Mark Russinovich编著的《深入解析Windows操作系统(卷2英文版第6版)》系统全面介绍了Windows操作系统相关知识，本书内容丰富，信息全面，适合众多Windows平台开发人员、系统管理员阅读。

Mark Russinovich编著的《深入解析Windows操作系统(卷2英文版第6版)》是操作系统内核专家Russinovich等人的Windows操作系统原理的最新版著作，针对Windows 7和Windows Server 2008 R2进行了全面的更新，主要讲述Windows的底层关键机制、Windows的核心组件（包括进程/线程/作业，安全性，I/O系统，存储管理、内存管理、缓存管理、文件系统和网络），并分析了启动进程、关机进程以及缓存转储。书中提供了许多实例，读者可以借此更好地理解Windows的内部行为。

《深入解析Windows操作系统(卷2英文版第6版)》内容丰富，信息全面，适合众多Windows平台开发人员、系统管理员阅读。

Windows Internals, Sixth Edition, Part 1

 (See appendix for Part 1's table of contents)

Chapter 8　I/O System

 I/O System Components

 The I/O Manager

 Typical I/O Processing

 Device Drivers

 Types of Device Drivers

 Structure of a Driver

 Driver Objects and Device Objects

 Opening Devices

 I/O Processing

 Types of I/O

 I/O Request to a Single-Layered Driver

 I/O Requests to Layered Drivers

 I/O Cancellation

 I/O Completion Ports

 I/O Prioritization

 Container Notifications

 Driver Verifier

 Kernel-Mode Driver Framework (KMDF)

 Structure and Operation of a KMDF Driver

 KMDF Data Model

 KMDF I/O Model

 User-Mode Driver Framework (UMDF)

 The Plug and Play (PnP) Manager

 Level of Plug and Play Support

 Driver Support for Plug and Play

 Driver Loading, Initialization, and Installation

 Driver Installation

 The Power Manager

 Power Manager Operation

 Driver Power Operation

 Driver and Application Control of Device Power

 Power Availability Requests

 Processor Power Management (PPM)

 Conclusion

Chapter 9　Storage Management

 Storage Terminology

 Disk Devices

 Rotating Magnetic Disks

 Solid State Disks

 Disk Drivers

 Winload

 Disk Class, Port, and Miniport Drivers

 Disk Device Objects

 Partition Manager

 Volume Management

 Basic Disks

 Dynamic Disks

 Multipartition Volume Management

 The Volume Namespace

 Volume I/O Operations

 Virtual Disk Service

 Virtual Hard Disk Support

 Attaching VHDs

 Nested File Systems

 BitLocker Drive Encryption

 Encryption Keys

 Trusted Platform Module (TPM)

 BitLocker Boot Process

 BitLocker Key Recovery

 Full-Volume Encryption Driver

 BitLocker Management

 BitLocker To Go

 Volume Shadow Copy Service

 Shadow Copies

 VSS Architecture

 VSS Operation

 Uses in Windows

 Conclusion

Chapter 10 Memory Management

 Introduction to the Memory Manager

 Memory Manager Components

 Internal Synchronization

 Examining Memory Usage

 Services Provided by the Memory Manager

 Large and Small Pages

 Reserving and Committing Pages

 Commit Limit

 Locking Memory

 Allocation Granularity

 Shared Memory and Mapped Files

 Protecting Memory

 No Execute Page Protection

 Copy-on-Write

 Address Windowing Extensions

 Kernel-Mode Heaps (System Memory Pools)

 Pool Sizes

 Monitoring Pool Usage

 Look-Aside Lists

 Heap Manager

 Types of Heaps

 Heap Manager Structure

 Heap Synchronization

 The Low Fragmentation Heap

 Heap Security Features

 Heap Debugging Features

 Pageheap

 Fault Tolerant Heap

 Virtual Address Space Layouts

 x86 Address Space Layouts

 x86 System Address Space Layout

 x86 Session Space

 System Page Table Entries

 64-Bit Address Space Layouts

 x64 Virtual Addressing Limitations

 Dynamic System Virtual Address Space Management

 System Virtual Address Space Quotas

 User Address Space Layout

 Address Translation

 x86 Virtual Address Translation

 Translation Look-Aside Buffer

 Physical Address Extension (PAE)

 x64 Virtual Address Translation

 IA64 Virtual Address Translation

 Page Fault Handling

 Invalid PTEs

 Prototype PTEs

 In-Paging I/O

 Collided Page Faults

 Clustered Page Faults

 Page Files

 Commit Charge and the System Commit Limit

 Commit Charge and Page File Size

 Stacks

 User Stacks

 Kernel Stacks

 DPC Stack

 Virtual Address Descriptors

 Process VADs

 Rotate VADs

 NUMA

 Section Objects

 Driver Verifier

 Page Frame Number Database

 Page List Dynamics

 Page Priority

 Modified Page Writer

 PFN Data Structures

 Physical Memory Limits

 Windows Client Memory Limits

 Working Sets

 Demand Paging

 Logical Prefetcher

 Placement Policy

 Working Set Management

 Balance Set Manager and Swapper

 System Working Sets

 Memory Notification Events

 Proactive Memory Management (Superfetch)

 Components

 Tracing and Logging

 Scenarios

 Page Priority and Rebalancing

 Robust Performance

 ReadyBoost

 ReadyDrive

 Unified Caching

 Process Reflection

 Conclusion

Chapter 11 Cache Manager

 Key Features of the Cache Manager

 Single, Centralized System Cache

 The Memory Manager

 Cache Coherency

 Virtual Block Caching

 Stream-Based Caching

 Recoverable File System Support

 Cache Virtual Memory Management

 Cache Size

 Cache Virtual Size

 Cache Working Set Size

 Cache Physical Size

 Cache Data Structures

 Systemwide Cache Data Structures

 Per-File Cache Data Structures

 File System Interfaces

 Copying to and from the Cache

 Caching with the Mapping and Pinning Interfaces

 Caching with the Direct Memory Access Interfaces

 Fast I/O

 Read-Ahead and Write-Behind

 Intelligent Read-Ahead

 Write-Back Caching and Lazy Writing

 Write Throttling

 System Threads

 Conclusion

Chapter 12 File Systems

 Windows File System Formats

 CDFS

 UDF

 FAT12, FAT16, and FAT32

 exFAT

 NTFS

 File System Driver Architecture

 Local FSDs

 Remote FSDs

 File System Operation

 File System Filter Drivers

 Troubleshooting File System Problems

 Process Monitor Basic vs　Advanced Modes

 Process Monitor Troubleshooting Techniques

 Common Log File System

 NTFS Design Goals and Features

 High-End File System Requirements

 Advanced Features of NTFS

 NTFS File System Driver

 NTFS On-Disk Structure

 Volumes

 Clusters

 Master File Table

 File Record Numbers

 File Records

 File Names

 Resident and Nonresident Attributes

 Data Compression and Sparse Files

 The Change Journal File

 Indexing

 Object IDs

 Quota Tracking

 Consolidated Security

 Reparse Points

 Transaction Support

 NTFS Recovery Support

 Design

 Metadata Logging

 Recovery

 NTFS Bad-Cluster Recovery

 Self-Healing

 Encrypting File System Security

 Encrypting a File for the First Time

 The Decryption Process

 Backing Up Encrypted Files

 Copying Encrypted Files

 Conclusion

Chapter 13 Startup and Shutdown

 Boot Process

 BIOS Preboot

 The BIOS Boot Sector and Bootmgr

 The UEFI Boot Process

 Booting from iSCSI

 Initializing the Kernel and Executive Subsystems

 Smss, Csrss, and Wininit

 ReadyBoot

 Images That Start Automatically

 Troubleshooting Boot and Startup Problems

 Last Known Good

 Safe Mode

 Windows Recovery Environment (WinRE)

 Solving Common Boot Problems

 Shutdown

 Conclusion

Chapter 14 Crash Dump Analysis

 Why Does Windows Crash?

 The Blue Screen

 Causes of Windows Crashes

 Troubleshooting Crashes

 Crash Dump Files

 Crash Dump Generation

 Windows Error Reporting

 Online Crash Analysis

 Basic Crash Dump Analysis

 Notmyfault

 Basic Crash Dump Analysis

 Verbose Analysis

 Using Crash Troubleshooting Tools

 Buffer Overruns, Memory Corruption, and Special Pool

 Code Overwrite and System Code Write Protection

 Advanced Crash Dump Analysis

 Stack Trashes

 Hung or Unresponsive Systems

 When There Is No Crash Dump

 Analysis of Common Stop Codes

 0xD1 - DRIVER_IRQL_NOT_LESS_OR_EQUAL

 0x8E - KERNEL_MODE_EXCEPTION_NOT_HANDLED

 0x7F - UNEXPECTED_KERNEL_MODE_TRAP

 0xC5 - DRIVER_CORRUPTED_EXPOOL

 Hardware Malfunctions

 Conclusion

 Appendix: Contents of Windows Internals, Sixth Edition, Part 1

 Index