mm. , , ,
, ,
Ex,
( ),
. .


, .
,
, . , -
. (
225

.) ,
Windows, -
.
(.10.1).

10.1.
,
,

x86 4 4 (2, - 1024 (512
PAE, - PAE)
)
x64 4 2 512
IA64 8 16 2048


IA64 -
4 256 . Windows Itanium 8 16
, -
. ,
x64 1, Windows
.


.
,
(Translation Look-aside Buffer,
TLB), ,
,
. ,
TLB-,
,
. , ,
, -
, .
TLB ,
.
, -
, 2, Windows
(Ntoskrnl.
exe Hal.dll), (,
, -
). Windows -
- (
MmMapIoSpace),
226 10.

. , Windows -
, -
, . (. MEM_LARGE_PAGE
VirtualAlloc, VirtualAllocEx VirtualAllocExNuma.)
,
HKLM\SYSTEM\CurrentControlSet\Control\
Session Manager\Memory Management\LargePageDrivers
, .
, -
,

(. .10.1),
-
. (, 0 511
x64 , 512 1023,
10 521 .) -
.
, .
- , -, -
. ,
.
,
(.).
.
. (
) ,
( ). , -
, , ,
, -,
-, , . -
,

, .
, -
Ntoskrnl.exe Hal.dll
, .
, (
) ,
,
, .
, , , (
),
- .
, -
, Driver Verifier ( ),
.
227


(free),
(reserved), (committed) (shareable).
,
.
(private) -
, , ,
( , , ).
Windows- VirtualAlloc,
VirtualAllocEx VirtualAllocExNuma.
, -
.
-
(, ),
,
, . ,
,
. ,
.
,
, .
() ,
, -
. ()
( ),
.
.


, ReadProcessMemory WriteProcessMemory, ,
, ,
( -
). ,
PROCESS_VM_READ PRO-
CESS_VM_WRITE , SeDebugPrivi-
lege, .

(section), ,
, , -
.
. Windows API
, .
-
( -
, ). ,
, (resident),
228 10.


, .
.
-
. -
(modified page
writing).
,
(modified page list); . (-

.)
FlushViewOfFile
.
VirtualFree VirtualFreeEx
() . -


, ,
, .
-
,
, . -
,
.
, -
. ,
(page tables) (Virtual Address
Descriptors, VAD), .

-
.
. (
1;
CreateThread CreateRemoteThread,
/STACK .)
, ,
(guard page), ,
, .

: .

TestLimit ( - )

, Process Explorer.
.
TestLimit, :
229

C:\temp>testlimit -r 1 -c 800

Testlimit v5.2 - test Windows limits


Copyright (C) 2012 Mark Russinovich
Sysinternals - wwww.sysinternals.com

Process ID: 1544

Reserving private bytes 1 MB at a time ...


Leaked 800 MB of reserved memory (800 MB total leaked). Lasterror: 0
The operation completed successfully.

:
C:\temp>testlimit -m 1 -c 800

Testlimit v5.2 - test Windows limits


Copyright (C) 2012 Mark Russinovich
Sysinternals - wwww.sysinternals.com

Process ID: 2828

Leaking private bytes 1 KB at a time ...


Leaked 800 MB of private memory (800 MB total leaked). Lasterror: 0
The operation completed successfully.

, Processes () -
Select Columns ( ) View (), -
(Memory Commit Size).
TestLimit. ,
.
230 10.

, ,
TestLimit.
, Process Explorer. ViewSelect Columns
( ), Process Memory ( )
Private Bytes ( ) Virtual Size ( ).
TestLimit.

, ,
Private Bytes ( ) , -
Virtual Size ( ).
( 1544) - , -
.
( Performance Monitor),
Process: Virtual Bytes (: ) Process: Private Bytes (-
: ).


Performance () Commit
Charge ( ) . -

(commit charge). ,
, .
, -
(system commit limit), (commit limit).
,
.
(RAM), . -
, Commit Charge ( )
Performance () . -
,
, .
231


, ,
. , -

.
:

Windows-
VirtualLock. ,
, ,
. -
, ,
.
,
SetProcessWorkingSetSizeEx
( ).
MmProbeAndLockPages, MmLockPagable
CodeSection, MmLockPagableDataSection MmLockPagableSectionByHandle
. , ,
. API-
, ,
,
- -
. API- , API
.


Windows
,
(allocation granularity).
Windows- GetSystemInfo
GetNativeSystemInfo. 64,
(, -
, ..) -
. ,
(, 64)
,
, -
,
.
232 10.


Windows . -
, ( -
).

(Thread Environment Block, TEB),
, ,
. 16- DOS-
x86 API- MapViewOfFileEx
MEM_DOS_LIM, ,
.

, , Windows -
, ,
. , x86
4, 18
x86 20. 18-
3, -
24. , (VAD)
64- , , -
, . (VAD-
.)

, Windows
-
. (shared memory)
, , ,
. ,
DLL-,
, ,
, -
.10.1.
-
, DLL-
- .
, ,
( .exe .dll
, .scr,
DLL- ) ,
, , ,

).
233

,
, (section objects), Windows
API (file mapping objects). -

.

DLL-

2

. 10.1.


, - ,
.
, ,
.
( -
) (
). , , -
,
( ),
. ( Windows , , -
,
.) ,
(, ),

, .
234 10.

Windows- CreateFileMapping
CreateFileMappingNuma, ,
( INVALID_HANDLE_VALUE , ),
. ,
OpenFileMapping .

(
), ( Duplicate-
Handle).
ZwOpenSection, ZwMapViewOfSection ZwUnmapViewOfSection.
,
. (
, () ,
.) -
,
(view of the section), MapViewOf-
File, MapViewOfFileEx MapViewOfFileExNuma, .
,
,
.
Windows-
-, . -

:
, DLL- ,
. ( , -
, 11.)

.

:
-
Process Explorer, Sysinternals.
DLL-, ViewLower Pane
ViewDLLs ( DLL-). ,
DLL- -
.
DLL-, (EXE),
.

, Process Explorer,
WinDbg, -
. Windows-
, ( DLL-)
Locale.nls,
Windows.
235

,
FindDLL. , ( )
DLL- ,
.


1 I, Windows , -

.
Windows .
-, ,
, ,
.
, ,
.
-, -
, -
. ,
,
.
(
SeDebugPrivilege),
ReadProcessMemory WriteProcessMemory.
-
.
, Windows ,
, ,
, .
236 10.

-, , -
, , Windows,
(, -
, ..),
. ,
, -
.
, Windows API, .10.2. (.
VirtualProtect, VirtualProtectEx, VirtualQuery VirtualQueryEx.)

10.2. , Windows API



PAGE_NOACCESS ,

PAGE_READONLY (
) -
,
PAGE_READWRITE , -

PAGE_EXECUTE , -
, ,
( -
)
PAGE_EXECUTE_ -
READ1 ,
PAGE_EXECUTE_ , ,
READWRITE1
PAGE_WRITECOPY
. -


PAGE_EXECUTE_
WRITECOPY .
(
)
PAGE_GUARD
EXCEPTION_GUARD_PAGE
. , -
. -
,
, , -
PAGE_NOACCESS

1
, , , -
( ,
x64 IA64, x86).
237


PAGE_NOCACHE .
.
,

PAGE_ .
WRITECOMBINE (

), -

. , -
, -
.
-
.
, ,

, Windows
(Access Control Lists, ACL).
,
, .
, .

, .
,
-
.
, -
, ACL . ,
, -
,
(copy-on-write), -.
, ,
.


,
(Data Execution Prevention, DEP), ,
, , ,
. -
,
, , . DEP
, -
,
. , ,
238 10.

, ATTEMPTED_
EXECUTE_OF_NOEXECUTE_MEMORY. ( 14.)
, ,
, STATUS_ACCESS_VIOLATION
(0xc0000005). , ,
, PAGE_EXECUTE,
PAGE_EXECUTE_READ, PAGE_EXECUTE_READWRITE PAGE_EXECUTE_WRITECOPY
.
32- x86, -
DEP-, (Page Table Entry, PTE) -
63. DEP-
(Physical Address Extension,
PAE), 32.
(. .) ,
DEP- 32-
PAE- (%SystemRoot%\System32\Ntkrnlpa.exe),
(, -
4). 32-
DEP- PAE
. PAE ,
DEP-, BCD- nx
AlwaysOff, pae ForceDisable.
64- Windows
64-
BCD- nx AlwaysOff.
32- (.
). 64- Windows
( , ), -
, ,
(
). 32- Windows
,
.
32-
BCD- nx. .10.2,
Data Execution Prevention ( )
Performance Options ( ),
ComputerPropertiesAdvanced System Settings (
) Settings ()
Performance (). -
Performance Options ( )
BCD- nx.
Data Execution Prevention (
) .10.3. 32- ,
, HKLM\SOFTWARE\Microsoft\
239

Windows NT\CurrentVersion\AppCompatFlags\Layers.
DisableNXShowUI.

. 10.2.

10.3. BCD- nx
BCD-
nx
OptIn Turn on DEP for essential Win- DEP- -
dows programs and services only Windows. -
( DEP 32- -
DEP-
Windows)
OptOut Turn on DEP for all programs DEP-
and services except those I select , -
( DEP - . 32--
, -
) DEP-
. DEP-
-


240 10.

10.3 ()
BCD-
nx
AlwaysOn DEP-
-
.
-
32- -
, -

DEP-
AlwaysOff DEP- ( -
). -
32-

Windows ( 64-, 32-)


32- -
( BCD-
nx OptIn), 32-
, ,
. , ,
. Windows -
32-
32- ( BCD- nx OptOut).


-
Windows Application Compatibility Toolkit ( www.micro-
soft.com) Compatibility Administrator Tool. -
System DatabaseApplicationsWindows Components (
).
.

DEP- ,
DEP- . , -
(.-
3 I) ,
(, SafeDisc SecuROM)

, .
, ( 7.1
) Active Template Library (ATL) Windows
ATL- (ATL thunk emulation).
ATL-, DEP- -
.
241

ATL-, -
Microsoft C++ /NXCOMPAT ( PE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT), ,
DEP-. , -
AlwaysOn, ATL- .
, OptIn OptOut
32- , SetProcessDEPPolicy
DEP- . ( DEP-
API-, -
.)
ATL-,
/NXCOMPAT.
64- , AlwaysOff
AlwaysOn, . GetProcessDEPPolicy -
32- DEP-
( 64- ,
), GetSystemDEPPolicy
, ,
.10.3.

: DEP-
DEP- , ,
,
Process Explorer. DEP-
,
Select Columns ( ), Process Image
( ) DEP Status (
DEP-):

DEP (permanent) DEP-, -


Windows ;
DEP DEP- , ,
32- , API-,
SetProcessDEPPolicy, /NXCOMPAT
;
Nothing , , DEP-
,
API- .

Process Explorer ,
DEP- OptOut. ,
, ,
USB-, DEP
DEP- DEP. , DEP-
, .10.2. -
, Windows-, DEP
DEP- DEP (permanent), , DEP-
.
242 10.


, ,
Windows .
DEP-
Windows. ( -
3 I.)
( Microsoft
Visual C++, /SAFESEH),
(-
), .
, -
.
DEP-
x86 ,
(Structured Exception
Handler Overwrite Protection, SEHOP).
,
.
.
,
. , , -
( )
, ,
. -
(Address Space Layout Randomization, ASLR),
,
,
.
243

(Struc-
tured Exception Handler, SEH), /SAFESEH ,
(image dispatch mitigation) -
, SEH- , ,
, , ,
( , DLL- -
, , -
). ,
(executable
dispatch mitigation) , SEH- -
,
,
,
.
DEP-
cookie- .
, -
.
(cookie-) cookie- -
, (
, ). cookie-
, ,
. Cookie-

KUSER_SHARED_DATA. ,
. (

3 I.)
cookie- API-
EncodeSystemPointer DecodeSystemPointer, -
. DLL-
, , ,
,
. cookie- -
,
, - ,
. API-
EncodePointer DecodePointer , cookie-
, ,
.


cookie-
, ,
.
244 10.


(copy-on-write) ,
.

, , , -

, . ,
.10.3, ,
,
- .

. 1
. 2

. 3

. 10.3.

, -
. ,
,
, -
, ,
( , ,
) , ,
,
. , ,
.10.4,
, , , -
. ,
, -
.

. ,
.
, , ,
. ,
245

PAGE_EXECUTE_READWRITE
.
, -
,
.

. 1

. 2
. 3

. 3

. 10.4.

,
(lazy evaluation).
.
, .
,
.
,
Memory: Write Copies/sec (:
/).


32- Windows 64
(. .2.2 2 I), 32-
2 .
( BCD- increaseuserva, -
,
3.) ,
, 2 (
3), ,
.

.
(
) Windows , -
246 10.

(Address Windowing Extensions, AWE).


,
.
-

.
AWE-
:
1. . Windows-
AllocateUserPhysicalPages AllocateUserPhysicalPagesNuma. (
, .)
2.

. Win32- VirtualAlloc, VirtualAllocEx
Virtual AllocExNuma MEM_PHYSICAL.
3. , -, .

MapUserPhysicalPages MapUserPhysicalPagesScatter,
, , -
, , .
.10.5.
256 4 ( , -
4 ).
MapUserPhysicalPages MapUserPhysicalPagesScatter, -
,
256.
,
.

.
AWE- Windows
. -
AWE 32- ,
2, 32-
,
.
: AWE- -
, AWE- ,

. ( , VirtualLock.)
, , -
, AWE-:
247

;

;
-, -
.
AWE- Windows- x64 IA64,
8 7
, 2
. AWE,
,
,
. AWE
-
. , API-
( 4 8 64).

4 64


-

2
-

AWE-
- AWE-

. 10.5. AWE

, -
, , 4,
.
248 10.


, ,
, .
, .

, -
, ,

, IRQL-.
(.3
I),
DPC/dispatch .
, DPC/dispatch ,
.


, . -
,
DPC/dispatch .
.
-
.
,
WDK ,
ExAllocatePool ExFreePool.
, ( -
) .
64 ,
NUMA-.
. ,
-
, NUMA-, .
( , , -
, NUMA-.
NUMA ..)

. ,
, ,
. ( 1 I.) ,
(special pool). , , -
, ,
, .
14.
249


-
, , .
3% .
40, 40,
10% 40, -
10% .
Windows ,
(.10.4).

10.4.
32-
64-
75% 2 75%
, 128 -
,
2 128

,
,
.
.10.5.

10.5. ,



MmSizeOfNonPagedPoolInBytes Memory: Pool -
Nonpaged Bytes (- .
: - -
- -
) , -

.
-
,

MmMaximumNonPagedPoolInBytes

Memory: Pool Paged -
Bytes (:
-
)

250 10.

10.5 ()


WorkingSetSize ( - Memory: Pool Paged (-
) MmPagedPoolWs Resident Bytes (- ) -
( _MMSUPPORT) : -

)
MmSizeOfPagedPoolInBytes (-
)

:
Process Explorer,
(.1 I).
Process Explorer ViewSystem Information
( ) Memory ().
Kernel Memory ( ).

, Process Explorer
, . (
Process Explorer
Process Explorer 1 I.)
251

-
!vm:

kd> !vm
1: kd> !vm
*** Virtual Memory Usage ***
Physical Memory: 851757 ( 3407028 Kb)
Page File: \??\C:\pagefile.sys
Current: 3407028 Kb Free Space: 3407024 Kb
Minimum: 3407028 Kb Maximum: 4193280 Kb
Available Pages: 699186 ( 2796744 Kb)
ResAvail Pages: 757454 ( 3029816 Kb)
Locked IO Pages: 0 ( 0 Kb)
Free System PTEs: 370673 ( 1482692 Kb)
Modified Pages: 9799 ( 39196 Kb)
Modified PF Pages: 9798 ( 39192 Kb)
NonPagedPool Usage: 0 ( 0 Kb)
NonPagedPoolNx Usage: 8735 ( 34940 Kb)
NonPagedPool Max: 522368 ( 2089472 Kb)
PagedPool 0 Usage: 17573 ( 70292 Kb)
PagedPool 1 Usage: 2417 ( 9668 Kb)
PagedPool 2 Usage: 0 ( 0 Kb)
PagedPool 3 Usage: 0 ( 0 Kb)
PagedPool 4 Usage: 28 ( 112 Kb)
PagedPool Usage: 20018 ( 80072 Kb)
PagedPool Maximum: 523264 ( 2093056 Kb)
...

32- 4 -
.

, .10.5.
32- :

lkd> ? poi(MmMaximumNonPagedPoolInBytes)
Evaluate expression: 2139619328 = 7f880000

lkd> ? poi(MmSizeOfPagedPoolInBytes)
Evaluate expression: 2143289344 = 7fc00000

, ,
2,
32- .
, , -
35, 80,
.


Memory
( , -
). , , -
, Poolmon ( WDK).
252 10.

Poolmon , , ,
.10.6.

. 10.6. , Poolmon

. (
, (/) Poolmon.
/ .)
Poolmon ( ?). -
(, ),
. , P
D Diff (-
), ,
. , , -
( ). ,
poolmon iCM CM-,
(configuration manager),
. .10.6.

10.6. , Poolmon

Tag ,
Type : (paged) (nonpaged)
Allocs ( -
Allocs )
Frees (
Frees )
Diff Allocs Frees
253


Bytes , (
Bytes -
)
PerAlloc

, Windows, \Program
Files\Debugging Tools for Windows\Triage\Pooltag.txt. (
Debugging Tools for Windows, 1
I.)
, (Local-
tag.txt) 32- Poolmon, WDK,
c. , ,
, . (-
,
, .)

Strings.exe Sysinternals. ,
%SYSTEMROOT%\system32\drivers\*.sys | findstr /i "abcd"
, abcd. ,
%SystemRoot%\System32\Drivers,
.
Run ()
Msinfo32. Software Environment ( )
System Drivers ( ). ,
, ,
.
, ,
Driver Verifier,
. -
, ( -
Driver Verifier ).
Driver Verifier Manager
(%SystemRoot%\System32\Verifier.exe), Verifier /Log
.
,
!poolused . !poolused2 -
.
!poolused4
. -
:
lkd> !poolused 2
Sorting by NonPaged Pool Consumed
Pool Used:
NonPaged Paged
Tag Allocs Used Allocs Used

254 10.

Cont 1669 15801344 0 0 Contiguous physical memory


allocations for device drivers
Int2 414 5760072 0 0 UNKNOWN pooltag 'Int2', please
update pooltag.txt
LSwi 1 2623568 0 0 initial work context
EtwB 117 2327832 10 409600 Etw Buffer , Binary: nt!etw
Pool 5 1171880 0 0 Pool tables, etc.

lkd> !poolused 4
Sorting by Paged Pool Consumed
Pool Used:
NonPaged Paged
Tag Allocs Used Allocs Used
CM25 0 0 3921 16777216 Internal Configuration manager
allocations, Binary: nt!cm
MmRe 0 0 720 13508136 UNKNOWN pooltag 'MmRe', please
update pooltag.txt
MmSt 0 0 5369 10827440 Mm section object prototype
ptes, Binary: nt!mm
Ntff 9 2232 4210 3738480 FCB_DATA, Binary: ntfs.sys
AlMs 0 0 212 2450448 ALPC message, Binary: nt!alpc
ViMm 469 440584 608 1468888 Video memory manager, Binary:
dxgkrnl.sys

:

, , -
. Notmyfault, -
Sysinternals. Notmyfault.exe
Myfault.sys .
255

1. Leak (), Leak/Second ( )


1000 Leak Paged ( -
). Notmyfault
Myfault , ,
Stop Paged ( ).
, -
, (
), -
. , Myfault
, , .
2.
Performance (). -
Kernel Memory (MB): Paged ( (): ). -
System Information ( )
Process Explorer. ViewSystem Information
( ) Memory ().
3. , ,
Poolmon B .
P, Poolmon -
. , Leak ()
. (Poolmon ,
.)
4. Stop Paged ( ),
.
5. , Leak
(), , , -
Strings, Sysinternals:
Strings %SystemRoot%\system32\drivers\*.sys | findstr Leak

Myfault.sys, -
Leak ().


, Windows , -
(look-aside lists).
, -
,
.
, , -
-.
-
, , -
ExInitializeNPagedLookasideList ExInitializePagedLookasideList
( WDK). , -
, (,
-, ) ,
256 10.

, -
. (256 ) -

.
( ),
. -
, .
( , .)
,
, ,

, . -
, . (
,
ExAdjustLookasideDepth.)

:

!lookaside . -
:

lkd> !lookaside

Lookaside "nt!IopSmallIrpLookasideList" @ 81f47c00 "Irps"


Type = 0000 NonPagedPool
Current Depth = 3 Max Depth = 4
Size = 148 Max Alloc = 592
AllocateMisses = 930 FreeMisses = 780
TotalAllocates = 13748 TotalFrees = 13601
Hit Rate = 93% Hit Rate = 94%

Lookaside "nt!IopLargeIrpLookasideList" @ 81f47c80 "Irpl"


Type = 0000 NonPagedPool
Current Depth = 4 Max Depth = 4
Size = 472 Max Alloc = 1888
AllocateMisses = 16555 FreeMisses = 15636
TotalAllocates = 59287 TotalFrees = 58372
Hit Rate = 72% Hit Rate = 73%

Lookaside "nt!IopMdlLookasideList" @ 81f47b80 "Mdl "


Type = 0000 NonPagedPool
Current Depth = 4 Max Depth = 4
Size = 96 Max Alloc = 384
AllocateMisses = 16287 FreeMisses = 15474
TotalAllocates = 72835 TotalFrees = 72026
Hit Rate = 77% Hit Rate = 78%
...

Total NonPaged currently allocated for above lists = 0


Total NonPaged potential for above lists = 3280
Total Paged currently allocated for above lists = 744
Total Paged potential for above lists = 1536
257


,
, 64 -
, VirtualAlloc Virtual-
AllocExNuma.

. Windows -
, (heap manager)
,
, -
. : 8
32- 16 64-.

.
: Ntdll.dll Ntoskrnl.exe. API- -
(, API- Windows) Ntdll.dll,

Ntoskrnl.exe. Ntoskrnl ( Rtl)
Windows- , -
. API- Windows
( Heap) ,
Ntdll.dll. , Windows-
API- ( Local Global),

.
C- (C RunTime, CRT)
malloc free new C++.
Windows- :

HeapCreate HeapDestroy .
.
HeapAlloc .
HeapFree , HeapAlloc.
HeapReAlloc ( -
).
HeapLock HeapUnlock
.
HeapWalk .


,
. , -
258 10.

. 1,
, /HEAP -
. ,
. (
.)
, ,
- Windows-.
, , Windows-
GetProcessHeap.
, HeapCreate.
, ,
HeapDestroy.
, Windows-
GetProcessHeaps.

, Vir-
tualAlloc,
. ,
,
,
. Win32 GUI (Win32k.sys) -
GDI User -
. ,
, , , -
. -,
,
. -,

. , -

,
, .
, -
,
.


.10.7, ,
. -
,
. -
, ,
,
, .
259

API- Windows
(HeapAlloc, HeapFree, LocalAlloc, GlobalAlloc . .)




()

. 10.7.

,
,
. , Windows,
(Low Fragmentation Heap, LFH).
.


-
.
,
, HEAP_NO_SERIALIZE
, .
,
,
. , -
, Windows- HeapWalk
.
, -
. ,
(
), -
260 10.

.
, .


Windows
( 1).
-
.
. , ,
. , -
, .
,
(,
), -
.
(LFH) -

, (buckets).
, LFH , ,
. ( 8.)
1 8, 9 16 ..,
,
249 256, , -
257 272 .. ,
, 15873
16384. (binary buddy).
, ,
, .10.7.

10.7.

132 8 1256
3348 16 257512
4964 32 5131024
6580 64 10252048
8196 128 20494096
97112 256 40978194
113128 512 819516384

LFH
. Windows -
, LFH
261

,
,
LFH .
-
. ,
LFH,
.
LFH
,
, .
LFH-,
(affinity manager). LFH ,
-
, LFH .
.

.

,
- , -
LFH.
LFH API- HeapSetInformation
HeapCompatibilityInformation.


-

. -
- . ,
, ,
,
.
,
, . ,
( ). -
API- HeapSetInformation HeapEnableTerminationOnCor-
ruption, -
, .
- -
. , -
, , - .
LFH-. ,
.
!heap i, ,
262 10.

,
. LFH-, .
, , ,
, ,
, , ,
. ,
!heapi ,
.
0x001a0000. ,
.
!heap i :
0:000> !heap -i 001a0000
Heap context set to the heap 0x001a0000
0:000> !heap -i 1e2570
Detailed information for block entry 001e2570
Assumed heap : 0x001a0000 (Use !heap -i NewHeapHandle to change)
Header content : 0x1570F4EC 0x0C0015BE (decoded : 0x07010006 0x0C00000D)
Owning segment : 0x001a0000 (offset 0)
Block flags : 0x1 (busy )
Total block size : 0x6 units (0x30 bytes)
Requested size : 0x24 bytes (unused 0xc bytes)
Previous block size: 0xd units (0x68 bytes)
Block CRC : OK - 0x7
Previous block : 0x001e2508
Next block : 0x001e25a0


8
, -
, ,
:
. -
, .
,
.
.
, ,
(,
). -
,
.
. -
, .
. .
263

. -
() ()

.
, ,
. (
.)
-
Gflags. (. Windows 3
I.)
!heap Windows. (
.)
. ,
- LFH -
, (
). , LFH
(- ,
) , .

pageheap
, -
, ,
, -
, pageheap.
.
pageheap Gflags ( -
Debugging Tools for Windows). pageheap ,
,
. ,
,
. pageheap

( ). , pageheap
,
.
, pageheap
-
. ,
,
- .
, , pageheap
,
() DLL-.
pageheap Debugging
Tools for Windows Help.
264 10.


Microsoft,
. Windows , -
(Fault Tolerant Heap, FTH). FTH

.
: (detection),
FTH-, (mitigation), FTH-.
DLL- (Fthsvc.dll),
Windows (Wscsvc.dll), ,
,
.
(Windows Error Reporting).
Ntdll.dll,
, ,
, FTH-
, FTH-.
, FTH-
FTH-.
FTH-
. Windows XP,
, Windows,
.
. FTH-
,
, , .
, FTH
8- .
, -
, HeapFree
: ,
4.
, , , -
HeapFree, . ,
exit RtlExitUserProcess .
FTH-
. , .

. Run () eventvwr.msc, -

Applications And Services Logs (
)MicrosoftWindowsFault-Tolerant-HeapOperational log ().
: Enabled HKLM\
Software\Microsoft\FTH 0.
265

FTH- , ,
, Windows-, -
.
, Application Com
patibility Toolkit.

-
, 32- 64-
. ,
.
Windows
: , ,
, , .
1 I ,
, . -
,
- .
.
,

. -
, (ReadProcessMemory
WriteProcessMemory), -
.
, -
(page tables), ,
. .
, , -
, ,
.
(session space) ,
. ( 2 I.) -
(, ),
.
, Windows,
(Win32k.sys), -
GUI-. ,
Windows (Csrss.exe)
(Winlogon.exe). (Smss.exe)
,
266 10.

Win32k.sys,
Csrss Winlogon.
, , -
,
. ,
, .
, -
, , ,
, .
:
, HAL ,
.
.
.
,
, . (
11.)
. PTE-
, -,
. PTE-
Memory: Free System Page Table Entries (:
) .
. -
( ,
PTE-).

Windows, (Win32k.sys), -
, .
( Win32k.sys 2 I.)
,
, ,
.

. -
,
(, ).
, -
.
, HAL, , ,
(HAL).
, Windows -
,
x86, IA64 x64.
267

x86
32- Windows
2, -
2. BCD-
increaseuserva -
3. .10.8
.




DLL-

64



HAL



HAL


HAL HAL

. 10.8. x86
268 10.

32- 2 -
32-
, 2. ,
64- .
2,
IMAGE_FILE_LARGE_ADDRESS_
AWARE. Windows -
,
, 0x7FFFFFFF.
, -
, 2 .
, 2,
,
, ,
. 3 -
, , 2,
, .
,
/LARGEADDRESSAWARE. -
2 .
, -
, , -
:
Lsass.exe ;
Inetinfo.exe -;
Chkdsk.exe ;
Smss.exe ;
Dllhst3g.exe Dllhost.exe ( ,
COM+);
Dispdiag.exe ;
Esentutl.exe Active Directory Database Utility.
, VirtualAlloc, Vir-
tualAllocEx VirtualAllocExNuma
,
-
,
. -
, MEM_TOP_DOWN
DWORD- HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager\Memory Management\AllocationPreference
0x100000.
269

.10.9 TestLimit
( ), 32--
Windows,
3 increaseuserva.

. 10.9. , TestLimit 32-


Windows,
3 increaseuserva

, TestLimit
, , , 3.
, TestLimit
/LARGEADDRESSAWARE. , ,
,
increaseuserva.

:

, ,
Dumpbin Windows SDK. -
/HEADERS. Dumpbin
:

C:\Program Files\Microsoft SDKs\Windows\v7.1>dumpbin


/headers c:\windows\system32\smss.exe
Microsoft (R) COFF/PE Dumper Version 10.00.40219.01
Copyright (C) Microsoft Corporation. All rights reserved.

Dump of file c:\windows\system32\smss.exe

PE signature found

270 10.

File Type: EXECUTABLE IMAGE

FILE HEADER VALUES


8664 machine (x64)
5 number of sections
4A5BC116 time date stamp Mon Jul 13 16:19:50 2009
0 file pointer to symbol table
0 number of symbols
F0 size of optional header
22 characteristics
Executable
Application can handle large (>2GB) addresses


x86
32- Windows
, -
(. ). .10.8,
,
. -
.
. ,
, :
;
;
;
(PTE-);
;
;
();
.

x86

, -
.
.10.10.
,
, ,
.
271

Win32k.sys

WSL-

. 10.10. x86
( )

:

. , , -
, Process Explorer .
!session :

lkd> !session
Sessions on machine: 3
Valid Sessions: 0 1 3
Current Session 1

, !session s,
!sprocess:

lkd> !session -s 3
Sessions on machine: 3
Implicit process is now 84173500
Using session 3

lkd> !sprocess
Dumping Session 3

_MM_SESSION_SPACE 9a83c000
_MMSESSION 9a83cd00
PROCESS 84173500 SessionId: 3 Cid: 0d78 Peb: 7ffde000 ParentCid: 0e80
DirBase: 3ef53500 ObjectTable: 8588d820 HandleCount: 76.
Image: csrss.exe

PROCESS 841a6030 SessionId: 3 Cid: 0c6c Peb: 7ffdc000 ParentCid: 0e80


272 10.

DirBase: 3ef53520 ObjectTable: 85897208 HandleCount: 94.


Image: winlogon.exe

PROCESS 841d9cf0 SessionId: 3 Cid: 0d38 Peb: 7ffd6000 ParentCid: 0c6c


DirBase: 3ef53540 ObjectTable: 8589d248 HandleCount: 165.
Image: LogonUI.exe
...

MM_SESSION_SPACE
dt:

lkd> dt nt!_MM_SESSION_SPACE 9a83c000


+0x000 ReferenceCount : 0n3
+0x004 u : <unnamed-tag>
+0x008 SessionId : 3
+0x00c ProcessReferenceToSession : 0n4
+0x010 ProcessList : _LIST_ENTRY [ 0x841735e4 - 0x841d9dd4 ]
+0x018 LastProcessSwappedOutTime : _LARGE_INTEGER 0x0
+0x020 SessionPageDirectoryIndex : 0x31fa3
+0x024 NonPagablePages : 0x19
+0x028 CommittedPages : 0x867
+0x02c PagedPoolStart : 0x80000000 Void
+0x030 PagedPoolEnd : 0xffbfffff Void
+0x034 SessionObject : 0x854e2040 Void
+0x038 SessionObjectHandle : 0x8000020c Void
+0x03c ResidentProcessCount : 0n3
+0x040 SessionPoolAllocationFailures : [4] 0
+0x050 ImageList : _LIST_ENTRY [ 0x8519bef8 - 0x85296370 ]
+0x058 LocaleId : 0x409
+0x05c AttachCount : 0
+0x060 AttachGate : _KGATE
+0x070 WsListEntry : _LIST_ENTRY [ 0x82772408 - 0x97044070 ]
+0x080 Lookaside : [25] _GENERAL_LOOKASIDE
...

: .


!vm 4 . ,
32- Windows
:

lkd> !vm 4
.
.
Terminal Server Memory Usage By Session:

Session ID 0 @ 9a8c7000:
Paged Pool Usage: 2372K
Commit Usage: 4832K

Session ID 1 @ 9a881000:
Paged Pool Usage: 14120K
Commit Usage: 16704K
273


(PTE-)
-,
. PTE- . 32--
Windows PTE-
2
. 64- Windows PTE-
128 -
.

: .
PTE-
PTE- , -
Memory: Free System Page Table Entries (:
) !sysptes
!vm . _MI_SYSTEM_PTE_TYPE,
MiSystemPteInfo.
,
PTE-, , , -
PTE-.

0: kd> !sysptes

System PTE Information


Total System Ptes 307168

starting PTE: c0200000

free blocks: 32 total free: 3856 largest free block: 542


Kernel Stack PTE Information
Unable to get syspte index array - skipping bins

starting PTE: c0200000


free blocks: 165 total free: 1503 largest free block: 75

0: kd> ? nt!MiSystemPteInfo
Evaluate expression: -2100014016 = 82d45440

0: kd> dt _MI_SYSTEM_PTE_TYPE 82d45440


nt!_MI_SYSTEM_PTE_TYPE
+0x000 Bitmap : _RTL_BITMAP
+0x008 Flags : 3
+0x00c Hint : 0x2271f
+0x010 BasePte : 0xc0200000 _MMPTE
+0x014 FailureCount : 0x82d45468 -> 0
+0x018 Vm : 0x82d67300 _MMSUPPORT
+0x01c TotalSystemPtes : 0n7136
+0x020 TotalFreeSystemPtes : 0n4113
+0x024 CachedPteCount : 0n0
+0x028 PteFailures : 0
+0x02c SpinLock : 0
+0x02c GlobalMutex : (null)

274 10.


PTE-, PTE-,
DWORD- TrackPtes HKLM\SYSTEM\CurrentControlSet\Control\Session
Manager\Memory Management 1.
!sysptes 4:

lkd>!sysptes 4
0x1ca2 System PTEs allocated to mapping locked pages

VA MDL PageCount Caller/CallersCaller


ecbfdee8 f0ed0958 2
netbt!DispatchIoctls+0x56a/netbt!NbtDispatchDevCtrl+0xcd
f0a8d050 f0ed0510 1
netbt!DispatchIoctls+0x64e/netbt!NbtDispatchDevCtrl+0xcd
ecef5000 1 20 nt!MiFindContiguousMemory+0x63
ed447000 0 2
Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95
ee1ce000 0 2
Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95
ed9c4000 1 ca nt!MiFindContiguousMemory+0x63
eda8e000 1 ca nt!MiFindContiguousMemory+0x63
efb23d68 f8067888 2 mrxsmb!BowserMapUsersBuffer+0x28
efac5af4 f8b15b98 2 ndisuio!NdisuioRead+0x54/nt!NtReadFile+0x566
f0ac688c f848ff88 1 ndisuio!NdisuioRead+0x54/nt!NtReadFile+0x566
efac7b7c f82fc2a8 2 ndisuio!NdisuioRead+0x54/nt!NtReadFile+0x566
ee4d1000 1 38 nt!MiFindContiguousMemory+0x63
efa4f000 0 2
Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95
efa53000 0 2
Ntfs!NtfsInitializeVcb+0x30e/Ntfs!NtfsInitializeDevice+0x95
eea89000 0 1
TDI!DllInitialize+0x4f/nt!MiResolveImageReferences+0x4bc
ee798000 1 20 VIDEOPRT!pVideoPortGetDeviceBase+0x1f1
f0676000 1 10
hal!HalpGrowMapBuffers+0x134/hal!HalpAllocateAdapterEx+0x1ff

f0b75000 1 1 cpqasm2+0x2af67/cpqasm2+0x7847
f0afa000 1 1 cpqasm2+0x2af67/cpqasm2+0x6d82

64-
64- 16-
(18446744073709551616, 18,44
). x86,
( ), 64-
,
,
. , .10.8,
,
. , 64
.
275

10.8. 64-
IA64 x64
7152 8192
128 128
PTE-
1 1
128 128
75% 75%

64- Windows ,
, . -
, 64- Windows
(Wow64), 4
,
3, 4
- , 2 3
. .10.11
TestLimit, 32-
64- Windows, 64--
TestLimit, .

. 10.11. 32- 64- TestLimit,


64- Windows

, TestLimit,
/LARGEADDRESSAWARE.
, 2. 64-
, /LARGEADDRESSAWARE,
, ,
32- .
276 10.

IA64
x64 . IA64
.10.12, x64 .10.13.


: 0 7 HAL

64


4
x86. 8
4 VA- 16
: -
16 -



.
. 128

MM_SYSTEM_SPACE_START

MI_DYNAMIC_KERNEL_VA_BYTES,
MISystemVaBitMap.
1

8 , PTE-


8
(2- ) - : MM_SYSTEM_SPACE_START

,
8 (1- )
,
( 50-
PFN-,
Win32k.sys. 8 PTE-
. 8 ,
8 ~6 )


PFN-
8

.
8 . -
(2- ) 128


8 (1- )
:
50- MM_SYSTEM_SPACE_END PTE_KBASE ,
, 43 VA
VHPT- 8

VHPT-
64
KSEG3 ( ) 8


HAL, 8 (2-
, , )
NLS- ,

8 (1- )

. 10.12. IA64
277

:
8 64
64



512
:
512


, 512
4 ,

: >43
(interlocked
slists). , ,

, -
. 512

PTE-.
. 128

.
. 128

Win32k.sys. .
512

MM_SYSTEM_SPACE_START
MI_DYNAMIC_KERNEL_VA_BYTES,
MiSystemVaBitMap.
1
, PTE-

: VA-
, ,
( 49-
PFN-, 4 PTE-
8 , ~6 )

PFN-

-
.
. 128

4 , -
HAL. HAL

,
.

. 10.13. x64
278 10.

x64
, 64- -
16 (),
4,
32- . , ,
, ,
.
,
, ( ),
x64 AMD Intel 256
. 48-
64- .
- 64 , 8
. 16 ( 48 63)
, ( 47),
. , -
, .
-
0x0000000000000000, ,
0x00007FFFFFFFFFFF.
0xFFFF800000000000 0xFFFFFFFFFFFFFFFF.
128.
,
, 0x7FFFFFFFFFFFFFFF, ,
0x8000000000000000 (, ,
32 ).

16- Windows x64


Windows x64 : 256
, x64,
Windows 16.
8. ,
0 (-
0x000007FFFFFFFFFF), ,
F , -
0xFFFFF80000000000.
16- .
-
Windows.
, ,
, -, , Patchguard
DPC . Windows
x64 ,
x64 ,
64- Windows.
279

SLIST_HEADER, Windows
:
typedef union _SLIST_HEADER {
ULONGLONG Alignment;
struct {
SLIST_ENTRY Next;
USHORT Depth;
USHORT Sequence;
} DUMMYSTRUCTNAME;
} SLIST_HEADER, *PSLIST_HEADER;

, 8- , -
:
(32, 4), , 16
( 2).
CMPXCHG8B (-
8), Pentium .
8 .
, LOCK (
), -
32- ,
(
).
64- 64 , -
, 64.
,
64+32 , ,
, 128, -
. x64 CMPXCHG16B,
, . ,
64 , -
,
. SLIST_HEADER 64-
:
struct { // 8-
ULONGLONG Depth:16;
ULONGLONG Sequence:9;
ULONGLONG NextEntry:39;
} Header8;

16
9, .
39, , , 64. -
16- ,
4, , .
43, -
. ,
,
280 10.

, -
, , 32- . ,
,
, . NextEntry
44 , Windows.
, 32.
16 Windows
8 .
16 (48
256 ) ,
, 64. , , SLIST_HEADER
, , .
, , x64
128- , Windows
(
).
8- :
struct { // 8-
ULONGLONG Depth:16;
ULONGLONG Sequence:9;
ULONGLONG NextEntry:39;
ULONGLONG HeaderType:1; // 0: 8-; 1: 16-
ULONGLONG Init:1; // 0: ;
// 1:
ULONGLONG Reserved:59;
ULONGLONG Region:3;
} Header8;

, HeaderType Depth -
16- ,
. 16-
:
struct { // 16-
ULONGLONG Depth:16;
ULONGLONG Sequence:48;
ULONGLONG HeaderType:1; // 0: 8-byte; 1: 16-byte
ULONGLONG Init:1; // 0: ;
// 1:
ULONGLONG Reserved:2;
ULONGLONG NextEntry:60; // 4
} Header16;

, NextEntry 60-,
- 16-
, 64- .
, SLIST-,
8. , -

0xFFFFF80000000000, SLIST-.
281



32- Windows
, -
. 64-
Windows
( ),
(..10.8).
( -
.10.9) ,
, MiInitializeDynamicVa -
. MiIntializeSystemVaRange,
,
,
() HAL. , , -
MiIntializeSystemVaRange -
. ,
(
).

MiObtainSys-
temVa ( MiObtainSessionVa) MiReturnSystemVa.
, , PTE-, -
, () ,
, PFN-
, -
. , -

,
MiSystemVaType array,
. ,
MiSystemVaType, .10.9.

10.9.


MiVaSessionSpace (0x1)
MiVaProcessSpace (0x2)

MiVaBootLoaded (0x3) ,


MiVaPfnDatabase (0x4) PFN-


282 10.

10.9 ()



MiVaNonPagedPool (0x5)
MiVaPagedPool (0x6)
MiVaSpecialPool (0x7)
MiVaSystemCache (0x8)
MiVaSystemPtes (0x9) PTE-
MiVaHal (0xA) HAL
MiVaSessionGlobalSpace (0xB)

MiVaDriverImages (0xC) -

-
,
. ,
, -
, .
( .)

. ,
MiReclaimSystemVa,
, ( -
),
128. ( ,
.)
, ,
,
, -
.
, ,
, . 32-,
64-
,
. , 64-
, -
, ,

.
283

: .

-
.
, .10.9,
MiSystemVaTypeCount, MiSystemVaTypeCountFailures MiSystemVaTypeCountPeak -
, . -

( ):

lkd> dd /c 1 MiSystemVaTypeCount l c
81f4f880 00000000
81f4f884 00000028
81f4f888 00000008
81f4f88c 0000000c
81f4f890 0000000b
81f4f894 0000001a
81f4f898 0000002f
81f4f89c 00000000
81f4f8a0 000001b6
81f4f8a4 00000030
81f4f8a8 00000002
81f4f8ac 00000006
lkd> dd /c 1 MiSystemVaTypeCountPeak l c
81f4f840 00000000
81f4f844 00000038
81f4f848 00000000
81f4f84c 00000000
81f4f850 0000003d
81f4f854 0000001e
81f4f858 00000032
81f4f85c 00000000
81f4f860 00000238
81f4f864 00000031
81f4f868 00000000
81f4f86c 00000006

, -
, ,
. 32-

. ( 64- -
.)
,
,
(..10.9).
MiObtainSystemVa
, (. ) ,
,
.
. ( -
, .)
284 10.

: .

, -
, MiSystemVaTypeCountLimit.
-
-

. ( -
, http://msdn.microsoft.
com/en-us/library/bb870880(VS.85).aspx.)
, (..10.9).

,

MemLimit (http://www.winsiderss.com/tools/memlimit.html)
Winsider Seminars & Solutions. -
-q:

C:\ >memlimit.exe -q

MemLimit v1.00 - Query and set hard limits on system VA space consumption
Copyright (C) 2008 Alex Ionescu
www.alex-ionescu.com

System Va Consumption:

Type Current Peak Limit


Non Paged Pool 102400 KB 0 KB 0 KB
Paged Pool 59392 KB 83968 KB 0 KB
System Cache 534528 KB 536576 KB 0 KB
System PTEs 73728 KB 75776 KB 0 KB
Session Space 75776 KB 90112 KB 0 KB


100 :

memlimit.exe -p 100M

3 I testlimit h,
16 .
16 , -
, .


, -
,
,
32- , .
,
,
285


.
PagedPoolQuota , NonPagedPoolQuota , PagingFileQuota
WorkingSetPagesQuota HKLM\SYSTEM\CurrentControlSet\Control\Session Man-
ager\Memory Management
, .
, ,
(, ,
, -
).
, , -
HKLM\SYSTEM\CurrentControlSet\Session Manager\Quota System
, SID .
SID- ,
, . -
, ,
.10.10.

10.10.


PagedPool - - SeIncrease
Quota () , - QuotaPrivilege
, -


NonPaged- - SeIncrease
PoolQuota - () , - QuotaPrivilege
,
-
-

PagingFile- - - SeIncrease
Quota , , - QuotaPrivilege

-
-

WorkingSet- - SeIncreaseBase-
PagesQuota , PriorityPrivi-
lege,
-
( -
)
286 10.

-
-
, -
(, DLL- ,
)
(Address Space Layout
Randomization, ASLR).

DLL- -


-


-

. 10.14.
ASLR


, .10.14.
287

DLL-
, ( ) ( )
( ). (
, TEB- PEB-),
. ASLR
,
, DEP -
. Windows
, , ,
- -
DLL-.

:

,
, ,
VMMap, Sysinternals, -
:

Image ( ). ,
, (,
), ( -
).
Private ( ). , -
, , .
Shareable ( ). ,
.
( , Image,
Mapped File).
Mapped File ( ). -
.
Heap ( ). , ( ), .
Stack ( ). , -
.
System ( ). , (,
).

Explorer,
VMMap.
288 10.

, VMMap
, , ( -
) ( ).
,
, .
.

ASLR
DLL-, . , PE-
ASLR (IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE),
Microsoft Visual Studio
/DYNAMICBASE, , -
ASLR.
. ,
256, 64- .


()
.
8- 0x10000
0xFE0000, (Time Stamp Counter,
TSC) ,
254 1.
, , , 64. -
1 ,
, ASLR
PE-. -
289

, 256
16 PE-.
DLL-
,
(image bias), MiInitializeRelocations -
MiImageBias.
(TSC)
,
8- , 256 .
,
,
DLL-
. DLL- -
, .
-,
, ,
, . ,
DLL-, DLL-
.
-
MiImageBitMap.
0x50000000 0x78000000 ( MiImageBitMapHighVa), -
(64, ).
DLL-,
, ; DLL-
,
.
DLL-
. MiImageBias
, -
, -
. DLL-
( Ntdll.dll) ,
: 0x78000000 MiImageBias 0x10000.
DLL- 64. -
, Ntdll.dll, DLL-
. , ,
DLL- ,
Smss.
, ( ,
, ASLR, ),
DLL- , DLL-
64 16
.
290 10.


ASLR
( ). -
, StackRandom-
izationDisabled, 32
64 256. -
n-
, n TSC-
, 5- (
32 ).
TSC-
, 9 . -
4, , 2048 (
).
.


, ASLR (-
), .
RtlCreateHeap ,
TSC-. , 5-,
64 , 0,
0x00000000 0x001F0000. ,
, , ,
,
.

ASLR
ASLR . 32-
64 , 64- 256. -

, , ASLR

.


, ASLR
Windows -
: ASLR ,
IMAGE_DLL_CHARACTERISTICS_DYNAMIC_BASE, -
( )
.. -

, Microsoft
291

(Enhanced Mitigation Experience Toolkit, EMET). EMET


,
Windows, ,
Windows. , EMET -
,
, -
. , EMET
,
, .

: ASLR-
( , , DLL-)
Process Explorer, Sysinternals.
, ASLR. ,
DLL-, , ASLR,
.

ASLR-
, Select Columns ( ),
Process Image ( ) ASLR Enabled
( ASLR ). , Windows
ASLR; , -
, ASLR .

Notepad.exe ( ). -
0xFE0000. Notepad, -
, .
,
, , DLL- ASLR
.
292 10.


Windows -
,
.
.
32- x86 (
PAE-)
64- IA64 x64.
, -
( ), , Windows

.

x86
,
, , -
.
,
(Page Table Entry, PTE). PTE- , -
. , .10.15 , x86

. PTE- ,
,
,
.
.10.15 , PTE-
, .


, (, ),
,
, .

(memory descriptor list, MDL),
WDK.

, Windows x86 -
: (PAE)
. , -
.
, ,
, -
293

PAE. x64
, PAE.

-

-

. 10.15. (x86)

x86 PAE
. 32--
,
4, : (virtual
page number) , (byte
offset). , ,
.10.16, (page directory index)
(page table index).
.
, . -
, 12,
4096 (212= 4096).
294 10.

10 , 1024
(210= 1024).

0 ( )
- -

10 10 12

. 10.16. 32- x86

-
, .
x86 PAE .10.17.

. 10.17. x86 PAE

, . , -

. ,
,
(Page Frame Numbers, PFN).
, .
.

.10.18.
:
1. -
(Memory Management Unit, MMU)
CR3.
2. , ,
,
(Page Directory Entry, PDE), , -
. , PDE
295

, (Page
Frame Number, PFN), , ,

,
. PDE- , -
, , PFN-
,
.


( , ( 512
1024 ) 512 ,
1024 )

. 10.18.
( x86 PAE)

3.
PTE-, .
4. PTE- , -
( ).

. 5.
(. .)
(, - ),

(bug check).
296 10.

5. PTE- (
), PFN- PTE-
,
.

, , ,
, PTE-.


x86 PAE
, ,
.
(KPROCESS),
x86 PAE 0xC0300000.
( KPROCESS
5 I.)

, CR3.
. (
, 12 ,
CR3 .) , -
, , -
, , ,
, KPROCESS.

,
,
, .
(PDE-),
4. PDE-
. -
, ,
.
( ,
VAD-.)
PDE- ,
PTE-, .
4 -
1024 . ,
, 1024 PDE-.
10 (210= 1024).

: PDE-
,
DirBase !process :
297

lkd> !process -1 0
PROCESS 857b3528 SessionId: 1 Cid: 0f70 Peb: 7ffdf000 ParentCid: 0818
DirBase: 47c9b000 ObjectTable: b4c56c48 HandleCount: 226.
Image: windbg.exe

, -
PTE- :

lkd> !pte 10004


VA 00010004
PDE at C0300000 PTE at C0000040
contains 6F06B867 contains 3EF8C847
pfn 6f06b ---DA--UWEV pfn 3ef8c ---D---UWEV

PTE- ,
, x86
PAE.

Windows -
,
. , -
, ( -
,
). , -
,
, ,
.
,
.


.
PTE-.
( .10.18) , PTE-
.
10, 1024 PTE-,
4. , x86 4
,
. ,
, -
4 , .
, x86 4
. , 4 -
1024 (4/4).
1024 .
PTE-
!pte. (. .) PTE-
, . -
298 10.

PTE- : (PFN)
,
, , , .10.19,
.

()
( PTE-)
( )
Global ()
( . PDE)
Dirty ()
Accessed ()
Cache disabled ()
Write through ( )
Owner ()
Write ()
Valid

. 10.19. PTE- x86

, .10.19 -
MMU
PTE-. .
PTE- .10.11.

10.11. PTE-



(. )


(,
PTE- )
- , PDE- -
4 2 PAE (.
)
,


PTE-
,
299


, -

( -
)
(write-combined).

MMU

x86 PTE- ,
MMU, . MMU
( , )
. MMU
.
, MMU .
x86 MMU .
, ,
.
, -
(.) ,
(,
) -
.


Windows

.
( 1) , .
MMU .
,
, - ,
.
, -
. MMU-
PTE-,
.
, PTE-.

-. ,
, MMU-
.
.
, Windows -
PTE-, (1)
300 10.

, (11), , -
, , .
,
, ,
, .
,
( ), - -
, PTE- ,
, , -
.
,
.
, -
. MMU -
, ,
, .
-
, , ,
. ,
,
, (
PTE-).
,
, , -
. , ,

(.)
.


,
.
.
. x86
12, 4096
( ).
-:
, PTE-.
.


,
: ( -
)
.
301


,
, -

. , -
(Translation Look-aside Buffer,
TLB). ,
. TLB
, .10.20, -
, ,
, , .
TLB ,
, , ,
, .
, PTE-. PTE-
, Windows
, , TLB-
.




: 17 5 290

64

17 1004


7

6 14

65 801

. 10.20.

, TLB ,

, , .
TLB , ,
, .

PTE-, TLB-
302 10.

. ,
, ( )
PTE- ( TLB ,
).


, (Physi-
cal Address Extension, PAE), Intel x86 Pentium
Pro. PAE 32--
Intel
x86 (
4) 64,
x64 1024 -
( Windows 64
- PFN-, -
). ,
(MMU) ,
, (.10.21). MMU -
, , PAE,
.




( ,
4 )


( , ( 512
512 8
8 )
)

. 10.21.
303

, 32-
, .
,
, -
,
(.
).
PAE
. 2 I, 32-
Windows PAE, Ntkrnlpa.exe. 32- -
,
(. ),
, PAE, PAE -
.
PAE, BCD- pae ForceEnable.
, PAE
32- Windows,
.
,
PAE, ,
Windows
. BCD-, PAE, nolowmem.
4 (, -
5 )
. ,
32 ,
, .
PAE, ,
. , PAE
4.
- 12- 20-
: 12+ 20= 32 , 232 4.
( , -
, PFN . ,
86 PAE
32 , .)
PAE PFN- 24. 12-
224+12 , 64, .
24- PFN- PAE PFN
20 24 .
, 8
4. ( , PFN PTE- PDE-
32, 4 , x86 PFN- 24 . -
PDE- ,
, .)
,
, 512, 1024 . -
10 9 .
304 10.

.
, PAE
, ,
(Page Directory Pointer Table,
PDPT). 8,
PFN- . , -
PDPT-,
(page directory pointer index).
, CR3 ,
PDPT, . PDPT-
32- 4
( CR3 x86 32--
, PAE).
,
, , -
,
. , -
32 .

:
, , -

x86 PAE.
PDPT, ,
PTE-. ( x86
4 Windows PAE,
, -
.) ,
0x30004 .
,
.

0x30004 ,
. 0x30004
11.0000.0000.0000.0100. .


(0) (0x30 48 (4)
)

-
,
CR3.
DirBase !process :
305

lkd> !process -1 0
PROCESS 852d1030 SessionId: 1 Cid: 0dec Peb: 7ffdf000 ParentCid: 05e8
DirBase: ced25440 ObjectTable: a2014a08 HandleCount: 221.
Image: windbg.exe

DirBase ,
0xced25440. ,
,
, . , PDPT-,
,
0xced25440.

x86 PAE, !pte


PDE- PTE-, :

lkd> !pte 30004


VA 00030004
PDE at C0600000 PTE at C0000180
contains 000000002EBF3867 contains 800000005AF4D025
pfn 2ebf3 ---DA--UWEV pfn 5af4d ----A--UR-V

, ,
:

lkd> !dq ced25440 L 4


#ced25440 00000000`2e8ff801 00000000`2c9d8801
#ced25450 00000000`2e6b1801 00000000`2e73a801

!dq .
dq ( 64- , -
, 16),
, .
, PDPT- ,
, L4, .

, PDPT- ( ) -
0, , PDPT-
. PDPT- ,
PD- PT-, ,
, PFN-, 0x2e8ff
2e8ff000. .

!pte PDE- ,
. x86 PAE -
0xC0600000.
0, , PDE-
. PDE-
.

PAE, PFN-
, PFN- 0x2ebf3. ,
0x2ebf3000. MMU
(0x30) , 8 (
PTE ; PAE 4). PTE
0x2ebf3180.
306 10.

, PTE- 0xC0000180.
, , (0x180),
,
. , -
0xC0000000, 0x180 0xC0000000 ,
: 0xC0000180. ,
PFN PTE- 0x5af4d.

, . -
, MMU PFN-
PTE-, 0x5af4d004. , -
0x30004.

PTE , PFN-. -
, PTE-, , ,
--A--UR-V. A accessed ( ), U
( ), R,
( ,
), V , ( PTE-
).

-
, . , -
dd (dd display dwords
) , :
lkd> dd 30004
00030004 00000020 00000001 00003020 000000dc
00030014 00000000 00000020 00000000 00000014
00030024 00000001 00000007 00000034 0000017c
00030034 00000001 00000000 00000000 00000000
00030044 00000000 00000000 00000002 1a26ef4e
00030054 00000298 00000044 000002e0 00000260
00030064 00000000 f33271ba 00000540 0000004a
00030074 0000058c 0000031e 00000000 2d59495b

!dd
:
lkd> !dd 5af4d004
#5af4d004 00000020 00000001 00003020 000000dc
#5af4d014 00000000 00000020 00000000 00000014
#5af4d024 00000001 00000007 00000034 0000017c
#5af4d034 00000001 00000000 00000000 00000000
#5af4d044 00000000 00000000 00000002 1a26ef4e
#5af4d054 00000298 00000044 000002e0 00000260
#5af4d064 00000000 f33271ba 00000540 0000004a
#5af4d074 0000058c 0000031e 00000000 2d59495b


PTE- PDE-.

x64
x64 , x86
PAE, . -
307

,
(page map level4 table). -
512 ,
(page parent directories).
x86 PAE,
512, -
, 4, 512 . PDPT-,

, , , 512,
. ,
( 512 )
.
(PFN).
x64
48. , 48- -
, .10.22.
.10.23. , x64
.10.24.

64- x64 (
48-)

4- -

9 9 9 9 12

. 10.22. x64

- -
PTE
4


4


( 248)

. 10.23. x64
308 10.


Software ( PTE)
Software ( )

- -
(
-

)

. 10.24. x64

IA64
IA64
. .
Windows , .
.10.12.

10.12. IA64

0
1
2
3
4 Kseg3, -
. , -
TLB

5 Kseg4, -
.
-, -.

6
7

64- Windows IA64


. -
, 1024 .
309

1024 , ,
, . PTE-
IA64 .10.25.

-
(
(37 )
)

. 10.25. IA64


, PTE-
. PTE- , ,
- .
PTE- -
.


PTE-,
32- x86. PTE- 64-
, .


(page fault). (.
3 I) -
(MmAccessFault) . -
,
(
) .
(.10.13).
310 10.

10.13.

, -
, -

, -
,
(standby) -
(modified)
-
(,

, )
-
,

,

,


(
, )
, ( -
) -
,

, PTE-


, - (
, -
)


PTE-, .
PTE-
PTE-, ,
.

PTE-
PTE-, ,
, , PTE-
, , -
311

. MMU
PTE-,
,
.
PTE-
. PTE-,
, MMU.
PTE- .10.11,
,
PTE-.
. .
.10.26, 4 PTE- , 16
, 20 ( x86
PAE; ) . -

.
-
(
), -
(.).

. 10.26. ,

. PTE-
,
. .
, .
,
. , -
, , .
. PTE- ,
,
. ,
, ,
(Virtual Address Descriptor,
VAD) . ,
312 10.

.
VAD- ,
, -
, VAD. ( VAD-
.)
.
, ,
. .10.27, PTE-
.
( - ) -
.

. 10.27.

. PTE- ,
( ,
, ). -
VAD-
, , .
, , -
. (. VAD-.)
(
),
.

PTE-
, -

, (prototype
page table entries), PTE-. ,
313

,
PTE-; -
. PTE-
, .
,
( , VAD- ,
),
PTE- PTE-,
. ,
PTE-, , ,
. PTE- , -
, PFN-
. ,
,

.
.10.28, ,
, , PTE-
, PTE-,
.

PTE PTE
( 7-27) ( 0-6)

. 10.28. PTE-,
PTE-

,
, PTE-, -
PTE-, , , ,
.
, PTE-:
/. -
.
.
(
).
.
, (.10.19).
314 10.

. ,
.
. .
. .
PTE- -
PTE-, PTE-

,
.
, ,
PTE-, -

, . ,
- .
,
PTE-, PTE- ,
, (
- PTE-). ,
, PTE- .
.10.29 .
, . , ()
PTE- PTE-.

PTE-. PTE- (
) PTE-.



-


PTE
-

PTE



= 1


PFN

. 10.29.
315

-
- (In-paging I/O)
( )
. , , -
-
-,
, PTE- PTE-
, .
- , -
-
(Asynchronous Procedure Call, APC).
-
- . -
- - ,

.
- ,
,
. , -
, -
. --
,
:

( ,
, ).
-
.
.
PTE-, ,
PTE-, .
,
,
-. , -
, ,
, . ,
, ,
, PTE- .


, -
,
316 10.

-,
(collided page fault). -

,
.
, -
, , -
. (
PFN-.)
,
PFN-, -
(-,
, , ). -
, ,
-.
- , ,
, . -
, PFN-.
-,
-,
PFN- PTE-.
PFN-, -
,
, ,
, PFN-
-, ,
. - , PTE-
, , ,
-.


-
.
,
, -
, ,
, .
( , ,
TLB.)
PTE-
.
,
. ,
. -
317

,
. , .10.30, -
, -
-.

X ( Y)
. X
X ( Z)

Y Z ,
MDL-

. 10.30.
MDL

, -
A, Y, Z B, , -
. A B ,
. Y Z
, . (,
,
.)
A B , A
B.
,
(A, Y, Z B).
, , ,
..
(Memory Descriptor
List, MDL), , -
A B, Y Z ,
X.
X ,
X . Y Z
MDL, Y Z, X.

,
MDL-
318 10.

MDL-, . ,
.


, , -
, ,
( -
).
,
.
(.13) -
, HKLM\
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles.
, -
. Windows 16
. x86
4095. x86 PAE x64
16 (),
IA64 32.
, -
System (.2 I). , ,
, -
, .

Pagedefrag, Sysinternals. ,
,
, ,
.

,
. -
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\ClearPageFileAtShutdown 1.
, -
. -,
.

, , .
:

1, , .

4, ,
.
319

,
. , -
,
.

:
( )
HKLM\SYSTEM\
CurrentControlSet\Control\Session Manager\Memory Management\PagingFiles .
,
Advanced System Settings ( ).
, System And Security (
), System (). System Properties
( ) ,
Computer () Properties ().
, Advanced System Settings (
), Performance () Settings
(). Performance Options ( )
Advanced () Virtual Memory (
) Change ().

(
) NtCreatePagingFile, Ntdll.dll.
, ,
, . ,
System, ,
,
.

, -
(commit charge) (system commit limit).
,
VirtualAlloc ( ) MapViewOfFile,
,
, .
( , ) , -
, MapViewOfFile,
.
-
, , :
( ).
-
,
,
320 10.

, -
, ( ).


. ,
, Windows (
). ,
( ) .

-
, -
,
, , .
, Windows, -
.
,
. , -
, Windows.
-
,
, . ,

.
, .
Windows ,
(process page file quota). -
, ,
.
. ,
,
, ,
, .
( -
)
( ):
(private committed memory)
VirtualAlloc COMMIT.
.
.
, (page-file-backed
mapped memory), MapViewOfFile,
, , , .
. -
.
321

, (copy-on-write regions of
mapped memory), .

, ,
, ,
.
.
.
(nonpaged and paged pool),
, -
. ,

.
, ,
, -
.
.
(kernel stacks).
(page tables),
, . -
, . ,
, .
, .
, , -
, (,
),
.
( ) ,
.
, API-
(Address Windowing Extension, AWE).

, . ,
-
,
, . ,
, (.).

.
,
.
, ,
. ,
322 10.

.
, ,
. -
.

, , .
-
.
VirtualAlloc
. ,
,
. ,
(
).
, ( )
VirtualAlloc MapViewOfFile, ,
,
. , -
- .
( , - , -
..)
.
-
Memory: Committed Bytes (: -
). Performance
() Commit ()
. Process Explorer
Memory () System Information (-
) Commit Charge ( )
Current ( ).

Process: Page File Bytes (: -
). Process: Private
Bytes (: ). (
.)
- ,
,
. , -

, - .
, .10.14,
, , -
.
323

10.14. ,



Memory: Committed Bytes .
(: -
) , -
, -
.
,
()
Memory: Commit Limit (- ,
:
) ;
,
Process: Page File Quota (- Memory: Committed
: ) Bytes (: )
Process: Private Bytes (- , Process: Page File Quota (:
: )
)
Process: Working Set Process: Page File Quota
Private (: (: ),
()) -
.
Process: Work-
ing Set (: )
Process: Working Set (- Process: Virtual Bytes
: ) (: ), -


Process: Virtual Bytes (- , ,
: , -
)
Paging File: % Usage ( -
: % )
Paging File: % Usage Peak Paging
( : % - File: % Usage ( : % )
())


, .10.14, -
. , ,
, ,
,
.
324 10.

, ,
,
.
Process Explorer Memory () System
Information ( ).
,
,
( ).
, -
, ,
, ,
.
,

(system running low on virtual memory). ,
, Process: Private Bytes (:
). ,

, -
. (
.)

:


(Performance). ,
.
325


System () . -
, .
, ,
-
, . ,
,
( ,
, ). ,
. ,
.

System Information ( ) Process Explorer



,
.

,
,
. (stack). -
Windows ,
(user stack) (kernel stack), ,
DPC- (DPC stacks). -
,
, , ,
326 10.

,
.
,
.


-
, 1.
CreateThread CreateRemoteThread
/STACK:_
Microsoft C/C++,
. 1,
( PE- )
. ,
, ,
.
1, -
. ( .)

:
2,
32- , , -
, -
, , 2048
, 2 (
BCD- increaseuserva, ).
-
64, 30400-
, , TestLimit,
Sysinternals. :

C:\>testlimit -t
Testlimit - tests Windows limits
By Mark Russinovich

Creating threads ...


Created 30399 threads. Lasterror: 8

64- Windows (
8 ), -
(,
, ). , , TestLimit
, 32- , Testlimit.exe
32- Wow64. (
Wow64 3 I.)
32- Wow64, 64- ,
, -
2. -
327

64-
Windows, 64-
Testlimit64.exe.

, TestLimit
Process Explorer , Ctrl+C ,
-
, .


1, ,
, : 12 x86
16 x64, PTE- (
16 20 ). ,
, , , ,

.
( ),
.
,
Win32k.sys, -
, ,
. ,
Windows
16.
, -
16 (- ;
).
.10.31,
( ),
.


16



16



16

. 10.31.
328 10.


, , -
,
API- KeExpandKernelStackAndCallout.

:

MemInfo, Winsider Seminars &
Solutions. u
:

C:\>MemInfo.exe -u | findstr /i "Kernel Stack"


Kernel Stack: 980 ( 3920 kb)

-
TestLimit:
C:\>MemInfo.exe -u | findstr /i "Kernel Stack"
Kernel Stack: 92169 ( 368676 kb)

TestLimit 32- -
,
32- .

DPC-
, Windows DPC-, -
(DPC).
DPC- (
DPC-, DPC-
). DPC-

SYSENTER SYSCALL. SYSENTER
SYSCALL ,
(Model-Specific Register, MSR), Windows -
MSR , -
. Windows MSR
DPC- .


, ,
(demand-paging algorithm),
-
. ,
(lazy evaluation),
, .
329


, ,
. ,
VirtualAlloc VirtualAllocExNuma,
, -
. ?
.
,
,
. ,
() ,
.
, -
,
. ,
.

. ,
, .
, ,
, .
(Virtual Address
Descriptors, VAD). VAD- .


VAD- -
. VAD-
- (
- ), -
.
VAD-, .
-
, (
, ,
..). VAD-
.10.32.

, VAD- ,
, -
, ,
,
.
PTE-
, . VAD-
330 10.

, ,
PTE-. ,
VAD-, , -
, ,
, .

: 20000000-2000FFFF
:
:

: 00002000-0000FFFF : 4E000000-4F000000
: :
: :

: 32000000-3300FFFF : 7AAA0000-7AAA00FF
: :
: :

. 10.32.

:
VAD-
!vad . !process -
VAD-, ,
VAD- , Notepad.exe (),
!vad:

lkd> !process 0 1 notepad.exe


PROCESS 8718ed90 SessionId: 1 Cid: 1ea68 Peb:
7ffdf000 ParentCid: 0680
DirBase: ce2aa880 ObjectTable: ee6e01b0 HandleCount: 48.
Image: notepad.exe
VadRoot 865f10e0 Vads 51 Clone 0 Private 210. Modified 0. Locked 0.

lkd> !vad 865f10e0


VAD level start end commit
8a05bf88 ( 6) 10 1f 0 Mapped READWRITE
88390ad8 ( 5) 20 20 1 Private READWRITE
87333740 ( 6) 30 33 0 Mapped READONLY
86d09d10 ( 4) 40 41 0 Mapped READONLY
882b49a0 ( 6) 50 50 1 Private READWRITE
...
Total VADs: 51 average level: 5 maximum depth: 6
NUMA 331


, -
,
AGP-,
. -
,
(rotate
virtual address descriptors), -
(Graphical Processing
Unit, GPU) -
. ,
,
.10.33.

,

AGP-



-

-
- -
-
,

. 10.33.

NUMA
Windows
-
(Non Uniform Memory Architecture, NUMA),
( SMP- Intel i7
AMD Opteron). NUMA
, , -
,
, NUMA,
.
332 10.

MiComputeNumaCosts
,
.
,
( ).
, ,
( ).
, ..
, , , -
, -
(ideal node),
API- VirtualAllocExNuma, CreateFileMappingNuma, MapViewOfFileExNuma
AllocateUserPhysicalPagesNuma,
.
, ,
. , -
,
,
. ,
- ,
, ,
. , -
, - ,
. , ,
, API- MmAllocatePagesforMdlEx MmAllocateCo
ntiguousMemorySpecifyCacheNode.
NUMA- -
.

.
-
,
, . ,
NUMA-
. , -
PTE-,
.
, , -
, NUMA-,
NUMA-, ,
. -
(.) ,
,
, .
333


, ,
Windows (file mapping object),
,
.
- .

, .
( , ,
11.) -
.
,
, (
- ). -
( , )
,
( ) .
,
( ,
Windows- FlushViewOfFile).
, ,
.
, ,
. ,

, .
.10.34.



/
/

. 10.34.
334 10.

:
Object Viewer (Winobj.exe Sysinternals)
. -
, -
3 I. ( 3,
\Sessions\x\BaseNamedObjects , x
.) .

, , , -
Process Explorer, Sysinternals.
ViewLower Pane View ( ) DLLs
(DLL-), ViewSelect Columns ( -
) Mapping Type ( ). Data
Mapping () ( DLL-
, ).
.

, , .10.15.

10.15.

, ,
(Maxi- ; , -
mum size)
,
(Page protection)
, ( -
, ,
(Paging , ,
file/Mapped file) ) (
)
335


- , , -
(Based/
Not based) , , -

, -
, .10.35.
, , (
, ..).

-

PTE PFN


(
)

. 10.35.

( )
(section object pointers). -

, .
-
(control areas). ,
, ,
.
336 10.

, ,
(subsections),
( , , ..).
(segment),
, , , PTE-
, , -
. , PTE-
, , , ,
.
Windows , , ( -
), ,
, (

, ). -
, (
), (,

, ,
, ).
:
1. API- -
( ), ,
, .
2.
, ,
, .
, ,
.
3. .
4. , (
) (
,
).
, , -
( ),
,
. -
, , , -
, ,
, (
).
337

:
,
. -
,
!handle . !file
,
. , dt,
,
. :
, (.11) -
.
( )
!ca.

, PowerPoint !handle
, , ,
, PowerPoint-. ( -
!handle 3 I.)

lkd> !handle 1 f 86f57d90 File


.
.
0324: Object: 865d2768 GrantedAccess: 00120089 Entry: c848e648
Object: 865d2768 Type: (8475a2c0) File
ObjectHeader: 865d2750 (old version)
HandleCount: 1 PointerCount: 1
Directory Object: 00000000 Name:
\Users\Administrator\Documents\Downloads\
SVR-T331_WH07 (1).pptx {HarddiskVolume3}

(865d2768) dt,
:

lkd> dt nt!_FILE_OBJECT 865d2768


+0x000 Type : 5
+0x002 Size : 128
+0x004 DeviceObject : 0x84a62320 _DEVICE_OBJECT
+0x008 Vpb : 0x84a60590 _VPB
+0x00c FsContext : 0x8cee4390
+0x010 FsContext2 : 0xbf910c80
+0x014 SectionObjectPointer : 0x86c45584 _SECTION_OBJECT_POINTERS

, (0x86c45584) -
dt, :

lkd> dt 0x86c45584 nt!_SECTION_OBJECT_POINTERS


+0x000 DataSectionObject : 0x863d3b00
+0x004 SharedCacheMap : 0x86f10ec0
+0x008 ImageSectionObject : (null)

, , !ca
:
338 10.

lkd> !ca 0x863d3b00

ControlArea @ 863d3b00
Segment b1de9d48 Flink 00000000 Blink 8731f80c
Section Ref 1 Pfn Ref 48 Mapped Views 2
User Ref 0 WaitForDel 0 Flush Count 0
File Object 86cf6188 ModWriteCount 0 System Views 2
WritableRefs 0
Flags (c080) File WasPurged Accessed

No name for file

Segment @ b1de9d48
ControlArea 863d3b00 ExtendInfo 00000000
Total Ptes 100
Segment Size 100000 Committed 0
Flags (c0000) ProtectionMask

Subsection 1 @ 863d3b48
ControlArea 863d3b00 Starting Sector 0 Number Of Sectors 100
Base Pte bf85e008 Ptes In Subsect 100 Unused Ptes 0
Flags d Sector Offset 0 Protection 6
Accessed
Flink 00000000 Blink 8731f87c MappedViews 2


!memusage. :

lkd> !memusage
loading PFN database
loading (100% complete)
Compiling memory usage data (99% Complete).
Zeroed: 2654 ( 10616 kb)
Free: 584 ( 2336 kb)
Standby: 402938 (1611752 kb)
Modified: 12732 ( 50928 kb)
ModifiedNoWrite: 3 ( 12 kb)
Active/Valid: 431478 (1725912 kb)
Transition: 1186 ( 4744 kb)
Bad: 0 ( 0 kb)
Unknown: 0 ( 0 kb)
TOTAL: 851575 (3406300 kb)
Building kernel map
Finished building kernel map
Scanning PFN database - (100% complete)

Usage Summary (in Kb):


Control Valid Standby Dirty Shared Locked PageTables name
86d75f18 0 64 0 0 0 0 mapped_file(
netcfgx.dll )
8a124ef8 0 4 0 0 0 0 No Name for File
8747af80 0 52 0 0 0 0 mapped_file(
iebrshim.dll )
883a2e58 24 8 0 0 0 0 mapped_file(
WINWORD.EXE )
86d6eae0 0 16 0 0 0 0 mapped_file(
oem13.CAT )
339

84b19af8 8 0 0 0 0 0 No Name for File


b1672ab0 4 0 0 0 0 0 No Name for File
88319da8 0 20 0 0 0 0 mapped_file(
Microsoft-Windows-MediaPlayer
Package~31bf3856ad364e35~x86~en-US~6.0.6001.18000.cat )
8a04db00 0 48 0 0 0 0 mapped_file(
eapahost.dll )

Control () ,
. !ca
, . ,
Winword.exe
!ca , Control ():

lkd> !ca 883a2e58

ControlArea @ 883a2e58
Segment ee613998 Flink 00000000 Blink 88a985a4
Section Ref 1 Pfn Ref 8 Mapped Views 1
User Ref 2 WaitForDel 0 Flush Count 0
File Object 88b45180 ModWriteCount 0 System Views ffff
WritableRefs 80000006
Flags (40a0) Image File Accessed

File: \PROGRA~1\MICROS~1\Office12\WINWORD.EXE
Segment @ ee613998
ControlArea 883a2e58 BasedAddress 2f510000
Total Ptes 57
Segment Size 57000 Committed 0
Image Commit 1 Image Info ee613c80
ProtoPtes ee6139c8
Flags (20000) ProtectionMask

Subsection 1 @ 883a2ea0
ControlArea 883a2e58 Starting Sector 0 Number Of Sectors 2
Base Pte ee6139c8 Ptes In Subsect 1 Unused Ptes 0
Flags 2 Sector Offset 0 Protection 1

Subsection 2 @ 883a2ec0
ControlArea 883a2e58 Starting Sector 2 Number Of Sectors a
Base Pte ee6139d0 Ptes In Subsect 2 Unused Ptes 0
Flags 6 Sector Offset 0 Protection 3

Subsection 3 @ 883a2ee0
ControlArea 883a2e58 Starting Sector c Number Of Sectors 1
Base Pte ee6139e0 Ptes In Subsect 1 Unused Ptes 0
Flags a Sector Offset 0 Protection 5

Subsection 4 @ 883a2f00
ControlArea 883a2e58 Starting Sector d Number Of Sectors 28b
Base Pte ee6139e8 Ptes In Subsect 52 Unused Ptes 0
Flags 2 Sector Offset 0 Protection 1

Subsection 5 @ 883a2f20
ControlArea 883a2e58 Starting Sector 298 Number Of Sectors 1
Base Pte ee613c78 Ptes In Subsect 1 Unused Ptes 0
Flags 2 Sector Offset 0 Protection 1
340 10.


8 Driver Verifier,
,

. Driver Verifier, -
(, ,
8).
HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager\Memory Management . VerifyDriverLevel -
, .
VerifyDrivers . (
,
.) VerifyDrivers
(*).
.

, , ,
. ( ,
-
.) ,
, , ,
, .
, , VfLoadDriver,
Vf*

. , ExAllocatePool
VerifierAllocatePool. (Win32k.sys)

.
-
, ,
: Special Pool ( ), Pool Tracking ( ),
Force IRQL Checking ( IRQL), Low Resources Simulation (-
), Miscellaneous Checks ( ) Automatic Checks
( ).
. -
, -
,
. Special
Pool ( )
, .
Special Pool ( ),
Driver Verifier. Driver Verifier,
341

, , -
, ,
. , Driver Veri-
fier . Driver Verifier
,
, -
,
.
.10.36 , Driver
Verifier ,
.

. 10.36.

Driver Verifier
. , -
, -
, .
,
, DWORD- HKLM\
SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PoolTagOverruns
0 ( Gflags
Verify Start Verify End).
Windows , Driver Verifier
, .
-
.
Driver Verifier, ,
, , .
, ,
.
342 10.


IRQL- .
, :
IRQL- DPC/dispatch .
Special Pool ( ) , -
DWORD- HKLM\SYSTEM\CurrentControlSet\Control\
Session Manager\Memory Management\PoolTag. , -
. , Driver
Verifier , ,
,
PoolTag , .
PoolTag 0x0000002a (*),
, , -
. (

.)
. Pool Tracking ( ),
-
. ,
, . Driver Verifier
Pool Tracking ( ).
!verifier .
, Driver Verifier,
.
-
, , ExAllocatePoolWithTag,
API- , : IoAllocateMdl,
IoAllocateIrp IRP-, ; -
API-, Rtl;
IoSetCompletionRoutineEx.
, Pool
Tracking ( ), .
ExAllocatePoolWithQuotaTag
. DPC-
, , DPC-
. Pool
Tracking ( ) -
DPC-.
Driver Verifier
, , -
-.
DRIVER_LEFT_LOCKED_PAGES_IN_PROCESS (
) PROCESS_HAS_LOCKED_PAGES ( )
,
.
343

IRQL-.
,
, , -
, IRQL-. 3 I,
IRQL- DPC/
dispatch . ,
,
IRQL-, ,
, . -
,
IRQL_NOT_LESS_OR_EQUAL ( IRQL-
,
).
,
Driver Verifier . Force IRQL Checking
( IRQL) Driver Verifier -
, , IRQL-
. , ,
MiTrimAllSystemPagableMemory. -

IRQL- ,
, .
-
IRQL- ,
, .
,
IRQL-,
. Driver Verifier
KTIMER, KMUTEX, KSPIN_LOCK, KEVENT, KSEMAPHORE, ERESOURCE FAST_MUTEX.
. Low Resources Simulation
( ) Driver Verifier -
,
.
, , , -
, ,
.
, ,
, .
, ,
, ExAllocatePool*, MmProbeAndLockPages, MmMapLockedPagesSpecifyCache,
MmMapIoSpace, MmAllocateContiguousMemory, MmAllocatePagesForMdl, IoAllocateIrp,
IoAllocateMdl, IoAllocateWorkItem, IoAllocateErrorLogEntry IOSetCompletion
RoutineEx, API-, Rtl
. ,
, ( 6% ),
344 10.

( ),
( )
( 7
, -
,
).
Driver Verifier
.
, ,
, .
. , Driver Veri-
fier ,
, .
( -
ExFreePool ,
, IoQueueWorkItem).
(
ExFreePool ExDeleteResource ERESOURCE).
(
ExFreePool ExDeleteNPagedLookasideList
ExDeletePagedLookasideList ).
, , Driver Verifier
. -
, .
(MDL), ,
MmProbeAndLockPages MmProbeAndLockProcessPages. ,
MmProbeAndLockPages MDL-,
MmBuildMdlForNonPagedPool.
MDL-, ,
MmMapLockedPages. , MmMapLockedPages
MDL-, . -
MmMapLockedPages
MDL-, .
MDL- (
IoBuildPartialMdl) MmUnlockPages MmUnmapLockedPage.
MDL-, ,
MmUnmapLockedPages.
,
.
Driver Verifier
, .
345

, Driver Verifier ,
Driver Verifier ,
Windows.


-
Windows- , PTE- VAD-
. , Windows
, , Windows .
, -
, (Page Frame Number, PFN)
.
.10.16.

10.16.

( -
(active), - , , -
) (-
(valid) , )
PTE-
, -
(transition) . -
, -
-. PTE-
,
. ( ,
-
PTE-;
PTE- , -
)
,
(standby) ( -

).
. PTE- - -
,
,
(modified) . , -
,
. PTE- -
, -
.


346 10.

10.16 ()


, , ,
,
(modified . -
no-write) , ,
. , NTFS
,
,
,
. (
NTFS 12)
, -
(free) . (
-
)

(zeroed) (
)
, - ,

(rom)

(bad) ,

PFN- ,
.
.10.37. , PTE-
PFN-, PFN-
( PFN-) ,
( ).
PFN-, PTE-.
, .10.16,
() ,
. (, , -
,
.) ,
,
( ).
.10.38 , .
,

.
347


1 PFN

:


- -

:

PTE

-

:

. 10.37.
348 10.


PFN-

. 10.38. PFN-

: PFN-

MemInfo, Winsider Seminars & Solutions, s. -
:

C:\>MemInfo.exe -s

MemInfo v2.10 - Show PFN database information


Copyright (C) 2007-2009 Alex Ionescu
www.alex-ionescu.com

Initializing PFN Database... Done

PFN Database List Statistics


Zeroed: 487 ( 1948 kb)
Free: 0 ( 0 kb)
Standby: 379745 (1518980 kb)
349

Modified: 1052 ( 4208 kb)


ModifiedNoWrite: 0 ( 0 kb)
Active/Valid: 142703 ( 570812 kb)
Transition: 184 ( 736 kb)
Bad: 0 ( 0 kb)
Unknown: 2 ( 8 kb)
TOTAL: 524173 (2096692 kb)

!memusage , ,

.


.10.39 .
, , .



,
, -



- ROM-


- - - - -
-
-



-
-

. 10.39.
350 10.


:
, -
( ,
,
, ), , -
,
. ,
. , -
, .
, ,
,
(Common Criteria). ,

, .

,
.
, .
, ,
,
(zero page thread), 0 System.
. -
, . ,
, -
0, ,
, 1.


,
(. 5 I),
1, , - .
.


,
MmAllocatePagesForMdl MmAllocatePagesForMdlEx,
Wndows-, AllocateUserPhysicalPages
AllocateUserPhysicalPagesNuma, ,
,
MiZeroInParallel, ,
, . , -

( NUMA- ,
NUMA).
351

, , -
. ,
. , -
.
,
PTE- ( PTE-),
.
PFN- -
( PTE-
), PTE-
.
( -
, , ,
), -
, (),
, , .
, -
. , , -
, ,
.

: .


System Information ( ) Process Explorer.
.
TestLimit:

C:\temp>testlimit -d 1 -c 800

Testlimit v5.1 - test Windows limits


Copyright (C) 2012 Mark Russinovich
Sysinternals - wwww.sysinternals.com

Leaking private bytes 1 MB at a time ...


Leaked 800 MB of private memory (800 MB total leaked). Lasterror: 0
The operation completed successfully.

d TestLimit -
, , .
,
.
,
800.

, -
(, Ctrl+C ).
Process Explorer ViewSystem Information (
352 10.

). Free () Zeroed
().

TestLimit . -
, ,
.

, ,
,
. , 800
, 138 .
Process Explorer , ,
,
.

,
, ,
. ,
.

: .



, Sysinternals,
VMMap RAMMap.
353

RAMMap -
.

x86, 3,4 , -
Windows. (..10.39).
, , -
.

1,2 (
). 1700
(, , , , ,
). 448
, -
.

-
( , ..).
, 448 138
.

, , TestLimit,
.
d, TestLimit ,
,
:

C:\Users\user1>testlimit d

Testlimit v5.21 - test Windows limits



354 10.

Copyright (C) 2012 Mark Russinovich


Sysinternals - www.sysinternals.com

Process ID: 1000

Leaking private bytes with touch (MB) ...


Leaked 2017 MB of private memory (2017 MB total leaked). Lasterror: 8
Not enough storage is available to process this command.

TestLimit 2017 1 .

RAMMap
FileRefresh (), RAMMap
(- ).

, 2 ( Active)
( Process Private).
TestLimit. -
, (Standby), (Zeroed) (Free)
. ,
TestLimit, , .

RAMMap .
Physical Pages ( ) , -
Process (),
Testlimit.exe. ,
.
355

,
, d
TestLimit. RAMMap , -
RAMMap VirtualAlloc.
VMMap.
VMMap , :
356 10.


, 1 1
. ,
TestLimit. -
. , 0x580000.

,
RAMMap. , Virtual Address
( ). ,
.

, , 0x01340000, -
0x97D78000.

TestLimit d
.
!dc (dc display
characters, , ):

lkd> !dc 0x97d78000


#97d78000 74736554 696d694c 00000074 00000000 TestLimit.......
#97d78010 00000000 00000000 00000000 00000000 ................
#97d78020 00000000 00000000 00000000 00000000 ................
...

,
( , ) ,
, -
.

VMMap TestLimit, ViewEmpty Working


Set ( )
. VMMap .
357

, Working Set ( ) . -
,
9,
32, -
. RAMMap. Use Counts ( -
) ,

.
358 10.

Processes () RAMMap ,
TestLimit.

RAMMap, Physical Pages ( ).


Physical Address ( )
( 0xc09fa000). RAMMap
, .
359

, - TestLimit
.

, ,
:

lkd> !dc 0x97d78000


#97d78000 74736554 696d694c 00000074 00000000 TestLimit.......
#97d78010 00000000 00000000 00000000 00000000 ................
#97d78020 00000000 00000000 00000000 00000000 ................
...


, PFN- . ( PFN-
.)

lkd> !pfn 97d78


PFN 00097D78 at address 84E9B920
flink 000A0604 blink / share count 000A05C1 pteaddress C0002C00
reference count 0000 Cached color 0 Priority 5
restore pte 00000080 containing page 097D60 Modified M
Modified

, - TestLimit
.


, , -
, . -
0 7.
.
,
.
, , .10.40,
.
-
.
, . ( ,
-
.) ,
. , ,
,
.
, 5,
, -
. , ,
Process Explorer (
PFN-, ).
360 10.

.10.41 Threads () Process Explorer,


Winlogon.
, 5.

. 10.40. ,

. 10.41. Threads () Process Explorer

,
,
, .
361

: ,

-
Winsider Seminars & Solutions MemInfo c.
MemInfo (repurposed)
. ,
.
, :
C:\Windows\system32>meminfo -c
MemInfo v2.10 - Show PFN database information
Copyright (C) 2007-2009 Alex Ionescu
www.alex-ionescu.com

Initializing PFN Database... Done

Priority Standby Repurposed


0 - Idle 0 ( 0 KB) 0 ( 0 KB)
1 - Very Low 41352 ( 165408 KB) 0 ( 0 KB)
2 - Low 7201 ( 28804 KB) 0 ( 0 KB)
3 - Background 2043 ( 8172 KB) 0 ( 0 KB)
4 - Background 24715 ( 98860 KB) 0 ( 0 KB)
5 - Normal 7895 ( 31580 KB) 0 ( 0 KB)
6 - Superfetch 23877 ( 95508 KB) 0 ( 0 KB)
7 - Superfetch 8435 ( 33740 KB) 0 ( 0 KB)
TOTAL 115518 ( 462072 KB) 0 ( 0 KB)


, ,
,
MemInfo i. , ,
,
, System Information ( -
) Process Explorer, ViewSystem Information
( ).
362 10.

x64, (.
, MemInfo), , 0,
, 1 165, 2 29.
, .

, , 1
TestLimit, Sysinternals.
(
20 50 ):

testlimit d 50 c 20

MemInfo
:

Priority Standby Repurposed


0 - Idle 0 ( 0 KB) 2554 ( 10216 KB)
1 - Very Low 92915 ( 371660 KB) 141352 ( 565408 KB)
2 - Low 35783 ( 143132 KB) 0 ( 0 KB)
3 - Background 50666 ( 202664 KB) 0 ( 0 KB)
4 - Background 15236 ( 60944 KB) 0 ( 0 KB)
5 - Normal 34197 ( 136788 KB) 0 ( 0 KB)
6 - Superfetch 2912 ( 11648 KB) 0 ( 0 KB)
7 - Superfetch 5876 ( 23504 KB) 0 ( 0 KB)
TOTAL 237585 ( 950340 KB) 143906 ( 575624 KB)

, -
TestLimit:

Priority Standby Repurposed


0 - Idle 0 ( 0 KB) 2554 ( 10216 KB)
1 - Very Low 5 ( 20 KB) 234351 ( 937404 KB)
2 - Low 0 ( 0 KB) 35830 ( 143320 KB)
3 - Background 9586 ( 38344 KB) 41654 ( 166616 KB)
4 - Background 15371 ( 61484 KB) 0 ( 0 KB)
5 - Normal 34208 ( 136832 KB) 0 ( 0 KB)
6 - Superfetch 2914 ( 11656 KB) 0 ( 0 KB)
7 - Superfetch 5881 ( 23524 KB) 0 ( 0 KB)
TOTAL 67965 ( 271860 KB) 314389 ( 1257556 KB)

,
(
), , -
- .



( )
. (MiModifiedPageWriter) -
, (MiMappedPageWriter) -
. ,
363

, ,
, , ,
(,
, -
). ,
- ,
-.
17,
. ,
, MmMappedPageWriterEvent.
:
(MiInsertPageInLockedList MiInsertPage
InList). , ,
-
, 800 , 1024,
256.
(MiObtainFreePages).
(MmWorkingSetManager), -
(
). ,
,
, 800 .
(MmFlushAllPages).

(MmFlushAllFilesystemPages). ,

, -
, ,
16. MmFlushAllFilesystemPages MmFlushAllPages
.
MiMapped-
PageListHeadEvent, 16 .
16
(MiCurrentMappedPageBucket).
, , -
-
100 ( MiWriteGapCounter,
).
-

,
800.
364 10.


(MmModifiedPageWriterGate),
:
.
(MmAvailablePages ) 128
.
, ,
20000 ,
, , ,
: ,
64 (16384 ).
,
15000.
(MiInsertPageInLockedList MiInsertPageIn
List). , , -
,
800, 1024
256 .
,
MiRescanPageFilesEvent
(MmPagingFileHeader),
.

-.
PTE, PFN- ,
,
. ,
, -
-
.
, ,
. -
PFN-, ,
, , .
- , ,
,
.

PFN-
PFN- , -
.
365

, .
PFN- .10.42.

PTE- | PTE- |



PTE- PTE-
PFN- PFN-

PTE- PTE-

PFN- PFN-

-

PFN
PTE- | PTE- |



PTE- PTE-
PFN- PFN-
PTE- PTE-

PFN- , PFN- ,

-

. 10.42. PFN-
( )

PFN- -
, PFN-.
PFN- :
PTE- (PTE address). PTE-,
. , PTE-
4- (8- 64- ), -

PFN-.
(reference count). . -
,
()
- (, ).
366 10.

,
.
, .
, ,
PFN-, ,
, .
(type). , PFN-. ( -
: , , , , ,
, , ,
, .)
(flags). , , .10.17.
(priority). , PFN-, ,
.
PTE- (original PTE contents).
PFN- PTE-,
( PTE-). -
PTE- ,
. PFN-
AWE- ;
AWE-.
PFN- PTE- (PFN of PTE). ,
PTE-,
PFN-.
(Color). , PFN-
, , -
, NUMA- .
(Flags). ,
, PTE- (.10.18).

10.17. PFN-

. DWORD-
(Write in progress) ,
, -
. ( ,
(Modified state)
.)
-
(Read in progress) . DWORD-
, , -

367


-
(Rom) , -
, -


-. (
(In-page error) PFN- .)
(Kernel stack) .
PFN-
PFN-
(- ECC-
(Removal requested) - )
(Parity
error)

10.18. PFN-

PFN- PFN- (-
(PFN image verified) -
, PFN-)
AWE- (AWE PFN- AWE-
allocation)
PTE- , PTE-,
(Prototype PTE) PFN-, . (,
.)

PFN-. ,
PFN- .10.42 ,
.
PTE-, . (, -
,
/, -
.) , ,
PTE- .
, .
-
( , -
), , -
. ,
-
, .

368 10.

, , -
. (
.) , ,
,
,
.
.
PFN- .10.42 ,
, .
.
.
,
( ),
. ,
. (- , -
-,
), .
PFN- .10.42 ,
. , Windows -
,
() ,
. PFN-
, , ,
, .
PFN- .10.42 ,
- (, ).
-, ,
-. ,
, ,
-. PFN-
.
PFN-
, .10.19.

10.19. ,

MmNumberOfPhysical- ,
Pages
MmAvailablePages ( -
, )
MmResidentAvailable , -
Pages , -


369

: PFN-
PFN- !pfn . -
PFN-. (,
!pfn 1 , !pfn 2 ..)
PTE- 0x50000, PFN-, -
, :

lkd> !pte 50000


VA 00050000
PDE at 00000000C0600000 PTE at 00000000C0000280
contains 000000002C9F7867 contains 800000002D6C1867
pfn 2c9f7 ---DA--UWEV pfn 2d6c1 ---DA--UW-V

lkd> !pfn 2c9f7


PFN 0002C9F7 at address 834E1704
flink 00000026 blink /
share count 00000091 pteaddress C0600000
reference count 0001 Cached color 0 Priority 5
restore pte 00000080 containing page 02BAA5 Active M
Modified

lkd> !pfn 2d6c1


PFN 0002D6C1 at address 834F7D1C
flink 00000791 blink /
share count 00000001 pteaddress C0000280
reference count 0001 Cached color 0 Priority 5
restore pte 00000080 containing page 02C9F7 Active M
Modified

PFN- MemInfo.
, , -
. MemInfo
PFN-:

C:\>meminfo -p 2c9f7

PFN: 2c9f7
PFN List: Active and Valid
PFN Type: Page Table
PFN Priority: 5
Page Directory: 0x866168C8
Physical Address: 0x2C9F7000

C:\>meminfo -p 2d6c1

PFN: 2d6c1
PFN List: Active and Valid
PFN Type: Process Private
PFN Priority: 5
EPROCESS: 0x866168C8 [windbg.exe]
Physical Address: 0x2D6C1000

MemInfo , PFN-
, PFN- WinDbg, ,
!pte 50000.
370 10.


, , Windows , ,
Windows . -
,
, , , ,
, .
, (
), , ,
.
,
. , ,
, , , -
.
, -

.
.
Windows
, ,
.
Windows
.10.20.

10.20.
32- 64-
, ,
(Ulti- 4 192 64--
mate), ; -
(Enterprise) - , -
(Profes-
sional) 32-

- 4 16 64--
(Home Premium) ; -
, -

32-

4 8 64--
(Home Basic) ; -
, -

32-

371

32- 64-
, ,
(Starter) 2 2
Server Datacenter, 2 -
Enterprise Server for
Itanium
Server Foundation 8
Server Standard Web 32
Server
Server HPC Edition 128

2 -
, ,
Microsoft ,
.
2.

Windows
64- Windows , -
, 2
(Starter Edition) 192 (Ultimate), -
(Enterprise) (Professional) . 32-
Windows 4 ,
, -
x86.
x86 PAE-
( -
4 ), ,
, ,
( - , -
, )
, 4. , -
.

, , , .

, , 4,
.
BCD- nolowmem,
, 4,
.
.
372 10.

32-
4 32-
, -
. ,
, ,
x86 x64 ,
4, 32-
, ,
4.
PAE, Windows - -
(
64- ).
4 , - ,
,
500, , .10.43, 500 4
4.






4


4,5

. 10.43.
4

, 3
32- Windows,
.
, System
Properties ( ), ,
373

Windows, Performance ()
Msinfo32 Winver. Msinfo32,
4 32--
Windows 3,5:
(RAM) 4,00;
3,50.
MemInfo, -
Winsider Seminars & Solutions. .10.44
MemInfo 32- r,
.

. 10.44. 32- Windows

9F0000
100000, DFE6D000 FFFFFFFF (4).
, 64- Windows, 4
(.10.45), Windows 500
, 4.

. 10.45. x64

, -
,
Windows ( MemInfo -
). Devmgmt.msc,
ViewResources By Connection ( ),
Memory (). , , -

, 256 E0000000-EFFFFFFF
(.10.46).
374 10.

. 10.46.
32- Windows

, PCI-

.

4 . , -
8 1
32- Windows 2,2.
.10.47, MemInfo 64-
Windows 8FEF0000 FFFFFFFF.

. 10.47. 64- Windows

, 512 2 -
( 256 ), PCI-
,
, , , ,
, , . ,
2, 32- Windows,
-
, .
375


, , Windows
, , Windows
.
, ,
, (working set).
:
, , -
.
,
(, Ntoskrnl.exe ),
.
,
,
Windows, (Win32k.sys),
,
.

, ,
. -
.


Windows
.
, -
.
- . ,
, , ,
, -
.
.
.
,
,
.
( ) Windows
, (logical
prefetcher) . -
, ,
.
376 10.


-
,
, , , ,
, , , .
, ,

. ,
,
, .
-
.
-
,
,

. ,
, ,
( ), ,
, , ,
( ).
10 .
,
30 ( Explorer),
60 Windows 120 ,
, .
, , ,
(Master File Table, MFT)
NTFS (
NTFS-), , . -
,
(%SystemRoot%\System32\Sysmain.dll),
Svchost. -
, , .
\KernelObjects\PrefetchTraces-
Ready, ,
.



, DWORD- HKLM\SYSTEM\Cur-
rentControlSet\Control\Session Manager\Memory Management\PrefetchParameters\En-
ablePrefetcher. 0 ,
1 , 2
, 3
, .
377

( ,
,
),
, NtQuerySystemInformation.

, ,
%SystemRoot%\Prefetch (.10.48). ,
, -
. .pf.
NOTEPAD.EXE-AF43252301.PF.

. 10.48. Prefetch

. -
, ,
Microsoft (%SystemRoot%\System32\Mmc.exe), -
Windows (%SystemRoot%\System32\Svchost.exe), -
DLL- (%SystemRoot%\System32\Rundll32.exe) Dllhost
(%SystemRoot%\System32\Dllhost.exe).
, -
. ,

.
378 10.

,
.
NTOSBOOT-B00DFAAD.PF . ( , boodfaad
boot fast, .) ,
( -
),
.

:
,
.
Strings, Sys-
internals. ,
:

C:\Windows\Prefetch>Strings n 5 ntosboot-b00dfaad.pf

Strings v2.4
Copyright (C) 1999-2007 Mark Russinovich
Sysinternals - www.sysinternals.com

4NTOSBOOT
\DEVICE\HARDDISKVOLUME1\$MFT
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\TUNNEL.SYS
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\TUNMP.SYS
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\I8042PRT.SYS
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\KBDCLASS.SYS
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\VMMOUSE.SYS
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\MOUCLASS.SYS
\DEVICE\HARDDISKVOLUME1\WINDOWS\SYSTEM32\DRIVERS\PARPORT.SYS
...


.
, , -
. ,
NTFS
MFT, , , -
, , .
MmPrefetchPages ,
, .
, ,
.

: .

Windows ( Windows Server -
) , Process
379

Monitor, Sysinternals, ,
, , -
. 10 ,
. -
(Notepad)
(Include), , Process Monitor
%SystemRoot%\Prefetch.

1 4 , Notepad -
Notepad . 5 11,
10 , , ,
Svchost
.

,
-
,
, %SystemRoot%\Prefetch\Layout.
ini (.10.49).
, .

, -
, . -
,
,
, ,
. , ,

.
, ,
. (
12.)
380 10.

. 10.49.


,
, . -
,
(placement policy). ,
, Windows - .
-
, ,
, ,
(replacement policy).
LRU (Least Recently Used ) FIFO (First
In, First Out , ). LRU (
UNIX)
.
, ,
. FIFO
,
, .
,
.
,
. , , -
FIFO, ,
381

, .
-
, .


, .
Windows . -
() -
,
, , .


50,
345. ,
Windows- Set-
ProcessWorkingSetSize,
(increase scheduling priority).
,
,
,
( ,
,
). -
SetProcessWorkingSetSizeEx
QUOTA_LIMITS_HARDWS_MIN_ENABLE,
,
.

, -
MiMaximumWorkingSet ,
, .10.21.

10.21.
Windows
x86 2047,9
x86- Windows, 2047,9
increaseuserva ()
IA64 7152
x64 8192

,
. ,

382 10.

( , ,
).
Windows
, .
Windows
, ,
, .
, (working set
manager) ,
(. ), -
.
( Windows- SetProcessWorkingSetSizeEx
, -
.)
,
.
, ,
, . ,
, .
, -
. , ,
, ,
; , ,
, ; ,
, ,
..
, ,
,
.
,
, -
.
,
. -
PTE-, , . -
, (aged),
, ,
.
.
PTE- , -

. ,
, , -
.
,
383


. (
, .)

:
-
, ,
.


Process: Working Set (:
)
Process: Working Set Peak
(:
())
Process: Page Faults/sec (- -
: /)


(, Process Explorer).

, ,
_Total.
,
, , ,
. ,
,
, .
, , -
.

: .

TestLimit ,
-
, Process Explorer
. TestLimit,
, , :

C:\temp>testlimit -d 1 -c 800

Testlimit v5.2 - test Windows limits


Copyright (C) 2012 Mark Russinovich
Sysinternals - wwww.sysinternals.com

Process ID: 700



384 10.

Leaking private bytes 1 MB at a time...


Leaked 800 MB of private memory (800 MB total leaked). Lasterror: 0
The operation completed successfully.

Process Explorer. ViewSelect


Columns ( ), Process Memory ( -
) Private Bytes ( ), Virtual Size (
), Working Set Size ( ), WS Shareable Bytes (
) WS Private Bytes (
). , , TestLimit.

TestLimit ( ) PID- 700.


, -
, , , ,
.

,
, .
(822064)
, (-
WSPrivate).
, .

:
!wsle
.
WinDbg.

lkd> !wsle 7

Working Set @ c0802000


FirstFree 209c FirstDynamic 6
LastEntry 242e NextSlot 6 LastInitialized 24b9
NonDirect 0 HashTable 0 HashTableSize 0

Reading the WSLE data...............................................

Virtual Address Age Locked ReferenceCount


385

c0600203 0 1 1
c0601203 0 1 1
c0602203 0 1 1
c0603203 0 1 1
c0604213 0 1 1
c0802203 0 1 1
2865201 0 0 1
1a6d201 0 0 1
3f4201 0 0 1
707ed101 0 0 1
2d27201 0 0 1
2d28201 0 0 1
772f5101 0 0 1
2d2a201 0 0 1
2d2b201 0 0 1
2d2c201 0 0 1
779c3101 0 0 1
c0002201 0 0 1
7794f101 0 0 1
7ffd1109 0 0 1
7ffd2109 0 0 1
7ffc0009 0 0 1
7ffb0009 0 0 1
77940101 0 0 1
77944101 0 0 1
112109 0 0 1
320109 0 0 1
322109 0 0 1
77949101 0 0 1
110109 0 0 1
77930101 0 0 1
111109 0 0 1

,
(, 0xC0000000),
DLL- (, 0x7nnnnnnn),
Windbg.exe.


-
, (balance set manager).
( KeBalanceSetManager)
. ,
, -
(MmWorkingSetManager).
: -
, ,
,
, , .
,
,
, -
.
386 10.

, ,
, (
).
-
, :
1. DPC-, .
DPC- KiScanReadyQueues, ,
,
. (. , -
(PU starvation) 5 I.)
2. -
-
(KiSwapperThread ),
( KeSwapProcessOrStack).
3.
( ,
).
4.
-
, IRP-
.
-.
5.
. ( ,
,
.)
,
, , .
, 15
( , 12 ).
, (
),
, , , .
, ,
. , , ,
(, Winlogon
), .


, -
,

(system working sets):
387

(MmSystemCacheWs) , -
.
(MmPagedPoolWs) , -
.
PTE- (MmSystemPtesWs)
, ,
.
, ,

(.10.22). ,
, .

10.22. ,

, ,

Memory: Cache Bytes (: MmSystemCacheWs.Work- ,
-), Mem- ingSetSize
ory: System Cache Resident Bytes
(:
)
Memory: Cache Bytes Peak (- MmSystemCacheWs.Peak
: - ())

Memory: System Driver Resident MmSystemDriverPage ,
Bytes (: -
)

Memory: Pool Paged Resident Bytes MmPagedPoolWs.Working- ,
(: - SetSize -
)


Memory: Cache Faults/sec (: -
/), ,
( , ).
MmSystemCacheWs.PageFaultCount.


Windows
, ,
, () . -

. ,
388 10.

. ,
. , -
.

. CreateMemoryResour
ceNotification, , -
.
. ( ), -
, .
, QueryMemoryResourceNotification
.
,
\KernelObjects, , -
,
(.10.23).

10.23.


HighCommitCondition
. -
, , -
,


HighMemoryCondition -

HighNonPagedPoolCondition -

HighPagedPoolCondition
LowCommitCondition -
. , -
,

LowMemoryCondition -

LowNonPagedPoolCondition

LowPagedPoolCondition -

MaximumCommitCondition
. ,
,
,
-

389


MemoryErrors ( ,
)

,
,
.


HKLM\SYSTEM\
CurrentControlSet\Session Manager\Memory Management DWORD- ,
LowMemoryThresholdor HighMemoryThreshold, -
.
,
, . -
DWORD- PageValidationAction.

: .

, ,
Winobj, Sysinternals, KernelObjects.
, ,
.
390 10.

, -
() .

,
, LowMemoryCondition
HighMemoryCondition. , Process Explorer Find
() Handle ().
WinDbg. ( -
3 I.)


()
-
, ,
,
-
. Windows
, -
(superfetch). ,

.
Windows
. -,
, -
. -, ,
, ,
. ,
, , ,
(,
) ( )
.
,
, () ,
, .
- , ,
,
, . -
,
, . Windows
.

,
-
() 391

,
.
(Tracer). (Pf),
-
, .
FileInfo
(%SystemRoot%\System32\Drivers\Fileinfo.sys).
(Trace collector and processor).
,
.
. -
, (.) -
, (, ).
(Agents).
, .
:
;
;
;
;
.
(Scenario manager). ,
, : ,
() . -
, , API-
,
.
(Rebalancer). ,
,
(, , ), -
,
,
PFN- ,
, -
.
,
, ,
,
. ,
, -
FileInfo
.
392 10.

, , -

PFN-, -
, . .10.50
.
- (
- 8),
.

PFN-

.

.
-

.

-
.




PFN- PFN- -

- -
-
PFN-
FileInfo
PFN-

PFN-


- FileInfo

SuperFetch


-
-
-

SuperFetch FileInfo

. 10.50.
() 393


-
, ,
, -
.
- Windows (Event
Tracing for Windows, ETW), ,
,
, ,
. ,
,
,
.
-
,
. ,
(access) . ,
, , ,
.

FileInfo. (
8.)

(
NTFS 12), -
. FileInfo
( , -
FsContext )
, -
,
, .

- .
,
, ,
.
-
, -.
, , -
, ,
, PTE,
, ,
.
, -
( ),
394 10.

( , ),
,
( , -
) .
,
, -
, ,
, ( -
),
,
. , -
, ,
. -
, , -

, . ,
,

.

, -
, (
), , -
,
.
, .
, :
.
, -
.
, ,
.

. -
2 ,
5, -
.

, .


, -
() 395


.
,
API- NtSetSystemInformation NtQuerySystemInformation,
.
SystemSuperfetchInformation, -
, ,
, .
,
, .
, .

, .


,
, ,

. ,
,
()
, -
,
.

, .
-
, , .
, ,
. , , , ,
, ( ),
. ,
1 6 ( 7 , -
).
, -
,
(. 361). 5 , , , -
1 , .
. ,
6 ,
. -
.
,
,
396 10.

.
, ,
.
Microsoft
, . Win-
dows
, ,
, , , -

. (-
Sysmain.dll)
7,
.
7 ,
( -
). , 7
, , -
7,
, .
( ) -
,
, . ,
,
, , ,
, . ,
,
,
. , ,
, (
). , -
, ,
.
, -
, ,

. ,
,
, -
. ,
, -
, , ,
,
, .
, -
(
() 397

), .
-
, -
. ,
,
, ,
, ,
.
, ,
,
.
, ,
, .
(, , )
, , ,
, .
,
.

,
.
,
.
: , , ,
6 ,
. ,
Outlook ( ), Word ( -
), , ,
Outlook, Word
.
,
2 ( -
), , ,
,
,
.
, ,
ReadyBoost ReadyDrive.


, , -
(robust performance), (robustness).
,
, ( Pf-), -
398 10.

-,
-
. , -
, ,
(
). ,
( - -
, ,
5).
-: -
( )
( ).
, ( )
, ,
(
), (
). , ,
, , , 2.
,
, .

. , -
, ,
, ,
, .
.
, -

, . , -
Strings.exe, Sysinternals,
, .
, , , .
Strings.exe
, ,
. ,
, -
. -
, ,
,
.
, , -
,
, -
.

() 399

, -
, -
. -
, , , ,
, .
-
,
, .


-
, ,
, -
,
. -

, , ,
, .

, , ,
.
-
.
.

: ,
. : ,
,
.
.
,
, ,
400 10.

. : -
,
, , (

), .


, .

, . , ,
Microsoft Word, ,
Word (
), ,
. , -
, -
. ,

,
.

ReadyBoost
-
, , ,
. ,
, , ,
, ,
,
-
. ( ,
- .)
, -
USB- (USB Flash Disk, UFD), CompactFlash Secure Digital.
( CompactFlash Secure Digital
USB-, UFD-.)
, , ,
, .
-,
-
,
, 13
3.
- 10 ,
. Windows
ReadyBoost,
- ,
.
() 401

ReadyBoost (%SystemRoot%\System32\
Drivers\Rdyboost.sys), -
(Non-Volatile Random Access Memory,
NVRAM). UFD- , ReadyBoost
, , -
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\
Emdmgmt , .10.51. Emd -
External Memory Device ( )
ReadyBoost.

. 10.51.

256 32,
4 2,5 -
, 512
1,75 , ReadyBoost ,
. ReadyBoost
ReadyBoost.sfcache,
.
ReadyBoost -
(,
C:\) ,
. , , -
, , Volume Snapshot. , -
, 2:1, ,
4 , , 8 .
AES (Advanced Encryption
Standard ),
,
.
402 10.

ReadyBoost ,
, ,
, -,
-
, . ,
-
-, .
- ,
, ,
( ,
).
ReadyDrive, -
.

ReadyDrive
ReadyDrive Windows,
(Hybrid Hard Disk Drives, H-HDD). H-HDD- -
- ( NVRAM).
H-HDD- 50 512 , ,
Windows, 2.
ReadyDrive -
, .
Windows ATA-8, ,
-. , Windows -
,
. ,
,
. - , ,
Windows - ,
,
. ,
.
ReadyDrive -
, , ReadyBoost,
,
-, .
( -
),
,
, .


,
ReadyBoost ReadyDrive, .
() 403

,
, -
.
(store manager), -
.
-
,
. ,
- ( -
), UFD- ( ). -
, ,
, ,
,
. ( ,
NVRAM- , , -
, UFD-. UFD-
, , UFD-
. NVRAM-
, -
.)

.10.52.
(store).
-
( NVRAM-
) .
(store
pages), (pages).
(4 8
Itanium), ( -
), .

, (
). ,

4, .
,
.
,
-
. , NVRAM-,
,
.
.
,
(store manager).
404 10.

Sysmain.dll,
(SmXxx, SmPageRead) Ntoskrnl.exe -
, Storemgr.sys. ,
.
; .

, ,
.
, ,
.


-

(sysmain.dll)

NtosKrnl.exe ( Storemgr.sys (-
) -
) (

-
RAM-
)


NVRAM-
-
c

NVRAM-

-
USB--

. 10.52.

, -
.
, -
,
.
() 405

. -, -
- -
( UFD-, NVRAM-
). -, NVRAM-
,
.
, -
, ,
. -
, .

.
( -
) .
. -
.

,
,
. , -
,
( ) .

. -
,
, , ,
,
.


, ,
- ,
. -

-,
, .
,
,
.
,
-, ,
,
,
.
406 10.


Windows (Windows Diagnostic Infrastructure, WDI), -

. ,
(Memory Leak Diagnoser) Windows
(Resource Exhaustion Detection and Resolu-
tion, RADAR) ,
.
Microsoft (Windows Error Reporting, WER)
. WDI -
,
. ,
,
.
RtlCre-
ateProcessReflection Ntdll.dll. ,
. -
, ,
. -
RtlpCreateUserThreadEx
. RtlpProcessReflectionStartup
Ntdll.dll. Ntdll.
dll ,
, , -
Ntdll.dll. ,
RtlCreateProcessReflection , ,
, RtlCreateProcessReflection , -
, .
, ,
, ,
. RtlCloneUserProcess,
, .
RtlCreateProcessReflection, ,
, ,
(Process Environment Block, PEB)
(fiber-local storage), RtlCreateProcessReflection
. ,
.
RtlCloneUserProcess
RtlpCreateUserProcess,
, , -
. RtlpCreateUserProcess, ,
ZwCreateUserProcess, .
ZwCreateUserProcess
, ,
PspAllocateProcess, -
() 407

, MmInitializeProcessAd-
dressSpace , , (
) ,
.
, API- fork
Unix-. ,
, ,
, , -
.
,
RtlpCreateUserProcess. ,
STATUS_PROCESS_CLONED, -
STATUS_SUCCESS.
, -
RtlCreateProcessReflection,
Ntdll.dll. , RADAR RtlDetectHea-
pLeaks,
, RtlCreateProcessReflection.
,
, RtlCreateProcessReflection.
RADAR WDI ,
RtlCreateProcessReflection -
.
- ,
,
.
.
- , - -
.
Sysinternals Procdump r,
.

: Preflect

Preflect.
Notepad.exe -
, Process Explorer .
Preflect
, .
. Process Explorer Notepad:
, , ,
( ).
408 10.

,
Perfomance () .

, -
,
, -
,
, GDI- USER-. , -
Threads () Process Explorer
, ,
Notepad.exe, ,
RtlpProcessReflectionStartup.
409

,
Windows. ,
,
,
.
,
.
Windows API Windows -
.
,
.
11.

Windows -
,
( ,
). ,
, ,
,
,
.
Windows- CreateFile, .



, .
Windows Driver Kit (WDK).
WDK http://www.microsoft.com/whdc/devtools/wdk/
default.mspx.


:
( , ),

.
,
( -
).
( ),
, -
( ),

. ( ,
-, .)
,
(, ,
..).
411

(, ,
) .
,
, , -
.



,
, -
. , Windows
,
( ,
, -).
, ( -
, ) -
(system metadata) (, ).
, , Windows,
.


,
, ,
. ,

-. , ,
, ,
-
(section
objects); Windows API
(file mapping objects). (
10.)
,
. ,
, ,
.
-

- (I/O request packets, IRP) ,
. -

, -
.
412 11.

,
, . (
-, , -
,
.) , , -
, , , ,
.


-
, , -
. ,
(, , ),
( Windows-
MapViewOfFile). Windows,
, , -
,
. ,
(
),
( )
, .11.1. ( ,
, 10.)
, 1 (1) , -
, 2
, 2 ,
1, , , -
. ,
, , ,
, ( ). -
, Windows, ,
,
-,
Windows- .



,
-,
-, . ,
,
,
,
. ( ,
Windows, -
12.)
413



1
4


2


2
-
c


1



2
4


2



2

-
c

. 11.1.


Windows , -
(virtual block caching), ,
.
256 -
,
. :
.
, ,
.
414 11.

-
, ( -). -
, ,

- .
, -
, .


(stream caching),
. -
. , NTFS,
; -
,
. NTFS ,
(.12) .
, ,
( , , ), -
, ,
.


, , -
.


, NTFS,
.
, -, -
, ,
, .
- -
. ,
,
, (-
). ,
, -
, , .


:
, .
415

, -
, ,
, .
,
, ,
. :
1. ,
.
2.
.
3. ,
.
4. ,
. (,
, .)
, -
(Logical Sequence Number, LSN),
, . -
, LSN- (
),
. , , , -
NTFS ,

. (
, -
,
, , .)
(
) LSN-,
, .
,
, LSN-.
,
, ,
, , .

.


Windows
, (
416 11.

) , -
(Virtual Address Control Blocks, VACB). VACB-
256,
(views). -
, VACB-
. , ,
, VACB-.

.
- ( )
256- 256--
, ,
. , 10,
300000, ,
262144 ( 256-
) 256.
-
,
256- , 256-
.., .11.2. B, -
A, C. , B
. ,
256- B, ,
C, 100 (,
),
256- .


0 (500 )
1 0
2 1
3
4 B (750 )
5 0
6 1
7 2
8
C (100 )
0

. 11.2. ,
417

, ,
( ,
).
.
FILE_FLAG_RANDOM_ACCESS CreateFile,

, , -
. , ,
, (
) ,
,
. , ,
FILE_FLAG_SEQUENTIAL_SCAN, ,
. , -
,
,
. -
: ,
.
, -
, ,
, .
, -,
, .
,
, ,
.


Windows
. ,
,
.


32- Windows
Sys-
temCacheLimit , . ( -

10.) ,
(2), ,
,
418 11.

(PTE-), -
, . 64- Windows
1024 (1).


, Windows -

.
, -
,
, ,

.
,
, , ,
Ntoskrnl- .
10, -
(system cache working set),
. ,
(system
working set). 10, LargeSystemCache
1 -
, , .

:
!filecache
, ,
, , ,
, , . (
,
, .)

lkd> !filecache
***** Dump file cache******
Reading and sorting 999 VACBs ...
ReadVirtual: 85b77038 not properly sign extended
ReadVirtual: 85ba7010 not properly sign extended
Processing 998 active VACBs ...
File Cache Information
Current size 30528 kb
Peak size 65752 kb
461 Control Areas
Skipping view @ 91980000 - no VACB, but PTE is a prototype!
Loading file cache database (100% of 523264 PTEs)
SkippedPageTableReads = 882
File cache has 7668 valid pages
Usage Summary (in Kb):
Control Valid Standby/Dirty Shared Locked FsContext Name
419

85fa5be0 0 4 0 0 add0dbf8 $Directory


85f971b8 0 8 0 0 ad9bc918 $Directory
87c489f0 4 4 0 0 93b390f8 $Directory
87c4a9c0 4 0 0 0 93b38c30 $Directory
87c451a8 0 4 0 0 93b35780 $Directory
86a83710 4512 45432 0 0 86a90168 $Mft
85f96770 0 8 0 0 ad9c00f8 No Name for File
85e90998 0 512 0 0 abb83510 No Name for File
88062008 4 0 0 0 9e6c40f8 $Directory
87c291e8 44 164 0 0 93b400f8 $Directory
87c27e10 0 16 0 0 93b4bd08 $Directory
87b4bc88 236 84 0 0 93b28d08 $Directory
86ce23a8 12 0 0 0 a2051528 $Directory
87c2bb20 4 0 0 0 93b3b850 $Directory
87d51480 0 4 0 0 824f9830 $Directory
87c8c900 0 4 0 0 825b06d0 utmpx
87c2aa30 44 216 0 0 93b3fc70 $Directory
86ecc168 12 4088 0 0 9c3c5c50 Microsoft-Windows-
GroupPolicy%4Operational.evtx


, -
,
, .
,
, -
.
10,

, , , -
,
- .
,

. ,
, , -
.
, ,
, . ,

, .
, , -
,
. ,
. ,
, (%SystemRoot%\System32\
Drivers\Srv2.sys, .12),
420 11.

.
1 ,
, (
VACB-).

. ,
, -
, .
- , -
,
, . ,
.11.3,
.


-
, - ,
-

960 ~ 7

. 11.3. ,


, ,
,
. -
.
( )
, ,
,
.
, -
, Cache (),

. , Process Explorer,
Cache WS ( ),
Standby ( ) Modified ( ).
Process Explorer .11.4
Cache WS ( ) Physical Memory ( -
), Paging Lists ( ), ,
421

. ,
Cache () ,
Process Explorer Paged WS (
), Kernel WS ( ) Driver WS ( ).
, -
. ,
.

. 11.4. System Information Process Explorer

VACB-, 256- .
, -
,
(.).
( )
, , -
.
.
422 11.


, -
,
(Virtual Address Control Block, VACB)
. VACB- 32-
32, VACB- 128, , VACB-
4096 VACB-. 64- VACB- 64,
, VACB- 2048 VACB-.
VACB-
VACB-, CcVacbArrays.
.11.5, VACB- 256-
. VACB- .11.6.
, VACB- VACB- : -
VACB- (low priority mapping VACBs) -
VACB- (high priority mapping VACBs).
VACB- 64 VACB-, -
. VACB- ,
.
-
, -
,
VACB-. VACB- -
, , , -
. VACB- ,
, VACB-, -
.
, (.)
PIN_HIGH_PRIORITY,
VACB-.
.11.6, VACB-
. (
) , , . -
,
( 256- ).
16 , ,
-
,
. VACB- VACB-,
(Least Recently Used, LRU) VACB-
; ,
VACB-. , VACB-
VACB-, .
- VACB-
, , - -
, . ,
423

VACB-
VACB- 0 0
VACB- 1 1
VACB- 2 2
VACB- 3 3
VACB- 4 4
VACB- 5 5
VACB- 6 6
VACB- 7 7


VACB- VACB-
VACB- 0
VACB- 1
VACB-
VACB- 0 0
VACB- 1 1
VACB- 2 2
VACB- 3 3
VACB- 4 4
VACB- 5 5
VACB- 6 6
VACB- 7 7

VACB-

. 11.5. VACB-







LRU-
VACB-,

. 11.6. VACB-
424 11.

VACB- .
,
, .

: VACB-
,
-
.
CcDbg, x:

lkd> x nt!*ccdbg*
8194ba84 nt!CcDbgNumberOfCcUnmapInactiveViews = <no type information>
8197c740 nt!CcDbgNumberOfFailedMappingsDueToVacbSpace =
<no type information>
8197c730 nt!CcDbgNumberOfFailedBitmapAllocations =
<no type information>
8197c73c nt!CcDbgNumberOfFailedHighPriorityMappingsDueToMmResources =
<no type information>
...

- 32- 64-
.
, .
VACB-,
VACB-.
CcVacbArrays VACB-
, ,
_VACB_ARRAY_HEADER.
:

lkd> dd nt!CcVacbArraysHighestUsedIndex l 1
8194ba7c 00000000

, -
. ( ) 0,
, :

lkd> ?? (*((nt!_VACB_ARRAY_HEADER***)@@(nt!CcVacbArrays)))[0]
struct _VACB_ARRAY_HEADER * 0x8315b000
+0x000 VacbArrayIndex : 0
+0x004 MappingCount : 0x5ab
+0x008 HighestMappedIndex : 0x9a9
+0x00c Reserved : 0

,
.
, VACB- VACB-
1451 (0x5ab).

, CcNumberOfFreeVacbs VACB-
VACB-. , -
, 2645 (0xa55):
425

lkd> dd nt!CcNumberOfFreeVacbs l 1
8197c768 00000a55

, (0x5ab, 1451 ) -
(0xa55, 2645 ) VACB- 32-
VACB- 4096, VACB-
VACB-. VACB-, -
VACB-.
,
() VACB- (
, VACB-). ,
VACB- 4096.
, -
,
.

,
.
( 8.) ,
(private cache map),
, -
(.
). ,
.
( )
(shared cache map),
, . (

.) (-

), , , VACB-
,
. ( 10.)
, , -
.11.7.

:
1. ?
2. , VACB-, , -
?
, , -
. VACB-,
, , ,
.
426 11.











-

0
1
2
3 VACB
-
- VACB

VACB-

. 11.7. ,

, -
, VACB-,
VACB- (VACB index array).
VACB- 256 ,
256 .. .11.8 ,
.

VACB- ,
, .
( , VACB-), ,
, , . , VACB-
, .
,
( , VACB-) -
.

VACB- . VACB- -
256,
VACB-,
427

1. 1,
VACB- ,
256 .
.


VACB

0
VACB 0
1
1
(500 ) 2
2
3
0 3
1 4
VACB B 5
B 0 6
(750 ) 1 7
0 2 8
1 3
2

VACB C
C
(100 ) 0
1
0
2
3

. 11.8. VACB-

32,
VACB-, ,
,
128. , , -
:

( , 18) / 7

. 18
, VACB-
256, 256 218. 7 ,
128, 27 128. ,
, ,
63 ( , ),
. , -
,
, .
VACB- ,
, , .11.9.
428 11.





VACB-

. 11.9. VACB-

,
,

. , 32,
256,
VACB- ,
, a 32 (235)
.
VACB-,
VACB- 128000 , 1000-
VACB-.
429

:
,
dt
. !filecache VACB-
.
:

8742a008 120 160 0 0 System.evtx

,
. ( . 10.) -
, -
. .
, ,
:

lkd> !ca 8742a008


ControlArea @ 87cd7248
Segment 824157e0 Flink 00000000 Blink 00000000
Section Ref 1 Pfn Ref 1117 Mapped Views 3
User Ref 0 WaitForDel 0 Flush Count 0
File Object 87bcab60 ModWriteCount 0 System Views 3
WritableRefs 0
Flags (c080) File WasPurged Accessed

\Windows\System32\winevt\Logs\System.evtx

...

,
:

lkd> dt nt!_FILE_OBJECT 87bcab60


+0x000 Type : 0n5
+0x002 Size : 0n128
+0x004 DeviceObject : 0x86a4c4d0 _DEVICE_OBJECT
+0x008 Vpb : 0x86a0c270 _VPB
+0x00c FsContext : 0x93b2a8e0 Void
+0x010 FsContext2 : 0x93b2aa38 Void
+0x014 SectionObjectPointer : 0x87c1b6f0 _SECTION_OBJECT_POINTERS
+0x018 PrivateCacheMap : 0x87cd59e8 Void
+0x01c FinalStatus : 0n0
+0x020 RelatedFileObject : (null)
+0x024 LockOperation : 0 ''
...

0x18:

lkd> dt nt!_PRIVATE_CACHE_MAP 0x87cd59e8


+0x000 NodeTypeCode : 0n766
+0x000 Flags : _PRIVATE_CACHE_MAP_FLAGS
+0x000 UlongFlags : 0x1402fe
+0x004 ReadAheadMask : 0xffff
+0x008 FileObject : 0x87bcab60 _FILE_OBJECT
+0x010 FileOffset1 : _LARGE_INTEGER 0x1000

430 11.

+0x018 BeyondLastByte1 : _LARGE_INTEGER 0x1080


+0x020 FileOffset2 : _LARGE_INTEGER 0x1000
+0x028 BeyondLastByte2 : _LARGE_INTEGER 0x1080
...

, SectionObjectPointer
, :

lkd> dt nt!_SECTION_OBJECT_POINTERS 0x87c1b6f0


+0x000 DataSectionObject : 0x87cd7248
+0x004 SharedCacheMap : 0x87cd58f8
+0x008 ImageSectionObject : (null)

lkd> dt nt!_SHARED_CACHE_MAP 0x87cd58f8


+0x000 NodeTypeCode : 767
+0x002 NodeByteSize : 0n352
+0x004 OpenCount : 1
+0x008 FileSize : _LARGE_INTEGER 0x1211000
+0x010 BcbList : _LIST_ENTRY [ 0x87cd5908 - 0x87cd5908 ]
+0x018 SectionSize : _LARGE_INTEGER 0x1300000
+0x020 ValidDataLength : _LARGE_INTEGER 0x1116200
+0x028 ValidDataGoal : _LARGE_INTEGER 0x1116200
+0x030 InitialVacbs : [4] (null)
+0x040 Vacbs : 0x87dc3a20 -> 0x85ba9df0 _VACB
+0x044 FileObjectFastRef : _EX_FAST_REF
+0x048 VacbLock : _EX_PUSH_LOCK
...


!fileobj. , -
, :

lkd> !fileobj 87bcab60

\Windows\System32\winevt\Logs\System.evtx

Device Object: 0x86a4c4d0 \Driver\volmgr


Vpb: 0x86a0c270
Event signalled
Access: Read Write SharedRead
Flags: 0xc3042
Synchronous IO
Cache Supported
Modified
Size Changed
Handle Created
Fast IO Read

FsContext: 0x93b2a8e0 FsContext2: 0x93b2aa38


Private Cache Map: 0x87cd59e8
CurrentByteOffset: 1116180
Cache Data:
Section Object Pointers: 87c1b6f0
Shared Cache Map: 87cd58f8 File Offset: 1116180 in VACB number 44
Vacb: 85ba9d90
Your data is at: 82756180
431



,
. ,
CcInitializeCacheMap
, .
, -
. -
,
:

.

.

.

,
: .
,
(, ),
, , IRP-
.



-
-


- -


-,

. 11.10.
432 11.

.11.10 , -

, -. -
( CcCopyRead
CcCopyWrite). , ,
CcFastCopyRead CcCopyRead, -

, .

, -
, -
, ,
.
,
.


,
.
, ,
. (,
,
.) ,
-
,
,
.


,
,
, (,
).
,
. ,
,

, , -
.

, -
. ,
, -
. .
- 433

,
, -
, . ,
(
).
, -
(.10)
, .
( ), -
,
, .
, -
: .
-
,
.
, ,
,
. , ,
.


, -
,
(Direct
Memory Access, DMA). DMA-
, , , -
.
DMA-
( ,
), -
.
( 1 2) ,
, DMA-

, .
(Memory
Descriptor List, MDL), 10.

-

- (fast I/O). -
434 11.

8, -
IRP-. -
-, , ,
- , IRP-.
-
,
, ,
, , -
IRP-.
- . ,
(
,
). ,
, - ,
-
-,
,
-. -
- ,
- -
, ,
( LockFile UnlockFile).
, ,
, -
IRP-. - .11.11.
-
:
1. .
2. , - , -
-
. ,
,
-.
3. -, -
, , - ,

. ( - ,
-,
IRP- - -
.)
4.
.
5. ,
, .
435



?
?



-
? ?
( )


IPR
?

. 11.11. -

6. :
, FILE_FLAG_RANDOM_
ACCESS,
, . ,
FO_RANDOM_ACCESS,
.

, ,
.
, , -
.


,
. ,
436 11.

- , FILE_FLAG_
NO_BUFFERING Windows-
- (, ReadFile WriteFile). ,
FILE_FLAG_NO_BUFFERING
.


FILE_FLAG_NO_BUFFERING,
-
, ; -

.
( , 512 NTFS 2048 CDFS). -
, ,
, ,
-.


(intelligent read-ahead) -
, ,
, , , ,
, . -
, , -

.
,
,
, , ,
. -
Cache: Read
Aheads/sec (: /) CcReadAheadIossystem.
, ,
, -
,
.
( , ),

, , -
(asynchronous read-ahead with history).

- , . , -
4000, 3000,
,
2000, .
437



, -
.

, Win32- CreateFile
FILE_FLAG_SEQUENTIAL_SCAN,
. ,
,
. -
,
, ,
, ,
, .
(, 1,
2). ,
,
( ).
,
, -
, .

,
- ,
. -
, ,
. -
, ,
.
, ,
CreateFile FILE_FLAG_RANDOM_ACCESS. -

, , .

,

.


,
. , , , -
, . ,
, ,
-.
438 11.


, -
,
( ). -
.
,
.
, -
.
(.10)
(Logical Block Address, LBA),
-

. -

,
(Virtual Byte Offset, VBO),
.
,
, -
.
.
, -
-. ,
(
, )
(-
).

(lazy
writer),
( ) . -
, -
,
,
. -

. ,
-
.
, ,
.
439

, -
, .
,
,
. (
-
.)

:
, -

Windows Explorer ( -
-) ,
Process Monitor.

Process Monitor
, Explorer.exe System, ReadFile WriteFile.
C:\Users\Administrator\Downloads\dump.dmp
C:\dump.dmp, .

, Process Monitor , -
.
440 11.

-, -
, .
:

1- Explorer .

128 1.
, 1.
1- 1-
. ,
. -
, ,
Stack (), -
, , , CcCopyRead , -
NTFS-,
.
441

1- -,
,
, System 1--
1- .
- Explorer,
1.
,
.
442 11.

1- , Explorer,
,
Explorer, 1-
.
,
, Synchronous Paging I/O
( -).

, ,
MmPrefetchForCacheManager MmAccessFault/MiIssueHardFault.
443

, Explorer .
64- . -
132 System WriteFile,
.


,
.

- ,
,
.
( 10.)

, -
Explorer Process Monitor, ,
, System.
444 11.

1-
, ( Windows
1, 32;
).
,
.

,
( Windows ), -
.
, ,
.
445


FILE_ATTRIBUTE_TEMPORARY
Windows- CreateFile -
, -
.
,
,
.
.



,
,
.
CreateFile FILE_FLAG_
WRITE_THROUGH. ,
, ,
Windows- FlushFileBuffers.


-
, , -
, ,
. (, ,
, , -
, .)
,
- .
(, Windows- FlushFileBuffers),
, ,
. ,
,
, . -
, ,
, , -
,
.
:
1. .
2. .
, ,
, .
446 11.

:
,
, ,
Data Maps/sec (: /) Lazy Write Flushes/sec ( -
/c).
.
Data Maps/sec (: /), Lazy
Write Flushes/sec ( /c). , -
Lazy Write Flushes/sec ( /c),
.


, -
,
. CcCanIWrite
, -
, .
-,
, -
CcDeferWrite.
CcCanIWrite .
,
447

, ,
.
, ,
.
, -
. (write
throttling) - ,
.


,
, , RAID-0 SSD,
- USB-, -
SSD-.

(dirty page threshold)



.
( ). : (top)
(bottom) .

CcAdjustThrottle,
-
.
- , ,
. .11.1 ,
.

11.1. ,




/ 8 / 8 / 8

/ 2 / 2 / 8


. , , -

9600.
,
. ,
,
. CcSetDirtyPageThreshold
448 11.


, (
), .
, ,
.

:
!defwrites , -
, (CcTotalDirtyPages).
:

lkd>
!defwrites
*** Cache Write Throttle Analysis ***

CcTotalDirtyPages: 39 ( 156 Kb)


CcDirtyPageThreshold: 32753 ( 131012 Kb)
MmAvailablePages: 81569 ( 326276 Kb)
MmThrottleTop: 450 ( 1800 Kb)
MmThrottleBottom: 80 ( 320 Kb)
MmModifiedPageListHead.Total: 4337 ( 17348 Kb)
Write throttles not engaged

, ,
(CcDirtyPageThreshold),
.


, -,
,
.
,
-
(
).

(
):
- (express queue) .
(regular queue) , -
( ,
), .
(fast teardown queue) ,
, ,
449

( ), -
CcWriteBehind .
(post tick queue) -
-
, , .
, -
,
,
. (
10.)
: 32 , 64
, 128 256
. -

(global look-aside list), .


- -
.
.
,
-,
-
. , ,
, Windows,
.
12.

Windows
. ,
,
, . -
Process Monitor, Windows Sysinternals (
http://technet.microsoft.com/ru-ru/
sysinternals/default.aspx) ,
.

(Common Log File System, CLFS)
,
Windows NTFS. NTFS
, ,
, , ,
( , CLFS) .
,
9. , .
:

(sectors) .
512, -
4096- (.9). , -
512 632- ,
512- .
(file system formats)
. ,
,
, .
-
. ,
, .
,
, NTFS exFAT.
(clusters) ,
. , -
.12.1.
: , -
, ,
Windows 451

, .

, - ,
.

(8 )

. 12.1.

(metadata) , -
. , , .
, , ,
.

Windows
Windows :

CDFS;
UDF;
FAT12, FAT16 FAT32;
exFAT;
NTFS.
, .

CDFS
CDFS (CD-ROM File System CD-ROM)
( %SystemRoot%\
System32\Drivers\Cdfs.sys), -
ISO-9660 Joliet. ISO-9660
32,
ASCII, Joliet
Unicode .
452 12.

( ), CDFS Joliet.
CDFS :
4;
65535.
CDFS ,
UDF (Universal Disk Format).

UDF
UDF Windows UDF- OSTA
(Optical Storage Technology Association -
). UDF ISO-13346
, CD-R DVD-R/RW. 1995
OSTA UDF ,
DVD-ROM, ISO-9660.
UDF DVD CDFS.
:
ASCII 254,
Unicode 127;
( , , );
64- ;
(Access Control Lists, ACL);
.
UDF- UDF 2.60. UDF -
. UDF- Windows
(%SystemRoot%\System32\Drivers\Udfs.sys)
Blu-ray, DVD-RAM, CD-R/RW DVD+-R/RW UDF2.50,
UDF2.60 . , Win-
dows UDF,
.

FAT12, FAT16 FAT32


Windows FAT

- .
%SystemRoot%\System32\Drivers\Fastfat.sys.
FAT ,
. 12- FAT12
212 (4096) . Win-
dows 512 8,
FAT12 32.
Windows 453


FAT -
, , , FAT12
, 4096.

FAT16, 16- ,
216 (65536). Windows FAT16
512 ( ) 64 ( 512),
FAT16 4.
4096 256. Windows
. .12.1.
format Disk Management FAT
16, Windows FAT12 FAT16.

12.1. FAT16 Windows



<8
832 512
3264 1
64128 2
128256 4
256512 8
5121024 16
12 32
24 64
>16

FAT , .12.2. -
(File Allocation Table, FAT),
, .

, FAT . ,
(, Chkdsk)
FAT (, - ),
.

- -
-
1 2 ()

. 12.2. FAT
454 12.

(
.12.3),
. , , ,
. -
0xFFFF FAT16 0xFFF FAT12. FAT,
, . .12.3 , FILE1
2, 3 4; FILE2 5,
6 8; FILE3 7. FAT- -

.

. 12.3. FAT

FAT12 FAT16 -
, 256,
. ( FAT32 .)
32. , ,
( ,
..). Unicode-
MS-DOS 8.3, -
,
. .12.4 The quick
brown fox. 8.3 THEQUI~1.
FOX ( , ,
)
Unicode.
16.
FAT32 32- ,
4 , 28.
FAT32 64,
16- . Windows -
FAT32 (
), FAT32
Windows 455

32. , FAT32, -
, FAT16;
128 512- -
. .12.2 ,
FAT32.

( )

. 12.4. FAT

12.2. FAT32

<32
3264 512
64128 1
128256 2
256 8 4
816 8
1632 16
>32

, FAT32 FAT12
FAT16 ,
. ,
. , FAT32
. FAT32 FAT16
. 4,
32- .
456 12.

exFAT
Microsoft (Extended File
Allocation Table, exFAT), FAT64, -
FAT
-. -
, NTFS,
,
-. ( -
9.) .12.3 exFAT,
.

12.3. exFAT

<7
7256 4
256 32 32
32 256 128
>256

FAT64,
264, 16. -
,
32- 2255. exFAT
-, ,
. , exFAT
1000.
.
, exFAT , NTFS,
(ACL)
exFAT FAT (Transaction-SafeFAT,
TFAT). exFAT
Windows EmbeddedCE, exFAT Windows.


ReadyBoost, 10, -, -
exFAT, ,
4.

NTFS
, NTFS -
Windows . 64- ,
16. Windows
457

NTFS- , 32-
, , 256 ( 64).
.12.4 NTFS, -
. ( NTFS-.)
NTFS 2321. NTFS
16,
16.

12.4. NTFS

<7
7 16 4
1632 8
3264 16
64128 32
128256 64

NTFS , -
, , , -
, , () ,
, .
(recoverability).
FAT- ,
.
, NTFS, , -
-
. (, TxF,
, .) ,
NTFS- Windows (self-healing),

Windows.
NTFS -
.


(File System Drivers, FSD) -
. ,
.
-
- . -

.
458 12.

Ntoskrnl.exe, .
,
Windows Driver Kit (WDK). ( WDK -
1 I, , http://www.microsoft.com/
whdc/devtools/wdk.)
Windows :
FSD- ,
;
FSD- ,
.

FSD-
FSD- Ntfs.sys, Fastfat.sys, Exfat.sys, Udfs.sys Cdfs.
sys, Raw ( Ntoskrnl.exe). -
FSD- -
.12.5.
9, FSD- -
-.
.

.
, FSD-Raw,
, ,
.
Raw, ,
.


()

. 12.5.
459


Raw, , -
. -
(FILE_SYSTEM_RECOGNITION_STRUCTURE).
,
, .
Raw, -
.
FILE_SYSTEM_RECOGNITION_STRUCTURE,
-
FSCTL_QUERY_FILE_SYSTEM_RECOGNITION.
Windows -
. -
, FSD- ,
,
, .
FSD- ,
. -
,
, , FSD-
(VPB). , -
, , FSD-. ( VPB
9.)
FSD-
, -
. ( 11.)
, .
, , FSD-
, ,
. (
10.) Windows
, .
FSD- -
, FSD-
.
.

- .

FSD-
FSD- : .
FSD-
. FSD-

460 12.

(, SMB), ,
FSD-. FSD-
.
FSD-, ,
.
Windows FSD-,
LANMan Redirector ( ),
FSD- LANMan Server (%SystemRoot%\System32\
Drivers\Srv2.sys).
FSD- .12.6.
RDBSS 7 I.

- -


FSD FSD

- - FSD
( TDI) ( TDI) (NTFS, FAT)

. 12.6. CIFS

, ,
Windows Common Internet File System (CIFS). -
Server Message Block (SMB) Microsoft. ( SMB
http://msdn.microsoft.com/en-us/library/windows/desktop/aa365233(v=vs.85).aspx.)
FSD-, FSD-
-
,
, .
SMB FSD-
,
461

(opportunistic locking, oplock). ,


, -
.

. FSD- -
, FSD-,
.

,
, , , ,
-
. .
, SMB, , -
.
, .
. (oplock) -
( FsRtlXxx)
.
,
.

,
.
. -
, ,

.
, .
-
. -
. ,
. , ,
.
-
. SMB2.1 :
1, .
-
, .
2, .
, .
.
.
, .
, (.bat),
462 12.

.
, (, -
). , .
, . -
,
.
2, , -
,
. .
, ,
, ,
( )
, .
,
. ,
, .
(
),
,
, . (
, -.)
.12.7. , -
, 1.

. , ,
1.
, . -
, ,
.
.
,
2, , -
. -
, ,
.
.
, ,
. ,
.
. SMB 2.1 SMB -
-
, ,
.
, -
. ,
463

. -
.

1 2


1 1 -
1

-
-


-
- 1


Oplock
-
- -
/
- 2

/

. 12.7.

SMB 2.1
, (lease) .
,
.
(R), . ,
. -
.
- (RH), . 2,

, .
( -
.)
2, -
. (
, .)

,
, -
, - .
- (RW), . -
.
.
-- (RWH), . -
.
, .
464 12.



. ( -
.) (
GUID),
(File Control Block, FCB) .


CreateFile (
FILE_GENERIC_READ
FILE_GENERIC_WRITE)
-






-


-
,
- .




-

-

- .






-
-


CreateFile (

FILE_GENERIC_READ)
- -
,



-





- .



-



-

. 12.8.
465


CreateFile (
FILE_GENERIC_READ
FILE_GENERIC_WRITE)
-


RH





-




-
,
- .




-

-
- .





-
-


CreateFile (

FILE_GENERIC_READ)
;
-
,






-


- .



-

-
-

. 12.9.


, , .

, .
.12.8, .12.9
.
SMB 2.1
, .
466 12.

, R RW,
, -
,
(2),
1.

: .

, -
, . -
\Driver .
, -,
SERVICE_FILE_SYSTEM_DRIVER (2), \FileSystem. -
, , WinObj ( Sysinternals),
,
( ,
\FileSystem ).

-
System Information ( ). Run
() Start () Msinfo32 System Drivers (-
) Software Environment ( ).
Type (),
SERVICE_FILE_SYSTEM_DRIVER .
467

,
, FSD-. ,
Npfs (Named Pipe File System)
, , -
,
. , Npfs,
7 I.


: ,
- (, ReadFile WriteFile), ,
, -
. ( 10.)
.12.10 , -
, . ,
FSD-:
468 12.

,
;
,
;
, ;
, ;
, .


NTFS


NTFS ( )

. 12.10. , -

,
FSD . ,
FSD- .

-

Windows- -, CreateFile, ReadFile WriteFile.
469

CreateFile, -
, , CreateFile
Windows-. -
Kernel32.dll CreateFile NtCreate-
File, , ,
( . ..)
\?? (, \??\C:\Daryl\Todo.txt).
NtCreateFile
ObOpenObjectByName,
(??).
3 I, ,
.
\??
. DosDevicesDirectory, -
(

). -
, Subst.exe, ,
( C) , ,
GlobalDosDevicesDirectory
. GlobalDosDevicesDirectory
\Global??, Windows . (
3 I.)

\Device, , -
, IopParseDevice,
- . (
, ,
, .) 12.11
.
\GLOBAL??\C:
\Device\HarddiskVolume1.

IopParseDevice -
- (IRP) IRP_MJ_CREATE, ,
, VPB ,
. -
IoCallDriver IRP ,
.
FSD- IRP- IRP_MJ_CREATE,
, , ,
, .
-
, ,
, CreateFile.
470 12.

, -
.

. 12.11.

, FSD- -
, , ReadFile
FSD -
. , ReadFile CreateFile, ,
-,
NtReadFile
ReadFile -
.
, NtReadFile
IRP- IRP_MJ_READ ,
. FSD-,
, IoCallDriver,
- FSD- IRP-.
(
CreateFile FILE_FLAG_NO_BUFFERING), FSD-
471

, .
PrivateCacheMap
( 11), , .
, PrivateCacheMap null.
FSD
. FSD CcInitializeCacheMap ,
,
,
, .
, , FSD -
,
ReadFile.
try/except, ,
, .
CcCopyRead ,
, .
CcCopyRead
, . 11 ,
(Vir-
tual Address Control Block, VACB), VACB-
256. VACB- -
null, CcCopyRead VACB,
256, -
( MmMapViewInSystemCache).
CcCopyRead
( , -
ReadFile). ,
, MmAccessFault.
MmAccessFault

(Virtual Address Descriptor, VAD) VAD- . (-
VAD- 10.) VAD
, ,

MmAccessFault MiDispatchFault,
( VAD)
, . ( ,
,
.)
, MiDispatchFault
IoPageRead -, IRP- ( IRP_MJ_READ)
FSD-, , -
. ,
CcCopyRead ,
IRP- , -,
472 12.

. FSD-, -
. , ,
(
, ), IRP-
, , .
(VPB) FSD
.
, FSD IRP-
, -
. CcCopyRead FSD
NtReadFile .
-
.
WriteFile , ,
NtWriteFile IRP- IRP_MJ_WRITE, FSD -
CcCopyWrite, CcCopyRead. , CcCopyRead, -
, ,
WriteFile .
, ( ), -
.
, CcCopyRead . ,
NtReadFile NtWriteFile, -
IRP- FSD-, FSD
-. , , 4 ,
,
.
FSD- - -
CcFastCopyRead CcFastCopyWrite .
,
. ,
CcFastCopyRead CcFastCopyWrite --
. NtReadFile NtWriteFile IRP.
( - 11.)


(
)
. -
IoAsynchronousPageWrite IRP- IRP_MJ_WRITE
, .
IRP-, MiDispatchFault, IRP-
,
-. , FSD-
IRP-
.
473



, -
, . -
, , MmFlushSection,

.
, MmFlushSection FSD-
IoSynchronousPageWrite.


:
. ,
,
.
, ,
.
, -
, ,
( ). ,
, , ,
.
,
, ,
. , -
,
.
, ,
( VACB-), -
. ,
,
.
, .
Windows (superfetch),
. ,
(%SystemRoot%\System32\Sysmain.dll)
, -
. -
, -
12:00, Outlook 8:00.
, ,
. -
,
, (
-).
474 12.

, , .
, .



- .
, ,
, ,
. MmAccessFault
, , -
CcCopyRead
CcCopyWrite, IoPageRead IRP- ,
.


, ,
, (file system
filter driver). ( 8.) -

, , -
, ,
. ,
, , IRP-
, IRP_MJ_CREATE,
. ,
, . -
, ,
.
, IRP- (
), .

Process Monitor
Process Moni-
tor (Procmon) Sysinternals, ,
, IRP-,
. Windows
(%SystemRoot%\System32\Drivers\Fltmgr.sys)
/- . -
,
Windows - - -
,
.
Process Monitor -.
Process Monitor
( Procmon.exe)
475

, ,
.
,
, ,
. ,
,
. -
IRP- ,
. , -
-,
Process Monitor.
IRP-, Process Monitor ,
(,
, ) .
500 GUI Process Monitor
,
. Process
Monitor .

: .
Process Monitor
, , -

(%SystemRoot%\System32\Fltmc.exe). Process Monitor
(ProcMon.exe) Fltmc. ,
Process Monitor (PROCMON20) Instances -
. Process Monitor Fltmc.
, Process Monitor ,
.
476 12.


4 I , .
, ,
,
. ,
DLL.

NTFS -
.

.
Process Monitor -
, -
- .

. , -
Process Monitor .


ProcessMonitor
Process Monitor , -

. -
, :
NTFS- ;
- ;
-, System;
-, Process Monitor.
Process Monitor -
-, IRP-,
. , IRP_MJ_WRITE FASTIO_WRITE -
WriteFile, IRP_MJ_CREATE Open
Create .

: .

Windows
(file change notification),
.
ReadDirectoryChangesW, FindFirstChangeNotification FindNextChangeNotification. -
Process Monitor
,
.
477

Process Monitor
, . ,
Properties
(). , ,
Process () .

Process Monitor
Process Monitor ,
. -
Process Monitor , -
, ,
. I
(. Process
Monitor 4).
Result NAME NOT FOUND,
NO SUCH FILE, PATH NOT FOUND, SHARING VIOLATION ACCESS DENIED.
. -
. ,
- Run ()
,
PATH,
. , ,
Process Monitor
:
25314 7:44:27.4180943 PM Explorer.EXE 1640 CreateFile
C:\Program Files\Microsoft Windows Performance Toolkit\test.exe NAME NOT FOUND Desired
Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes:
n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a

, ,

. -
,
. -
, ,
.
, ,
, BUFFER OVERFLOW -

. ,
, -
, .
BUFFER OVERFLOW .
Process Monitor Microsoft -
,
.
478 12.


.
, ,
(log records), , (logging).
,
.
Windows -
(CLFS). Windows -
, NTFS(TxF)
(TxR),
. CLFS -
,
, CLFS- . -
,
.
CLFS , ;
;
, , -
.
CLFS

, .
CLFS ,
(streams) (containers), , -
, NTFS. , CLFS
,
, ,
, ,
. , NTFS
CLFS .

CLFS -
(Algorithm for Recovery and Isolation Exploiting Semantics, ARIES),

. CLFS -
ARIES; .
ARIES www.sai.msu.su/~megera/postgres/
gist/papers/concurrency/p94-mohan.pdf.

.
479

CLFS
, ( -
) . CLFS
.
, -
, (marshalling
area), .
- ,
.
- , -
. -
,
API-.
CLFS , ,
, , ,
, .
CLFS- ( -
) -

, . ,
,
, . -
, , ,

.


CLFS : (dedicated logs) -
(multiplexed logs), (common logs).
,
. , -

.
.
- .
CLFS .
,
(physical client), CLFS
(FCB) .
,
(virtual client), CLFS
(FCB)
(Context Control Block, CCB)
FCB-. CLFS -
, .
480 12.

, , CLFS
. (
11.)
,
, -
CLFS, .
CLFS - -
IRP- NTFS.
.12.12 , CLFS
.

API CLFS


API CLFS -

CLFS-

FCB-
CLFS -


-
FCB- CLFS
/-

BLF- CLFS

CLFS-

. 12.12. CLFS


, CLFS
, , .
(owner page) -
4.
512 .
,
. .12.13
481


,
-.


t1, t3 t4 t2 t5


(
)

. 12.13. CLFS

:
(
40000);
CLFS API ;
, -
(
).
CLFS , -
. NTFS
IRP-, CLFS , .
( ,
..).


(Base Log File, BLF),
, ,
1023.
482 12.

64 .
, , , , ,
, ,
. -

. BLF (dump count),
.

. ,
512. 4. CLFS-
,
. CLFS
, BLF.
.12.14.

(1- )

LSN

(2- )

. 12.14. CLFS

CLFS- ,
.
(physical container identifier)
(logical container identifier).
,
.
, .


, CLFS
(Log Sequence Number, LSN),
483

. , ,
. LSN ,
LSN . -
LSN- LSN LSN .
, BLF-.
LSN 64 , .12.15:
32- ,
;
23- ;
9- .

32 23 9

. 12.15. LSN- CLFS


,
(torn write), CLFS (log blocks) ,
. , -
512, CLFS
.
2,
. ,
, .12.16.

. , , -
, , , CLFS
.

1 2 3
-
(0 )

, -
.

. 12.16. CLFS
484 12.


, 512, -
(region),
. (pages) 4,
, -
. . 12.17,
. , CLFS
, .

512 512



4 4

. 12.17. CLFS

:
,
, ( 0).
1024.
LSN-
. -
LSN- .
LSN , CLFS -
, LSN- .
, CLFS LSN
,
.
FCB- -
,
. CLFS
( .12.17). ,

. CLFS
, -
, .
, CLFS
, LSN- , , -
.
CLFS ,
. CLFS .
CLFS ( -
485

LSN
) . CLFS
, .
CLFS , -
. CLFS,
. ,
. .

LSN-
CLFS -
LSN-. CLFS -
,
LSN-. ,
, -
LSN-.

: LSN-
0: 1 1- 0.1000.0 1:
1: 1 2- 1. . -
2: 2 1- LSN- , -
1, 0.0.0.
3: 2 2-
2 . -
4: 2 3- LSN-
5: 2 4- 0.400.0.
6: 1 1- 2. .
7: 1 2- LSN- ,
8: 1 1- 1, 0.C00.0.
9: 1 2- 2 . -
10: 2 1- LSN- -
0.1000.0. .
LSN-
3. .
1 (0.0.0 ~ 0.1400.0)
LSN- ,
LSN-
1, 0.1000.0.
2 (0.0.0 ~ 0.1600.0)
. 0.1000.0.

1 2 1 1 2

LSN-


LSN-

. 12.18. LSN- CLFS

LSN-
:
1. , LSN-
.
486 12.

2. LSN- , -
, LSN .
.
3. LSN- ,
LSN- CLFS -
. LSN- ,
CLFS LSN- .
CLFS LSN- -
, .12.18.
4. LSN- , CLFS
,
, LSN- LSN-
.


CLFS ,
. .12.5.

12.5. CLFS

ClfsMgmtPolicyMaximumSize
ClfsMgmtPolicyMinimumSize
ClfsMgmtPolicyNewContainerSize
ClfsMgmtPolicyGrowthRate , -
.
,

ClfsMgmtPolicyLogTail ,
-

.


ClfsMgmtPolicyAutoShrink -

ClfsMgmtPolicyAutoGrow , -

ClfsMgmtPolicyNewContainerPrefix -

NTFS 487

NTFS
, NTFS,

.


NTFS , -
.
,
.
.
, -
,
. , NTFS.

NTFS
, -
(atomic transaction).
,
. , , ,
. ( -
-,
.) , , -
, .
,
, (roll back).
.
NTFS . -
-, NTFS-,
, ,
..,
. , ,
- .
, , NTFS.
, NTFS -
, ,
.

NTFS Windows-.
. (
6 I.)
488 12.

, $Secure,
, $SDS (Security Descriptor Stream -
). ,
, Windows
.
,

. ( 6
I, 8.)



, -
. NTFS
, ,
. ,
, .
Windows
(.8),
. , NTFS ,
, , .
(mirror), , ,
.
RAID 1.
(stripes) -
, .
,
XOR. RAID 5.
( , RAID-5 9.)

NTFS
NTFS , ,
, ,
. -
API, :
;
Unicode;
;
;
;
() ;
;
NTFS 489

;
, ;
;
;
POSIX;
;
.
.


NTFS , ,
, , ,
( NTFS-).
(stream), .
(, ,
). , -
, NTFS ( ,
) .
NTFS . -

. API- -,
,
(:) . -

, :
myfile.dat:stream2

( -
),
( , )
(, ). ,
,
.
Windows , , Attach-
ment Execution Service, , ,
Internet Explorer Outlook, Windows API-
-. , (-
, My Computer, Intranet Untrusted),
, , ,
. , .12.19
, Process Explorer
Sysinternals.
490 12.

. 12.19.


Always ask before opening this file (
) .

.
,
, . -
, ,
,
.
,
.

:
Windows- -
, echo more -
. ,
. echo,
more. test -
stream:

C:\>echo hello > test:stream


C:\>more < test:stream
hello
C:\>

test -
, NTFS
.
NTFS 491

C:\>dir test
Volume in drive C is WINDOWS
Volume Serial Number is 3991-3040

Directory of C:\

08/01/00 02:37p 0 test


1 File(s) 0 bytes
112,558,080 bytes free

Streams Sysinternals ,
.
/r dir.

C:\>streams test

Streams v1.56 - Enumerate alternate NTFS data streams


Copyright (C) 1999-2007 Mark Russinovich
Sysinternals - www.sysinternals.com

C:\test:
:stream:$DATA 8

Unicode
Windows , NTFS 16- Unicode-
1.0/UTF-16 , . ( -
Unicode, 2012 6.1,
4.
.) Unicode
, .
.
,
8, 16.
. Unicode -
,
. , ,
255. Unicode-,
.


NTFS
-. ( -
.)
, , -
. , , FAT ,
, .
NTFS -
, .
492 12.


-
, NTFS.
NTFS- .


-
, .
NTFS-,
,
, NTFS .
NTFS .
( -
$BadClus) .

, ,
. -
(, ), NTFS
,
.


(hard links) -
. ( .)
C:\Documents\Spec.doc, C:\Users\Administrator\Documents\Spec.
doc, . -
. ,
Windows- CreateHardLink POSIX- ln.
NTFS
,
. , -
(
C:\Users\Administrator\Documents\Spec.doc).
(C:\Documents\Spec.doc), .
( ),

.

:
: fsutil hardlink create
mklink /H. ,
, -
. test.txt ( - ):

C:\>echo hello > test.txt


NTFS 493

hard.txt:

C:\>mklink hard.txt test.txt /H


Hardlink created for hard.txt <<===>> test.txt

, ,
. , -
; :

C:\>dir *.txt
Volume in drive C is OS
Volume Serial Number is 38D4-EA71
Directory of C:\
05/12/2012 11:55 PM 8 hard.txt
05/12/2012 11:55 PM 8 test.txt
2 File(s) 16 bytes
0 Dir(s) 10,646,011,904 bytes free

()
NTFS
, (symbolic), (soft),
. ,

,
. ,
. ,
, ,
, .
, C:\Drivers
, %SystemRoot%\System32\Drivers, ,
C:\Drivers\Ntfs.sys, %SystemRoot%\System\
Drivers\Ntfs.sys. -

.
Drivers , -
Ntfs.sys .
. ,
,
lnk-. , ,
mklink ( /H) API CreateSymbolicLink.

,
, -
SeCreateSymbolicLink, . -
SymLinkEvaluation,
:
fsutil behavior set SymLinkEvaluation
494 12.

Windows
,
:
C:\>fsutil behavior query SymLinkEvaluation
Local to local symbolic links are enabled
Local to remote symbolic links are enabled.
Remote to local symbolic links are disabled.
Remote to Remote symbolic links are disabled.

NTFS-,
(reparse points). ( .)
, -
, (reparse data).
, .
,
,
-. ,
NTFS STATUS_REPARSE, -

-. -
,
,
, .
( -) -
:
- , -
,
. (
), , .
, -
-.
Windows- . -
FSCTL_SET_REPARSE_POINT
DeviceIoControl.
FSCTL_GET_
REPARSE_POINT.
FILE_ATTRIBUTE_REPARSE_POINT,
GetFileAttributes.
NTFS -
(junction). NTFS , -
,
.
Windows,
.
NTFS 495

:
,
. soft.txt,
, -
test.txt:

C:\>mklink soft.txt test.txt


symbolic link created for soft.txt <<===>> test.txt

, , -
, <SYMLINK>.
, , ,
.
:

C:\>dir *.txt
Volume in drive C is OS
Volume Serial Number is 38D4-EA71

Directory of C:\

05/12/2012 11:55 PM 8 hard.txt


05/13/2012 12:28 AM <SYMLINK> soft.txt [test.txt]
05/12/2012 11:55 PM 8 test.txt
3 File(s) 16 bytes
0 Dir(s) 10,636,480,512 bytes free

, test.txt , -
,
, .


NTFS , , .
NTFS , -
, . ,
, .
, -
FSCTL_SET_COMPRESSION DeviceIoControl.
FSCTL_GET_
COMPRESSION. FILE_ATTRIBUTE_
COMPRESSED,
GetFileAttributes.
(sparse files).
, NTFS
, .
NTFS , .
- ,
, -
, .
496 12.

, .
, ,
. , ,
.
,
NTFS .
, DeviceIoControl FSCTL_SET_SPARSE.
, FSCTL_SET_ZERO_
DATA. NTFS, ,
FSCTL_QUERY_ALLOCATED_RANGES.
NTFS, ,
.


.
,
, . -

.
,
.

FindFirstChangeNotification ReadDirectoryChangesW -
.
, ,
.
, -
. , ,
FindFirstChangeNotification ,
. , FSD
, ReadDirectoryChangesW.
, .
NTFS , : -
FSCTL_
CREATE_USN_JOURNAL ( USN )
DeviceIoControl. NTFS -
, (change journal).
, ,
. FSCTL_QUERY_USN_
JOURNAL ,
DeviceIoControl , .



, , NTFS
NTFS 497

.
, NTFS
. NTFS -
, , ,
. ,
, , NTFS
- ,
(disk full).
NTFS ,
(Security ID, SID) ,
. ( SID 6 I.) -
,
. ,
, . -
, 50 10,
50.
. ,
-
NTFS Quota ()
, .12.20. Quota Entries ( ),
,
. ,
NTFS-, COM- ,
IDiskQuotaControl, IDiskQuotaUser IDiskQuotaEvents.

. 12.20.
498 12.


Windows (, )
, . -
, Start ().
(Object Linking and Embedding, OLE)
, .
Microsoft Office, PowerPoint,
Excel Word.
-
, OLE-, -
OLE- (
, ) . NTFS
,
(distributed link-tracking).
OLE- . , ,
NTFS-, NTFS-
,
.
NTFS
, (object ID).
FSCTL_CREATE_OR_GET_OBJECT_ID ( -
, ) FSCTL_SET_OBJECT_ID. -
FSCTL_CREATE_OR_GET_OBJECT_ID
FSCTL_GET_OBJECT_ID. FSCTL_DELETE_OBJECT_ID
.


.
,
, ,
. NTFS
, ,
NTFS- Windows. , NTFS-
-
Windows. 6 I , -
,
.
NTFS EFS (Encrypting File
System ). -
. , EFS
. ,
, -
.
NTFS 499


NTFS , -
\Windows,
, EFS . 9 BitLocker
, -
.

EFS , Windows -
,
, NTFS, DLL- ,
(Local Security
Authority Subsystem, LSASS) DLL-.

EFS- ( -
). . ,
, , -
EFS-
(
).
Windows API- EncryptFile
DecryptFile ,
FileEncryptionStatus EFS- , ,
, , . -
FILE_ATTRIBUTE_ENCRYPTED,
GetFileAttributes.

POSIX
2, Windows -
POSIX1003.1. POSIX ,
, , (-
),
(
MS-DOS) . NTFS .

NTFS -
, ,
.
, .
, .12.21 ,
. ( FAT Windows),
NTFS
( ), -
,
500 12.

(Master File Table, MFT). (NTFS MFT-


.) MFT-
,
. ( MFT .)

. 12.21.

-
, Windows API- , -
,
. API- -
,
(FSCTL_GET_VOLUME_BITMAP), ,
(FSCTL_GET_RETRIEVAL_POINTERS), (FSCTL_MOVE_FILE).

. 12.22.
NTFS 501

Windows ,
Disk Defragmenter (%SystemRoot%\System32\Dfrgui.exe),
.12.22, %SystemRoot%\
System32\Defrag.exe, ,
. , -
, ,
.
NTFS
NTFS-.


NTFS-
, , . ,
, , FSCTL_
EXPAND_VOLUME. ,
, -
( ).
: (shrinking engine)
.
.
NTFS, ,
, , ,
.
,
, FSCTL_MARK_HANDLE
(, ).
($MftMirr), NTFS-
($LogFile) ($Volume),

.
-
. ,
,
FSCTL_SHRINK_VOLUME:
ShrinkPrepare .
, -
. ShrinkPrepare
, , ,

. ,

. .
ShrinkCommit.
, . (
-
502 12.

, .) ShrinkCommit ,
, ,
.
ShrinkAbort
, , , .
ShrinkCommit, -
.

.
, NTFS -
,
. , -
,
.
, -
( 9). ,
VSS ,
.
, , ,
. -
VSS. ,

. ,
, ,
.

NTFS
8, - Windows ,
NTFS
. , Win-
dows API- - (, POSIX).
.12.23, , ,
, . (-
3 I.)
-,
- Windows.
,
, -
. , NTFS-
, .12.24.
.
NTFS 503



DLL


Windows

- - - -
- - NTFS
- - LPC

-
Windows

. 12.23. - Windows



-
/

/
NTFS



/









. 12.24. NTFS
504 12.

(Log File Service, LFS)


NTFS, ,
. LFS- -
NTFS . (
.)
Windows, , -
NTFS-
, ( ). -
Windows ,
-
.
.
- , ,
- (cache miss), NTFS
. -
-,
( )
. ( 11.)
NTFS Windows- , .

, -
. ( 3 I.)
, -
Windows: . , -
NTFS, ,
.
, -
. (
6 I.) -
.
NTFS .
. 12.25 ,
.
NTFS
. , , -
,
(Stream Control Block, SCB) ,
.
.
,
. SCB-
, (File
Control Block, FCB). FCB ( ,
, )
(MFT), .
NTFS- 505






NTFS

(

) -

NTFS
( )

. 12.25. NTFS

NTFS-
NTFS- , -
,
,
() NTFS.

NTFS- . (volume)
NTFS.
Disk Management ( ) MMC RAID-,
. -
diskpart (%SystemRoot%\System32\Diskpart.exe).
, .
NTFS .
150 .12.26.
506 12.

C: C:
(75 ) (60 )
NTFS- 1 FAT-
C: NTFS-
(150 ) D: D:
(75 ) NTFS- 2 (90 ) NTFS-

. 12.26.

.
FAT ,
. NTFS- ,
, , .


NTFS- Windows 7 Windows Server 2008 R2 -
3.1, WindowsXP WindowsServer2003.
$Volume.

NTFS-, (cluster factor),


format Disk Management (-
) MMC. ,
,
(1, 2, 4, 8 ..).
, 512, 1, 2 ..
NTFS . ( NTFS
- ,
, .) NTFS

. NTFS
, ,
, 512. (
9.) -
-
. (
4096, 1024, 3072. ,
, 9.) format
, Format () ,
All Tasks ( ) Action () Disk
Management ( ),
, .
NTFS- 507

NTFS
(Logical Cluster Numbers, LCN). -
, . LCN-
NTFS
, .
NTFS (Virtual Cluster Numbers, VCN),
0 m.
, -
LCN- .


NTFS .
, ,
, (NTFS-
).
, . ,
NTFS ,
.
NTFS-
(MFT). . -
1 . (
.) , MFT
, MFT-.
MFT NTFS- -
.
($) . -
, MFT $MFT. NTFS-
, .12.27.
MFT- . -
,
. MFT-,
, (base file record).
NTFS- ,
,
. -
, NTFS (VBR),
LCN-, MFT- . VBR ,
(Boot Parameter Block, BPB). MFT-
;
($MFTMirr), MFT- (MFT mirror)
MFT-. MFT-
, - MFT-
.
508 12.

MFT








NTFS





. . .
. . .

. .
TxF
TxF
TOPS-

. 12.27. MFT- NTFS

NTFS MFT-,
VCN LCN -
. (run) VCN LCN ,
, LCN- VCN-.
( .)
NTFS , MFT. NTFS
MFT-
. , NTFS (.
) .
.
NTFS- 509


, -
VCN, LCN . NTFS
LCN-/ VCN-. VCN-, NTFS
, VCN-.

NTFS ,
(log file), $LogFile. NTFS
, NTFS-. , ,
, , copy.
NTFS- ,
.
MFT ,
, C:\. ,
NTFS- . NTFS
, . ,
NTFS MFT, ,
, -
MFT.
NTFS
(bitmap file), $BitMap.
, -
.
(security file), $Secure,
, .
NTFS ,
NTFS ,
.
,
.
(boot file) $Boot.
, Windows.
, -
.
, BIOS.
format , MFT.
MFT ,
NTFS , () -
.
, Windows-.
, , ,
-,
.
, NTFS (bad-cluster file),
$BadClus -
510 12.

, (volume file), $Volume


, NTFS ,
. , ,
Chkdsk. ( .)
(uppercase file) $UpCase
. -
NTFS , (attribute
definition table); $AttrDef -
, , ,
..
NTFS
$Extend. : (object identifier
file) $ObjId, (quota file) $Quota,
(change journal file) $UsnJrnl,
(reparse point file) $Reparse -
(default resource manager directory) $RmMetadata.
, NTFS.
,
, ,
,
, .
, , , -
NTFS(TxF).
(transaction log directory) $TxfLog,
(transaction isolation directory) $Txf
(transaction repair directory) $Repair.
TxF- (TxFbase log file) $TxfLog.blf --
, .
:
(Kernel Transaction Manager, KTM) $TxfLogContain
er00000000000000000001, TxF-
$TxfLogContainer00000000000000000002.
TxF- (TxF old page stream),
$Tops .

: NTFS-
NTFS-, -
MFT-,
Fsutil.exe:

C:\>fsutil fsinfo ntfsinfo c:


NTFS Volume Serial Number : 0x9a38d50e38d4ea71
Version : 3.1
Number Sectors : 0x0000000015c82ff0
Total Clusters : 0x0000000002b905fe
Free Clusters : 0x000000000013c332
NTFS- 511

Total Reserved : 0x0000000000000780


Bytes Per Sector : 512
Bytes Per Cluster : 4096
Bytes Per FileRecord Segment : 1024
Clusters Per FileRecord Segment : 0
Mft Valid Data Length : 0x0000000023db0000
Mft Start Lcn : 0x00000000000c0000
Mft2 Start Lcn : 0x00000000016082ff
Mft Zone Start : 0x0000000002751f60
Mft Zone End : 0x000000000275cd60
RM Identifier: CF7234E7-39E3-11DC-BDCE-00188BDD5F49


NTFS- 64- ,
(file record number) -
. MFT 1 (
, , MFT 1).
-
MFT. NTFS
. .12.28.


-
-

. 12.28.


NTFS
, ,
,
(unnamed data attribute). ,
, , . MFT-
.12.29.
. ,
NTFS , . NTFS
: , , ( )
( ). -
.
, .
.12.6 NTFS-. ( -
.)
512 12.

. 12.29. MFT-

.12.6 , -
, NTFS
. MFT-
.
, , -
. ( )
$AttrDef.

12.6. NTFS

- $VOLUME_IN-
FORMATION, $Volume.
$VOLUME_
NAME
- $STANDARD_ ,
- INFORMATION , ..;
,

$FILE_NAME Uni-
code1.0. -
,


-

MS-DOS 16--
Windows
NTFS- 513


$SECURITY_
- DESCRIPTOR
NTFS
NTFS (3.1) .
NTFS -

$Secure,

-
. NTFS

-
.
-
$SECURITY_DESCRIPTOR,
$Boot
$DATA . NTFS
-
.
,

,
.

,


$INDEX_ROOT, , - -
, $INDEX_ALLO- , -,
CATION, $BIT- ,
MAP , -
-

$ATTRIBUTE_ , -
LIST
MFT, -
. -
, -
MFT
- $OBJECT_ID 16- -
- (GUID)
.

-
- OLE-. NTFS
API
,


514 12.

12.6 ()


- $REPARSE_
- POINT .
- , -

- $EA, $EA_IN- , -
- FORMATION /,
,

OS/2
EFS- $LOGGED_ EFS -
UTILITY_ ,
STREAM ,
, -

, ,
. -

, TxF
$TXF_DATA
,

,
. -
. , $FILE_NAME ,
$DATA ,
.
, , -
, $DATA .
, . , -
$DATA: $DATA, -
,
$DATA,
.


NTFS, FAT 255.
Unicode-, . FAT
MS-DOS (Unicode),
. 12.30 -
Windows .
,
Windows, POSIX.
NTFS- 515

NTFS POSIX . POSIX ,


Windows- DOS-, ,
. POSIX-
,
POSIX .


POSIX


Windows

MS-DOS
Windows

. 12.30. Windows

32- Windows-, DOS- 16--


Windows- . , Windows
.12.30, , Windows
NTFS-, DOS- 16- Windows-
. , MS-DOS
8.3, Unicode- (),
, .
NTFS
MS-DOS. Windows , dir
/x.
MS-DOS
NTFS- . MFT-
DOS- .12.31.



NTFS MS-DOS

. 12.31. MFT- MS-DOS


516 12.

NTFS- , MS-DOS, -
, , . DOS-
, , .
,
. MS-DOS, NTFS
DOS- ( , NTFS MS-
DOS ).


.
NTFS MFT- .
. , (
), .
. NTFS-
DOS-, , .

, NTFS DOS-
( RtlGenerate8dot3Name
, CDFS FAT,
):

1. , DOS-,
Unicode-. .
, .
2. ( ) . ,
,
,
MS-DOS . ,
.
~n (n 1, -
, ).
( ) .
3. . -
MS-DOS , ,
NTFS , .
4. ,
, ~n. n 4 ( -
) ,

.

.12.7 , .12.30, DOS-


, NTFS. .12.30
, .
NTFS- 517

12.7. , NTFS
Windows- , NTFS
LongFileName LONGFI~1
UnicodeName.D UNICOD~1
File.Name.With.Dots FILENA~1.DOT
File.Name2.With.Dots FILENA~2.DOT
File.Name3.With.Dots FILENA~3.DOT
File.Name4.With.Dots FILENA~4.DOT
File.Name5.With.Dots FIF596~1.DOT
Name With Embedded Spaces NAMEWI~1
.BeginningDot BEGINN~1
25.two characters 255440~1.TWO
6E2D~1


, HKLM\SYSTEM\
CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation 1
DWORD . -
, .


(tunneling) NTFS
, -

, .
, ,
. , DOS-
(safe save),
, , -
. ,
,
( ).

NTFS -
, .
,
. ,
, . NTFS
, -
, :
;
;
;
.
518 12.

NTFS 15,
, MaximumTunnelEntryAgeInSeconds
HKLM\SYSTEM\CurrentControlSet\Control\FileSystem .
, MaximumTunnelEntries -
.
.

1. file1.
2. 15 ( ,
).
3. file2.
4. dir /TC. .
5. file1 file.
6. file2 file1.
7. dir /TC. ,
.


, (, -
) .
MFT ( -
, - MFT),
(resident). ( , .12.31 .)
, NTFS .
, , .
,
, NTFS . -
, ,
.
. -
12.32 .

RESIDENT
: 8h
: 14 h

. 12.32.
NTFS- 519

MFT, NTFS
.
( , ,
FAT), NTFS .
.12.33,
MFT.
( -) (
) .





1, 2, 3, ...

. 12.33. MFT-

, MFT-,
1. -
MFT-, NTFS MFT.
(run).
(,
), NTFS . ,
, MFT, (nonresident).
, ;
.
, , ,
, , NTFS ,
. ,
, .12.34.


NTFS

. 12.34. MFT-

,
. ( .12.34
). .
520 12.

(
), .12.35. MFT-
- .
, ,
(index allocations). , -
.
. -
. , ,
.

4 8

1, 2, 3 5, 6

. 12.35. MFT-

MFT- -
, NTFS VCN LCN.
LCN- 0 n, VCN-
0 m , .

.12.36.

16

. 12.36. VCN-

, -
VCN8. .12.37,
VCN LCN , NTFS
.
NTFS- 521

16 - -
VCN LCN

. 12.37. VCN LCN

. 12.36 ,
, MFT- . -
, MFT-,
( )
MFT-. ,
(attribute list).
, MFT-, . -
,
, MFT-
VCN LCN, .
, 200. ,
MFT-,
MFT .


NTFS , , ,
LZ77, LZNT1. ( NTFS
, -
.) , ,
GetVolumeInformation. ,
GetCompressedFileSize. ,
DeviceIoControl. (.
FSCTL_GET_COMPRESSION FSCTL_SET_COMPRESSION.) ,
,
.
,
.
, , -
.
522 12.

NTFS .
.


(sparse data) ,
.
. , NTFS
(VCN) 0 m. VCN-
(LCN),
. .12.38 (
) () VCN-, LCN-,
.

. 12.38.

, .
12. .12.39 MFT- .
, MFT- -
VCN LCN ,
. , VCN- 0 11
LCN-. VCN0
4, VCN4 4 ..
.

- -
VCN LCN

. 12.39. MFT-

NTFS -
. ,
,
. NTFS
.
NTFS- 523

.12.40 , ,
. , VCN- (1631
64127) .

. 12.40. ,

MFT- VCN-, -
. . , ,
.12.41 VCN0 16.
VCN32 16.

- -
VCN LCN

. 12.41. MFT- ,

, NTFS MFT-,
VCN LCN .
, ,
. NTFS ,
524 12.

. ,
NTFS .
.


.
, .
.
, , .
NTFS , .
( ,
,
FSCTL_SET_COMPRESSION.) , NTFS -
(compression units) 16
(, 512 8). -
;
NTFS , -
. , NTFS
16 .
16 15 , NTFS
, ,
. 12.42 , .
,
. , .
26 ,
41%.

. 12.42.
NTFS- 525


LCN-, -
.
MFT-, ,
.12.42.

NTFS ,
16- . VCN-
16, 16.
NTFS
. NTFS
, -
-. 16
: ,
. 16


. -
16. (- .)
.12.43 MFT- , .12.42.

- -
VCN LCN

. 12.43. MFT-


, 16.
MFT- NTFS , -
. 16
NTFS
. , 16,
, , .
, NTFS -
, . , NTFS
,
, . NTFS -
,
526 12.

.
, ,
.
NTFS .
LCN-, .12.42
, .
NTFS ,
.
, ,
,
.


( , ),
, , NTFS .
NTFS MFT-
, , -
.


\$Extend\$UsnJrnl ,
NTFS . ,
(File Replication Service, FRS) ,
, .
$J, -
$Max.
:
;
(. 12.8);
;
;
MFT- ;
;
;
(Update Sequence Number, USN) ;
(, FRS ..).

12.8.

USN_REASON_DATA_OVERWRITE
USN_REASON_DATA_EXTEND
NTFS- 527


USN_REASON_DATA_TRUNCATION
USN_REASON_NAMED_DATA_
OVERWRITE
USN_REASON_NAMED_DATA_
EXTEND
USN_REASON_NAMED_DATA_
TRUNCATION
USN_REASON_FILE_CREATE
USN_REASON_FILE_DELETE
USN_REASON_EA_CHANGE

USN_REASON_SECURITY_
CHANGE
USN_REASON_RENAME_OLD_
NAME
USN_REASON_RENAME_NEW_
NAME
USN_REASON_INDEXABLE_
CHANGE ( ,

)
USN_REASON_BASIC_INFO_
CHANGE ()
USN_REASON_HARD_LINK_
CHANGE
USN_REASON_COMPRESSION_
CHANGE
USN_REASON_ENCRYPTION_ -
CHANGE (EFS)
USN_REASON_OBJECT_ID_
CHANGE
USN_REASON_REPARSE_POINT_
CHANGE , -
(,
),
USN_REASON_STREAM_CHANGE
, -

USN_REASON_TRANSACTED_ -
CHANGE ,
TxF-
USN_REASON_CLOSE , -


528 12.

, .
, NTFS
, ,
.12.44. NTFS
, .

$J


-


MFT-


$UsnJrnl:$J


$UsnJrnl:$J

. 12.44. ($UsnJrnl)

:
, -
Usndump.exe Winsider Seminars & Solutions
(www.winsiderss.com/tools/usndump/usndump.htm). , ,
,
Fsutil.exe:

C:\>fsutil usn queryjournal c:


Usn Journal ID : 0x01c89ddaec1b9648
First Usn : 0x0000000038140000
Next Usn : 0x000000003a22fa50
Lowest Valid Usn : 0x0000000000000000
Max Usn : 0x00000fffffff0000
Maximum Size : 0x0000000002000000
Allocation Delta : 0x0000000000400000


. , , NTFS
. Usn.txt, -
UsnNew.txt Usndump:
NTFS- 529

C:\>echo hello > Usn.txt


C:\>ren Usn.txt UsnNew.txt
C:\>Usndump.exe
...
File Ref# : 0x4000000001be9
ParentFile Ref# : 0x300000000a962
USN : 0xfc54d8
SecurityId : 0x00000000
Reason : 0x00000100 (USN_REASON_FILE_CREATE)
Name (014) : Usn.txt

File Ref# : 0x4000000001be9


ParentFile Ref# : 0x300000000a962
USN : 0xfc5528
SecurityId : 0x00000000
Reason : 0x00000102 (USN_REASON_DATA_EXTEND USN_REASON_FILE_CREATE)
Name (014) : Usn.txt

File Ref# : 0x4000000001be9


ParentFile Ref# : 0x300000000a962
USN : 0xfc5578
SecurityId : 0x00000000
Reason : 0x80000102 (USN_REASON_DATA_EXTEND USN_REASON_FILE_CREATE)
Name (014) : Usn.txt

File Ref# : 0x4000000001be9


ParentFile Ref# : 0x300000000a962
USN : 0xfc55c8
SecurityId : 0x00000000
Reason : 0x00001000 (USN_REASON_RENAME_OLD_NAME)
Name (014) : Usn.txt

File Ref# : 0x4000000001be9


ParentFile Ref# : 0x300000000a962
USN : 0xfc5618
SecurityId : 0x00000000
Reason : 0x00002000 (USN_REASON_RENAME_NEW_NAME)
Name (020) : UsnNew.txt

File Ref# : 0x4000000001be9


ParentFile Ref# : 0x300000000a962
USN : 0xfc5668
SecurityId : 0x00000000
Reason : 0x80002000 (USN_REASON_RENAME_NEW_NAME)
Name (020) : UsnNew.txt

,
.

NTFS ,
( ),
-. NTFS
. MFT- .12.45.
530 12.




5
4 10 15

0 1 3 11 12 13 14

6 8 9

. 12.45.

, MFT-
.
, 4
( ).
, -. -
, ,
. -
(, ) ,
(, ).
.12.45 -
(, file6),
MFT-,
. NTFS
MFT-. , FAT, NTFS,
. ,
,
, .
VCN-
LCN-, , -
, , VCN- ,
. .12.45 VCN- (
), .
4 2030
( ).
-
, ,
NTFS- 531

,
. MFT -
, -.

. ,
. , .12.45 file4
-. , ,
(), , file0, file1 file3. -
, file1, file3 .. .
,
.
- .
, .
, NTFS
. , - , ,
.
, NTFS ,
NTFS- ( ,
) -
.
NTFS - -
, ,
, .
(file name indexes), -
(view indexes).


,
$OBJECT_ID MFT-, NTFS -
$O
\$Extend\$ObjId. (
GUID), NTFS . -
API-,
. 12.46
$ObjId $OBJECT_ID MFT-.


NTFS \$Extend\$Quota, -
$O $Q.
.12.47. NTFS -
(SID),
.
, NTFS ,
. $O NTFS ,
532 12.

SID ,
. $Q NTFS .

.

, MFT- $Objld


$0
-
$0

$0
-
0 3
MFT-
1
-
1
MFT-
2

-
2
MFT-

. 12.46. $ObjId $OBJECT_ID


SID -
$STANDARD_INFORMATION

$0 $0

0

0 0

1

1 1

2

2 2

. 12.47. $Quota
NTFS- 533

, NTFS SID -
$O .
$STANDARD_INFORMATION
, ,
. NTFS
$Q , -
. ,
, , NTFS
,
. NTFS -
,
$STANDARD_INFORMATION. NTFS
-
. , -
, NTFS .


NTFS ,
, ,
. NTFS
$Secure, -
.
$Secure , $SDH (Security Descriptor Hash
) $SII (Security ID Index
), $SDS (Security Descriptor Stream -
), .12.48. NTFS

( , -
)
.
. $SDH
$SDS,
$SII NTFS- -
$SDS.
, NTFS
$SDH . NTFS
$SDH -
. -. $SDH
, NTFS
$SDS. , ,
NTFS $SDH . -
, ,
$SDS. NTFS -
, $SDH
534 12.

$STANDARD_INFORMATION .
$STANDARD_INFORMATION ,
, .


$STANDARD_INFORMATION

NTFS--
1 0

$SDS 1 $SDS

2 NTFS--
1

$SDS 0 $SDS
NTFS--
0
2

$SDS $SDS

. 12.48. $Secure

NTFS $SDH -
, , , ,
, NTFS -
. 32- ,
SID-, , , -
SID-
$STANDARD_INFORMATION. NTFS
$SDS $SDH $SII,
$SDS.
NTFS $SII
. NTFS
$STANDARD_
INFORMATION MFT-. $SII NTFS -
$SDS. $SDS NTFS
.
32 , , NTFS
$SII, $SII
$Secure.
$Secure NTFS ,
. ,
NTFS- 535

, ,
.
- NTFS -

. $SII NTFS
$Secure, $SDH ,
$Secure,
.


, (reparse point)
, -
16, 32- ,
$REPARSE_POINT . ,
, NTFS \$Extend\$Reparse,
, ,
. -
NTFS
,
. ( 9.)
\$Extend\$Reparse -,
( $R)
.


(Kernel Transaction Manager, KTM) -
(CLFS)
NTFS , NTFS
(Transactional NTFS, TxF). TxF API
,
(File System Control, FSCTL) -
.


TxF NTFS
. NTFS 3.1 ,
WindowsXP Windows Server2003. TxF
($LOGGED_UTILITY_STREAM),
EFS, .

.12.49, TxF :
API-, Kernel32.dll;
TxF- (%SystemRoot%\System32\Txfw32.dll);
536 12.

COM-, TxF
(%SystemRoot\System32\Txflog.dll);
NTFS- NTFS-;
CLFS- .

TxF-- CLFS--
API-


NTFS-- CLFS--

. 12.49. TxF

,
(Transactional Registry, TxR), 4
I, TxF , ,
(isolation) . , -
,
, TxF ,
, ,
-
.
(read-committed isolation).
, -
(transacted writers) (transacted
readers). ,
. -
,
.
-
. , ,
. ,
.
-
.
NTFS- 537

, -
. ,
. ,
, .
,

. -
. ,
.
. TxF -
:
;
,
;
, .

:
Transactdemo.exe , -
, , ,
.
Transactdemo.exe:

C:\>Transactdemo.exe

Transaction Demo v1.0


by Mark Russinovich

Transaction created: {5CD5E900-9DA8-11DD-8379-005056C00008}

Created C:\TransactionDemo.txt.
Pass TransDemo the GUID listed above to see the transacted file.

Rollback or commit transaction? (r/c):

Transactdemo
C:\TransactionDemo.txt.
dir , TransactionDemo.txt:

C:\>dir transactiondemo.txt
Volume in drive C is OS
Volume Serial Number is 0C30-686E

Directory of C:\
File Not Found

, . -
echo:

C:\>echo Hello > TransactionDemo.txt


The function attempted to use a name that is reserved for use by another trans-
action.
538 12.

, .

-
%SystemRoot%\System32\Ktmutil.exe %SystemRoot%\
System32\Fsutil.exe. ,
:

C:\>ktmutil tx list
TxGuid Description
------------------- ------------------ ---------------------------
{5cd5e900-9da8-11dd-8379-005056c00008} Demo Transaction?

, GUID ,
Transactdemo. GUID,
Fsutil , .

:

C:\>fsutil transaction query all {5cd5e900-9da8-11dd-8379-005056c00008}


dwOutcome: 1
dwIsolationLevel: 0
dwIsolationFlags: 0
dwTimeout: -1
Owner: BUILTIN\Administrators
Number of Files: 1
---- \TransactionDemo.txt

Transactdemo ,
Fsutil ,
. , Transactdemo, -
C .
() .

API-
TxF
(API) -. Transacted:
API : CreateDirectoryTransacted, CreateFileTransacted, CreateHard-
LinkTransacted, CreateSymbolicLinkTransacted;
API : FindFirstFileNameTransacted, FindFirstFileTransacted, Find-
FirstStreamTransacted;
API : GetCompressedFileSizeTransacted, GetFileAttributesTransacted,
GetFullPathNameTransacted, GetLongPathNameTransacted;
API : DeleteFileTransacted, RemoveDirectoryTransacted;
API /: CopyFileTransacted ,
MoveFileTransacted;
API : SetFileAttributesTransacted.
, API- -
, -
NTFS- 539

, , API- CreateFileTransacted.
API-, ,
, .12.9.

12.9. API-, TxF


API
CloseHandle ,

CreateFileMapping, , -
MapViewOfFile , ,

FindNextFile, ReadDirectory ,
Changes, GetInformationBy-
Handle, GetFileSize
GetVolumeInformation TxF,
FILE_SUPPORTS_TRANSACTIONS
ReadFile, WriteFile -

SetFileInformationByHandle , -
FileBasicInfo, FileRenameInfo, FileAllo-
cationInfo, FileEndOfFileInfo FileDispositionInfo

SetEndOfFile, SetFileShort- ,
Name, SetFileTime


, TxR (Resource Manager, RM) -
, TxF
(default resource
manager) . , TxF
, (secondary
resource managers).
, -
, -
, . TxF
API- ,
(Distributed
Transaction Coordinator). ,
System.Transaction .NET Framework .

TxF , FSCTL_TXFS_CREATE_
SECONDARY_RM, FSCTL_TXFS_START_RM FSCTL_TXFS_SHUTDOWN_RM.

FSCTL_TXFS_ROLLFORWARD_REDO, FSCTL_TXFS_ROLLFORWARD_
540 12.

UNDO. ,
, (, ).
.
,
, :
$Txf , -
. ,
,
. -
$Txf. NTFS-
, SCB ,
. ,
, , -
. NTFS
$Txf.
, .
$Tops, TxF- (TxF Old Page Stream,
TOPS),
$T . -
, , GUID,
CLFS- LSN-, . -
$T ,
( ,
$Txf). NTFS- , ,
, -

$Tops:$T.
$T (
) .
TxF- CLFS-,
.
$TxfLog,
. TxF
$TxfLog.blf. (\$Extend\$RmMetadata\$TxfLog\$TxfLog)
: KtmLog -
, TxfLog TxF-.
CLFS-,
$TxfLogContainer,
, 00000000000000000001. TxF-
.
,
\$Extend\$RmMetadata , -
NTFS.
NTFS- 541

:
%SystemRoot%\System32\Fsutil.exe
,
, , -
.
,
(\):

C:\>fsutil resource info \


RM Identifier: CF7234E7-39E3-11DC-BDCE-00188BDD5F49
KTM Log Path for RM: \Device\HarddiskVolume3\$Extend\
$RmMetadata\$TxfLog\$TxfLog::KtmLog
Space used by TOPS: 79 Mb
TOPS free space: 100%
RM State: Active
Running transactions: 0
One phase commits: 0
Two phase commits: 1
System initiated rollbacks: 0
Age of oldest transaction: 00:00:00
Logging Mode: Simple
Number of containers: 2
Container size: 10 Mb
Total log capacity: 20 Mb
Total free log space: 14 Mb
Minimum containers: 2
Maximum containers: 20
Log growth increment: 2 container(s)
Auto shrink: Not enabled

RM prefers availability over consistency.

, fsutil resource
TxF- .
. , fsutil resource
create c:\rmtest
Rmtest, fsutil resource start c:\rmtest .
$Tops $TxfLogContainer*, TxfLog $Txf.


.12.6, $LOGGED_UTILITY_STREAM TxF
,
. $TXF_DATA ,
TxF -
. MFT; ,
, .
. .12.50.

,
. -
5, (\) MFT,
542 12.

.12.27. TxF FCB ,


. ,
, , NTFS -
. (
3 I.)

RM-

TxF- (TxID)
LSN NTFS-
LSN
LSN
USN-

. 12.50. $TXF_DATA

, $TXF_DATA, -
TxF- (TxID). -
$TXF_DATA. NTFS
, ,
. ,
sample.txt, (-
), TxF - .
TxID 64-
, TxF ,
( ). , TxF-
, $TXF_DATA
.
, , -
CLFS LSN-. ,
, , TxF
CLFS-. LSN-,
$TXF_DATA. LSN-
, NTFS-,
. , -
, TxF
MFT-. LSN , -
. LSN- TxF . -
, LSN- ,
, , ,
TxID.
$TXF_DATA , TxF -
, USN-, -
NTFS- 543

. TxF- USN-,
NTFS- ( ),
TxF, USN- -
.


, ,
, TxF .
. -
, , ,
, TxF-
(TxID), GUID- KTM-, -
.
(redo record) , -
,
. (undo record) ,
.
, -
,
, .
TOPS- TxF : LSN-
(base LSN) LSN- (restart LSN).
LSN- , ,
LSN- .
(restart record) TxF , ,
, . ,
LSN- .
TxF (Compensating Log Records,
CLR). , ( -
).
LSN- (undo-next LSN),
-
, . ,
,
. , TxF (prepare records),
(abort records) (commit records),
KTM- TxF.


FSCTL_TXFS_START_RM ( -

), TxF . TxF TOPS-, -
LSN- , ,
,
(redo pass). TxF
544 12.

, , LSN $TXF_DATA LSN


. LSN- , ,
,
. , -
, . TxF ,
, LSN $TXF_DATA LSN .
TxF (transaction table),
;
, TxF .
TxF
KTM, , -
. ( , KTM
KtmLog TxF-.)
TxF KTM, -

(undo pass). TxF -
, LSN-
.
.
,
,
.

NTFS
NTFS , -
()
,
. Chkdsk -
,
- (, ,
) .
NTFS
Chkdsk .
, NTFS -
. -
( ) . NTFS
, ,
, , - .
,
, NTFS -
. NTFS(TxF).
-
, NTFS -
NTFS 545

. , NTFS
.


NTFS (recoverable file
system). -
, (journaling),
.
,
.
,
( FAT,
). -

.
.

.
. -
- . ,
, -
.
,
, ,
.
, .

. , ,
. ,
,
.
NTFS ,
. -,
, NTFS-
. -,

( ),

.
(cache write-through),
, (cache flushing), -
. NTFS
-
,
.
546 12.

, -
. , FAT NTFS ,

.


NTFS
, TxF.
, .
TxF NTFS
CLFS. CLFS , -
(Log File Service, LFS).
, 4 I. ,
TxF, ,
, NTFS ,
.


, -
NTFS-, NTFS .
NTFS LFS ,
. LFS ,
,
.12.51. , LFS CLFS,
, ,
.


-



NTFS


//







. 12.51. (LFS)
NTFS 547

.12.52, LFS : -
(restart area) (logging area).

LFS

1 2

. 12.52.

NTFS LFS.
NTFS , -
, .
-
LFS .
, , -
. LFS
(
). LFS,
CLFS, LSN-. LSN-
. LSN- NTFS 64,
LSN- .
NTFS . LFS
, NTFS , -
, ,
LSN- LSN-
. NTFS LFS ,
, TxF: -
,
.
:
1. NTFS LFS ,
.
2. NTFS ( ).
3. LFS . -
, -
( .12.51).
4. -
(, ).
,
,
548 12.

-
.
-
. NTFS ,
, , ,
. NTFS ,
.


NTFS , -
TxF: (update records)
TxF, (checkpoint records) -
TxF. .12.53
. ,
. NTFS,
, -
() .

: / : 39
MFT
: : 39

:
:

. 12.53.

( LFS
) NTFS
. , NTFS
, -
(committing a transaction).
NTFS , ,
.
NTFS -
.
, NTFS ,
. . ,
, NTFS -
.
NTFS
, ,
NTFS 549

. , .12.53, NTFS
T1c,
T1b.
. ,
NTFS ,
.
,
. , -
, NTFS -
.
, , .. NTFS
TxF, ,
, A.dat. NTFS
( ) :
;
;
;
;
;
;
.

, ,
NTFS
, , ,
. NTFS ,
,
. ,
(idempotent), -
. , , ,
,
, . ,
.
NTFS -
, .12.54.
NTFS , -
,
. NTFS, , ,
, .
NTFS LSN ,
.
LSN- , TxF.
550 12.




NTFS

. 12.54.

LFS NTFS,
.
(, )
, LFS, CLFS, -
:
;
,
;
, () -
, .
, LFS
(log file full), NTFS -
. NTFS
.
, NTFS
. -
, NTFS
.
,
. NTFS
.
, NTFS -
,
. ,
NTFS . NTFS -
, .
. -
.
, NTFS
, -
, .
.
NTFS 551

- NTFS
. ( ,
.) ,
NTFS . -, ,
TxF, -, (dirty page
table), ,
. -
.
5 NTFS
. NTFS LFS -
. NTFS
LSN- ,
. NTFS -
LFS ,
.
NTFS .
-
.
, .
NTFS ,
. NTFS
.
, NTFS ,
, -
. :
1. .
2. .
3. .

(analysis pass), .12.55, NTFS -


,
,
. ,
,
. NTFS
.
, -
,
. ,
,
. ,
552 12.

, , -
.

- - - - -

. 12.55.

NTFS
, LSN ,
. LSN-
() , LSN-
, . LSN ,
NTFS , , .
, .


TxF- . ,
,
.

(redo pass), .12.56, NTFS


, LSN
, . NTFS , -
, ,
. NTFS .

- - - - -

. 12.56.
NTFS 553

NTFS
,

.

, NTFS (undo pass),


, . .12.57
; 1 ,
2 . NTFS 2.

. 12.57.

, 2 .
, .
-
, .
NTFS
LSN- .
, 2 LSN-
4049. .12.58, NTFS 2.

1 : 39
2 : 39

:
:

: / MFT
:

. 12.58.
554 12.

LSN- 4049, NTFS -


, 39. NTFS
LSN- 4048,
. , NTFS
LSN- 4046 -
MFT-. 2
. NTFS
.
, NTFS . -
, NTFS
!
.
NTFS ,
. NTFS ,
TxF LFS-. TxF NTFS
,
, TxF CLFS NTFS-
. ( TOPS- ,
CLFS.) NTFS LFS- ,
, ,
, .
.
NTFS , -
, .
NTFS , NTFS
.
,
,
LFS LFS
( 5). ,
.
, ,

, .
,
.
NTFS ,
,
. -
, -. NTFS
,
. -
.

.
NTFS 555

- -
, NTFS
. , NTFS
MFT, .
,
. NTFS

. -
,
.

NTFS
Windows (VolMgr)
, -
,
. ( 9.)
,
, .
FAT . ,
FAT, ,
,
Chkdsk Format.
.
, -
.
NTFS ,
, ,
. (, NTFS ,
, .)
NTFS ,
.

, NTFS .
NTFS ,
.
. 12.59 MFT-
, -
. , NTFS -
$BadClus, .
. NTFS
VCN LCN,
. (
) .12.59. 1357, -
, , .
556 12.

-
-


. 12.59. MFT-

, , ,
, NTFS
. ,
. ,
NTFS ,
.
,
. , FAT
, -
.
- ,
( ).
( , , -
). , , FAT
, .
, NTFS
. NTFS
. -
, NTFS , .12.60.
, NTFS -
. ,
.

,
. ,
NTFS , .
,
. ,
NTFS ,
.
NTFS 557

, NTFS $Volume , -
.
Chkdsk
NTFS-.

-
-
$Bad




-
-


. 12.60.

-
.
, . ,
, , NTFS MFT-
, .

, ,
NTFS .
NTFS . -
,
558 12.

Chkdsk NTFS- .

, Chkdsk .
,
.
Chkdsk NTFS -
FAT. FAT
, .
-, , Chkdsk.
NTFS Chkdsk
, NTFS -

. ,
MFT [$MftMirr],
. , NTFS
.
. 12.10 , -
,
Windows, , .

12.10. NTFS
, - , -
-
, - , -

- 1. - 1. -
1 . .
2. 2.
. -
3. - .
3. NTFS

1. 1. -
. .
2. 2.
- -
. .
3. NTFS - 3. NTFS
. - . -
2

 , RAID-1 ()
1

RAID-5.
: NTFS .
2
NTFS 559

, , -
RAID-1 () RAID-5,
( , ),
, , FAT NTFS.
,
.
, -
, ( NTFS) ,
, . -
FAT . NTFS
,
( ),
.

,

.
, NTFS , -
. , NTFS

, , Chkdsk.
.
, .
fsutil repair set -
, .12.11. Fsutil
FSCTL_SET_REPAIR , VCB .

12.11. NTFS

SET_REPAIR_ENABLED
SET_REPAIR_WARN_ -
ABOUT_DATA_LOSS , , -

SET_REPAIR_DISABLED_ NtfsBugCheckOnCorrupt ,
AND_BUGCHECK_ON_ NTFS, 1
CORRUPTION , STOP
error 0x24, -
.
,

, (-
, ), NTFS
.
560 12.

NTFS -
,
FSCTL_INITIATE_REPAIR FSCTL_WAIT_FOR_REPAIR,
fsutil repair initiate fsutil repair wait.
.

FSCTL_QUERY_REPAIR fsutil repair query:
C:\>fsutil repair query c:
Self healing is enabled for volume c: with flags 0x1.
flags: 0x01 - enable general repair
0x08 - warn about potential data loss
0x10 - disable general repair and bugcheck once on first corruption

9, BitLocker -
, .

(Encrypting File System, EFS). ,
BitLocker EFS . -
.
BitLocker EFS .
EFS -
( ).
( -
).
;
http://msdn.microsoft.com/en-us/library/windows/desktop/aa380251(v=vs.85).aspx.
EFS API- CNG (Cryptography Next Genera-
tion ), ,
CNG .
EFS (Advanced En-
cryption Standard, AES) ( 256- )
RSA ( Rivest, Shamir Adleman)
( 2048- ).
.
Properties (), Advanced
() Encrypt contents to secure data ( -
), .12.61.
, . -
Cipher
(%SystemRoot%\System32\Cipher.exe) API- Windows,
EncryptFile AddUsersToEncryptedFile.
561

. 12.61.

Windows , -
. EFS ,
(File Encryption Key, FEK). EFS
. EFS ,
, -
$EFS.
X.509, -
, -
, (%SystemRoot%\
System32\Certmgr.msc). EFS , -
:
, FEK
, .
, , ,
, -
. : ,
. ,
, FEK. ,
.
,
FEK.
FEK ,
EFS ,
. FEK
.
FEK EFS ,
.
$EFS . ,
. -
, ,
562 12.

. FEK
. ,
EFS FEK. -

, FEK.
EFS , -
.12.62. EFS NTFS-.
NTFS EFS-.

. EFS FEK
, FEK .
EFS FEK
CNG- .


Windows 7

-



PIN -
SC - EFS-
EFSRPC
EFS-

-
- Kerberos

LSA-
RPC-


EFS-
FSCTL
EFSRPC

-
( )
EFS-

. 12.62. EFS

(Local Security Authority Subsystem, LSASS)


, EFS- (%SystemRoot%\System32\
Lsass.exe). , EFS FEK
563

, , NTFS EFS-
LSASS.


, NTFS- EFS-
. , ,
.
NTFS ,
. , Windows
: cipher
Encrypt contents to secure data ( -
) Advanced Attributes ( ),
. API- EncryptFile,
Advapi32.dll.
EFS ,
. -
(key entries); EFS EFS- ,
(Data Decryption Field, DDF).
(key ring),
, , EFS
.
EFS- .12.63.
EFS , -
. (
) , , ,
-
. .
FEK. FEK
EFS CNG.

EFS

SID
(S-1-5-21-...)
DRF
-
DDF- 1 (ee341-2144-55ba...)
(DDF)
(Microsoft Bass Cryptographic Provider 1.0)
DDF- 2
EFS
(cb3e4e...)
DRF
FEK
-
(03fe4e3c...)
DDF- 1
(DRF)

. 12.63. EFS-
564 12.

EFS -
(Data Recovery Field, DRF). DRF- DDF- .
DRF ,
, , -
, , .
,
.

Encrypted Data Recovery Agents.
Local Security Policy ( )
MMC, .12.64.
Encrypting File System Add Data Recovery Agent
. -
, / (
) EFS.
Lsasrv
.
EFS DRF-
EFS- .

. 12.64. Encrypted Data Recovery Agents

EFS- Lsasrv
DDF DRF, MD5 Base
Cryptographic Provider1.0. Lsasrv EFS-.
EFS ,
EFS- .


, :
1. EFS- .
2. , -
.
565

3. FEK
DESX 3DES, .
4. DDF,
(FEK). EFS -

X.509 3.
5. , DRF,
RSA
.
EFS -
X.509 3, EFS-
. FEK
, -
DRF.


file recovery EKU (enhanced key us-
age ). EKU
. File Recovery
EKU, Microsoft (Public
Key Infrastructure, PKI).

6. ( DDF DRF) EFS .


,
. , -
,
1. , -
.
7. .

, .


:
1. , NTFS EFS-.
2. EFS- DDF EFS-.
3. EFS- ,
DDF FEK.
4. EFS- EFS- FEK.
5. EFS- FEK -
.
566 12.


, ,
, EFS -
. encryption,
. -
.

6. EFS- NTFS ,
.



, ,
.
, .
EFS , ,

.
.
-
EFS API- OpenEncryptedFileRaw, ReadEncryptedFileRaw,
WriteEncryptedFileRaw CloseEncryptedFileRaw.
,
ReadEncryptedFileRaw.

: EFS-
EFS API-,
. , AddUsersToEncryptedFile
,
RemoveUsersFromEncryptedFile, , .
QueryUsersOnEncryptedFile
DDF DRF . SID,
DDF DRF .
EFSDump Sysinternals.
:

C:\>efsdump test.txt
EFS Information Dumper v1.02
Copyright (C) 1999 Mark Russinovich
Systems Internals http://www.sysinternals.com

test.txt:
DDF Entry:
DARYL\Mark:
CN=Mark,L=EFS,OU=EFS File Encryption Certificate
DRF Entry:
Unknown user:
EFS Data Recovery
567

, test.txt DDF- Mark


DRF- EFS Data Recovery,
.


-
; -
EFS- .
, ,
NTFS-, FAT-
( NTFS-). - -
.
,
, ,
, , .
,
. copy
The specified file could not be encrypted (
).

Windows ,
, .
-
, NTFS ,
. Windows.
13.

Windows ,
. -
. ,
. ,
.


Windows , -
.
, ,
.
, Windows
Session Manager (Smss.exe), (-
0 1). , ,
.
, BIOS
(Basic Input Output System -) EFI (Extensible Firmware
Interface ), -
. EFI 16-
, BIOS;
.
, BIOS,
EFI.
( EFI2.0,
UnifiedEFI, UEFI) Windows ,
,
-
, .

BIOS
Windows
, Windows . -
Windows Setup
. , .
569

, ,
.
x86 MS-DOS.
Microsoft -
, (partitions). -
( FAT NTFS) .
.
, -
(extended partition).
.
, , , ,
..
. .13.1, .13.1 -
, BIOS. ( Windows
9.)

13.1. BIOS
-

- 16- - -
(VBR) -
(MBR)
16- -
( , - ()
Bootmgr

)
Bootmgr 16- -
(BCD),
32- -
-
,
-
(Memtest.exe).
64- Windows
Winload -
64-
Winload.exe 32- Ntoskrnl.exe -
- (Boot-
, vid.dll 32- , Windows
64- Hal.dll, Kdcom.dll, Ci.dll, Clfs.sys,
- Pshed.dll)

Win64

570 13.

13.1 ()
-

Winresume.exe 32- -
-
, 64-- Windows - Windows
- Hiberfil.sys


Win64
Memtest.exe 32- - -

-
-

(RAM)
Ntoskrnl.exe - -
,
. Windows

-
Smss.exe
Hal.dll - DLL- , - -
-
Ntoskrnl Windows
.

,
, -

Smss.exe - -
-
. 0 Windows

Windows (Win32k.sys)
Csrss.exe,
Windows (Wininit.
exe).
Csrss
Winlogon
Wininit.exe Windows- -
(SCM), -
Windows
(LSASS)
(LSM).
-


571

-

Winlogon.exe Windows- -
,
LogonUI Windows
Logonui.exe Windows- - -

Windows
Services.exe Windows- -
-
Windows- Windows

1 2 3 4
()

. 13.1.

(sector).
BIOS , , 512 (, 9,
4096). -
, ,
Windows Setup, (MBR) .
( 9.) MBR , -
, (boot code),
, (partition table), , -
572 13.

.
BIOS - BIOS.
, MBR -
MBR .
-
, ,
, , Windows Setup Disk Management MMC.
MBR- ,
(Active), .
MBR -
.
(system partition), (boot sector), -
(Volume Boot Record, VBR).
(system volume).

. , Windows Setup MBR
( )
100.
, -
. , .
Windows Setup
, ( , Windows
, -
) NTFS ( )
NTFS. NTFS ,
Windows. ,
, Windows (, FAT32).
, .
Setup Boot Manager
(Bootmgr), Windows .
, Setup -
(Boot Configuration Database, BCD), BIOS -
\Boot\BCD .
Setup Windows
. BCD ,
Setup ,
. BCD 3 I.

BIOS Bootmgr
Setup
, . , -
NTFS, Windows NTFScapable. -
Windows
Bootmgr . ,
573

. Bootmgr
, NTFScapable .
Bootmgr ,
BOOTMGR is missing ( Bootmgr).
COM- EXE- (Startup.
com Bootmgr.exe), ,
, COM-. -
. ,
, ,
.
DOS-. Bootmgr
.
- , 32--
. Bootmgr
. -
, 16, Bootmgr .
Windows.
Bootmgr ,
. IDE,
- BIOS-.
, BIOS-.
Bootmgr
\Boot BCD-. , Bootmgr
NTFS ( , Bootmgr
, FAT, El Torito CDFS UDFS, WIM- VHD-
). ,
Bootmgr .



NTFS-,
, NTFS- .
, ,
bootsect.dat.

Bootmgr . Windows BCD-, -


Bootmgr ,
Winresume.exe, -
,
. ,
. Hiberfil.sys ,
.
Hiberfil.sys , -
. (
8.)
574 13.

BCD Bootmgr
( , Bootmgr
Winload.exe). BCD
, (
\Windows) . Windows
, .
100,
.
BCD ,
, Winload
.
Bootmgr .13.2. 13.3 BCD-
, .13.4 BCD- Windows.

13.2. BCD- Windows (Bootmgr)


BCD-
bcdfilepath -

( \Boot\BCD)
displaybootmenu ,
-
,

keyringaddress ,
BitLocker
noerrordisplay -

Resume , -
.
-
Windows
Timeout , -

,
Resumeobject GUID , -

displayorder


toolsdisplayorder -


bootsequence

575

BCD-
Default GUID ,
-
Customactions , -
-

bcddevice GUID , -
BCD-

13.3. BCD-
BCD-
avoidlowmemory -

.
(, ISA),
16
badmemoryaccess
(
10)
badmemorylist - ,
(Page -
Frame Number, PFN) RAM
baudrate
(19200),


bootdebug
. -
-
Kd.exe Windbg.exe
bootems Windows -

(Emergency Management Services, EMS),
-


busparams
PCI -
FireWire ,
PCI, -

channel 0 62 {debugtype, 1394}
IEEE1394,


576 13.

13.3 ()
BCD-
configaccess- Default, Disal- ,
policy lowMmConfig -
-
PCI -
HAL-
-. -

debugaddress -
(COM) ,

debugport COM- -
(
COM2),


debugstart Active, AutoEnable,
Disable . AutoEnable

,

debugtype Serial, 1394, USB , -
FireWire (IEEE 1394) USB2.0

. ( -
)
emsbaudrate EMS
-

emsport COM- (COM)
EMS
Extendedinput -
BIOS
firstmegabyte- UseNone, UseAll, Use- , HAL
policy Private 1 ,
BIOS

fontpath OEM-, -

graphicsmodedis- -
abled
graphicsresolu-
tion
577

BCD-
Initialconsole- ,
input
PC/AT
integrityservices Default, Disable,
Enable , Kernel
Mode Code Signing. -

locale
(, EN-US)
noumex -
.
,

novesa VESA-

recoveryenabled -
, .
Windows
Startup And
Recovery PE
recoverysequence -
( )
relocatephysical -
NUMA-

targetname USB- -
USB2 {debugtype, usb}
testsigning , -
-
64- .

traditionalkseg- , -
mappings KSEG0, -
MIPS. -
KSEG0 24

( -
0x80800000 0x800000 RAM).
-
,

truncatememory -

578 13.

13.4. BCD- Windows (Winload)


BCD
advancedoptions false -
-
;
-

,
. F8
bootlog Windows -
%SystemRoot%\Ntbtlog.txt
bootstatuspolicy DisplayAllFailures, ,
IgnoreAllFailures, Ig- , -
noreShutdownFailures, , -
IgnoreBootFailures

bootux Disabled, Basic, Standard
. -
Disabled
( ), -
Basic
. Standard -

Windows
clustermodead- ,
dressing
-
(APIC)
configflags -

dbgtransport
,
(Kdcom.dll, Kd1394, Kdusb.dll), -
, -
,
Windows
debug
detecthal -
HAL
driverloadfail- Fatal, UseErrorControl
urepolicy . Fatal -
,
UseErrorControl -

,

579

BCD
ems
EMS. (
bootems, EMS
)
evstore , -

exportascd
ramdisk
ISO-, Windows In-
stallation Media (WIM) System Deploy-
ment Image (SDI)
groupaware -

, .
64- Windows
groupsize -
,
(64). -
,

.
.
64- Windows
hal HAL- HAL-
(hal.dll).
-
(
kernel)
halbreakpoint HAL -
.
Win-
dows
HAL, -
(
).

/DEBUG,
0x00000078 (PHASE0_ EX-
CEPTION)
hypervisorbau- - -
drate
hypervisor 0 62
channel FireWire (IEEE1394)
hypervisordebug


580 13.

13.4 ()
BCD
hypervisorde- COM-
bugport COM-
hypervisorde- Serial, 1394 ,
bugtype
hypervisordis- -
ableslat
(SLAT),

hypervisor- Off, Auto
launchtype Hyper-V
hypervisorpath

hypervisorusel-
argevtlb TLB-
increaseuserva
2 -
, 3
(
). -

,
. ( -
9)
kernel
(Ntoskrnl.exe).

( -
hal)
lastknowngood

loadoptions - -
, BCD-
.
,
BCD (,
)
maxgroup -
, -
. NUMA
3 I
maxproc
,
, Windows

581

BCD
msi Default, ForceDisable -
,
nocrashautore-
boot ( )
nointegrity- Windows -
checks .

nolowmem PAE -
4 -
.
Windows PAE,
Ntkrnlpa.exe, 4
. -
, -
.
-

, -

numproc ,
-
. , /NUM-
PROC=2 -
Windows

nx OptIn, OptOut, Always 32--
Off, AlwaysOn Windows -
,

PAE.
.

64- Windows
x64- (.9)
onecpu
Windows
optionsedit
. -

-
.
F10
osdevice GUID ,


582 13.

13.4 ()
BCD
pae Default, ForceEnable, Default
ForceDisable , -
PAE, PAE-.
ForceEnable -
, ForceDisable -

,
-
x86 PAE
4
pciexpress Default, ForceDisable
PCI Express
perfmem -
. -
remove-
memory, Windows -
,
quietboot Windows -
VGA-, -
-
.
,
Windows

ramdiskimage- ramdisk
length
ramdiskima-
geoffset ramdisk
(, ), -
,
ramdisk
ramdisksdipath SDI-
ramdisk
ramdisktftp- WIM ramdisk -
blocksize Trivial FTP (TFTP) -

ramdisktftpcli- WIM ram-
entport disk Trivial FTP
(TFTP)
ramdisktftpwin- WIM
dowsize ramdisk Trivial
FTP (TFTP)
removememory Windows -

583

BCD
restrictapic APIC-
cluster ,

resumeobject GUID , -
-
. Winresume.exe
safeboot Minimal, Network,
DsRepair . Minimal -
,
Network -
, DsRepair
(-
)
safebootalter- Windows -
nateshell ,
HKLM\SYSTEM\CurrentControlSet\Con-
trol\SafeBoot\AlternateShell.
-

sos Windows -
, -
( ),

stampdisks Winload MBR-
RAW- Win-
dowsPE ( ).

, -
,
, BIOS, -
,
systemroot osdevice

targetname USB 2.0 ,

tpmbootentropy Default, ForceDisable, -
ForceEnable (TPM)
. -
TPM Boot Entropy,
TPM -
(RNG)
usefirmwarepci- Windows
settings PCI- IO/IRQ.

148501 Microsoft

584 13.

13.4 ()
BCD
uselegacyapic-
mode APIC,
-
APIC. -
/
usephysicaldesti- APIC-
nation
useplatformclock
-

vga Windows
VGA- -
-

winpe Windows PE.
-
SYSTEM ,
,
,
x2apicpolicy Disabled, Enabled, , -
Default APIC,

. Disabled
uselegacyapicmode,
Enabled -
ACPI .
Default -
( )
xsavepolicy XSAVE
XSAVE
(Hwpolicy.sys)
xsaveaddfea-
ture0-7 XSAVE Intel;
-
,
.
CONTEXT ,
-
,

Xsaveremovefea- -
ture XSAVE-, -

585

BCD
Xsaveproces- , , -
sorsmask XSAVE-

xsavedisable XSAVE,

Bcdedit.exe
. BCD- -
(, /DEBUG ) HKLM\SYSTEM\CurrentControlSet\
Control\SystemStartOptions ;
BCD-.
, BCD, -
, Bootmgr ,
( ).
Bootmgr . -
Windows Winload.exe.
Winload.exe , ACPI- BIOS
. :
( CMOS-);
, ;
, (, ISA, PCI,
EISA, MCA), , , -
.

HKLM\HARDWARE\DESCRIPTION .
, CMOS BIOS
, , -
Windows.
.
PnP-.
Winload
(boot volume). , -
( \Windows) .
Winload:
1. HAL ( Ntoskrnl.
exe Hal.dll), . Winload
- , Windows could not
start because the following file was missing or corrupt (Windows -
, ), .
586 13.

2. VGA- ( vgaoem.fon).
, -
.
3. NLS-, .
l_intl.nls, c_1252.nls c_437.nls.
4. \Windows\System32\Config\System , ,
. ( -
4 I.)
5. SYSTEM
(boot device drivers).
SERVICE_BOOT_START (0).
HKLM\SYSTEM\CurrentControlSet\Services. ,
.13.2 fvevol BitLocker. (
Services 4 I.)

. 13.2. BitLocker

6. , -
(NTFS),
. Winload .
, ,
.
7. , .
, Winload Starting Windows.
BCD sos, Winload
. ,
, .
8. Ntoskrnl.exe.
, 1 8 Winload
(Kernel Mode Code Signing, KMCS), 3
I, 64- .
587

,
.
Winload . -

KiSystemStartup Ntoskrnl.exe.

UEFI-
UEFI- , -
Windows Setup (NVRAM). -
BCD-, NVRAM.
Bcdedit.exe
NVRAM- BCD,
.
UEFI (Unified Extensible Firmware Interface -
), EFI-
,
.
BIOS UEFI Windows 2-
EFI- , EFI-
Bootmgr (Bootmgfw.efi).
,
UEFI- :
;
;
;
;
.
UEFI-
,
Windows 16- . ,
EFI 32-, 64- , Windows
EFI 64- .
Bootmgr x86 x64, EFI-
. -
,
EFISystem, EFI- Windows (Winload.efi).
UEFI, -
FAT EFISystem 100 1,
1% . , Windows
EFI System EFI\Microsoft.
,
.13.1 -
588 13.

UEFI-. : .exe
.efi, , BIOS- API-,
EFI. , MBR-
( ), UEFI- -
GPT (GUID Partition Table GUID ),

(GUID).


EFI 2001 , UEFI 2005, -
- -
20 - .
Itanium Intel Macintosh Apple.

iSCSI-
iSCSI- (Internet SCSI, iSCSI)
(Small Computer System
Interface, SCSI). ,
(Host Bus Adapter, HBA) Ether-
net. (Network-Attached
Storage, NAS), ,
NAS . -
, iSCSI- Ethernet, iSCSI-
,
. iSCSI-
, .
Windows -
, PXE, Windows
iSCSI- iSCSI-.
(Winload.exe) UNDI
(Universal Network Device Interface ),
(Network Interface Card, NIC)
13h ( - BIOS)
-. EFI- -
,
API- EFI-.
,
,
iSCSI- (iSCSI Boot Firmware Table, iBFT). ,
, ACPI (Advanced
Configuration and Power Interface
). iBFT- -
Windows Setup, iSCSI-
589

( ) . iSCSI-
, Windows iSCSI-, .13.3.


iSCSI-


-
iBFT

NDIS--

. 13.3. iSCSI-


Winload Ntoskrnl, , -
. -
, , Winload
, ,
HARDWARE ,
SYSTEM ,
, Winload, ,
.

:
-
KeLoaderBlock. ,


. dt -
:

0: kd> dt poi(nt!KeLoaderBlock) nt!_LOADER_PARAMETER_BLOCK


+0x000 OsMajorVersion : 6
+0x004 OsMinorVersion : 1
+0x008 Size : 0x88
+0x00c Reserved : 0
+0x010 LoadOrderListHead : _LIST_ENTRY [
0x8085b4c8 - 0x80869c70 ]
+0x018 MemoryDescriptorListHead : _LIST_ENTRY [
0x80a00000 - 0x80a00de8 ]

590 13.

+0x020 BootDriverListHead : _LIST_ENTRY [


0x80860d10 - 0x8085eba0 ]
+0x028 KernelStack : 0x88e7c000
+0x02c Prcb : 0
+0x030 Process : 0
+0x034 Thread : 0x88e64800
+0x038 RegistryLength : 0x2940000
+0x03c RegistryBase : 0x80adf000 Void
+0x040 ConfigurationRoot : 0x8082d450
_CONFIGURATION_COMPONENT_DATA
+0x044 ArcBootDeviceName : 0x8082d9a0
"multi(0)disk(0)rdisk(0)partition(4)"
+0x048 ArcHalDeviceName : 0x8082d788
"multi(0)disk(0)rdisk(0)partition(4)"
+0x04c NtBootPathName : 0x8082d828 "\Windows\"
+0x050 NtHalPathName : 0x80826358 "\"
+0x054 LoadOptions : 0x8080e1b0 "NOEXECUTE=ALWAYSON
DEBUGPORT=COM1 BAUDRATE=115200"
+0x058 NlsData : 0x808691e0 _NLS_DATA_BLOCK
+0x05c ArcDiskInformation : 0x80821408 _ARC_DISK_INFORMATION
+0x060 OemFontFile : 0x84a551d0 Void
+0x064 Extension : 0x8082d9d8
_LOADER_PARAMETER_EXTENSION
+0x068 u : <unnamed-tag>
+0x074 FirmwareInformation : _FIRMWARE_INFORMATION_LOADER_BLOCK

, MemoryDescriptorListHead !loadermemorylist
:

0: kd> !loadermemorylist 0x80a00000


Base Length Type
1 00000001 HALCachedMemory
2 00000004 HALCachedMemory
...
4a32 00000023 NlsData
4a55 00000002 BootDriver
4a57 00000026 BootDriver
4a7d 00000014 BootDriver
4a91 0000016f Free
4c00 0001b3f0 Free
1fff0 00000001 FirmwarePermanent
1fff1 00000002 FirmwarePermanent
1fff3 00000001 FirmwarePermanent
1fff4 0000000b FirmwarePermanent
1ffff 00000001 FirmwarePermanent
fd000 00000800 FirmwarePermanent
fec00 00000001 FirmwarePermanent
fee00 00000001 FirmwarePermanent
ffc00 00000400 FirmwarePermanent

Summary
Memory Type Pages
Free 0001bc50 ( 113744)
LoadedProgram 0000013d ( 317)
FirmwareTemporary 000006dd ( 1757)
FirmwarePermanent 00000c37 ( 3127)
OsloaderHeap 0000022a ( 554)
591

SystemCode 000005dc ( 1500)


BootDriver 00000968 ( 2408)
RegistryData 00002940 ( 10560)
MemoryData 00000035 ( 53)
NlsData 00000023 ( 35)
HALCachedMemory 0000001e ( 30)
======== ========
Total 00020bc5 ( 134085) = ~523MB

Ntoskrnl 0,
( 1). -
, ,
.
0 .
, 1.
Ntoskrnl KiSystemStartup, , ,
HalInitializeProcessor KiInitializeKernel.
,
, ,
. , BCD-
hypervisorlaunchtype,
. KiInitializeKernel
0 InitBootProcessor,
HalInitSystem.
InitBootProcessor
BCD-
burnmemory, . -
NLS-, Winload
( ), Unicode ANSI
OEM. HAL- HalInitSystem,
HAL , Windows
. , ,

,
. (
5 I.)
HalInitSystem ,
InitBootProcessor -
. -
. ,
.
Windows 64- ,
.
InitBootProcessor
, .
, -
. InitBootProcessor
592 13.

(control vector).
150 ,
HKLM\SYSTEM\CurrentControlSet\Control .
, .
InitBootProcessor -
0 , (driver
verifier) . .
1. ,
, , , -
,
Windows-, .
.
2. , ,
(, ,
) . ,
, .
3. -
, .

( 10).
,
.
InitBootProcessor HalInitializeBios -
BIOS, HAL. BIOS-,
EFI- ( -
) 16- , -
Bootvid VGA- .
Bootvid
InbvEnableBootDriver InbvDriverInitailize
.
InitBootProcessor Win-
load , ,
DbgLoadImageSymbols, ( )
. -
,
. InitBootProcessor
HvlInitSystem, , Win-
dows Hyper-V. HvlInitSystem
, InitBootProcessor HeadlessInit
,
(EMS).
InitBootProcessor ,
, ,
-. Winload
593

NLS- , ,
, .
( 3 I.)
InitBootProcessor , -
, ,
PnP-.
:
1.
, -
.
.
2.

. (
6 I.)
3. 0,
, ,
. -
, Idle .
System
Phase1Initialization. ,
.
4.
debug,
. ( -
3 I.)
5. PnP-
,
.
KiInitializeKernel
DPC- -
( x86), Idle,
,
, 1. (
8 1.)
1 :
1. Phase1InitializationDiscard, , , -
, INIT , .
2. 31
, .
3. NUMA/group,

594 13.

, NUMA- ,
BCD-.
4. HalInitSystem
.
5. , Windows,
-
. quietboot, .
6. sos, ,
Bootvid. ,
.
7. .
8. ( HalQueryRealTimeClock),
.
9. KeStartAllProcessors
HalAllProcessorsStarted .
, , -
,
, , numproc
onecpu, , (
).
.
10. ( \),
\ObjectTypes DOS- (\Global??).
\DosDevices
Windows.
11. ,
, , .
12. - ,
, , , .
13. -
, .
14. , ,
.
15. ()
.
16.
(Dbgk).
17. (
) ,
.
595

18. \Security -
. .
19. \SystemRoot.
20. \Device\PhysicalMemory -
( 10).
21. NLS- , -
.
22. Ntdll.dll.
23. -
.
24.
\Registry SYSTEM. -
Winload
HARDWARE.
25. -
. ,
BCD .
26.
INF- ( ,
8), .
27. superfetch prefetcher.
28. .
29. .
30. .
31. KdDebugger-Initialize1 , Kdcom.dll,
.
32. PnP- BIOS- PnP-.
33. (Advanced Local
Procedure Call, ALPC) ALPC- ALPC-
. LPC- .
34. ( BCD-
bootlog), .
.
35. -
, ,
, ,
. ,
596 13.

(, ) -
.
36. MiniNT/WinPE , -
. NLS-,
-
NLS-.
37. .
, ALPC-
.
38. -. -
, .
-
.
PnP-, HAL,
. (
- 8.)
Windows (Win-
dows Management Instrumentation, WMI),
WMI-. ( Windows
Management Instrumentation 4 I.)
Windows (Event Tracing for Windows, ETW). -
,
, ,
. ( ,
, 8.) -
Windows.
39. WPP (Windows software trace preprocessor
Windows-) ETW, WMI
. ( ETW WMI 4
I.)
40. , , -
, INF- ,
.
41. , .
42. , -
( Ntoskrnl ).
43. , SMP-
;
.
44. 32- DOS-
(Virtual DOS Machine, VDM), ,
(Virtual Machine Extensions, VME).
597

45. ,
,

(Ntdll.dll).
46. .
47. ,
.
48. LSASS -
. ( Windows
6 I.)
49. Smss ( 2
I). , -
Windows.
.
50. TPM-.
, , ,
TPM-. -
( , ),
. ,
. .
51. , -
, .

1
.
, SESSION5_INITIALIZATION_FAILED.
, -
1
( 10). ,

.

Smss, Csrss Wininit


Smss . -
, Windows . -,
Smss (native) .
Smss ,
, . -
, Smss API- Windows API-
, Windows nativeAPI.
API- Win32 Smss ,
598 13.

Windows . ,
Smss Windows.
Smss , -
, .
, , ,
. -
HKLM\SYSTEM\CurrentControlSet\Control\hivelist.
Smss :
1. Smss , -
. 5 I,
Smss . , Smss

. (
5 I.)
2. ,

. ( 7 I.)
3. SmpInit,
Smss, ,
Smss .
, .
4. SmpInit ALPC- (\SmApiPort)
(, ).
5. SmpInit SmpLoadDataFromRegistry,
, ,
SAFEBOOT.
6. SmpLoadDataFromRegistry SmpInitializeDosDevices,
DOS- (, COM1
LPT1).
7. SmpLoadDataFromRegistry \Sessions
( ).
8. SmpLoadDataFromRegistry ,
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute
SmpExecuteCommand. , Autochk
( Chkdsk, ).
9. SmpLoadDataFromRegistry SmpProcessFileRenames -
, HKLM\SYSTEM\
CurrentControlSet\Control\Session Manager\PendingFileRenameOperations HKLM\
SYSTEM\CurrentControlSet\Control\Session Manager\PendingFileRenameOperations2.
10.
SmpLoadDataFromRegistry SmpCreatePagingFiles
. -
599

HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory
Management\PagingFiles.
11. SmpLoadDataFromRegistry ,
NtInitializeRegistry.
, HKLM\SAM, HKLM\SECURITY HKLM\
SOFTWARE. HKLM\SYSTEM\CurrentControlSet\Control\
hivelist ,
\Windows\System32\Config.
12. SmpLoadDataFromRegistry SmpCreateDynamicEnvir
onmentVariables ,
HKLM\SYSTEM\CurrentControlSet\Session Manager\-Environment,
, , NUMBER_PROCESSORS,
PROCESSOR_ARCHITECTURE PROCESSOR_LEVEL.
13. SmpLoadDataFromRegistry , -
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SetupExecute -
SmpExecuteCommand. ,
Windows ,
Setupcl.exe.
14. SmpLoadDataFromRegistry SmpConfigureSharedSessionData
, (
, ), 0 (
Wininit.exe). -
, S0InitialCommand HKLM\SYSTEM\
CurrentControlSet\Control\Session Manager .
15. SmpLoadDataFromRegistry SmpInitializeKnownDlls
DLL-
\Knowndlls . DLL-, -
, HKLM\SYSTEM\CurrentControlSet\
Control\Session Manager\KnownDLLs, -
DllDirectory . 64- 32-DLL-
, Wow64,
DllDirectory32.
16. , SmpLoadDataFromRegistry SmpTranslateSyst
emPartitionInformation SystemPartition (
HKLM\SYSTEM\Setup, NT -
) , BootDir.
Windows Update ,
.
17. SmpLoadDataFromRegistry
SmpInit , .
Smss ( -
600 13.

0, NumberOfInitialSessions
Smss ),
SmpCreateInitialSession,
Smss. SmpStartCsr
Csrss.
18. Csrss
Windows (Win32k.sys) . Win32k.sys

. VGA-
, ,
.
19. Smss
, Psxss,
Unix-. (
3 I.)
20. Smss 0 0
( 14), Windows
(Wininit). Smss -
(Winlogon), Wininit .
Wininit Winlogon.


, DLL-
, -
Windows,
(hotpatching). API- MoveFileEx ,
. -
, , ,
API-
MoveFileEx . MoveFileEx
PendingFileRenameOperations PendingFileRenameOperations2
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager . -
MULTI_SZ, :
, .
.
Pendmoves, Windows Sysinternals (http://
www.microsoft.com/technet/sysinternals).

-
Smss Winlogon,
ALPC-
. Wininit Csrss , -
.
Winlogon .
Wininit , ,
.
601

0,
(UI0Detect.exe) -
. ( 4 I.)
Wininit SCM- (%SystemRoot%\System32\Services.exe),
,
, LSASS- (%SystemRoot%\System32\
Lsass.exe). (%SystemRoot%\
System32\Lsm.exe). 1 Winlogon,
(
Microsoft
-) LogonUI (%SystemRoot%\System32\
Logonui.exe), . ( -
Wininit, Winlogon LSASS
Winlogon 6 I.)
SCM-
, , -
. (
HKLM\SYSTEM\Select\LastKnownGood)
\CurrentControlSet.


,
LastKnownGood, ,
. .
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Re-
portBootOk 0 ,
, API-
NotifyBootConfigStatus, HKLM\SYSTEM\
CurrentControlSet\Control\BootVerificationProgram.

SCM Winlogon -
. (
6
I), Winlogon
HKCU. -
, HKCU\Environment,
, HKLM\SOFTWARE\Microsoft\Windows NT\
CurrentVersion\Winlogon\Notify.
Winlogon , , -
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinLogon\Userinit
( , ).
\Windows\System32\Userinit.exe. Userinit
.exe :
1. , HKCU\Software\
Policies\Microsoft\Windows\System\Scripts, ,
HKLM\SOFTWARE\Policies\Microsoft\Windows\System\Scripts. (
602 13.

, ,
.)
2. , Userinit.exe -
%SystemRoot%\System32\Proquota.exe.
3. , HKCU\Software\
Microsoft\Windows NT\CurrentVersion\Winlogon\Shell.
Userinit.exe , HKLM\SOFTWARE\
Microsoft\Windows NT\CurrentVersion\Winlogon\Shell. Explorer.exe.
Winlogon
. Microsoft,
(%SystemRoot%\System32\Mpr.dll), -
.
HKCU\Network HKCU\Printers . .13.4
Process Monitor
( ). Smss
( ).
, .

. 13.4.
603

ReadyBoot
700 , Windows
(
10),
.
; , -
,
.
ReadyBoost ( 10)
.
,
,
. %SystemRoot%\
Prefetch\Readyboot .fx,
HKLM\SYSTEM\CurrentControlSet\Services\Rdyboost\Parameters
REG_BINARY , .
, Ready-
Boost (Ecache.sys),
, .
, ReadyBoost,
. , ReadyBoot . Ready-
Boost 50 , (
) HKLM\SYSTEM\CurrentControlSet\
Services\Ecache\Parameters\ReadyBootStats , .13.5.

. 13.5. ReadyBoot


Userinit Shell Winlogon -
,
604 13.

.
Msconfig (%SystemRoot%\System32\Msconfig.exe) , -
. Sysinternals
Autoruns , Msconfig,
(.13.6). Autoruns
,
, Include Empty Locations Options
. Options ,
Microsoft, Verify
Image Signatures. ,
.

. 13.6. Autoruns Sysinternals

: Autoruns
, -
.
,
, , -
, . ,
,
Autoruns Sysinternals. Autoruns ,
Msconfig, .
.
605

,
Windows - , , -
.
Windows :
,
Windows (Windows Recovery Environment, WinRE).
, ,
.
, , WinRE ,
Windows.


(Last Known Good, LKG) -
-
. HKLM\SYSTEM\
CurrentControlSet\Control, HKLM\SYSTEM\
CurrentControlSet\Services,
. , ,
, F8
.
, , , -
HKLM\SYSTEM\Select Failed -
HKLM\SYSTEM\Select\Current HKLM\SYSTEM\Select\LastKnownGood.
HKLM\SYSTEM\CurrentControlSet,
LastKnownGood. Services
LastKnownGood ,
.


, Windows -
, .
- ,
.
(safe mode).
, .
, , Windows
, .
F8 -
. : Safe Mode
606 13.

( ), Safe Mode With Networking ( -


) Safe Mode With Command Prompt (
). -
. -
. ,
,
Windows-, -
, (Cmd.exe).
Windows Directory Services Restore
( ). -
Active Directory
.
.
, Active Directory. ,
- Active Directory.


Windows ,
, -
? HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
. Minimal Network, ,
, , . ,
vga.sys VGA,
.
PC- .
,
, . -
SafeBoot ,
, . ,
vga.sys Driver.
Boot
Driver Group. ( .inf), -
, - . -
List HKLM\SYSTEM\
CurrentControlSet\Control\ServiceGroupOrder. -
, Windows, -
. ServiceGroupOrder
.
. Group
.

HKLM\SYSTEM\CurrentControlSet\Services. , -
VgaSave VGA,
Video Save. , Windows
, , Boot file
607

system. File system,


Save Mode Save Mode with Networking.
(Winload) (Ntoskrnl.exe)
, BCD
. , Winload BCD-
safeboot, .
minimal,
network.
, Winload minimal
safebootalternateshell.
dsrepair.
Windows
InitSafeBoot

InitSafeBootMode , HKLM\SYSTEM\
CurrentControlSet\Control\SafeBoot\Option\OptionValue. -
, SCM, -
. ,
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option\
UseAlternateShell 1. , Winload,
HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions.
, HKLM\SYSTEM\
CurrentControlSet\Services, - IopLoadDriver.
PnP- -
, PipCallDriverAddDevice.
IopSafebootDriverLoad,
InitSafeBootMode ,
. ,
IopSafebootDriverLoad Minimal ,
. , IopSafebootDriverLoad -
, . -
, IopSafebootDriverLoad .
, . -
.
IopSafebootDriverLoad Network.
, IopSafebootDriverLoad -
.


, .
Winload ,
Start 0. Winload SafeBoot,
, ,
Start 0. , Winload
, Ntoskrnl.
608 13.


, ,
(SCM), Services.exe,
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Option\OptionValue, ,
.
SCM IopSafebootDriverLoad. SCM -
, HKLM\SYSTEM\CurrentControlSet\
Services,
. SCM
4 I.
Use-
rinit (%SystemRoot%\System32\Userinit.exe) -
, ,
. HKLM\SYSTEM\CurrentControlSet\Control\
SafeBoot\Option\UseAlternateShell. , Userinit
Explorer.exe, , HKLM\
SYSTEM\CurrentControlSet\Control\SafeBoot\AlternateShel. Windows
AlternateShell Cmd.exe,
Windows , -
. , ,
Explorer.exe.
.
?
GetSystemMetrics(SM_CLEANBOOT) .

SAFEBOOT_OPTION,
.


Winload -
, , , bootlog.
bootlog ,
. ,
. ,
IopSafebootDriverLoad -
- , IopBootLog
. , IopLoadDriver ,
, IopBootLog
. ,
, .
Chkdsk,
, IopBootLog -
. HKLM\
SYSTEM\CurrentControlSet\BootLog.
, (%SystemRoot%\System32\Smss.exe), -
609

Chkdsk, ,
NtInitializeRegistry. ,
, IopCopyBootLogRegistryToFile.
Windows (%SystemRoot%) Ntbtlog.txt
BootLog. IopCopyBootLogRegistryToFile
, IopBootLog , -
. :
Microsoft (R) Windows (R) Version 6.1 (Build 7601)
10 4 2012 09:04:53.375
Loaded driver \SystemRoot\system32\ntkrnlpa.exe
Loaded driver \SystemRoot\system32\hal.dll
Loaded driver \SystemRoot\system32\kdcom.dll
Loaded driver \SystemRoot\system32\mcupdate_GenuineIntel.dll
Loaded driver \SystemRoot\system32\PSHED.dll
Loaded driver \SystemRoot\system32\BOOTVID.dll
Loaded driver \SystemRoot\system32\CLFS.SYS
Loaded driver \SystemRoot\system32\CI.dll
Loaded driver \SystemRoot\system32\drivers\Wdf01000.sys
Loaded driver \SystemRoot\system32\drivers\WDFLDR.SYS
Loaded driver \SystemRoot\system32\drivers\acpi.sys
Loaded driver \SystemRoot\system32\drivers\WMILIB.SYS
Loaded driver \SystemRoot\system32\drivers\msisadrv.sys
Loaded driver \SystemRoot\system32\drivers\pci.sys
Loaded driver \SystemRoot\system32\drivers\volmgr.sys
Loaded driver \SystemRoot\system32\DRIVERS\compbatt.sys
Loaded driver \SystemRoot\system32\DRIVERS\BATTC.SYS
Loaded driver \SystemRoot\System32\drivers\mountmgr.sys
Loaded driver \SystemRoot\system32\drivers\intelide.sys
Loaded driver \SystemRoot\system32\drivers\PCIIDEX.SYS
Loaded driver \SystemRoot\system32\DRIVERS\pciide.sys
Loaded driver \SystemRoot\System32\drivers\volmgrx.sys
Loaded driver \SystemRoot\system32\drivers\atapi.sys
Loaded driver \SystemRoot\system32\drivers\ataport.SYS
Loaded driver \SystemRoot\system32\drivers\fltmgr.sys
Loaded driver \SystemRoot\system32\drivers\fileinfo.sys
...
Did not load driver @battery.inf,%acpi\acpi0003.devicedesc%;Microsoft AC Adapter
Did not load driver @battery.inf,%acpi\pnp0c0a.devicedesc%;Microsoft ACPI-Compliant
Control Method Battery
Did not load driver @oem46.inf,%nvidia_g71.dev_0297.1%;NVIDIA GeForce Go 7950 GTX
Did not load driver @oem5.inf,%nic_mpciex%;Intel(R) PRO/Wireless 3945ABG Network
Connection
Did not load driver @netb57vx.inf,%bcm5750a1clnahkd%;Broadcom NetXtreme 57xx Gigabit
Controller
Did not load driver @sdbus.inf,%pci\cc_080501.devicedesc%;SDA Standard Compliant
SD Host Controller
...

Windows
, -
- - . , .
, Safe,
610 13.

.
, .
( ,
.)
, , ,
(MBR).
Windows (Win-
dows Recovery Environment, WinRE). -

. :
Startup Repair ( ). , -
Windows -
.
System Restore ( ). -
, Windows .
System Image Recover ( ).
Windows Complete PC Restore ASR (Automated
System Recovery ). -
Windows , ,
.
Windows Memory Diagnostic Tool ( Windows).
. RAM
-
.
Command Prompt ( ). ,
(,
BCD),
Windows, -
.
, -
.
- Windows -
Windows Setup
.
System Recovery Options, .13.7.
Windows WinRE
. WinRE -
F8. .
Repair Your Computer, ,
. - ,
MicrosoftWinRE (http://blogs.msdn.com/winre)
WinRE Windows
Windows (Windows Automated Installation Kit, AIK).
611

. 13.7. System Recovery Options

-
, .13.8.
, .13.8, System Image Recovery.

. 13.8. System Recovery Options

, -
Winload , Bootmgr -
WinRE .
.13.8
Startup Repair (.13.9).
612 13.

. 13.9. Startup Repair

-
,
. -
, . , .13.10,
Startup Repair .

Root cause found:


----------------------------
Boot sector code for system disk partition is corrupt

Repair action: Boot sector repair


Result: Completed successfully. Error code = 0x0
Time taken = 171 ms

----------------------------
----------------------------

. 13.10. Startup Repair


613

Startup Repair -
,
System Recovery Options.


Windows (%SystemRoot%\Bootstat.dat)
,
. , Windows
Startup Repair
, -
.
,
:
( -
);
;
.
,
,
. ,
. API- (Runtime
Library, Rtl) Ntdll.dll ,
Windows . , BCD,
.


, -
, , .
. ,
Windows
Startup Repair
.

MBR

(MBR) -
BIOS (Power-On Self Test, POST),
BIOS -
, .
MBR : Invalid
partition table ( ), Error loading operating system
( ) Missing operating system (-
).
614 13.


MBR ,
Windows -
.

Windows, Command Prompt
bootrec /fixmbr. MBR.



MBR,
, , BIOS -
POST. A disk
read error occurred ( ), BOOTMGR is missing
( BOOTMGR) BOOTMGR is compressed ( BOOTMGR).

-
,
Windows .

Windows, Command Prompt
bootrec/fixboot.
.
, .

BCD

BIOS POST, , -
: Windows could not start because of a computer disk hardware configuration
problem ( Windows - -
), Could not read from selected boot disk (
) Check boot path and disk hardware
( ).

BCD- , -
- , .

Windows, Command Prompt -
bootrec/scanos bootrec/rebuildbcd. -
Windows.
, BCD
.
, BCD,
615

Bcdedit.exe BCD-
.



( ,
DLL) -. , BIOS
POST, : Windows could not start
because the following file is missing or corrupt ( Windows -
).
. , :
STOP: 0xC0000135 {Unable to Locate Component}.

, , -
.

Windows, Command Prompt -
chkdsk. Chkdsk
. ,
. , , %SystemRoot%\
winsxs\Backup, Windows
WRP (. Windows).
, . -
,
, .
, -
,
, . ,
, ,
, Backup and Restore ( -
), .
Backup and Restore ( ),
Maintenance () Start (), -
.
, ,
. -
Windows
( ).
,
Windows . Windows -
. ,
, .
,
.
616 13.

Windows
Windows (Windows Resource Protection, WRP)
,
, . -
(ACL), .
Sfc.exe API- (
%SystemRoot%\System32\Sfc.dll %SystemRoot%\System32\
Sfc_os.dll). -
.

WRP ,
( ). -
,
WRP, Modules Installer, TrustedInstaller.
.
, , (-
),
. WRP
,
.

, WRP ACL,
TrustedInstaller.
API- SfcIsFileProtected SfcIsKeyProtected
.

. -
, ,
,
WRP. , -
, .

(UAC), 6, . -
:

, , -
requestedExecutionLevel;
WRP (
TrustedInstaller);
(
UAC -
-).

WRP Windows , -
%SystemRoot%\winsxs\Backup. ,
, .
.
System File Checker (Sfc.exe), -
.
617

System

System ( 4) -
, BIOS POST, Winload
: Windows could not start because the following file is
missing or corrupt: \WINDOWS\SYSTEM32\CONFIG\SYSTEM (
Windows - : \WIN-
DOWS\SYSTEM32\CONFIG\SYSTEM).

System,
.

Windows, Command Prompt
chkdsk. ,
System. Windows 12 (
.OLD)
%SystemRoot%\System32\Config\RegBack.
System %SystemRoot%\System32\Config.
( -
9),
. System Restore -
Windows .



, Windows
, . -
,
, ,
.


, - ,
System.

.
(LKG). -
,
.

, ,
.
F8
.
618 13.

, LKG
, ,
. LKG , -
.reg , , ,
.
File ():
1. HKLM\SYSTEM\CurrentControlSet.
2. File () Export ()
good.reg.
3. HKLM\SYSTEM\Select, Failed -
HKLM\SYSTEM\ControlXXX, XXX Failed.
4. bad.reg.
5. WordPad CurrentControlSet
good.reg ControlSet.
6. ControlXXX bad.reg ControlSet.
7. Windiff Support Tools .
-
,
Control Parameters , Services.
Enum Services
.
,
, .
,
.
.
, ,
(
).
Action () Disable ().
, ,
,
. ,
Properties (), Roll Back Driver
() Driver ().

( -
).
, , ,

.
,
619


, .
-
,
, , -
F8 .
, (%SystemRoot%\System32\Smss.exe)
%SystemRoot%\ntbtlog.txt , -
, , .
,
.
. -
, ,
. Did not load driver ,
, Windiff. ,
, ,
. ( , .)
(-
, ), ,
, ,
, -
Driver Verifier . (
14.)


- , -
, ExitWindowsEx, Csrss
. , Csrss
RPC (Remote Procedure Call
) Winlogon,
. Winlogon
( , ,
) ExitWindowsEx
. Csrss -
.
Csrss , Winlogon, -
( ,
, ) ,
(shutdown level). , -
.
SetProcessShutdownParameters. 0 1023,
, , 640. , Explorer
2, 1. ,
620 13.

, Csrss
WM_QUERYENDSESSION Windows-.
TRUE, . Csrss
WM_ENDSESSION -
, HKCU\Control
Panel\Desktop\HungAppTimeout. ( 5000.)
, Csrss , -
.13.11. ( , HKCU\Control Panel\Desktop\
AutoEndTasks 1.) -
,
. Windows ,
,
. ( -,
.) ,
.
,
.

. 13.11.

: HungAppTimeout
, HungAppTimeout ,
, . ,
HungAppTimeout, Csrss.exe ,
Notepad. , ,
. Cancel Csrss.exe
.
621

( -
Notepad).
, -
.
. Csrss.exe , Notepad
, ,
.

-, Csrss
WM_QUERYENDSESSION WM_ENDSESSION -
, .
Csrss -
.
, Csrss ,
CTRL_LOGOFF_EVENT. (
.) FALSE, Csrss
. TRUE
HKCU\Control Panel\Desktop\WaitToKillAppTimeout (
20000), Csrss ,
.13.11.
Winlogon ExitWindowsEx, Csrss -
COM-, .
.
Wininit ExitWindowsEx, -
. Wininit Csrss 0,
. Csrss
WM_QUERYENDSESSION WM_ENDSESSION
GUI- ( ).
CTRL_LOGOFF_EVENT CTRL_SHUTDOWN_EVENT.
, (SCM)
, .
, , , -
.
( - SCM) 4 I.
Csrss -,
,
622 13.

. ( , - -
, , .)
-
. ,
, Smss, Wininit, Services LSASS.
Csrss ,
Winlogon NtShutdownSystem . ,
, PoSetSystemPowerState, -
(PnP-,
, -,
).
, PoSetSystemPowerState - -
- ,
.
Windows. ,
, -

. -
, .
-,
.
. ,
.

Windows
, .
Windows , , , -
, . , -
.
14.

Windows
. ,
Windows -
, .
Windows. -
, , -
, (crash dump)
, ,
.
, .
,
.
.
, ,
.

Windows ?
Windows .
, ,
, ,
. -
.
, (,
) (, USB- ) -
.

, Windows . ,
, ,
.
Windows?
,
? ,
. , ,
, -
.
,
, .
624 14.

Windows ,
RAM.


,
KeBugCheckEx , Windows Driver Kit (WDK).
- (stop code), (bugcheck code), -
, .
KeBugCheckEx , -
VGA (
Windows ) -
, -
. KeBugCheckEx (
KeRegisterBugCheckCallback)
, -
. ,
( KeRegisterBugCheckReasonCallback),

.
Technical information .14.1
- ,
KeBugCheckEx. -
-. -
0x000000D1 DRIVER_IRQL_NOT_LESS_OR_EQUAL.
(
.14.1), Windows ,
, .
.
300 -, -
. Windows
-. , - -
( -
, ).
- (
) (
, ).
-
Bug Checks (Blue Screens) Debugging Tools for Windows. (
1 I.) , -
- Microsoft
(http://support.microsoft.com).
, . Bugcodes.h
WDK 300 -
625

. , , - -
http://msdn.microsoft.com/en-us/library/windows/hardware/
hh406232(v=vs.85).aspx.

. 14.1.

Windows
, Windows 7 7SP1,
-, 91% ,
:
.
IRQL- DPC/dispatch , -
-. IRQL-
. ( IRQL -
3 I.) - :
0xA IRQL_NOT_LESS_OR_EQUAL;
0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL.
.

. -
10 -
. -:
0x9F DRIVER_POWER_STATE_FAILURE.
626 14.

. -

. -:
0x1E KMODE_EXCEPTION_NOT_HANDLED;
0x3B SYSTEM_SERVICE_EXCEPTION;
0x7E SYSTEM_THREAD_EXCEPTION_NOT_HANDLED;
0x7F UNEXPECTED_KERNEL_MODE_TRAP;
0x8E KERNEL_MODE_EXCEPTION_NOT_HANDLED P1 ,
0xC0000005 STATUS_ACCESS_VIOLATION.
.
, -


. -:
0x50 PAGE_FAULT_IN_NONPAGED_AREA;
0x8E KERNEL_MODE_EXCEPTION_NOT_HANDLED P1, 0xC0000005
STATUS_ACCESS_VIOLATION.
. ,
. , -
. -:
0x116 VIDEO_TDR_FAILURE.
.
. -:
0x19 BAD_POOL_HEADER;
0xC2 BAD_POOL_CALLER;
0xC5 DRIVER_CORRUPTED_EXPOOL.
.

. -:
0x1A MEMORY_MANAGEMENT;
0x4E PFN_LIST_CORRUPT.
.
(Non-Maskable Interrupt, NMI).
,
. -:
0x7A KERNEL_DATA_INPAGE_ERROR;
0x124 WHEA_UNCORRECTABLE_ERROR.
627

USB. (Universal Serial


Bus, USB) . -:
0xFE BUGCODE_USB_DRIVER.
. , -
Windows. -:
0xF4 CRITICAL_OBJECT_TERMINATION.
NTFS. -
NTFS. -:
0x24 NTFS_FILE_SYSTEM.
.14.2 -
Windows7 Windows7SP1 2012.

NTFS, 2,1 %
,
2,3 %
USB, 1,8 %
, 18,3 %

, ,
4,5 % 13,2 %


, 7,0 %
,
, 7,0 % 17,0 %

,
12,6 %
,
14,0 %

. 14.2.
- Windows 7 Windows 7 SP1 2012


-
.
,
628 14.

F8,
Last Known Good Configuration (
). Windows ,
(HKLM\SYSTEM\CurrentControlSet\Services)
( ).
,
. ( .13.)
(Bootmgr) -
Windows
Windows , .14.3.

, .

. 14.3. Windows

, -
, , .
-
,
.
(, Storport.sys SCSI-), ,
.
629

,
. -
HKLM\SYSTEM\CurrentControlSet\Services , Windows
,
.
DisplayName Description, , -
. , "Virus Scanner" DisplayName
.
System Information ( )
Start () All Programs ( )Accessories
()System Tools ()System Information ( -
). Software Environment ( )
System Drivers ( ). Process Explorer

( DLL System).
Properties ()
Details (). -
. ,
, .
-
.
, , . ,
Windows ,
. Windows
.
, .


Windows
.
System Properties ( ),
System () Advanced System
Settings ( ).
Advanced (), Settings () -
Startup And Recovery ( ). Windows,
, .14.4.
:
. -
. ,
1 .
256,

630 14.

256. ,
.
2 ,
, -
:
wmic recoveros set DebugInfoType=1

Wmic.exe
WMI- Win32 Provider CrashDumpEnabled -
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl 1.
Windows , ,
-
.

. 14.4.

.
,
. , -
, . -
,
. ,
, , -
,
, (kernel memory dump).
631

,
, -
. ,
Windows.
. 128 1,
(triage dump).
- , , -
, (
5 EPROCESS ETHREAD),
, , -
. , , ,
,
.


-
, KeRegisterBugCheckReasonCallback.
,
,
. 256 .
, ,
, . ,
, .
,
.

, ,
, !process .
!process :
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\Minidump\100911-22965-01.dmp]


Mini Kernel Dump File: Only registers and stack trace are available
...
0: kd> !process 0 0
**** NT ACTIVE PROCESS DUMP ****
GetPointerFromAddress: unable to read from fffff800030c5000
Error in reading nt!_EPROCESS at 0000000000000000

, -
,
. -
:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]



632 14.

Kernel Summary Dump File: Only kernel address space is available


...
0: kd> !process 0 0 explorer.exe
PROCESS fffffa8009b47540 ...

0: kd> .process fffffa8009b47540


Process fffffa80`09b47540 has invalid page directories


, .
, , .

( - , -
),
. ,
,
1 , 256 .

,
. ,
.
,
.
%SystemRoot%\Minidump , ,
, ,
(, 040712-24835-01.dmp). -
, GetTickCount
.
Windows 50-. -
, MinidumpsCount HKLM\SYSTEM\CurrentControlSet\
Control\CrashControl.
, - ,
. ( -
Ntoskrnl.exe.)
, , .
Microsoft ( ) Windows,
,
. (, -
.)
, -
, . -
,
. -
WinDbg - .dump /m.
- , ,
.
633


.dump LiveKd
, .
, .
,
. LiveKd -
m.
. API-
, . -
LiveKd Hyper-V
LiveKd . 657.

.
, ,
, ,
. , 64-
Windows 4 RAM 294.
,
. .14.1, -
, . ,

.
, -
, .
, .
, -
Notmyfault. ( .)
, ,
, . 32--
2 256,
2 (,
, increaseuserva,
1).
Memory.dmp,
, .14.4.

14.1.
, ,
<4 200
8 400
>= 8 800

, , Windows -
, .
634 14.

( ), Windows
, , Memory.dmp.
.
, .
25 .
- ,
System ,
.14.5. , DWORD
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\AlwaysKeepMemoryDump -
1. Windows
.

. 14.5.

:
, -
, ( ) -
.
,
. .dumpdebug .
, ,
:

0: kd> .dumpdebug
----- 64 bit Kernel Summary Dump Analysis

DUMP_HEADER64:
MajorVersion 0000000f
635

MinorVersion 00001db1
KdSecondaryVersion 00000000
DirectoryTableBase 00000001`ad6a2000
PfnDataBase fffffa80`00000000
PsLoadedModuleList fffff800`02a47670
PsActiveProcessHead fffff800`02a29350
MachineImageType 00008664
NumberProcessors 00000002
BugCheckCode 000000d1
BugCheckParameter1 fffff8a0`027475c0
BugCheckParameter2 00000000`00000002
BugCheckParameter3 00000000`00000000
BugCheckParameter4 fffff880`0343a361
KdDebuggerDataBlock fffff800`029f30a0
SecondaryDataState 00000000
ProductType 00000001
SuiteMask 00000110

SUMMARY_DUMP64:
DumpOptions 504d4453
HeaderSize 00049000
BitmapSize 00230000
Pages 000151f0
Bitmap.SizeOfBitMap 00230000

KiProcessorBlock at fffff800`02ab1c40
2 KiProcessorBlock entries:
fffff800`029f4e80 fffff880`009ec180

.enumtag .
, ( ASCII)
. API-
Debugger Extension , ,
, . ( -
Debugging Tools Windows.)

0: kd> .enumtag
{270A33FD-3DA6-460D-BA893C1BAE21E39B} - 0xfc8 bytes
09 00 00 00 00 00 00 00 48 00 00 00 13 00 00 00 ........H.......
48 08 00 00 14 00 00 00 C8 0F 00 00 15 00 00 00 H...............
C8 0F 00 00 17 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 EF B2 01 00 00 00 00 00 ................
...


HKLM\SYSTEM\
CurrentControlSet\Control\CrashControl . ,
- , . -
- dump.
DumpFilters .
, BitLocker Drive Encryption Crashdump Filter Dumpfve.sys.
636 14.

( BitLocker 9.) ,
,
, - ,
-
. , -
.
(%SystemRoot%\System32\Drivers\
Crashdmp.sys) ,
.
, , , -
. ,
Crashdmp.sys - -

,
( ).


-
, ,
.
, HAL, ,
,

. ( -
.)

(Smss.exe)
HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\
ExistingPageFiles -
. ( 10.)
SmpCheckForCrashDump,
.
PAGEDUMP PAGEDU64 32- 64- . -
.
HKLM\SYSTEM\CurrentControlSet\
Control\CrashControl ,
( %SystemRoot%\Memory.dmp,
).
,
. ,
(, , -
),
. (,
NtCreatePagingFile, .)
DUMPxxxx.tmp, xxxx
. ( , ,
637

100.)
hidden system
.
HKLM\SYSTEM\CurrentControlSet\
Control\CrashControl\MachineCrash
DumpFile. DWORD TempDestination,
, . -
,
. -
. DumpFile
, TempDestination
.
Wininit
MachineCrash, , Wininit WerFault (
), TempDestination
DumpFile. TempDestination 1, -
, WerFault ,
, ,
System Administrators. WerFault
FinalDumpFileLocation
MachineCrash. .14.6.

. 14.6.

, -
, SAN, ,
, Windows
(dedicated dump file), DedicatedDumpFile DumpFileSize
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl.
,
638 14.

. DumpFileSize Windows -
, .
Windows
( 32-
64-),
, 256.
,
, .

Microsoft
3 I, Windows
Windows (Windows Error Reporting, WER),
(, ) Microsoft
( ) . -
, . WER
,
Microsoft ( ,
). Problem Reporting Settings (
),
Action Center ( ) Change Action Center
Settings ( ), .14.7.
Windows.

. 14.7.
639

, Wininit.exe HKLM\SYSTEM\
CurrentControlSet\Control\CrashControl\MachineCrash, WerFault.exe -
k, c (k , c ,
),
. WerFault
Microsoft (On-
line Crash Analysis, OCA) , ,
:
1. , -
%SystemRoot%\Minidump.
MinidumpDir HKLM\
SYSTEM\CurrentControlSet\Control\CrashControl.
2. - HKLM\SOFTWARE\Microsoft\Windows\
Windows Error Reporting\KernelFaults\Queue.
3. WerFault (%SystemRoot%\System32\WerFault.exe) -
k, qr (qr
WerFault) HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce, WerFault
.


WerFault,
k, q (q
), -
. , Windows , WerFault
RunOnce.
WerFault HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\
KernelFaults\Queue ,
.
. WerFault.exe
XML:
,
, .
, OCA,
, WER, -
, .
(
), .14.8
,
. -
, WerFault XML- -
640 14.

https://oca.microsoft.com, -
.

. 14.8. ,

,
Microsoft,
( ). -
(bucket ID), , -
. ,
, .
WerFault URL- WER- (https://wer.microsoft.com).
Action Center ( )
System And Security (). ,
WER-
-. , -
, .


(OCA)
,
. ,
WinDbg Kd , -
OCA,
. , .
, ,
.
641

, -
Driver Verifier (.8)
.


OCA
, , .
, OCA -
. -
Microsoft. OCA ,
.

Notmyfault
, ,
Notmyfault, Windows Sysinternals (http://technet.microsoft.
com/en-us/sysinternals/bb963901). Notmyfault.exe
Myfault.sys. -
.14.9 ,
,
.
( Microsoft) .
Crash, Hang, Leak Paged Leak Nonpaged -
API DeviceIoControl ,
.

. 14.9. NotMyFault
642 14.


Notmyfault
, -
, .


Notmyfault (
), . -
Notmyfault ,
.


Notmyfault
High IRQL Fault (Kernel-Mode) Crash.
, IRQL- DPC/dispatch
. ( IRQL 3 I.)
, ,
- .
:
1. , .
2. IRQL- DPC/dispatch ,
, .
3. ,
.
,
. (
10.)
WinDbg
:
Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [C:\Windows\MEMORY.DMP]


Kernel Complete Dump File: Full address space is available

Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols


Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x82814000 PsLoadedModuleList = 0x8295e850
Debug session time: Wed Mar 21 08:12:50.194 2012 (UTC - 7:00)
System Uptime: 8 days 8:54:38.580
Loading Kernel Symbols
643

...............................................................
Loading User Symbols
......................
Loading unloaded module list
.....
****************************************************************************
* *
* Bugcheck Analysis *
* *
****************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck D1, {946ae800, 2, 0, 91df15ab}

*** ERROR: Module load completed but symbols could not be loaded for myfault.sys
Probably caused by : myfault.sys ( myfault+5ab )

Followup: MachineOwner
---------

, , WinDbg
Myfault.sys. ,
(
, Microsoft).
, .
. - -
, Probably caused by.
,
. Myfault.sys,
.
Followup, , . -
Microsoft,
Triage.ini, Triage Debugging Tools for
Windows. Microsoft
, .
Followup.


Notmyfault -
, ,
:
!analyze v


- .
:
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually caused by drivers

644 14.

using improper addresses.


If kernel debugger is available get stack backtrace.
Arguments:
Arg1: 946ae800, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 91df15ab, address which referenced memory

-
. ,
. ,
.

, -
. :
STACK_TEXT:
93cdbb3c 91df15ab badb0d00 84f3e380 946ad800 nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
93cdbbb8 91df19db 86d77900 93cdbbfc 91df1b26 myfault+0x5ab
93cdbbc4 91df1b26 85e38488 00000001 00000000 myfault+0x9db
93cdbbfc 8284b593 86c9a510 86d77900 86d77900 myfault+0xb26
93cdbc14 82a3f99f 85e38488 86d77900 86d77970 nt!IofCallDriver+0x63
93cdbc34 82a42b71 86c9a510 85e38488 00000000 nt!IopSynchronousServiceTail+0x1f8
93cdbcd0 82a893f4 86c9a510 86d77900 00000000 nt!IopXxxControlFile+0x6aa
93cdbd04 828521ea 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
93cdbd04 77af70b4 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a
0009f370 77af5864 75cb989d 000000c4 00000000 ntdll!KiFastSystemCallRet
0009f374 75cb989d 000000c4 00000000 00000000 ntdll!NtDeviceIoControlFile+0xc
0009f3d4 77a1a671 000000c4 83360018 00000000 KERNELBASE!DeviceIoControl+0xf6
0009f400 00c421f9 000000c4 83360018 00000000 kernel32!DeviceIoControlImplementation+
0x80
0009f4a0 7749c4e7 000201ec 00000111 000003f9 NotMyfault+0x21f9

,
Notmyfault DeviceIoControlImplementation Kernel32.dll, ,
, DeviceIoControl Kernelbase.dll ,
Myfault . -
,
-
.
, ,
, .
Myfault (nt Ntoskrnl).
, lm
( list modules ) .
k ( ), v ( )
m ():
0: kd> lm kv m myfault
start end module name
91df1000 91df2880 myfault (no symbols)
Loaded symbol image file: myfault.sys
645

Image path: \??\C:\Windows\system32\drivers\myfault.sys


Image name: myfault.sys
Timestamp: Sat Apr 07 09:34:40 2012 (4F806CA0)
CheckSum: 00003871
ImageSize: 00001880
File version: 4.0.0.0
Product version: 4.0.0.0
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 3.7 Driver
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Sysinternals
ProductName: Sysinternals Myfault
InternalName: myfault.sys
OriginalFilename: myfault.sys
ProductVersion: 4.0
FileVersion: 4.0 (sysinternals.com)
FileDescription: Crash Test Driver
LegalCopyright: Copyright 2002-2012 Mark Russinovich

, , -
, Windows
Update .
,
, .
( ),
.
Windows Update ,
, .

Update Driver Software ( ). Windows Update
,
. ,
.


Notmyfault
. , -
. -
, ,
.
-
, .
1. ,

, Driver Verifier,
646 14.

, . ( Driver Verifier -
8.)
2. 32- Windows, -
.
( 64- ,
, F8
Disable Driver Signature Enforcement.)
3. .
-
Driver Verifier .


Driver Verifier
, ( ),
Driver Verifier .

, Driver Verifier ,
, , .

Windows
. ,
,
, .

.

. ,
!pool. !pool
_. ,
. ,
, ,
, . ,
. Pooltag.txt Triage,
Debugging Tools for Windows ,
, Strings, -
Sysinternals.
,
. -
(use after free bug),
. ,
,
647

.
(Direct Memory Access, DMA).
, RAM,
, ,
-
. , -
, ,
, , , -
.
, , ,
,
. , ,
.
, .
, , RAM . -
- , -
, .
,
(, HTTP-, ..).


, Windows
-
. , , , -
, -
BAD_POOL_HEADER (0x19).

, , , -
Notmyfault Buffer Overflow.
Myfault 48.
Crash , -
, , - .
,
.
, Ntoskrnl .
-:
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is caused by drivers that have
corrupted the system pool. Run the driver verifier against any new (or suspect)
drivers, and if that doesn't turn up the culprit, then use gflags to enable special
pool.
Arguments:
Arg1: 4f4f4f53, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 829234a7, address which referenced memory
648 14.


Driver Verifier Gflags.
:
,
.
Driver Verifier ,

, .
, , -
.
, (
) ,
. 10.
, -
, . -
, ,
. , ,
, -
, ,
.

: .
Driver Verifier
, , -
, Driver Verifier Manager (-
) .
.
:

1. Start () verifier Enter


.
2. Display Information About The Currently Verified Drivers (-
) Next ().
3. Change (), Special Pool (
) OK. ( Enabled? (?)
No (), .)
4. Add (), File Name ( )
myfault.sys Open (). ( Myfault.sys
, .)
5. Next () ,

. Next ()
. -
Myfault.sys.
6. Finish () .
649

No Reboot Driver Verifier


, , .
.

Driver Verifier :

C:\>verifier /flags 0x1 /driver myfault.sys

New verifier settings:

Special pool: Enabled


Pool tracking: Disabled
Force IRQL checking: Disabled
I/O verification: Disabled
Deadlock detection: Disabled
DMA checking: Disabled
Security checks: Disabled
Force pending I/O requests: Disabled
Low resources simulation: Disabled
IRP Logging: Disabled
Miscellaneous checks: Disabled

Verified drivers:

myfault.sys

You must restart this computer for the changes to take effect.

Notmyfault ,
. :

Probably caused by : myfault.sys ( myfault+61d )

- :

DRIVER_PAGE_FAULT_BEYOND_END_OF_ALLOCATION (d6)
N bytes of memory was allocated and more than N bytes are being referenced.
This cannot be protected by try-except.
When possible, the guilty driver's name (Unicode string) is printed on the bug-
check screen and saved in KiBugCheckDriver.
Arguments:
Arg1: beb50000, memory referenced
Arg2: 00000001, value 0 = read operation, 1 = write operation
Arg3: 9201161d, if non-zero, the address which referenced memory.
Arg4: 00000000, (reserved)

,
.


, ,
. , -
650 14.

,
, .
,
, .
, ,
, , , , .
, -
, .
Notmyfault Code Overwrite,
Myfault NtReadFile .
. 2 , -
, Myfault.sys.
- , Myfault ,
:
ATTEMPTED_WRITE_TO_READONLY_MEMORY (be)
An attempt was made to write to readonly memory. The guilty driver is on the stack
trace (and is typically the current instruction pointer).
When possible, the guilty driver's name (Unicode string) is printed on the bugcheck
screen and saved in KiBugCheckDriver.
Arguments:
Arg1: 826a023c, Virtual address for the attempted write.
Arg2: 026a0121, PTE contents.
Arg3: 90f83b4c, (reserved)
Arg4: 0000000b, (reserved)

2, , -
. NtReadFile
, Windows ,
-
.
. ,
Win32k.sys Ntoskrnl.exe. :
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints the driver/
function that caused the problem. Always note this address as well as the link date of
the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard coded breakpoint
or assertion was hit, but this system was booted /NODEBUG. This is not supposed to
happen as developers should never have hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the system is booted /DEBUG.
This will let us see why this breakpoint is happening.
Arguments:
Arg1: c0000005, The exception code that was not handled
Arg2: 826a0240, The address that the exception occurred at
Arg3: 978eb9c4, Trap Frame
Arg4: 00000000

-
(system code write protection).
, Ntoskrnl.exe, HAL
651

(4 x86 x64 8
IA64). ,
.
(
).
2 RAM Ntoskrnl.exe HAL
(4 x86 16 IA64 x64).

, ,
. , -
Driver Verifier. , HKLM\SYSTEM\
CurrentControlSet\Control\Session Manager\Memory Management. -
, -
Ntoskrnl.exe .
LargePageMinimum DWORD 0xFFFFFFFF.
, .


, Driver Verifier
, .
,
. -
. ,
, .
Debugging Tools for Windows. ,
:
!cpuinfo ,
.
k , 1k, -
. , -
.
!thread
. ~s -
, ~1s.
( ).
.time ,
.
.
lm k, t ( t
, -
) . ,
652 14.


.
!vm , ,
.
.
.
, .
(
) 10.
!process 0 0 . -
, .
.
,
, . -
, , !irp. ,
.


- -
,
, , .
.

, ,
Notmyfault, , .
,
.
, ,
,
, , .
, -
,
.
Notmyfault Stack Trash
Myfault , -
, . Myfault
Ntoskrnl ,
, . -
, -
- , , .


.
653

, , -
, -
: KERNEL_MODE_EXCEPTION_NOT_HANDLED (0x8E) 32- KMODE_
EXCEPTION_NOT_HANDLED (0x1E) 64-.
:
STACK_TEXT:
9569b6b4 828c108c 0000008e c0000005 00000000 nt!KeBugCheckEx+0x1e
9569badc 8284add6 9569baf8 00000000 9569bb4c nt!KiDispatchException+0x1ac
9569bb44 8284ad8a 00000000 00000000 badb0d00 nt!CommonDispatchException+0x4a
9569bbfc 82843593 853422b0 86b99278 86b99278 nt!Kei386EoiHelper+0x192
00000000 00000000 00000000 00000000 00000000 nt!IofCallDriver+0x63

, IofCallDriver
Kei386EoiHelper , IRP- .
.
IRP- ,
. , -
, ,
. ,
, .
IRP-,
. -
- IRP- ,
ETHREAD . !thread
. ( -
, !thread .)
!irp:
0: kd> !thread
THREAD 8527fa58 Cid 0d0c.0d10 Teb: 7ffdf000 Win32Thread: fe4ec4f8 RUNNING on processor
0
IRP List:
86b99278: (0006,0094) Flags: 00060000 Mdl: 00000000
Not impersonating
...

0: kd> !irp 86b99278


Irp is active with 1 stacks 1 is current (= 0x86b992e8)
No Mdl: No System Buffer: Thread 8527fa58: Irp stack trace.
cmd flg cl Device File Completion-Context
>[ e, 0] 5 0 853422b0 85e3aed8 00000000-00000000
\Driver\MYFAULT
Args: 00000000 00000000 83360010 00000000

, IRP- (-
>) Myfault. -
, , ,
, .
Driver Verifier ( , -
).
654 14.


, WDK, /GS
( ).
,
cookie-
(security cookie). .
cookie-
. KeBug-
CheckEx - DRIVER_OVERRAN_STACK_BUFFER (0xF7).

.
(, esp rsp
x86 x64 ). -
, ,

. KiPreBugcheckStackSaveArea
KeBugCheckEx.
dps ( )
( )
, , -
.
32- :
0: kd> dps KiPreBugcheckStackSaveArea KiPreBugcheckStackSaveArea+3000
81d7dd20 881fcc44
81d7dd24 98fcf406 myfault+0x406
81d7dd28 badb0d00


Myfault, , ,
IRP-.
Debugging Tools for Windows.

,
(
), ,
, , (hung).
:
(Interrupt Service Routine, ISR)
(Deferred Procedure Call, DPC)
.
-

.
(
,
, ).
655


(deadlock detection) Driver Verifier. -,
, ,
. (
3 I.) Driver Verifier
, , -
. ,

, , . , ,
,
.
, , ,
.
, -
, . -,
,
. -, .
. -

.
,
HKLM\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters\CrashOnCtrlScroll
DWORD 1. i8042,
PS/2-, ISR-
( 3 I),
Scroll Lock Control. -
, KeBugCheckEx
- MANUALLY_INITIATED_CRASH (0xE2), ,
.
,
(, , , -
..). ,
, , ISR-
i8042. ( , - ,
IRQL- IRQL- ISR-, - , -
,
.)


USB- , -
i8042, .
PS/2-. , USB-,
http://msdn.microsoft.com/en-us/library/windows/hardware/ff545499.aspx.

,
crash. (
656 14.

.)
(Non-Maskable Interrupt,
NMI). 1 DWORD
HKLM\SYSTEM\CurrentControlSet\Control\CrashControl\NMICrashDump.
-
,
KeBugCheckEx. ,
i8042, IRQL- ,
i8042.
http://support.microsoft.com/kb/927069.
,
. .
. F8
Debugging Mode debuggingmode BCD,
debug. F8
, ( COM1
115200). F10 Edit Boot
Options,
. -
, , ,
, -
. . -
, IEEE1394 (FireWire) 1394
USB2.0 , USB-
. -
Debugging Tools for Windows -
. 660.

, ,
, IEEE1394-
USB2.0 . ,
. , -
WinDbg Kd,
. -
.


,
. , , ,
,
, .

-
. .dump
-.
657

( Microsoft). ,
- USB2.0
( 1394),
. -.
.dump /m. , , -
,
.crash. ,
.

: .
LiveKd
LiveKd .dump -
, Hyper-V.
hvl. LiveKd ,
GUID- :

C:\Users\Administrator>livekd -hvl

LiveKd v5.2 - Execute kd/windbg on a live system


Sysinternals - www.sysinternals.com
Copyright (C) 2000-2012 Mark Russinovich and Ken Johnson

Partition GUID Name


7EB669F2-EB6E-405D-94EA-21CB2ABD0A52 Windows Server 2008
D57D7601-D154-473B-847D-C3C77413AD0B Windows Server 2003

GUID LiveKd
hv o,
. LiveKd ,
, , .
Hyper-V , LiveKd
, -
. , LiveKd
Hyper-V
. p.
658 14.

, LiveKd , -

. -
, .
Hyper-V , LiveKd
.

, Notmyfault Hang With DPC.


Myfault DPC
, . DPC-
IRQL- DPC/dispatch, ISR
.
-
, !analyze -
hang.
.
, Notmyfault Hang With
DPC, .
!thread !process -
, , . (
~s, ~1s
1.) -
IRQL- DPC/dispatch ,
, !thread,
, .
,
Notmyfault:
STACK_TEXT:
8078ae30 8cb49160 000000e2 00000000 00000000 nt!KeBugCheckEx+0x1e
8078ae60 8cb49768 00527658 010001c6 00000000 i8042prt!I8xProcessCrashDump+0x251
8078aeac 8287c7ad 851c8780 855275a0 8078aed8 i8042prt!I8042KeyboardInterruptService+0x
2ce
8078aeac 91d924ca 851c8780 855275a0 8078aed8 nt!KiInterruptDispatch+0x6d
WARNING: Stack unwind information not available. Following frames may be wrong.
8078afa4 828a5218 82966d20 86659780 00000000 myfault+0x4ca
...

,
i8042 . Myfault ,
.
!locks, .
, ,
. , -
, !thread, ,
. ,
IRP- (
IRP- !thread ).
659

, IRP- . ( IRP-
.) !irp
, IRP-,
pending ( ).
, !stacks -
, . ,
. ,
.


, ,
- . , ,
.
.
,
. , ,
,
(
).
.
,
( ).

.
-
,
. , ,
, .

,
.
Automatically Restart ( -
) Startup And Recovery ( ),
.
.

. ,
.
,
-. -
. .dump
, -
.
660 14.

:

. .
F8
Debugging Mode. ,
,
BCDEdit:

bcdedit /debug on

, -
COM1 115200. - ,
, ,
. _NT_SYMBOL_PATH.
, Process Explorer
Process Monitor, .
, ,
:

setx _NT_SYMBOL_PATH srv*c:\symbols*http://msdl.microsoft.com/download/symbols /m

/m , . -
.
. , -
- .


Hyper-V. Hyper-V ( )
-
.
, .
661

-
, .
Hyper-V
resets=0 reconnect. (
Debugging Tools for Windows.)
, :

windbg -k com:pipe,port=\\.\pipe\debugger,resets=0,reconnect

WinDbg :

Microsoft (R) Windows Debugger Version 6.12.0002.633 AMD64


Copyright (c) Microsoft Corporation. All rights reserved.

Waiting for pipe \\.\pipe\debugger


Waiting to reconnect...

.
.
,
:

Connected to Windows 7 7601 x86 compatible target at


(Mon Mar 12 19:34:01.295 2012 (UTC - 7:00)), ptr64 FALSE
Kernel Debugger connection established.
Symbol search path is: srv*c:\symbols*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 7 Kernel Version 7601 (Service Pack 1) MP (1 procs) Free x86 compatible
Built by: 7601.17514.x86fre.win7sp1_rtm.101119-1850
Machine Name:
Kernel base = 0x82813000 PsLoadedModuleList = 0x8295d850
System Uptime: not available

, , -
/bugcheck Notmyfault, .
, -
Myfault.sys. , KeBugCheckEx
-. -,
:

notmyfault /bugcheck 0xdeaddead

-
, -
. ,
:

*** Fatal System Error: 0xdeaddead


(0x00000000,0x00000000,0x00000000,0x00000000)

Break instruction exception - code 80000003 (first chance)

A fatal system error has occurred.


Debugger entered on first try; Bugcheck callbacks have not been invoked.

A fatal system error has occurred.


...
662 14.

, , -
, .
, , , -
. ,
, .

, . x86
. -
.
(triple fault),
. . ,
, -
.


-
KiDispatchException. -
, ..

-
-,
Online Crash Analysis. -
!analyze v.
, ,
. -
Debugging Tools for Windows, ,
.

0xD1 DRIVER_IRQL_NOT_LESS_OR_EQUAL
- DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1) -

. ,
.
DRIVER_IRQL_NOT_LESS_OR_EQUAL (d1)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is usually caused by drivers
using improper addresses.
If kernel debugger is available get stack backtrace.
Arguments:
Arg1: a0a91660, memory referenced
Arg2: 00000002, IRQL
Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 85701579, address which referenced memory
- 663


, :
STACK_TEXT:
8b94bb3c 85701579 badb0d00 84f40600 a0a4f660 nt!KiTrap0E+0x2cf
WARNING: Stack unwind information not available. Following frames may be wrong.
8b94bbb8 85701849 86ffe5d8 8b94bbfc 857018ac myfault+0x579
8b94bbc4 857018ac 850d6890 00000001 00000000 myfault+0x849
8b94bbfc 8283e593 86efaa98 86ffe5d8 86ffe5d8 myfault+0x8ac
8b94bc14 82a3299f 850d6890 86ffe5d8 86ffe648 nt!IofCallDriver+0x63
8b94bc34 82a35b71 86efaa98 850d6890 00000000 nt!IopSynchronousServiceTail+0x1f8
8b94bcd0 82a7c3f4 86efaa98 86ffe5d8 00000000 nt!IopXxxControlFile+0x6aa
8b94bd04 828451ea 000000b8 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
8b94bd04 776f70b4 000000b8 00000000 00000000 nt!KiFastCallEntry+0x12a
0012f994 00000000 00000000 00000000 00000000 0x776f70b4


, ,
. ,
, .
(eip x86 rip x64) ,
. , .trap
, , ,
:
TRAP_FRAME: 8b94bb3c -- (.trap 0xffffffff8b94bb3c)
ErrCode = 00000000
eax=a0a91660 ebx=86ffe5f0 ecx=00200073 edx=84f40600 esi=a0a4f660 edi=00000000
eip=85701579 esp=8b94bbb0 ebp=8b94bbb8 iopl=0 nv up ei ng nz na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010286
myfault+0x579:
85701579 8b08 mov ecx,dword ptr [eax] ds:0023:a0a91660=????????

- DRIVER_IRQL_NOT_LESS_OR_EQUAL (0xD1) -
, .
(
), .

.
!pte ,

(valid bit). :
0: kd> !pte a0a91660
VA a0a91660
PDE at C0602828 PTE at C0505488
contains 0000000010BE6863 contains 00007A1800000000
pfn 10be6 ---DA--KWEV not valid
PageFile: 0
Offset: 7a18
Protect: 0
664 14.

0x8E KERNEL_MODE_EXCEPTION_NOT_HANDLED
- KERNEL_MODE_EXCEPTION_NOT_HANDLED (0x8E) ,
.
, .
STATUS_BREAKPOINT (0x80000003) STATUS_ACCESS_VIOLATION (0xC0000005).
KERNEL_MODE_EXCEPTION_NOT_HANDLED (8e)
This is a very common bugcheck. Usually the exception address pinpoints the driver/
function that caused the problem. Always note this address as well as the link date of
the driver/image that contains this address.
Some common problems are exception code 0x80000003. This means a hard coded breakpoint
or assertion was hit, but this system was booted /NODEBUG. This is not supposed to
happen as developers should never have hardcoded breakpoints in retail code, but ...
If this happens, make sure a debugger gets connected, and the system is booted /DEBUG.
This will let us see why this breakpoint is happening.
Arguments:
Arg1: 80000003, The exception code that was not handled
Arg2: 92c70a78, The address that the exception occurred at
Arg3: 9444fb4c, Trap Frame
Arg4: 00000000

, -
. ,
, .
, :
STACK_TEXT:
9444f6b4 828ba08c 0000008e 80000003 92c70a78 nt!KeBugCheckEx+0x1e
9444fadc 82843dd6 9444faf8 00000000 9444fb4c nt!KiDispatchException+0x1ac
9444fb44 82844678 9444fbc4 92c70a79 badb0d00 nt!CommonDispatchException+0x4a
9444fb44 92c70a79 9444fbc4 92c70a79 badb0d00 nt!KiTrap03+0xb8
WARNING: Stack unwind information not available. Following frames may be wrong.
9444fbc4 92c70b1c 8730f980 00000001 00000000 myfault+0xa79
9444fbfc 8283c593 87314a08 87279950 87279950 myfault+0xb1c
9444fc14 82a3099f 8730f980 87279950 872799c0 nt!IofCallDriver+0x63
9444fc34 82a33b71 87314a08 8730f980 00000000 nt!IopSynchronousServiceTail+0x1f8
9444fcd0 82a7a3f4 87314a08 87279950 00000000 nt!IopXxxControlFile+0x6aa
9444fd04 828431ea 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
9444fd04 772c70b4 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a
0012f2ac 00000000 00000000 00000000 00000000 0x772c70b4

.
STATUS_BREAKPOINT .
INT3 .
INT3 .
, .
0: kd> u 92c70a78
myfault+0xa78:
92c70a78 cc int 3
...

-
. lm ,
- 665

. (
-) , .
File flags Debug , :
0: kd> lm kv m myfault
start end module name
92c70000 92c71880 myfault (no symbols)
Loaded symbol image file: myfault.sys
Image path: \??\C:\Windows\system32\drivers\myfault.sys
Image name: myfault.sys
Timestamp: Sat Apr 07 09:34:40 2012 (4F806CA0)
CheckSum: 00004227
ImageSize: 00001880
File version: 4.0.0.0
Product version: 4.0.0.0
File flags: 1 (Mask 3F) Debug
File OS: 40004 NT Win32
...

-
ASSERT. , , -
,
.

0x7F UNEXPECTED_KERNEL_MODE_TRAP
- UNEXPECTED_KERNEL_MODE_TRAP (0x7F) ,
, Windows .
(bound trap), , -
, (double fault), ,
.
.
UNEXPECTED_KERNEL_MODE_TRAP (7f)
This means a trap occurred in kernel mode, and it's a trap of a kind that the kernel
isn't allowed to have/catch (bound trap) or that is always instant death (double
fault). The first number in the bugcheck params is the number of the trap (8 = double
fault, etc)
Consult an Intel x86 family manual to learn more about what these traps are. Here is a
*portion* of those codes:
If kv shows a taskGate
use .tss on the part before the colon, then kv.
Else if kv shows a trapframe
use .trap on that value
Else
.trap on the appropriate frame will show where the trap was taken
(on x86, this will be the ebp that goes with the procedure KiTrap)
Endif
kb will then show the corrected stack.
Arguments:
Arg1: 00000008, EXCEPTION_DOUBLE_FAULT
Arg2: 801db000
Arg3: 00000000
Arg4: 00000000
666 14.


. -
, ,
. , ,
.
.
, , .
(
) , :
TSS: 00000028 -- (.tss 0x28)
eax=8336001c ebx=86d57388 ecx=83360044 edx=00000000 esi=86d57388 edi=00000000
eip=96890918 esp=92985000 ebp=92987bc4 iopl=0 nv up ei pl zr na pe nc
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010246
myfault+0x918:
96890918 e8f9ffffff call myfault+0x916 (96890916)

EXCEPTION_DOUBLE_FAULT
: .
-
,
. , ,
.
!thread
, -
:
0: kd> !thread
THREAD 850e3918 Cid 0fb8.0fbc Teb: 7ffde000 Win32Thread: fe4f0dd8 RUNNING on processor
0
IRP List:
86d57370: (0006,0094) Flags: 00060000 Mdl: 00000000
Not impersonating
DeviceMap 8fa3b8e8
Owning Process 85100670 Image: NotMyfault.exe
Attached Process N/A Image: N/A
Wait Start TickCount 21664 Ticks: 0
Context Switch Count 461
UserTime 00:00:00.000
KernelTime 00:00:00.046
Win32 Start Address 0x00fe27ff
Stack Init 92987fd0 Current 92987af8 Base 92988000 Limit 92985000 Call 0
Priority 12 BasePriority 8 UnusualBoost 0 ForegroundBoost 2 IoPriority 2 PagePriority 5
ChildEBP RetAddr Args to Child
00000000 96890918 00000000 00000000 00000000 nt!KiTrap08+0x75 (FPO: TSS 28:0)
WARNING: Stack unwind information not available. Following frames may be wrong.
92987bc4 96890b1c 87015038 00000001 00000000 myfault+0x918
92987bfc 82845593 85154158 86d57370 86d57370 myfault+0xb1c
92987c14 82a3999f 87015038 86d57370 86d573e0 nt!IofCallDriver+0x63
92987c34 82a3cb71 85154158 87015038 00000000 nt!IopSynchronousServiceTail+0x1f8
92987cd0 82a833f4 85154158 86d57370 00000000 nt!IopXxxControlFile+0x6aa
92987d04 8284c1ea 000000c4 00000000 00000000 nt!NtDeviceIoControlFile+0x2a
92987d04 779a70b4 000000c4 00000000 00000000 nt!KiFastCallEntry+0x12a (FPO: [0,3]
TrapFrame @ 92987d34)
0012f424 00000000 00000000 00000000 00000000 0x779a70b4
- 667

: .
, ( esp)
, ,
. ( .)
, , -
, , :
. dps,
, , :
0: kd> dps 92985000 92988000
92985000 9689091d myfault+0x91d
92985004 9689091d myfault+0x91d
92985008 9689091d myfault+0x91d
...

Myfault.sys.
, .
,
, . -
, .
( ) , -
.

0xC5 DRIVER_CORRUPTED_EXPOOL
,
.
Driver Verifier -
.
. .
- DRIVER_CORRUPTED_EXPOOL (0xC5)
IRQL-
. - IRQL_NOT_LESS_OR_EQUAL
(0xA). KeBugCheck2 ( KeBugCheckEx
) -. IRQL_NOT_LESS_OR_
EQUAL (0xA) ,
, .
, Windows,
- DRIVER_CORRUPTED_EXPOOL (0xC5). ,
,
.
DRIVER_CORRUPTED_EXPOOL (c5)
An attempt was made to access a pageable (or completely invalid) address at an
interrupt request level (IRQL) that is too high. This is caused by drivers that have
corrupted the system pool. Run the driver verifier against any new (or suspect)
drivers, and if that doesn't turn up the culprit, then use gflags to enable special
pool.
Arguments:
Arg1: 4f4f4f53, memory referenced

668 14.

Arg2: 00000002, IRQL


Arg3: 00000000, value 0 = read operation, 1 = write operation
Arg4: 829234a7, address which referenced memory


Ntoskrnl .
,
, Windows:
STACK_TEXT:
8b8e3554 829234a7 badb0d00 00000000 91470d90 nt!KiTrap0E+0x2cf
8b8e3610 8288d2c6 00000000 00000280 76615358 nt!ExAllocatePoolWithTag+0x49d
8b8e3620 8288d19d 00000001 00000053 8b8e38a8 nt!KeAllocateXStateContext+0x25
8b8e3644 8288d6b5 00000003 00000000 8b8e37b4 nt!KeSaveExtendedProcessorState+0x104
8b8e3658 9139b443 8b8e37b4 fe7b8010 8288d038 nt!KeSaveFloatingPointState+0x14
8b8e3864 9139bfdb fe8af408 ffbbd540 00000000 win32k!EngAlphaBlend+0x230
8b8e38d0 9139c394 fe7b8010 fe989010 fe1c0010 win32k!SURFREFDC::vUnlock+0x1e5
8b8e3974 913a4a2f fe7b8010 fe989010 00000000 win32k!SURFREFDC::vUnlock+0x59e
8b8e39d4 913a4981 fe7b8010 fe989010 00000000 win32k!EngNineGrid+0x6e
8b8e3a34 913a4847 fe7b8010 fe989010 00000000 win32k!EngDrawStream+0x109
8b8e3aa8 913a13a3 8b8e3ba4 00000000 fe989000 win32k!NtGdiDrawStreamInternal+0x232
8b8e3bd4 913a0e09 3a010231 00000000 fe9ef140 win32k!GreDrawStream+0x557
8b8e3d20 828401ea 3a010231 00000060 0012f628 win32k!NtGdiDrawStream+0x8c
8b8e3d20 774570b4 3a010231 00000060 0012f628 nt!KiFastCallEntry+0x12a
0012f49c 75c973a5 75c9738f 3a010231 00000060 ntdll!KiFastSystemCallRet
0012f4a0 75c9738f 3a010231 00000060 0012f628 GDI32!NtGdiDrawStream+0xc
0012f5a4 74243efa 3a010231 00000060 0012f628 GDI32!GdiDrawStream+0x432



, .
,
:
TRAP_FRAME: 8b8e3554 -- (.trap 0xffffffff8b8e3554)
eax=8b8e35f8 ebx=82939940 ecx=4f4f4f4f edx=00000000 esi=82939da8 edi=82939944
eip=829234a7 esp=8b8e35c8 ebp=8b8e3610 iopl=0 ov up ei ng nz na po cy
cs=0008 ss=0010 ds=0023 es=0023 fs=0030 gs=0000 efl=00010a83
nt!ExAllocatePoolWithTag+0x49d:
829234a7 8b4104 mov eax,dword ptr [ecx+4] ds:0023:4f4f4f53=????????

, -
, .
, ecx,
4 (
eax). ,
.
, ecx , -
, . -

:
0: kd> ub 829234a7
nt!ExAllocatePoolWithTag+0x479:
...
829234a5 8b0e mov ecx,dword ptr [esi]
- 669

, ecx ,
, esi. dc , -
esi , ,
4f4f4f4f. ,
, ( ) -
:
0: kd> dc 82939da8
82939da8 4f4f4f4f 85045810 82939db0 82939db0 OOOO.X..........
82939db8 82939db8 82939db8 86f749f8 86f749f8 .........I...I..
82939dc8 82939dc8 82939dc8 82939dd0 82939dd0 ................
82939dd8 82939dd8 82939dd8 82939de0 82939de0 ................
82939de8 82939de8 82939de8 82939df0 82939df0 ................
...

, ,
, , -
, . ASCII 4f4f4f4f
OOOO, :
0: kd> dc 85045810
85045810 4f4f4f4f 4f4f4f4f 4f4f4f4f 4f4f4f4f OOOOOOOOOOOOOOOO
85045820 4f4f4f4f 4f4f4f4f 4f4f4f4f 4f4f4f4f OOOOOOOOOOOOOOOO
85045830 46524556 00574f4c 00000000 00000000 VERFLOW.........
85045840 00000000 00000000 00000000 00000000 ................
85045850 00000000 00000000 00000000 00000000 ................
...

!pool ,
:
0: kd> !pool 85045810
Pool page 85045810 region is Nonpaged pool
85045000 size: 808 previous size: 0 (Allocated) None
85045808 is not a valid large pool allocation, checking large session pool...
85045808 is freed (or corrupt) pool
Bad previous allocation size @85045808, last size was 101

,
.
.
.

"OVERFLOW". !for_each_module
.
, :
0: kd> !for_each_module .foreach (address {s -[1]a @#Base @#End "OVERFLOW"}) {lm 1m a
address}
BTHUSB
CLASSPNP
CLASSPNP
rfcomm
rfcomm
rfcomm
...
myfault
670 14.

, -
, .

Driver Verifier.


. -
.
.14.10.
, .
,
AutoReboot HKLM\SYSTEM\CurrentControlSet\Control\CrashControl.

. 14.10.

, , , -
, ,
, , .
, , -
. , .

(NMI) HKLM\SYSTEM\
CurrentControlSet\Control\CrashControl\NMICrashDump.

, NMICrashDump.
671

:
, ,
Sysinternals Blue Screen, -
Sysinternals.
Windows,
, . ,
, Windows.
, , Blue Screen
.

Psexec Sysinternals
. :

psexec \\computername c f i d "SysInternalsBluescreen.scr" s accepteula


. ( u p .)
, !


, ,
. ,
:
Microsoft Platforms Global Escalation Services http://blogs.
msdn.com/ntdebugging. ,
, .
http://www.dumpanalysis.org ,
.

Windows
Azure Microsoft, -
. Zero Day (Thomas Dunne
Books, 2011) Windows Sysinternals Administrators
Reference (Microsoft Press, 2011). Microsoft
2006 Microsoft Winternals
Software, 1996 ,
Sysinternals,
Windows. -
.
(@markrussinovich) Facebook (http://facebook.com/
markrussinovich).

(www.
solsem.com),
Microsoft Windows NT
1992 . Windows Internals,
IT- .
, -
, Microsoft.
Microsoft Most Valuable Professional 1993 2005
2008 .
,
Digital Equipment
Corporation VMS.
Windows NT for Open VMS Professionals (Digital Press/Butterworth Heinemann,
1996), Windows NT -
, VMS. , Inside Windows NT, Second Edition
(Microsoft Press, 1998), Windows NT 4.0. -
(Inside Windows 2000)
.
-
, Microsoft TechEd Microsoft PDC. -

Windows NT. Windows, ,
.