微内核与WinOS解析

《微内核与WinOS解析》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

MACH
:MACHᵫCMU(CarnegieMellonUniversity)ᓝẆᑴḄᑖ
ᐸ᪗ᢝ"ᦣஹ%὚ᔠ(ᜐᳮ+,-᪀(Loosely-coupledDistributedMemoryMultiprocessor),/0(ᜐᳮᘤ23ᓫ+5ᡂḄ789᛻;ᑁ᪶MicrokernelூIJ௃LMicrokernel;ᑁ᪶ᑁ᪶MN
Ḅ᪶OPQ஺;ᑁ᪶ᑁ᪶ḄST᱐VW^Yᓝᡂᙠ[\Ḅᑁ]^^ᑁ_`abឋMNdeᓄ2gYᓝ/hᵨᡝklmnḄop,᝞UNIXஹDOS.Windows,WorkplaceOS.WorkplaceUNIX஺IBMஹMicroaoft,1ₚ:"(OSF)UNIX^^(USL)
ᵨitiẆᡂḄi஺☢ᑡ¡℉£Ḅ;ᑁ᪶
‖MachCarnegie-MelIonᜧªYᓝ஺NucleusChorus¬(Beaverton,Oregon)rSnf>^¬£឵±^ᙠ²█஺᝞´ᡠ¶;ᑁ᪶ᑁ᪶Ḅ¡ST5·¸ᑁ᪶ºᡂᙠ»Ḅ¼½¾¿ᑖÀᩭÂᡂÃ/᪷᳎◤Ç`ᐭḄ⌹⍝ËÌÃMNÍÎḄÃ^ÏឋÍ`ᨵᦔḄÒᵨÓ᛻஺hᵨ;ᑁ᪶ÔLYᓝÕÖᓣØÙ⌕ᵨdeÛᣚ⃩dem◤⌕ᦋß᦮,I
஺ᡃâÃ/ᵨᖪäÕå5fcIJ;ᑁ᪶Ḅd᛻ᭆè஺ὃ!ëìIíîïðḄᖪ½^ᳮ஺·⍗òó
ᑖôᔠᐸìõ⍝ö^ᳮÃ/òìḄQ÷Íᨵᦔᙢᵨùú⌕Ḅᖪ½ó
û`ºùᐸìüý½þ᝞^ÿḄᖪᑖ஺ᩭᢝᨌḄᖪ஺^ᳮ៬ᵫᐸḄᶌ^⌕Ḅ#஺%&'(ᑁ᪶+,-ᢝ./01᪶234ᳮ567᛻Ḅ஺ᵨ⍝;<=(ᑁ᪶>?@AḄBCDᨵᦔḄGBHIḄ⍝Bᢣ@K^LᓝᡂᙠPQḄ⇋ᳮᘤTU/஺V?(ᑁ᪶Ḅ+,-᝞ᙌM-6ᡠ]^/ᑖḝᡈᐹᨵ᝞bᱯde(ᑁ᪶fghi“ᨬVm”Ḅo᝞pq^rஹtqIvwxஹy4ᳮஹ⇋ᳮI/O|஺ᐸo᝞}ᫀ4ᳮஹᢝwiᑮ(ᑁ᪶஺ᐺ%ᑁ᪶BᡂḄ(ᑁ᪶ᜧ஺(ᑁ᪶ᐹᨵḄ᤺ឋᡈᓄᵨq=ᵨᡝil/◤⌕Ḅo⍝ᨵᑭ?0^yᘤ◤஺᥅ᖪ¡᧕ᙢ¤(ᑁ᪶HIᑮᐸ⇋ᳮᘤ¥≶GᙠT☢G⍷ᔠᐸ¥ª◤⌕Ḅ7ᴮᓄ¬஺

1Gtᢣ}ᫀoᘤஹqᵨ®஺(ᑁ᪶¯¬ᨵiGᔣ567᛻fgIi஺ᙠ(ᑁ᪶±tqw²³´µᡈ¶/q”ᩭ·¸¹ᵨ஺^qᔁ¤3ᑖ»ᔁ¼1¾3fg¿⌶Á⎇ᙠ¼⇋ᳮᘤÃ᛻b^qᙠPQḄ⇋ᳮᘤT3⇼Æig/஺b☢ᑡÉÊ⌕Ḅ(ᑁ᪶+,-eWindowsNT⌼;+,-BÔ^℉MicrosoftLÚtf■Ḅ(ᑁ᪶ÜÝeÞᓝḄ@ßàᙠMachLᓝãÁä஺@fg^q^rஹ±åæ᜜#4ᳮஹ¼⇋ᳮᘤQè,-ឮÁêëᙠᣵíãÁ᰾®஺@ïP■Kyᘤ4ᳮq=^ÉᑁyÜð@Ḅ./ñïòPAKᐸ@^q±å஺0SF/1MK11B:øù=,-Vú■Ḅ0SF/1UNIX+,-ýᵨ(ᑁ᪶ẆÿḄᨬ᱐஺^^Machᑁ᪶ᡈᣳᳮஹ|!"#ᳮ஺UNIXSVR4UNIX,-./01234ᑁ᪶ḄUNIXSVR45,6V᱐47஺^8Nucleus4ᑁ᪶஺=☢?•AḄᡠᨵ4ᑁ᪶ᱯEFᯠHᙠ4ᑁ᪶JKᳮLI"#஺WorkplaceOSIBMḄ4ᑁ᪶TUVMach4ᑁ᪶Ḅ஺11X4ᑁ᪶ᙠMotorolaPowerPC⇋ᳮᘤ_`aTIntel80486!Pentium⇋ᳮᘤḄhiᐪkὅmWorkplaceno,6_ḄᵨᡝrsiijfKvḄ`aVno,6_Ḅim᝞DOS.OS/2ஹWindows,U-NIX஺IBM4ᑁ᪶Ḅ40K7,rᳮUḄ᝞^ᘤᳮஹ^ᳮஹJᳮ!஺Mach!Nucleus〉KḄ4ᑁ᪶no,6ᵨᡝrs⌹no,6Ḅim!ᱯឋ஺fjᓝᑖᔠrsil⇋ᳮᘤ!no,6ḄᓄḄᓝ¡¢£ᖪ¥r¦§J¨©஺ª«¬7ᙢ¦¯1§,6ᔣ±1§,6²³§#9Ḅ¶·ᨬᵨᡝrs¸ᑮᓤ»ᵨJ1·஺⌼X½8ᓄḄ¥¾^rs¸ᑮᜧÀḄr⌹Á஺4ᑁ᪶ÂÃÄÅ4ᑁ᪶Ã1Å4ᑁ᪶4ᑁ᪶ḄᭆÇTᵫRichardRashidᙠᓱᑁU᫥◖Carnegie-Mellon
ᜧÌÍÎMachno,6Ï0ḄÐ᪗T`Ò1-ÓUÔÕ〈messagepassing
×ᑴḄᨬᑁ᪶sÙᙠÚUẠ_`⌼Üᐸno,6Ḅ½Þßᩭ½Þᐸno,6Ḅᱯឋ஺sMach4ᑁ᪶á?â4ᑁ᪶ãᳮஹäᳮஹᑁᳮஹ!I/OÁåḄæ«஺ᙠMach4ᑁ᪶UẠ_`Ò1çèaᙠᵨᡝ᝱ãJḄno,6½Þêᵨᩭ½Þ4.3BSDஹSystemVஹHP/UXஹMS-DOSno,6Ḅᱯឋ஺ëç½Þê¸Machno,6«ìíᢝïèaÔᐸn

2o,6_Ḅðᵨê᝞ñ1ᡠò஺ᡠs4ᑁ᪶óôõᩭḄ1Óö⌕øùTᜧᜧúno,6Ḅûüឋ(compatibility)-¸UÔ4ᑁ᪶Ḅno,6«ì½Þᐸno,6ḄᱯឋýHíᢝïèaÔᐸno,6_Ḅèᵨê஺ñ1.Mach4ᑁ᪶Üᐸno,6Ḅ½Þ4ᑁ᪶óôõᩭḄ±᜜•Óö⌕øùTúno,6Ḅ᡽ᐙឋ(extensibility)஺ᑁ᪶Ḅ᪗ᑁ᪶⌕Ḅᐸ!"#ᑁ᪶$ᑖḄᶇ'ᵨᡝ᝱+,ᩭ./஺0Mach12#3!"ᑁ᪶Ḅᦻ5ஹ789:;ᙠᵨᡝ᝱+,./=஺>?3@ᑁ᪶A0BC#ᐳឋḄ+EFGHIJKL3@A0BM“Ḅ”஺PJ+EḄFGQRᑁ᪶Sᑴ./Uᶍᶇ'ᵨᡝ᝱+,-ᡈὅ@89,Z஺[\Ḅ]5ᜓᡈ_5ᢈab/c◤⌕efᡈgᦋ89,ZᓽAjG#k᪵mgᦋᑁ᪶஺ᑁ᪶ḄPnoᙠᨬᨵrstḄu"ᑁ᪶Ḅ-WindowsNTḄvwᔊy3Rᑮ=ᐙᑖḄ{/|HWindowsNTḄ}᱐(3.1)ᑮᨬ\ḄWindowsXP,ᐸᑁ᪶Ḅᦋ"#᝞Unix஺᜜ᵫ"ᑁ᪶=+EFGu"ᑁ᪶Ḅ᧕ᣵj⌕ḄᱯឋHBᡂḄ஺@ᑁ᪶QRᨵḄᮣឋ(flexibility)஺ᙠu"ᑁ᪶Ḅ3ᡠᨵḄᜐᳮᘤᐵḄṹ:Bᙠᑁ᪶¡HQRᨵḄ¢£ឋ(portability)|¤1ᑁ᪶{¥ᡠ0¢£¦§஺ᑁ᪶ḄA☠ឋ(reliability)Pᵫ"{¥Ḅᑁ᪶A0Rᑮ©Ḅª«஺¬c!"#ᑁ᪶$ᑖḄᵫ89,Z./Ḅᡠ0v®ᦑ°j±"²³Ḅ´µ஺ᨬ¶ᵫ"ᑁ᪶u"·¸#〈Sᑴᡠ0᧕ºᢝ¼½¾¿஺}Àᑁ᪶ÁḄᩭ@ᑁ᪶Âᩭ=ÃḄÄឋஹ᡽ᐙឋஹᮣឋஹ¢£ឋஹA☠ឋƼ½ºᢝ஺Çᑁ᪶ᨵÈ⌕Éo|ᵫ"ᑁ᪶Qᵨ+,ᩭ◞ËÌ5PÌ5ÍÎḄ¾¿Qᵨ=·¸#⌴ÐÑᩭ./Ì5Ì5ḄÒᵨP.▭3+Ô=ÕRPC(2᝞ᙠNT3LPC)Òᵨ஺ÇPJ×ØRPCḄÐѾÙ+,ξ¿(IPC)Sᑴ./ḄᐸឋÚÛ"#ḄÒᵨḄឋ஺Ü"ᑁ᪶Ḅ×ØRPCÒᵨ¾Ù·¸#〈Sᑴ./Ḅ#ḄÒᵨÚ¾Ù×ØtrapḄÐÝ./஺Þ"trapÐݾٷ¸#〈Sᑴ./ḄPJ×RPCÒᵨḄÐÑ᠒ᑁ᪶àᡂÕP᪵ÒᵨḄ᠒Pᵫ"◤⌕áâ·¸ஹv〈·¸ஹ+,ᑗᣚå©ḄEæ஺PEæQRᑁ᪶Ḅ·¸#〈$ᑖᡂ1ç⚠ᐸឋᜧᜧÛ"#ḄÒᵨ$ᑖ஺2᝞ᙠMach33•u"·¸#〈SᑴḄ×RPCÒᵨᙠ486-DX503ëᐭ=230|JSḄ├#UnixḄÒᵨᙠ¬]53ïïëᐭ

3=20psḄ├஺P@#UnixḄÒᵨÞMach3Ḅ×RPCÒᵨð10ñ஺PòᜧḄóôõöᙢøÛ=ù©úÔᙠᑁ᪶3Ḅûᵨ,ZḄឋ஺2᝞ChenÆBershadফᙠDEC-Station5200/2003Þ=ûᵨ,ZᙠMachÆUltrix(•UnixýJ)úÔcḄÿ
UltrixMachᨬᵨ66%Ḅឋ஺⊤73%Ḅឋ!RPCᡈRPCᐵ$%ᨵᐵ'஺ឋ◀)ᵫ+,-〈/ᑴ1Ḅ2345᜜
7!8ᑁ᪶;<=>Ḅ1ᵨᡝ᝱!᪶A᝱BCḄᑗᣚFG1ḄHIᙢᙬLCBCḄᑗᣚᨵᐵ஺MNẆP⊤HIᙢᙬLCBCḄᑗᣚ=>QRḄCacheSTU᳛(cache-missrate))=>ឋḄW⌕YZᵫ஺[\8ᑁ᪶;<ឋ]⚪ḄN_`)᡽ᜧ8ᑁ᪶cdMᐵeḄfg!h%Wijᐭᑮᑁ᪶Um
nopᙠᵨᡝ᝱!᪶A᝱BCḄᑗᣚFGᙠHIᙢᙬLCBCḄᑗᣚ஺_☢ḄstᨵMach!ChorusAu1஺vwNᱯyᨵzḄst)WindowsNT4.0Ḅ;<{N᱐}ḄWindowsNTd}ᩭᙠᵨᡝ᝱ḄWijᐭᑮᑁ᪶U
ᜧᜧᙢRḄឋ஺)
᡽ᜧᑁ᪶Ḅ_`ᜧᜧ8ᑁ᪶ᩭḄ-᡽ᜧḄᑁ᪶Ḅ᡽ᐙឋஹᮣ$ឋ!☠ឋ஺᡽ᜧᑁ᪶Ḅ
[\8ᑁ᪶ឋ]⚪ḄvMᩩ)M2pᑁ᪶ḄᜧcRPCᵨᓄ஺=>¡¢£¤¥8ᑁ᪶ḄMiḄᑁ᪶;<Ḅ¦஺ᙠiḄ8ᑁ᪶U
L48ᑁ᪶)MN℉zḄst஺L48ᑁ᪶L48ᑁ᪶Ḅ᪶A¨)©ᢝMN«+,-〈ḄIPCY¬
Fᙠ®«Ạ°±RឋḄRPC/ᑴ஺ᙠ486-DX50°
L4±MNRPCᵨ²├´ᵨ10µḄឋ஺¶B
ᙠMach°MNRPCḄᵨ²├¢230ps,oᙠUnix°MNRPCḄᵨ²├¢20RS஺·¸)¹
L4ḄIPC¶£M¥8ᑁ᪶ḄIPCº20»F°
¼¶-ḄIPC7⌕º஺◀®B᜜
L48ᑁ᪶7½ᙢᙬLC¾ᳮY¬!À¾ᳮY¬஺L4ḄᙢᙬLC¾ᳮY¬ÁÂᑁÃᙢᙬLCḄ᧜Å
©ᢝÆN{Grant.Map!Flush஺«
L4F©ᢝᵫHIḄᵨᡝFHIḄÇᶍᩭ᧜Å⚓☢஺L4ḄÀ¾ᳮY¬ÊËÀÌᵫᵨᡝFHIḄÇᶍᩭ±
no©ᢝᵨᡝ᝱ḄÀᘤ஺ᵫL48ᑁ᪶´´F7Nᵨθ±F°¨
ᡠFÐᓰᵨ12KᑁÃ'஺¶B
MNᐺÔḄ£M¥8ᑁ᪶ᓰᵨ300KᑁÃF©ᢝ140NᵨÎᵪ஺L48ᑁ᪶ḄvMNᱯᙠÖḄU×ᜐᳮ_Ù{L48ᑁ᪶dÚÛU×ᜐᳮᡂIPC+,஺8ᑁ᪶dÚÛÝ)MÌ〈IPC+,Þᐵᜐᳮ¥ṹḄÀ
odU×fgÝ)Màᙠᦈ1PC+,ḄÀ஺ÝMNÚÛU×âã
8ᑁ᪶ä¢NU×åâ•ᩩ+,cd®+,〈ᑮ!®U×ᐵὶḄᵨᡝU
ᯠéᵫᵨᡝUḄÁÂᦈᩩIPC+,ḄÀᩭᜐᳮNÚÛU×஺᪵
ᑁ᪶ÐÁÂåâU×+,
oHᵨëGᑮᐹíḄU×ᜐᳮ
noÊËU×ᜐᳮḄᐹíÇᶍ!ᑁ᪶◞ï²ᩭ஺ᜐᳮ_ÙÊË;ᜓh%Fᙠᵨᡝ᝱
ᐸU×fg¥ṹḄᜧí᪀᝞{driverthread:dowaitfor(msg,sender);ifsender=my_hardware_interruptthenread/writeI/Oports;resethardwareinterruptelse...endifenddo

4ᐸÖ£¤¥8ᑁ᪶ôḄ;ᩭ@"IPCD23E6FḄ!G;$%Hᑮᨬ6Ḅឋ%஺Exokernelᑁ᪶Ḅ᪶0ᢝ2367+ᓄḄ89LMNOPᑴRS(protectedcontroltransfer,PCT)஺PCT23$`aᦪḄcᙢᙬfgḄhijᵨ"ᐸm%nop23qrst஺ᙠPCTḄvẠ>"xy&'6FḄIPC!᝞RPCoᙠMIPSR3000ᜐᳮᘤ>"23vpPCTḄRPC&'lOpsḄ├";ᙠ--qr>ḄMachRPC95ps[U»Ramblerᑁ᪶Rambler$pᨵḄ>Ḅᑁ᪶஺᝞2⌕23ᑁ᪶Ḅ"ḄIPC/HAL¤ᙽ#¦§Ḽᑁ᪶Ḅ©⁐"xy«¬ᡠᨵḄ¯ᑖjᵨ஺᪶±h0ᢝcᙢᙬfg²c³´Ḅµi¶·jᵨ"ᙠᐰḄᔜ3¯ᑖº»2¼᫑᫡஺ᙠRamblers"ᡠᨵḄµijᵨ¿±hOCPÀÁḄ஺ᙠRamblersDᨵ23ᑁ᪶᝱i"òḄᑁ᪶ᨵÄᜧ$ḄRamblerḄᑁ᪶i23ᙠᑁ᪶᝱Ḅᙢᙬfg஺ᙠ=3ᑁ᪶᝱ᙢᙬfgsᨵÅƯr"$x⚜ÈḄ"ÉÊpᜐᳮᘤḄËÌ᪀஺ᙠÎÏḄ80386Ḅ&'>"ᑁ᪶iᒹÓstÔᳮᘤஹᙢᙬfgÔᳮᘤஹ8237ADMAPᑴᘤØÙ¤ᙽஹOCP᪷ᙢᙬfg²2ÛḄÜÙÝṹ஺Ã=Û¯rḄßàáâxyGḄ&'ãᶍ²ᜐᳮᘤËÌ᪀Ḅ◤⌕;ᦋç஺è᝞ᙠᐸᜐᳮᘤéê>"ᙢᙬfgÔᳮᘤx%«ëᙠ23ᱯḄᵨᡝ᝱ᙢᙬfgs";$îᙠᑁ᪶᝱஺ï᝞"ᙠRamblerðñ᱐óḄ&'s"OCP᪷ᙢᙬfgx%ôëᙠᙠᵨᡝ᝱ᙢᙬfgs";ÜÙÝṹô«õö஺ᡠy"Ramblerᑁ᪶i&▭$pḄᑁ᪶஺;ᑁ᪶Ḅø⌕m%«RamblerḄᔜ3ùÝú஺᝞iÔᳮ«ᙢᙬfgÔᳮᘤ(x%ᙠᵨᡝ᝱)ᡠúÝûiᑗᣚ«IPC¤ᙽḄjᵨᑗᣚᡠÝúûþiÔᳮÿIPC/HALᙽᵨ᛻ᡠIPCᙽḄᑖᙠᵨᡝ᝱Ḅᑁ!"#$%&'ᙠᵨᡝ᝱Ḅ"#()*+,-ᐭᑮᵨ0&'1ᨵḄExternalPager=ᜓ?@Aᙠᵨᡝ᝱ᙢᙬDE0!F"#(ᒹIJ#ᦻL"#)ᙠᵨᡝ᝱ᙢᙬDE+,-ᐭᑮᵨ0஺OPQRSTUVW*Rambler[&"#$%\]'•S_᪶=a஺ᦻbcᵨ1.1.JochenLiedtke,TowardsRealMicrokernels.CommunicationsoftheACM,39(9):70-77,September1996.2.2.Chen,J.B.andBershad,B.N.Theimpactofoperatingsystemstructureonmemorysvstemeerformance.InProceedingsofthe14thACMSymposiumonOperatingSystemPrinciples(SOSP)(Asheville,N.C.,Dec.1993).ACMPress,1993,pp.120-133.3.3.Bricker,A.,Gien,M.,Guillemont,M.,Lipkis,J.,Orr,D.,andRozier,M.Anewlookatmicrokernel-basedUnixoperatingsystems.Tech.Rep.CS/TR-91-7,Chorussystemes,Paris,France,1991.4.4.Condict,M.,BolingerD„McManus,E.,Mitchell,D.,andLewontin,S.Microkernelmodularitywithinteqratedkernelperformance.Tech.Rep.,OSFResearchInstitute,Cambridge,Mass,1994.

5ᡃḄ⌕DavidSolomonMarkRussinovich*ᡃᙠᔠ℉Ḅᐵ¡WindowsᑁᳮḄ"ᑡ¤¥Ḅᨬ§᱐©0ᑏ«¬஺ᙠ"ᑡ¤¥0*V᱐©Ḅ®᱐¯§᱐©°±ᨵ²³*ᙠ´µEWindows°±ᨵ¶·¸⌕Ḅ᱐©¹·º»ᡝ"#Ḅ¼ᜧ¾§*¿·ᑣºÁÁÂᜓÃÄ⌕Ḅ()ᘤ"#Ḅ¼ᜧ¾§஺º¡Æ᪵©¥Ḅ&ὅ*☢ÊḄ¶·ËÌÍ℉ḄÎ⚪*ÐÑMicrosoftWindowsNT"#ᙠÒÓ☢ḄÔÕ*%Ö×ØÙᙠÚ·᱐©0Û«ᱯឋḄÒÞḄßᓄ஺ᨬá*©¥Ḅ&ὅâᡂᩲ®Ḅå&*'ᐰ¥çèéê஺ëQì,íîDavidSolomonஹDavidCutlerMarkRussinovichðᡃñòᑮDavidSolomonó*ᡃôᙠDECDigitalEquipmentCorporation
'VAXḄVMS[&"#å&*ðóõᨵ16ö஺Q÷óø*ùúû¡[&"#Ḅüº[&"#ᑁᳮḄᦟþ஺ᡃ]ÿMarkRussinovichḄ
⌕᧽ᙠ⚞Ḅᱯᨵ
஺ᩲḄ"#᝞%ᙠMicrosoftWindows98&'(ḄNTFSᦻ*+,Ḅ“.
”Windowsᑁ᪶34ᘤ6789"ᐹ%+ᙠWindows'(Ḅ
᎛<=ᐸᑁ?@᝱B஺WindowsNT⚗DᨬFGH1988I10ᨴKLMḄNFḄD᪗G.PQ%RSḄTUVWOS/2XYឋஹ\ᐰឋஹP0SIXஹ^ᜐᳮTaஹbᡂḄdefT+,%☠ឋhi^j⚪஺lḼWindows3.0Ḅn(opᜧᡂfrD᪗sltnuvᓄvᡂxyᜐᳮWindowsḄXYឋz{OS/2XYឋRᑮQ}~஺ᡃᨬF%+ᙠI^
ᑁᡂQWindowsNT஺.▭&•Qn(᱐I
ᑮ1993Iᜩᡂrn(᱐ᢝInteli386ஹInteli486oMIPSR4000ᜐᳮᘤ஺ᕜ+ᡃᐭDigitalAlphaᜐᳮᘤḄᢝ஺WindowsNTḄQn(᱐#⚜Ḅ⌕ᜧஹ⌕᠒ᡠ+Q⌕Ḅ▤GQ¡DaytonaḄ⚗D6ᵨFloridaḄᩩ¤¥¦§ᩭ©ªB஺rn(᱐Ḅ«⌕D᪗G¬Ḅ®¯°¤Ḅ¥±²ᯠ⌕´µ¶·%☠஺1994I¸ᜩᡃn

6¹WindowsNT3.5,86Qᨴºn¹WindowsNT3.51,»¶¼᱐ᒹ¾IBMPowerPCᜐᳮᘤḄᢝ஺WindowsNTFQ᱐ḄD᪗G¶¼ᵨᡝÀ☢+ÂÃWindows95XY+,ÄMicrosoftÅLn^IḄᔜÇCairoᢈÉÊᔠÌᩭ஺rḄLnI^
ᨬÍᙠ1996IᜩWindowsNT4.0☢Î஺NTḄQ᱐GWindows2000,rGᨬQÏᡝoÐÑᘤÒ
n¹Ḅ஺r᱐ÓÔᙠÃ+Õ᱐ÖÒḄWindowsNTᢈÉ×Ạt&Ò
ᐭ⌕Ḅ¼ᱯឋ#᝞ÙÚDÛ஺ÜI
ᩭLnWindows2000,²
ḄWindowsNTᢈÉᐰ☢ḄÝ4o3⁚஺LnWindows2000G8ß11Iᩭàá4Çâã᪀ḄLntåæ஺ᙠWindows2000Lnãç
ᡃºèÚ•Qéêëᑜ⌕ᙠ¼ḄÏᡝoÐÑᘤ~Êᐭ¼ḄஹíîḄÏᡝᱯឋoᦋÌḄÐÑᘤTa஺ᙠrëᑜ.ð8ñ~ᨵòáᩭáóôᓽÐÑᘤᱯឋḄ.PÄö÷øÏᡝᱯឋ.PḄùú»ÏᡝoÐÑᘤḄ᱐ûᑖL஺ᙠ2001I8ᨴWindowsXPProfessionaloWindowsXPHomeEditionn¹I^+ᙠ2003I3ᨴMicrosoftWindowsServer2003n¹஺◀Intelx86âã᪀Ḅᢝ+᜜rÿᒹ
IntelIA-64Ḅᢝ᪗ḼWindowsNTᐭ64ᜐᳮḄ⚞஺ᨵᐵWindowsXPWindowsServer2003Ḅᑁ!᪀#$%ᳮḄᩗ'($஺)*+,-.Windows/ᩭ12ᑮ64456Ḅᜧᶍ9:ᒹ;AMDᙠ2003=>ᐭḄx64?@!᪀,AMD64-Intel2004=2ᨴBCDḄ64ᢝ,EM64T-«Eᐰᢝx64ḄGᡝIJᘤ᱐4ᑜᙠ2005=6N=OPᒹ
ᨵᐵx64@QRST⁚ḄVWXYZ[஺\x86?@!᪀]^_S`abcdᐚ(bஹx64?@!᪀ᓽWindowsNTḄhbcḄ]^஺?@!᪀-.32x86ijឋlmnopḄqrᢗtub+,-.64vᙬxylz{|h}ᵨᜧḄ◤஺mn32qrḄᢗtub,WindowsNTᐭ10=ᡈ)-.Ḅᥛ஺ᙠop=WindowsNT@QᔊD6Ḅᓄ+ᯠEᐰᙠᨬ¢ḄWindowsNTcṹ¤,codebase-Ḅ¤Ạ(ᓃ§ḼbḄ¨2ᔜªO«¬⌼Ḅ®¯°WᑁᱯឋḄRSO¯²ᜧḄᓄ஺$ὅ´µ¶·¸¹ºḄ#$ᩭ»¼WindowsNTcṹ¤ḄT⁚½ᐸᙠu᱐(u¿À(ḄRS6ḄÁÂubÃÄ,]OÅÆÇ#ᐹᩭÉÊËὅᳮÌWindowsNTᑁ᝞Î#$Ḅ஺ÏÐÑḄÒ$@Q]O·ᕒÔ}ÕᙠÖ×Ḅᫀᜮᨵ஺DavidN.Cutler

7SeniorDistinguishedEngineerMicrosoftCorporationSᙠᡃÄ´Ìïð៉Ḅòóஹᭆõ#ᐹᡠlᡃÄ÷ᜓ]^᢬᣾MierosoftWindowsÒ$@QḄᑁý4þ᪗ᦪ
᪀஺Ḅ
᪀ᐵḄஹ᝞ᑖ!"ᙠ$%᪵Ḅ'᛻)஺*+,-.ᨵ01ᳮ3Windowsᑁ<ᳮḄ᪾>✌ᐜAB)ᨬDḄ◤FGHIJ᪗L◤FGJ᪗MNOPQR+WindowsᨬDḄHIGT஺2.1◤FGHIJ᪗Aᑮ1989\)☢Ḅ◤F^_+WindowsNTḄ)Tbn,-.cd32fḄஹgᐜhḄ(preemptive)qrsᐭḄ(reentrant)vwᑁxyz{nᙠ|}~
᪀GO!"{nrᙠ|ᜐᳮᘤ(symmetricmultiprocessingsystems)O!"ᙢ〉ᜐᳮᘤḄᦪ{nᡂ*.⌕ḄᑖhIz*ᡝ¡¢ᘤ{n£!"ᜧ|ᦪ¥ᨵḄ16fMS-DOSGMicrosoftWindows3.1ᵨ®¯{n°ᔠ²³1POSIX1003.1¸¹ឋḄ⌕Fbn°ᔠ²³G»¼½1yz¾ᐰឋÀ☢Ḅ⌕F{nÁᢝUnicode,Ź᧕ᙢ〉ᐰᳫÈÉ஺⌕ÊË.ÌÍL◤FḄÎÏÐRᦪᓟ.ÒÓ{*+Å1ÐRLÒÓWindowsNTHIÔÕᙠ⚗J×ØD⌱Ú+)☢ḄHIJ᪗bn᡽Üឋ(⇿Þß"y)áᑏḄãṹÎÏ£åḼÈÉ◤FḄçᓄéê᝞ᙢëìGᦋç{nrîïឋ(Portability)ÎÏ!"ᙠ|}~
᪀OÎÏ᪷ÈÉḄ◤⌕¹᧕ᙢîᑮñḄ
᪀O{nr☠ឋGᏉôឋ(ReliabilityandRobustness)õ£ö÷êøùúûᑁḄ┯ýG᜜Ḅÿᦋ
஺ᵨᡈὅᐸḄᵨ

8nឋCompatibilityᯠWindowsNT᡽ᨵḄᢈ!"#$%Ḅᵨᡝ'☢)API*ὁ᱐-ḄWindows)MS-DOS./஺
0%1*ᐸḄ"2᝞UNIXஹOS/2)NetWare,56ᙢ8nឋPerformanceᙠᐸ;<=᪗Ḅ?@A"ᙠBCDEFGHIJKLMNOP"Q᜜SḄTJKᙢUV஺WḼᡃZ᢬᣾WindowsᑁS^᪀)ᑁSḄᔜDa⁚"cdefᑮ"hijkḄ;<=᪗)lm⌕o$᝞pᡂrᙢsᐭᑮḄ᪀⌼vwḄ஺#$"ᙠᡃZxk᢬᣾ᑁSa⁚yz"ᐜᩭfCAWindowsḄ}~;<"0d%*ᐸḄC2஺2.2ᙠᜧᦪᵨᡝw"ᵨ*-$◞Ḅ——ᑁ᪶ṹLMᙠᜐᳮᘤḄᱯᩗAᙠ-wᑁ᪶"kernelmode
,Kᦪ)EF;ᵨṹLMᙠᜐᳮᘤḄᱯᩗAᵨᡝ"usermode
,ᨵ5ᨵ▲ḄC¡¢K£ᵨ"QᦪḄ¤ᑮ▲ᑴ"0¦¡EF஺§ᵨᡝ¨ᵨC©ª«V"ᜐᳮᘤᣓᑮ¨ᵨ"ᯠ®d¨ᵨ¯ᑗᣚᑮᑁ᪶஺§ª«²ᡂV"d¯³᛻ᑗᣚµᵨᡝ"ᐕ·¨ᵨὅ¸¹᡻M஺*ᜧᦪUNIX»¼"Windows$C©½ᜧ
²᦮ḄḄᜧSᑖṹ*;ᜓÁÂṹᐳÄÅ᪵Ḅ¤ÇÈḄᑁ᪶ᑁÉÊË஺hÌᕡḼ"ḄÎCFᡈὅ;ᜓÁÂÏᨵKẚÑᐸFᡠ£ᵨḄᦪ஺Windows$C©Óᑁ᪶ᔩJÕᨵiÖ᝞×Ø"#$ᢥ᯿Óᑁ᪶microkernel
ḄᐺÜÝ"Windows$C©Óᑁ᪶஺ᙠÓᑁ᪶ḄÜÝw"ḄÞ⌕F2᝞ᑁÉÕᳮᘤஹßÕᳮᘤ)I/OÕᳮᘤàLMᙠᔜáâãḄßw"%ZᨵáäåᨵḄᙢᙬÊË"ᙠhCFyI$Óᑁ᪶çèḄCj骫஺ê᝞"CMUCarnegieMellonUniversity,ᓱὊí•᫥◖ᜧñàḄMach$©ḄÓᑁ᪶~^᪀Ḅêò"%óôC©ᨬöḄᑁ᪶"ᒹø¯¨ùஹúûü⌴ஹþÿᑁ
ᜓ஺ᐸḄᒹᔜAPIஹᦻᙠᵨᡝ#$%஺ᯠ'Mach(ᑁ᪶*+Ḅᖪ-᱐/0122345ᡠᨵḄᦻஹᑁ
8ᳮ:ṹ<ᙠᑁ᪶#$=஺>?@AᓫCDEḄ(ᑁ᪶Fᙠᖪ-GHIᑗ0▭Ḅ?LMḄᦔ᳛PQ஺RSWindows=ᨵRST:ṹᙠᑁ᪶#$%HᔲVWᕡḼMZ[\]^Ḅ(ᑁ᪶*+[_`ab᧕deᕖghi᝞k஺lὃ⇋%☢Ḅpq஺Ꮇᙠ*+Ḅᦻ:ṹ=ᨵ[\┯tu┯tvwxᦻyIyᙢde஺ᙠ[\{Ḅ*+=ᑁ᪶#

9$:ṹ}Z᝞ᑁ
8ᳮᘤᡈὅᦻ=Ḅ┯t@v᦮\*+de஺ᙠ[\DEḄ(ᑁ᪶*+=᪵Ḅᙠᵨᡝ#$%ᡠᙠᳮG᪵Ḅ┯tHWᕡḼuḄ5v⌨஺H0▭Ḅᩭ5vde?L⌕᪵[\ᐵḄᜫ=ឮᩭ22HIḄ஺ᯠ*+ḄᡠᨵHḄIv¡┯tḄ¢ᵨẚ¤?L¢ᵨI¥¦§¨*+=ᱯᩗ«ᑖḄ:ṹᦪ®}¯8M°±ᣩᙢ³ᵨᐸḄᑁ᪶´µ஺Windows¶H+L[\¢ᵨ´µᘤ·H[\¸+¹º»*+᪶¼´µ}Z᝞½¾ᑁ
8ᳮஹᦻI/Oஹ¿ᦻᡭᓺᐳÃḄᩭM@±ᙢÄÅÆᏉÈឋÊ_ឋËÌ☢ḄÍÎÏÐÑᡠ᝞k*+Ḅឋ^H>?Ñ[஺WindowsḄᑁ᪶#$ÒÓ1ÆÔ/Ḅ☢ᔣÖ×F>ᑣ஺Ù᝞M°ÚÛhIv¥¦ᐭÝ[\Ḅᦪ®Þ᪀ᩭ§¨uᡠàḄáâ஺ãäM°ᑭᵨ^$Ḅ¦æᩭ{⌴èᦪ¿§¨ᡈéᦋã¢Ḅᦪ®Þ᪀஺ëᯠWindowsᑁ«ìíᙢᵨÆÖ×ᩭ⊤ïᐳÃḄðñHòóWôGõWindowshIH[\☢ᔣÖ×Ḅ•LÆ÷øឋḄὃ⇋Windows*+ḄᜧTᦪ:ṹHᵨCúûüᑏḄ?LCúûḄþÿᐹᵨ஺Cᢝ☢ᔣḄᭆ᝞ᦪḄ᝱!"ஹ$᝱%ᦪᡈὅ()*஺+,Windows-C᱐/Ḅ01234ᵨ56789:;ᱯ"☢ᔣḄᱯឋ஺2.3>?@᪀ᙠCD⁚ᐵ:WindowsGHI᪗KᒹMNOḄPQRS-ᡃUᐜᩭXDXWindows>?@᪀-ḄᐵYZ[\]஺D^Pᓄ᱐/Ḅ>?@᪀᝞`2.1ᡠb஺cdeC^`23D^f/@᪀ghᨵjbklᱯ"ᑁn6o᝞pq\]KᔜsGᜓuvwḄxyhᨵjb;஺`2.1PᓄḄWindows@᪀`

10ᙠ`2.1-✌ᐜᑮ-ᨵDᩩWindowsZ[ḄᵨᡝO(usermodeKᑁ᪶O(kernelmode)ᑖᑜᑖᩭ஺☢ḄN᪾⊤5ᵨᡝOḄvḄ\]3ᑁ᪶OḄZ[஺¡᝞ᙠ¢1£-¤¥¦ᑮḄᵨᡝOḄvᙠD^§¨©Ḅvᙢᙬ¬-᡻®(¯°gUᙠᑁ᪶O-᡻®Ḅ±᎛gU³´µZ[¬)஺+,Z[ᢝvஹvஹᵨᡝ·ᵨvwK¸᛻ºZ[»ᨵgUᔜ¼Ḅ½ᨵvᙢᙬ¬஺¾sf/ḄᓽOvᑖÀÁÂ᝞஺nÃ"Ḅ(ᡈὅÄឋᢣ"Ḅ)Z[ᢝv(systemsupportprocesses'),᝞ÆÇ(logon)vKÊËÌᳮᘤ(sessionmanager),gU3WindowsḄ஺ÔÕ3ÖgU3ᵫØᑴÌᳮᘤᩭÚḄ(¢4£ÜÊÝÞᙢRSWindows)ßnv(serviceprocesses')àá(host)Ḅ3Windows᝞käåᘤ(TaskScheduler)KᎷῃí஺WindowsḄî®ïð⌕òó:ᵨᡝÆÇ஺ô$Windowsᘤ·ᵨ᝞MicrosoftSQLServerKMicrosoftExchangeServer,Ôᒹü5Dý³WindowsNOᩭî®Ḅ\]ßnᵨᡝ·ᵨvw(userapplications)ᨵþsÿWindows32ஹWindows64ஹWindows3.116ஹMS-DOS16ஹPOSIX32ᡈὅOS/232n᛻!"ᘤ$%(environmentsubsystemserverprocesses')&'()*᛻(environment)Ḅ,ᢝ.ᑖ஺12ᡠ4Ḅ᛻5ᢣ)*789ᵨᡝᡈὅ%<ᕒḄ>ឋᓄ.ᑖ஺WindowsNTᨬDEFḄG᎛I(J>KLḄ᛻:Windows,POSIXOOS/2஺ᯠQRWindows20005ᨬTUVIOS/2EFRWTOS/2XYZᣵ(஺ᑮ(WindowsXP,ᙠ^_Ḅ`abcᨵWindowse`aUfEF——KhR•>jkḄPOSIXlmnoᵨRp5┐rUnix`aḄuv!"ḄU.ᑖ஺____________________Uxy2.1bRz{|}“!"$%”O“ᵨᡝᵨ%<'᪾☢Ḅ“KDLL”᪾஺ᙠWindowsRᵨᡝᵨ%ᡈὅ>᝱(DLLs)ᩭEfᵨ஺DLLḄ⁐5RU>ᦻ᫏ᓄḄᦪ¢ᓄ£U¤ា¦Ḅᑁ.(¨5©ᦻ᫏ᓄḄ)Windows!"ᵨ஺1>¢ᓄh%mª«——lmªK«——ᔣᙠ£ᵨᡝᵨ%<®¯!"Ḅ᛻$%E〈U>±²஺WindowsḄᑁ᪶´µ¶·ᒹ¹n.ᑖ஺__________________________________nWindows᡻»¼(arecuᡭ're)ᒹ¹(^_Ḅ)*!"RÃ᝞ᑁÅÆᳮஹ$%OÈ%ÆᳮஹÉᐰឋஹI/OஹËÌOÍ$%Î஺nWindowsᑁ᪶(kernel)5ᵫU¶ÐÑVḄ)*Òª᪀ᡂḄRÃ᝞È%Õ(threadscheduling)ஹbÚ(interrupt)OܨᑖE(exceptiondispatching),nÝᜐᳮᘤLß஺pl®¯(U¶à%O^_rá஺᡻»¼Ḅᐸã.ᑖᑭᵨ1¤à%Orá&'åæÑVḄÒª஺nçᜓé%<(devicedrivers)êᒹëì·çᜓé%

11nì·ñáÑòHAL,HardwareAbstractionLayer5ᢣUÑᱯõḄöṹ,pøᑁ᪶ஹçᜓé%?ᑴA஺⊤2.1ᑡ᪗WindowsHI᪶KLᓺḄᦻ;OPQᨵS⌕$⍝VWᦻ;X3Yᡃ"[\ᵨX]ᩭ^ᵨ_`ᦻ;஺abc☢dᑖ=>cfḄb⁚h[\ijᙢlmᐸhḄopqL;஺⊤2.1WindowsḄ᪶Kᦻ;ᦻ;XL;Ntoskrnl.exe᡻z{ᑁ᪶Ntkrnlpa.exeᵨ32᡻z{ᑁ᪶3ᢝᱥᳮᙢᙬ᡽PAE,ᙬ64GBᱥᳮᑁHal.dll;Win32k.sysWindowsḄᑁ᪶dᑖᑁdᢝᦪ3=>᡻z{ᦪḄᑖNtdll.dll᪷stubKernel32.dll,Advapi32.dll,WindowsḄ᪶KDLLUser32.dll,Gdi32.dllᙠ¨©V`L;Ḅj⁚ª«3ᡃ"ᐜᩭp3Windows᝞®¯°;{±᪀Ḅ³´ឋ஺³´ឋWindowsḄpq¶·¸᪗'3⌕¹º»zᙠᔜ°½¾Ḅ;{±᪀ª¿3ᒹÁÂIntelḄCISC=>RISC஺WindowsḄÄÅz᱐aᢝx86MIPS{±᪀஺ÉcÊËᐭ6DECDigitalEquipmentCorporation,ÐÑÒÓCompaqÔÕ,ÖCompaqcᩭÊ×HPᓽHewlettPackardÚÛAlphaAXPḄᢝÞßAlphaAXP'pq64ᜐᳮᘤ3áWindowsNT»zᙠ32ã஺ᙠWindows2000Ḅåæh3pqçèḄ64᱐a=ᙠAlphaAXP¿»z3á'Vq᱐aéᨵÓê஺ᙠWindows3.51hÊËᐭ6ìí°ᜐᳮᘤ±᪀MotorolaPowerPCḄᢝ஺ᯠÖ3ᵫðñ◤óḄôᓄ3ᙠWindows2000«᜛36MIPSPowerPC{±᪀ḄᢝÓ÷ø஺cᩭ3CompaqÊùú6AlphaAXP{±᪀Ḅᢝ3ᡠ=ᨬýḄ±þ'3Windows2000ÿᢝx86᪀஺ᙠᨬḄWindows᱐,UPWindowsXPWindowsServer2003$,%&'()*64,ᜐᳮᘤ0Ḅᢝ,12ᑖ45IntelItaniumIA-640ஹAMDX86-640ABCIntel┐(x86Ḅ64,᡽FᢈHIEM64T,1LAMDx

1286-64᪀MNOAP5ᙠᡠᢝḄᢣST☢ᨵᶍXḄY4Z஺[\*ᜐᳮᘤ0]^64,᡽F_64-bitextendedsystems',ᙠ`$aᵨ^A64IᐵdWindows᝞fᙠ64,᱐$gh32,iᵨjkAl3mnopqrsZ஺Windowst⌕vwBx\*Tyᩭ{|}~ឋABᢝ*᪀஺nWindowsᨵᑖA_Ḅᑖ5Lᜐᳮᘤ᪀MᐵḄAᡈὅ5LMᐵḄAᑖ◞ᑮḄᙽ$AᡠBA_Ḅᑖ}Bὃ⇋᪀ḄY4Aᵨᐵ¡ḄY¢஺ᨵ\ᐵ£Ḅ¤^¥¦_§¨'}~ឋA125ᑁ᪶Iᒹ¬ᙠNtoskrnl.exeZ°±Iᡈ]HAL,ᒹ¬ᙠHal.d11$Z஺m[☢noµ¶ᙢ¸¹\¤஺L᪀MᐵḄº»A¼᝞½j¾᛻ᑗᣚIthreadcontextswitchingZ◍▟ᑖÇItrapdispatchingZ5ᙠᑁ᪶${|Ḅ஺ᙠÉ᪵Ḅ᪀$AÉ_ᨵᡠY¢Ḅº»IË᝞AÉḄtÌZᑣ5ᙠHAL${|Ḅ஺ÎᨵÏ᜜¤$ᨵMÑᦪÓḄÔṹ5L᪀MᐵḄAÖ×5ᑁØÙᳮᘤAP5L᦮_M¼AÛᯠÝ5Þᑖßà஺nWindowsḄáᜧᑖÔṹ5ᵨCäåæᑏḄAèᑖ5ᵨC++æᑏḄ஺ÝᨵÖ◤⌕ëìL_íhvîḄᑖI¼᝞$ï◍▟ᜐᳮᘤAinterrupttraphandlerZ,ᡈὅ(ឋ»᩽ñòóḄ¥¦_ᑖI¼᝞¾᛻ᑗᣚAcontextswitchingZ,ô5ᵨõæäåæᑏḄ஺öᙠᑁ᪶HAL$ᨵõæäåÔṹAß÷ᙠ᪶¥¦_ḄᐸùᙢTᨵõæäåÔṹI¼᝞{|'ú┝ᢣSḄËjABCᙢwjüᵨý$ḄᙽZAþ}»ᙠWindowsÿ
Ḅᑁ᪶ᑖᙠᵨᡝ᝞Ntdll.dllḄ!ṹ#$%&☢()*+
,-7஺012ᜐᳮ256multitasking7ᢣᙠ29᡻;<=>ᐳ@AB9ᜐᳮᘤḄDE
ᢈG஺ᯠIJBKLMNᨵPQB9ᜐᳮᘤḄR᎛T-AR᡻;U9<஺VWXᯠB9256DE
YPZ[\ᩭ^_ABR`-᡻;29<a7B92ᜐᳮDE
-bcᙢeᑮABR`᡻;29<ᙠg9ᜐᳮᘤh᡻;B9<஺c᝞$%ijRᡠlᑮḄWindowsḄB9ᐵtuLv᪗7Txyz{^ᙢᙠ2ᜐᳮᘤLMN
h|;஺Windows7B9012ᜐᳮ#SMP,symmetricmultiprocessingDE
஺ᙠᜐᳮᘤᨵᜐᳮᘤ——DE
ᵨᡝ<-ᑮ5B9ᜐᳮᘤh|;஺IᡠᨵḄᜐᳮᘤᐳ@BḄᑁ>஺012ᜐᳮ#ASMP,asymmetricmultiprocessingPAᙠB9ᐺḄ012ᜐᳮ
DE
⌱ᐸB9ᜐᳮᘤᩭ᡻;DE
ᑁ᪶!ṹIᐸḄᜐᳮᘤY|;ᵨᡝ!ṹ஺U2ᜐᳮḄ᝞2.2ᡠ஺

132.201012ᜐᳮWindowsXPWindowsServer2003¤ᢝU¦Ḅ2ᜐᳮᘤ
§¨<#hyperthreading®NUMA#B°Ḅᑁ±᪀,non-uniformmemoryarchitecture®஺ᙠ¸☢Ḅ¹º()»⌕ᙢ*+U
#ᨵᐵWindows0
Ḅ¤ᢝḄ½¾¿ÀÁÂÃÄ6%<B⁚®஺¨<7IntelÈᐭḄB⚗ᢈGT-ᙠB9ᱥᳮᜐᳮᘤhlÌ29ÍÎᜐᳮᘤ஺g9ÍÎᜐᳮᘤᨵTÏÐḄCPUÒ᝱a7᡻;ÈÔÕᱏhḄ×ØÙᑣ7ᐳ@Ḅ஺ÛÜB9ÍÎCPU-ᙠᐸÍÎCPUcÝḼ#᝞cᙠ᡻;ßᜐᳮàEáIâQãᙠ9ÍÎᜐᳮᘤh|;<®ḄR᎛äå᡻;஺WindowsXPḄMæçèᦋZãT-ᨬëᙢᑭᵨ2ᜐᳮᘤ¨<Nᘤí᝞îᩭḄeæ7(<ᑮB9ïḄᱥᳮᜐᳮᘤhðᙠᦋñ“⌱B9ᱥᳮᜐᳮᘤhḄïÍÎᜐᳮᘤ#óᜐᳮᘤḄᐸÍÎᜐᳮᘤcᙠÝḼ®”஺ᙠB°Ḅᑁ±᪀NUMA
ᜐᳮᘤõöᡂøùḄᓫᐗ1ñ⁚ü#nodes®஺g9⁚üᨵTÏÐḄᜐᳮᘤᑁýþZB9ÙB°#cache-coherent®Ḅÿὶ
ᑮᜧḄ஺NU.MAḄWindowsᯠSMPᩭ"#$ᐸ&ᡠᨵḄᜐᳮᘤ,-./0ᡠᨵḄᑁ2——456$⁚89ᙢḄᑁ2/0;ᩭ<ᐸ=⁚8Ḅᑁ2>?@A஺B⌕DEឋGḄHIJ$᪷LMᵨᑮḄᑁ2ᡠᙠḄ⁚8$PMQRᑮS⁚8&Ḅᜐᳮᘤ஺TUHIḄV᪗J$X-Gᙠ⁚8ᑁYZ[ᑁ2ᵭ]Ḅ]^$4ᨵᙠ_⌕Ḅ`᎛bcᐸ=Ḅ⁚8ᑖeᑁ2஺fᯠWindowsᨬhḄij4Gkᢝᨬm32ᜐᳮᘤ$pJ$ᙠmᜐᳮᘤij&$qrᨵ9sḄtu▲ᑴᜐᳮᘤḄᦪᨬm32—yzᯠ${ᦪ|4J}~@ᐭḄ▲ᑴ$t32ᜐᳮᘤ-.y᧕ᙢᵨ•Ḅ32ᦪLṹᩭ⊤஺▭$WindowsḄ64᱐9-.ᨬmkᢝ64ᜐᳮᘤ$tᙠ64ᘤ$|ḄᜧJ64஺

14GkᢝḄᜐᳮᘤḄ▭ᦪVᡠᵨḄWindowsḄ᱐9⊤2.32.4஺ᦪL2¡ᙠ¢£⊤¤HKLM\SYSTEM\CurrentControlSet\Control\Session\Manager\LicensedProcessors&µ¶$·ᦋ{ᦪLP¹º»¼½-¾¿$@À$⌕BÁ6Âᦋ¢£⊤ᩭᵨmḄᜐᳮᘤ$PÃÄÅmḄÆ$@5ÇÇÂᦋTᦪL஺ὃ⇋ឋGḄt$ᑁ᪶HALᙠWindows2000&$Ìᨵᐸ=ÍᐵÏḄᦻ¼ᨵᓫÒḄᓫᜐᳮᘤ᱐9mᜐᳮᘤ᱐9஺ᙠWindows2000±,Õᦻ¼ᙠÖ☢Ḅ¢µ&PÃØÙᙠmᜐᳮᘤᓫᜐᳮᘤᑖÚᨵᡠ5SÛᙠ32WindowsXPWindowsServer2003$4ᨵÞᦻ¼ᨵᡠ5S⊤2.2஺ᙠ64Windows$rᨵPAEᑁ᪶$ᡠ.$4ᨵᑁ᪶HALᙠᓫᜐᳮᘤmᜐᳮᘤᨵᡠ5S஺ᙠßàḄ`᎛$ßàMáPâãḄᦻ¼⌱åæᩭ$qÀçèᑮ9ᙢḄ\Windows\System32Vë&஺}ã¿ì?ᦻ¼íçè$]ᦻ¼\Windows\Repair\Setup.Iog,ñᑡæ}ᡠᨵ⌕çèᑮ9ᙢóôḄᦻ¼$.ÅPñõcö÷øsçèᑮìVë&஺⊤2.2┐úmᜐᳮᘤḄᦻ¼┐úᓫᜐᳮᘤḄᦻ¼ᙠᙠᓫᜐᳮᘤ᱐!Ḅᙠ#ᜐᳮḄᦻ"ᘤ᱐!Ḅ"Ntoskrnl.exeNtoskrnl.exeNtkrnlmp.exeNtkrnlpa.exeNtkrpamp.exein.PAEᑁ᪶45Ntkrnlpa.exein\Windows\\Windowsᨵ329:\Driver.cab\\Driver.cabᨵ;EFGHI.JK⊤2.6EFGHI.JKHal.dllNḄHALᑡ⊤;⊤2.6NḄHALᑡ⊤;Q☢Ḅᦻ5┐TWindows2000\I386\Driver.cabNWin32k.sys\I386\UNIPR0C\Win32k.sysḄWin32k.sysNtdll.dll\I386\UNIPR0C\Ntdll.dll\I386\Ntdll.dllKernel32.dll\I386\UNIPR0C\Kernel32.dll\I386\Kernel32.dllট^᝞`ab-QWindows2000ᦻ᪛NḄ\I386\UNIPROCᦻ¼ᜳ$ýPÃþᑮÿWinsrv.dllḄᦻ஺ᯠᦻ

15efᙠUNIPROCḄᦻᜳḄQ☢hijᨩlḼnopqᓫᜐᳮᘤ᱐!hrohs▭huᦻ5ᨵpq᱐!hvwx〉ᵨG#ᜐᳮᘤ{ᓫᜐᳮᘤ஺ᙠWindowsXP{WindowsServer2003Nhuᦻᜳ|}e~◀஺=sᙠWindows2000pb#ᜐᳮᘤᐵḄᢝᦻa5⌕ᙠᜓᳮᘤ(DeviceManager)Nb“(Computer)”TḄ⁚hvᑮhTGpq329Windows2000#ᜐᳮᘤhᦻoᨵᡠ¢wḄ஺1.ᡭ¤Ḅ¥ឋT§᪾(avª«ᑴ☢N⌱¯“(System)”hᡈὅᙠaḄ²☢³´µ¶“ᡃḄᵯᾯ(MyComputer)n,ᯠº⌱¯“¥ឋ(Properties)”»¼)஺2.µ¶“¾(Hardware)”᪗Á஺3.µ¶“ᜓᳮᘤ(DeviceManager)”஺4.¤“(Computer)”T஺5.ö“(Computer)”Q☢ḄÄ⁚µ஺6.µ¶“(Driver)”᪗Á஺7.µ¶“ÅÆÇ(DriverDetails)”஺TG#ᜐᳮᘤhaÈÉᑮQ☢ḄT§᪾:

16nᐵ´ḄᦻËᡠᨵᓫᜐᳮᘤ᱐!hoÌឋÍḄÎÌ——ÐᓫᜐᳮᘤÑÒh#ᜐᳮᘤḄwÓ!poÔÕÖᩖ{ὑxḄhᡠhÙnᐵ´ḄᦻᨵÚÛḄᓫᜐᳮᘤ᱐!hvÜᑮᙠᓫᜐᳮᘤÝÞnwÓ¤├.ᜧ#ᦪâãWindowsḄäoᓫᜐᳮᘤḄ;஺ᨵåḄohNtoskrnlḄᓫᜐᳮᘤ᱐!{#ᜐᳮᘤ᱐!oæçᙠèéṹNëᐭᩩîïᢣ¼ᩭòᡂḄ,ÑWindows2000NḄNtdll.dll{Kernel32.dllḄᓫᜐᳮᘤ᱐!ᑣoæçöᦋx86LOCK{UNLOCKᢣ¼ᩭùúḄhnûᩩᢣ¼eᵨGwÓ#qühᙠᓫᜐᳮᘤ᱐!NhᑭᵨN0Pᢣ¼.þÿ
ᩭ஺WindowsḄᐸᦻᒹᡠᨵḄᵨᐹஹ!"ᜓ$%&'()ᵨ᪵Ḅ᱐,-
./ᑖᓫᜐᳮᘤ!5ᜐᳮᘤ678-9:;<=>ᙢᜐᳮ@5ᜐᳮᘤḄA⚪஺CᙠCEFḄGHIJ)ᵨKLM-CḄGNO7PQWindowsIᵨ&'R7PQ"ᜓ$%&'——TC"UGḄV᎛X7YZ5ᜐᳮᘤḄA⚪-[\ᙠᓫᜐᳮᘤ!5ᜐᳮᘤ](⌕_`஺abcdC=ᙠefḄNtoskrnlḄ᱐,ᙠWindows2000oᐸ

17Log)”,¯°©(Event)ID±6009Ḅyz⚗-³ID⊤µKP⚗7w%V᎛ᑏᐭḄ஺³yz⚗[
⊤µC7ᔲ¹º~ᑁ᪶᧜ḄPAE᱐,(Ntkrnlpa.exe,»ᢝᜧ¾4GBḄᱥᳮᑁÀ)஺ᯠt:C;<ÃÄdªÅÆ⊤ÇHKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptionsᩭ>È7ᔲ¹º~PAEᑁ᪶஺³᜛Ê,᝞ËC¹º~PAEᑁ᪶-ᑣÅÆ⊤ÇHKLM\SYSTEM\CurrentControlSet\Control\SessionManager\MemoryManagement\Physical-AddressExtensionÍÎ"ϱ1஺C;<ÃÄcdᦻÐឋᩭ>ÈEF7ᔲÒÓ~5ᜐᳮᘤ᱐,ḄNtoskrnl(ᡈNtkrnlpa),M᝞:efWindowsÕÖ¥ᳮᘤ,ᑮ\Windows\System32ᦻᜳ-ÙÚÛ°Ntoskrnl.exe,ᯠp⌱“Ðឋ(Properties)”஺ᯠp-Û°”᱐,(Version)w᪗Ý,⌱“ÖᦻÞ(OriginalFilename)”Ðឋ᝞ËC=ᙠef5ᜐᳮᘤ᱐,Ḅß-Íàªᑮ☢Ḅáß᪾:

18ᨬp-=᝞ä☢ᡠåᑮÄḄ-C;<ᙠÒÓVÃÄdªᦻ\Windows\Repair\Setup,logᩭ>Èᑮê⌱~ëQᑁ᪶᧜!HAL஺;îïឋ5ᜐᳮᘤḄPQᐵÚA⚪7;îïឋ(scalability)஺±~ᙠP•QSMP]=>ᙢef-óôḄõṹ÷ø⍳úûüḄᢣºþᑣ஺ᙠ5ᜐᳮᘤH-ÕÖÿ
ᐸឋ⚪ᙠᓫᜐᳮᘤ⌕ᩖᙠḄ᎛⌕ὃ⇋#$஺Windows-.☢01ᱯឋ34■678ᱯឋ93Windows:;4■1ᡂ=Ḅᜐᳮᘤ>ᑮ@AB.DᐵF⌕Ḅ:ᵨHnIᙠJK41LᵨḄᜐᳮᘤMNOP:QṹSLATᙠ1ᜐᳮᘤMNOQṹHnᙠᓫ1UVᑁ᡻O1YV78YVLAᙠZTḄᜐᳮᘤM[Oᙢ᡻O]nᑁ᪶ᑁ_(᝞bc┝ஹ᣸gḄbc┝Ahi᪘┝78kᙠl3nop)AhᜓstVu
vwᘤUVᑁ_ḄxyzT{7|1}~LA[Oᙢᙠ1ᜐᳮᘤMNO஺

19n᝞I/Oᡂ(I/Ocompletionport,ᙠl9n)ḄVᑴ|LAᦔḄYVvwᘤUV[7᪵ḄVuᙠᜐᳮᘤMᨵḄឋ஺Windowsᑁ᪶Ḅឋ4ᙠZᙢU{஺᝞WindowsServer2003|ᵨ@┐91CPUḄzgᑡ7|LAᙠ1CPUM[Oᙢ᡻OYVz஺l6n@ᜐᳮᘤYVzḄx⁚஺ᨵᐵᜐᳮᘤT{ḄU4{x⁚LAᙠl3nᑮ஺ᡝ
vwᘤ᱐¢£Ḅ¤¥Windows¦§Oᡝ᱐¢Ḅ¨©ª~ᒹS§Ovwᘤ᱐¢Ḅ¨©ª~ᒹ஺ᙠWindows2000ᡝ᱐¢¬;Windows2000ProfessionalAdvancedServer
DatacenterServer஺WindowsXPᨵ61ᡝ᱐¢:WindowsXPHomeEdition>WindowsXPProfessionalஹWindowsXPStarterEdition>WindowsXPTabletPCEditionஹWindowsXPMediaCenterEdition
WindowsXPEmbedded²31᱐¢°WindowsXPProfessionao1Ḅ³-¢´[Zoxᙢ731᱐¢µ;¶·¸¹ᙠºWindowsXPProfessional»TḄ᪶¼P:M஺WindowsServer2003ᨵ61½¾HWindowsServer2003WebEditionஹStandardEditionஹSmallBusinessServerஹStorageServer^EnterpriseEdition^0DatacenterEdition஺78᱐¢ᙠA.¿☢ᨵᡠZTHnᡠÁᢝḄᜐᳮᘤḄᦪÄZT]nᡠÁᢝḄᱥᳮᑁÆḄᦪÇZT]nᡠÁᢝḄ[OÈÉÊËḄᦪÇ(Ì᝞ᙠᡝ᱐¢ᨬᐕÏTÊË101ᦻ~
ᡭᓺvw)ZT]nServer᱐¢ÓÔḄᑖÕvw(layeredservices)[ZᒹÖᙠProfessional᱐¢Ì᝞Ä×vw(directoryservices)>-Øvw(clustering),Ah9ᵨᡝÙvw(multiuserTerminalServices)ḄÁᢝ)஺⊤2.3᤺⌕ᑡÜ@Windows2000Ḅ41᱐¢ᙠᑁÆ
ᜐᳮᘤÁᢝ¿☢ḄZT஺⊤2.4ᑡÜ@WindowsXP
WindowsServer2003S£T᪵ḄÝÞ஺ᐵ3WindowsServer2003ZT᱐¢£Ḅoxßàáὃhttp://www.microsoft.com/windowsserver2003/evaluation/features/compareeditions.mspx஺⊤2.3Windows2000Professional
Server01᱐¢£Ḅ¤¥

20ÁᢝḄᜐᳮᘤḄ᱐¢ᦪÄÁᢝḄᱥᳮᑁÆWindows2000Professional24GBWindows2000Server44GBWindows2000AdvancedServer88GBWindows2000Datacenter3264GBServer⊤2.4WindowsXP
WindowsServer2003£Ḅ¤¥ÁᢝḄÁᢝḄᜐᳮᘤÁᢝḄᜐᳮᘤÁᢝḄᱥÁᢝḄḄᦪÄᱥᳮᑁḄᦪÄᳮᑁÆᱥᳮᑁõ32öÆõ32õ64öõItaniuÆõx64᱐¢÷ö᱐¢÷᱐¢÷m᱐¢÷᱐¢÷WindowsXP14GBZLᵨZLᵨZLᵨHomeEditionWindowsXP24GB2ᵨ128GBProfessionalWindows22GBᵨᵨᵨServer2003WebEditionWindows22GBᵨᵨᵨServer2003SmallBusinessServerWindows44GBᵨᵨᵨServer2003StandardEditionWindows832GB864GB64GBServer2003EnterpriseEditionWindows3264GB641024GB1024GBServer2003Datacenter

21Edition^^^&ᯠWindows()*+ᨵ-./ᡝ᱐2345ᘤ᱐2Ḅ89:;ᒹ=>?@AᐳCDEF᪶H*+ᦻ;=ᒹJᑁ᪶᧜MNtoskml.cxeRSTPAE᱐2Ntkrnlpa.exeVஹHALZஹ[ᜓ]^_`=STa2Ḅ*+bcdᐹ3DLL஺ghᦻ;ᙠWindows2000Ḅᡠᨵ᱐2kl?mDḄ஺nWindowsXP?WindowsNTpṹaRcodebaseVḄrE./ᡝ᱐2=stuᨵvwḄ45ᘤ᱐2஺x=ᙠWindowsXPyz{|ḄE}-~=┐v45ᘤ᱐2Ḅyd)ᯠᙠz=g?|ᩭḄWindowsServer2003஺=WindowsXP3WindowsServer2003kḄ᪶H*+ᦻ;?DḄ஺ᓽ᝞=ὅḄs℉R▭=ᨵ-F;suᨵᦋV஺ᡠS,᝞Windows2000ProfessionalWindows2000ServerḄᑁ᪶᧜MᐰmDḄR┐vWindowsXP3WindowsServer2003,¡V=¢£*+᝞¤¥⍝§¨©ª.᱐2ᕖ¬◤¯°n±⊤ḄHKLM\SYSTEM\CurrentControlSet\Control\ProductOptions¹ºḄProductType3ProductSuite.¼஺ProductTypeᵨᩭ½ᑖ¿ÀḄ*+?•./ᡝ*+Â?•.45ᘤ*+=@Ḅᨵᦔļ᝞⊤2.5ᡠÆ஺ǼÈÉᙠ*+ᐰÊËMmProductType3,ᙠ[ᜓ]^_`kSᑭᵨᑁ᪶ÍÎḄÏᢝÑᦪJÔ¯°ᑮ¼஺ᐵ×Ñᦪ=ØÙÚWindowsDDKḄᦻ᫏஺⊤2.5ProductTypen±⊤¼Windows᱐2ProductTypeḄ¼Windows2000ProfessionalஹWinNTWindowsXPProfessionalஹWindowsXPHomeEditionWindowsServerRÜÝᑴᘤVLanmanNTWindowsServerRß45ᘤVServerNT

22àE.n±⊤¼ProductSuite,áS½âWindows45ᘤ*+ḄD᱐2,StardardஹEnterpriseஹDatacenter,ããV=ÂS½ᑖWindowsXPHome3WindowsXPProfessional*+஺᝞ᵨᡝ_`◤⌕ᑨæ¿ÀçzḄ?ª.᱐2ḄWindows*+=èASéᵨWindowsḄÑᦪ஺PlatformSDKkᨵᐵ×êÑᦪḄᦻ᫏஺[ᜓ]^_`Séᵨᑁ᪶ÍκḄÑᦪWindowsDDKkᨵᐵ×ÑᦪḄᦻ᫏஺áᯠ*+Ḅ᪶Hᦻ;ᙠ/ᡝ᱐2345ᘤ᱐2k2ë?mDḄ=¢£=*+ᙠçzx_kì?᝞¤ᨵᡠDᕖ¬íîï{=ᙠðñòóº=45ᘤ*+┐v*+ôᔢËö©÷ᓄ=ù{Sᡂûüឋþwᵨ45ᘤÿ
ᡝ᱐ᕖᯠᨵᘤḄ┐☢ᵨ⌶Ḅ!"#$ᓄ஺'᝞ᙠ*+,-᎛᪷01234Ḅ56ᨵ7⚗9:ᑖ<Ḅ=>56Ḅ?᝞@A*+ᚮ,heap-ᡈὅE,pool-ḄᜧGஹᑁJḄ*+KLMN,systemworkerthreads-ḄᦪPQR*+ᦪ0STUVḄᜧG஺WXYZḄ>ᶍ——?᝞ᑁV]ᳮᘤᵨ_`aᩭc⊝*+efNḄᑁV◤h——ᙠᘤ᱐e
ᡝ᱐i56Ḅ஺jkMNlmiḄᨵno⁚ᙠqrᜧ12siᨵ56ḄtuYv?᝞!ᱏḄtuxmᡈὅMN▲z{|}~6஺ᙠrᜧ12siᨵ⌕XYḄᙢaᙠᩭḄᨵᐵ⁚izQl஺◀ᨵᱯᔲᑣiḄᑁ6〉ᵨ
ᡝ᱐eᘤ᱐஺᱐Windows2000ProfessionalஹWindowsXPProfessionaleWindowsServer2003ᨵᱯḄl¡᱐¢£v᱐.checkedbuild,¤ᨵMSDNProfessiona1ᡈ¥SḄ¦▅¨©ªQ«¬஺qWindows:ṹ¯°±¬ᑮḄ᱐°±³´#£v“DBG”Ḅ᪗¶·#¸᪗¶Q¹ᵨl¡eº»Ḅ°±Zᩩ½ṹ¢ᒹ¿fᩭ஺Wv#¥z᧕ᳮÁÂᡂ¬ᑮḄÄᘤṹ┐WindowsÅfᑴṹḄ¹ᜐᳮ$ᓄ{v#᡻Y¬¥ÉfYḄṹÊËÌ᪀$ᓄÎÏᨵ¢᡻Y{Ð}DebuggingToolsÑLᦻ½iḄ"Performance-OptimizedCode**Jᑖ஺ÓᡠQÕÖq᪵Ḅ᱐Ø⌕v#ÑLÙᜓÛÜÝÞßᕒávQ┐ân¢ÙᜓÛÜNãᡈᐸå*+ṹᡠlᵨḄᑁ᪶çèᦪ᡻Y¥véêḄ┯ì஺'᝞᝞íÛÜNã{ᡈὅᐸåḄᑁ᪶çṹ*+èᦪ᡻Y#îᦔlᵨ{?᝞᝞íᙠ┯ìḄið¨©ñ«òóô┝ᓽspinlock-,ÎW¸*+èᦪ÷⌴fᩭḄÐᦪâùúû⚪¢ýᑮQ¹*+þÿ
ᐕᦪ᪀ẚ
஺!"#$%&'(ᔲ*ᙠ,-WindowsḄ/0᱐2

234ᨵ&6ᑁ8Ḅ9ᐹ;<=(>?*ᙠ,-Ḅ/0᱐2@AB᱐2(DEFGᵫ᱐2
freebuild)஺ᯠ
SWMI(WindowsManagementInstrumentation,Windows`ᳮb)ḄWin32_0peratingSystemkḄ"Debug”oឋ,(qrs&tu஺'☢wᓫḄVisualBasic|2;cscriptosversion.vbsMicrosoft(R)WindowsScriptHostVersion5.6Copyright(C)MicrosoftCorporation1996-2001.Allrightsreserved.Caption:MicrosoftWindowsXPProfessionalDebug:FalseVersion:5.1.2600µ¢4ᨵᙠ,-WindowsḄ/0᱐2
s¶;<ḄDebug᪗¸FFalse஺

24ᙠ/0᱐2Ḅ¹ºᑴṹª
ᜧ½ᦪḄ▬¿ṹÀÁᵨASSERTÃÄḄÅ,µÃÆÇᙠDDKᜮᦻ©Ntddk.hª
DDKᦻ᫏ªᨵᐵÍÎÃḄÏÐ஺ASSERTÃ&6ᩩ©ÒÓ᝞&6ᦪ᪀ᡈὅ×ᦪḄᨵᦔឋÙ
᝞Å⊤ÛÜḄÝÞÅFALSE,ßàµÃáᵨᑁ᪶ãÜäᦪ"ssert,µäᦪåº&æáᵨçèéê3£áëuḄᦻ2ì〈ᑮ•6áëuïðñª஺᝞Åᨵ&6ᑁ᪶áᘤ▬óᑮ>?ª
ᑣµëuGõ;<ᙠ&6ö<÷Ḅ☢
ᵨᡝᩭúƵ᝞ûᜐᳮs&ýþᜫ
ஹᶍஹᡈὅ஺᝞ᑁ᪶ᘤ!"ᩭḄ
ᙠBoot,ini-.ᵨ/DEBUG5ᐵ,789:ᨵ▬=ᑁ᪶ᘤ>?ASSERTDḄᜫFG"HIJ஺ᐵKLᑁ᪶MᢝOᡠ᡻RḄᔜTASSERTUVWXYWindowsDDKᦻ᫏-Ḅ“CheckedBuildASSERTswiᑖ஺k21nᙠUV᱐p-᝞qrs■uNtoskrnl.exezNtkrnlmp.exe,ᡈὅrsuNtkrnlpa.exezNtkrpamp.exe,q~GᐰḄ——ᦻḄᜐᳮᘤ᱐p஺ᣚWindowsḄUV᱐p7:ᨵᑁ᪶᧜Ḅᓫᜐᳮᘤ᱐p஺UV᱐pKᳮᕒ9ᨵᵨḄ┐ᱯ¢Ḅ£¤¥ᑮ§Ḅ¨⁚ª«
ᨵᐵ¬¨Ḅᢣ®XYMicrosoftKnowledgeBase-²³314743Ḅᦻ·⚪¹"HOWTO:EnableVerboseDebugTracinginVariousDriversandSubsystems"஺ºLª«»¼½஻ᒺÀÁ£〈ᑮᑁiḄÄ«ÅÆÇ☢ÉÊᑮ½Ë஺ËV̺LÄ«qᡈὅFÍÎᑁ᪶ᘤ▬=ᑮ¹᪗Ð
º⌕ÒᙠÓÔu!"¹᪗78ᙠ᡻Rpᙢᑁ᪶Ḅ½-.ᵨÖÁ×Ø®ÙᡈὅᑭᵨᩭÛinw.sysinternals,comḄ

25ᑖ஺HIMicrosoftLMᨵNOWindows2000ServerḄST᱐UᡠVUWXYVᑭᵨ⚗ᢈ^ᙠWindows2000Server`abST᱐Ḅᑁ᪶஺ᨬfUST᱐ghijkllHI`aḄmnotimingpqᨵᡠrḄᵨᡝtuvṹXxyzᨵᵨḄoxHIU▬|ḄST}xᙠᑁ᪶.~ḄULᑁ᪶ḄxᓄḄp஺zUr┯ᱯmḄmnᩩᨵᐵ஺᝞WᙠST᱐ᩈḄ`aboᡈὅᑁ᪶HALxST᱐ḄpiUjᵫh᦮`aḄmnxrḄUᡠVᨵYjkᙠ¡Ḅ¢£`a.¤¥¦Ḅ§ᙠmn┯¨☄ªᩭ஺2.4ᐵ®Ḅ`aᡃ°±²³´WindowsḄµ¶·`¸᪀Uºᙠᡃ°ᩭ»ᐭᙢẆ¿WindowsḄᑁF¸᪀UVÀÁᐵ®ḄÂÃ`aᡠÄÅḄÆ⁐஺È2.3xᐵhWindows`a᪶ʸ᪀ḄÈUËÌÍÎ☢ЪḄ¸᪀Èo!È2.1pÒ|Ó᦮஺ÔÕ,Ë×ᯠMᨵÙÚᡠᨵḄUᱯÛxMᨵÙÚÜÝoÞ13ÍߤàáÜÝp஺•⁚ß▊åÈ2.3.ḄÁæ⌕ᐗé஺Þ3ÍêëWindowsᵨḄæ⌕ìᑴîᑴoÌ᝞gïðᳮᘤஹ.ôUõõp஺Þ5Í÷åøùᐵúWindowsḄ³UÞ4ÍàáᔜüðᳮîᑴUÌ᝞Ôý⊤ஹÿ
WMIWindowsManagementInstrumentation,Windowsᳮ஺ᯠᒕ"Ḅ$⁚&'(⁚ᙢ*+ᔜ-ᐵ/01Ḅᑁ34᪀6789᝞
6;ஹᑁ=ᳮஹ>ᐰឋஹI/Oᳮᘤஹ=DᳮஹEFG=ᳮᘤஹWindowsᦻIJKNTFS6PQ஺

26
⌱ᵨ᛻
stR2.3WindowsJK᪶T4᪀6UIV᛻XJK6XJKDLLY᝞R2.3ᡠ[,Windowsᨬ]ᨵ_-V᛻XJK:OS/2ஹPOSIX6Windows஺᝞aᡠbOS/2XJKᨬ•defWindows2000gh஺ᑮjWindowsXPkᩭfWindowsmngoḄpqP0SIXXJKrstufJKmngojv᝞wm-xyḄPOSIXXJK᱐q8{|}~UNIXḄḄm3ᑖᵨᡝᵨ஺Y᝞⌕Ḅ᪵_-XJKḄWindowsXJKeᱯḄWindowstoᨵ/ஹ᪗6[ᘤᓽᙠ¡ᨵ¢£ᵨᡝ¤¥ḄᘤJK¦§e¨©=ᙠḄ஺ª▭¦ᐸ®-XJK¯°±ᡂᢥ◤µ¶WindowsXJKᑣ¨©¸eᙠo஺XJKµ¶¹º¯»=ᙠ¼½⊤/HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\SubSystemsḄ"☢஺R2.4[jÀ/"☢ḄÁ஺

27R2.4¼½⊤ÅÆᘤ[jWindowsXJKµ¶¹ºRequiredÁᑡÊjËJKÌÍÎ'ÏḄXJK஺ÀÁᨵ®-ÐÑÒÓWindows6DebugoWindowsÁᒹ×jWindowsXJKḄᦻICsrss.exe,Ú⊤jÛᡝ/ᘤoÎXJKClient/ServerRun-TimeSubsystemàáq⁚☢Ḅ¼஺DebugÁeâḄã{¯ᵨäᑁ3åæãwçè§té஺OptionalÁ⊤ëjOS/26P0SIXXJK¯ᢥ◤µ¶஺¼½⊤ÁKmodeᒹ×jWindowsXJKḄᑁ᪶ðñ3ᑖḄᦻIòWin32k.sysq$☢õ
mö஺V᛻XJKḄ÷⁐eWindowspqJKḄ3ᑖXùú☄üᵨý஺þ-XJKÿ
WindowsᑖḄ஺ᕡḼᙠ"#$%&'(Ḅ)ᵨ+,-./ᑮḄ1234$ᙠ%&'(Ḅ)ᵨᡠ67/ᑮḄ஺8᝞#$Windows)ᵨ+,:;ᵨPOSIXḄ&B᝕Dᦪ஺F#$-᡻HḄ᧜JK.exeOPQRᑮ•$KT3U#ḄO%&'(஺V#$᧜JᦻXPYHZ[\+Ḅ]ṹ_`a᧜JᜮḄ%&'cd]ṹᡠ.e-.fghiḄ%&'ᨵkḄ\+P[஺ᙠVisualC++stuḄ/SUBSYSTEM}⛲.ᢣRcd]ᑭᚆWindowsᐹsḄExetypeᐹ-.acd]ṹ஺3#$ᨵᐵWindowsᔊḄWindows%&'\+ᡠ.PCsrss.exe,3ᙠWindowsNTḄsᡠᨵḄ%&'ᐰ¡U#Ḅ¢᛻%&'\+s¤¥\+sḄ¦+ᩭ᡻HḄ஺ᙠPOSIX¨OS/2%&'Pª«ᩭ¬ᑮe®¯°Ḅ\+s.±Windows%&'\+ḄᦻX²³ᨵᦋµ஺¶%&'·Dᦪ¸ᵨ¹ᔠ஺ᣚ¼½¾#$POSIX)ᵨ¿¸ᵨPOSIX%&'À«ḄWindows)ᵨ¿¸ᵨWindows%&'À«Ḅ஺h᝞Á±ÂÃ⌕ᑮḄÅ᪵#▲ᑴh3ÉÊ“ᨬÍḄPOSIX%&'KeÎÏ#$ÐÑᨵ

28▲ḄDᦪÒᔠÓÓPOSIX1003.1)¬Ð3#$ªØUNIX)ᵨ+,Ḅᨵᵨ¢᛻”Ḅ#஺h᝞Ú☢ᡠÜḄᵨᡝ)ᵨ+,¬Þ߸ᵨWindowsḄ&'஺àáe®fâ#$ᡈὅå$%&'DLLᩭ\H஺èéÀ«ḄßêᨵëìḄᦻ᫏¾îï3ðßᑮè%&'Ḅ+,-.¸ᵨèßê஺8᝞Windows%&'DLL(ò᝞Kernel32.dll.Advapi32.dllஹUser32.dll¨Gdi32.dll)ÎÏWindowsAPIDᦪ஺POSIX%&'DLL(Psxdll.dll)ÎÏPOSIXAPIDᦪ஺Îøùa-᡻H᧜JḄ%&'cdÂ-.ᑭᵨWindowsᐹsḄExetypeᐹᡈὅWindowsúᢝᐹ¨P1atformSDKsḄàþឋ
ᐹDepends.exe,ᩭᑮ᧜Ḅ,᝞ḄWindows᧜$Notepad,exe)ᓫḄᦻ,-.ᘤ0ᓽ23,4Cmd.exeWindows789:;᛻0ᐸ᝞>$C:\>exetype\Windows\system32

29otepad.exeFile஻\Windows\system32

30otepad.exe஻isofthefollowingtype:WindowsNT32bitmachineBuiltfortheIntel80386processorRunsundertheWindowsGUIsubsystemC:\>exetype\Windows\system32\cmd.exeFile"\Windows\system32\cnid.exe"isofthefollowingtype:WindowsNT32bitmachineBuiltfortheIntel80386processorRunsundertheWindowscharacter-basedsubsystem

31Z⊤\Notepad]GUI^_0`Cmdᑣ]bᑴdᡈὅghijḄ^_஺`l0ExetypeᐹḄnoᗗ:q$rᯠ┐uGUI4ghijḄ^_ᨵḄ0w]0Windowsᓾyᨵz஺`l0ᙠIntel386ᜐᳮᘤ~`0ᡈὅ486]ᢝWindowsḄ---Exetype^_Ḅᦻ,no஺zᵨ^_ᵨDLLḄᦪḄ᎛0>3Onᦪ¡ᐰ]ᙠDLL£¤Ḅ0ᙠᵨᡝ¦§>¨©஺ᣚ«¬0ᦪ®¯ᨵ°;᛻±^〈³´0`lµ¯ᨵᵨWindows᡻©·Ḅ¸¹஺ᦪ]ᙠᵨᡝ¦§>¡ᡂḄ0¨©Ḅ»¼½¾°ᵨὅ஺ᦪḄᨵrocess¿À]½¾-1,ᙠᡠᨵñ^ÄᐵḄᦪ0ᑭᵨÇÈÉᵨʱ^4GetQrrwtaocess/duhzÍᙠ¨©Ḅ±^0±^IDᦋÏ0ᡠȱ^IDÈÐÑÒḄᙢÔÕÖᑮ0Ð`×ØÙÚᵨÛᑁ᪶஺nᦪ⌕ßᵨWindows᡻©·zÚᡈὅàÚ஺᝞0WindowsḄá?ead&'/e4ᦈ஻e/7/eᦪᑖè⌕ᵨéêḄl×ᦻ᫏ḄᑁìWindowsI/O¸¹µ7?ea"'஻e4NtWriteFile.nᦪ⌕ßᙠ;᛻±^¡ᡂíî;᛻±^¨©ᙠᵨᡝ¦§>0¿ïðñòóíᙠᐸbᑴ>¨©Ḅôᡝᵨ^_Ḅõ᝱஺ᙠZ÷ø>0ᦪȳ´Ḅù§°;᛻〈zôᡝ/¸¹ᘤúß0Ð`û;᛻᡻©üî஺ᯠýDLLþÿ
ᦈᑮ
ᵨὅ஺ᨵᦪᑡḄ23⚗Ḅᔠ"᝞WindowsḄCreateProcessCreateThread?ᦪ஺,-Windowsᙠ/0Ḅ1᎛⌕45ᢝ789:Ḅ;᛻=>?@ABCḄDEᩭGHI8=>?JBKᡠᨵḄMṹᩭᜐᳮQRSTI/O,SᯠZ[\ᜧ^_`Ḅ>?ᦪabc>?Ḅdeᜧfgc>?Ḅឋᨬjkᯠlᩭm☢op஺qrWindowsstḄ=>?ᡠWindowsḄ/0ὅuvwxyzḄᦪ{ᙠWindows=>?|}~HᐸḄ=>?ᵨWindows=>?ᩭᡂSTI/O஺qPOSIXOS/2=>?ᵨWindows=>?|ḄᩭᡂSTI/OB▭᝞x᧜Ḅ=>?wZGᑮJWindows᡻ᦻ.☢ᡃᩭᙢGGI8;᛻=>?஺Windows=>?Windows=>?ᵫ¢8£⌕Ḅ᪀ᡂḄ஺

32n;᛻=>?¥¦(Csrss.exe)ᒹ®ᑡ5ᢝ:•±ᑴ³(ᦻz)QR´•µ¶ᡈᑤ◀¥¦º¦´•c16½¾¿DOSÁ(VDM)¥¦ḄÄᑖ5ᢝ´•ᐸ•ᦪ"᝞GetTempFileஹDefineDosDeviceExitWindowsEx,Æ¢8ÇᯠÈÉ5ᢝᦪ஺nᑁ᪶ÌÍ/ᜓÏЦÑ(Win32k.sys)ᒹ®:•QR-ᳮᘤ(windowmanager),±ᑴQRST-ᳮØÙÚÛÜᩭÇÝÞஹà᪗ᐸ/ᜓḄÚᐭã1ämåwᵨᡝḄçèé⌴ᵨ¦Ñ´■ìí/ᜓîR(GDI,GraphicsDeviceInterface),ö÷┐cìíÚ/ᜓḄᦪùᐸ|ᒹúºஹᦻzìíḄûᑴᦪÆûì±ᑴᦪ஺n=>?DLL("᝞Kernel32.dllஹAdvapi32.dllஹUser32.dllGdi32.dll),ᦻ᫏ᓄḄWindowsAPI#ᦪ%&'ᡂNtoskrnl.exeWin32k.sys.ា0Ḅ12ᜧ4ᦪ5ᦻ᫏ᓄḄᑁ᪶89:;<=>ᵨ஺nABCᜓEFGHIᢣKLMNᐵḄABPQᘤEFGHஹᡭᓺUEFGHV⚣XYZEFGH஺[ᵨGH>ᵨ᪗]ḄUSER#ᦪabᙠPQᘤdefᵨᡝh☢jM%k᝞mZᢥo஺mZpᳮᘤrstuv〈xGDI,zGDI{|⌴xABCᜓEFGH%ᙠCᜓEFGHᑁ~%rstu9ᓄa〉ᔠᱯḄPQᘤCᜓ஺PQᘤEFGHKV⚣XYUEFGHIᡂḄ%aV⚣PQḄᢝ஺GDI᪗]Ḅ#ᦪ%[ᵨGH⍝ᨵᐵABCᜓḄaKCᜓ¡஺GDI#ᦪ¢£[ᵨGH(k᝞PQᘤEFGHᡭᓺUEFGH)ABCᜓḄ.¥஺GDI¦§¨©[ᵨGHḄABª«tu%¬1rstuv〈xABPQᘤEFGH஺®[ᵨGH᪗]Ḅ¯Z%abrs[ᵨGHaᵨᔜ±²³ḄABª«Cᜓ஺´¯Z[ᵨGHµṹa·¸£LMCᜓḄE

33FGH஺GDIḄ¹º»%a¼ᔠCᜓḄ½¾%¡¿⌕[ᵨGHḄtuᑖ¨ᡂ4Â᧕£ᜐᳮḄ~ᑖ஺Å᝞%ᨵsCᜓaᳮ¨ÆÇᙊḄÉÊ%zᐸÌḄCᜓᑣ⌕uGDIÎÉʨ©ᡂ“:ᑡÑÒÓÔᙠᱯḄᙶ᪗ᜐ”஺ᨵᐵABV⚣EFGH×᪀ḄÙ4%tÚὃWindowsDDK.Graphics஻//-ÞḄ“DesignGuide^^⁚஺ᙠWindowsNT4aå%mZpᳮᘤAB<=Iᵨᡝ89Windowsæ:;GḄ~ᑖ஺ᙠWindowsNT4.%rsçèéᙠêndowsæ:;Gë᛻.ḄmZABµṹíᑮ>ᵨḄ:;<=.%ï¯éᙠᑁ᪶89ð(ᙠᦻMWin32k.sys.)஺ñᡠaór᪵Ḅõí%ö⌕ḄᳮᵫI®øùú:;ឋ½஺üᯠçþḄCÿ
ᓄWindowsᙠᑖḄᘤ"#$%&'()*+#,"#-᛻Ḅᑗᣚ123ὑᣵ67ᦪ9ḄCPUᕜ>,ᑁ@AB஺D᝞FGHᡝJḄK+#ᙠWindows"#$LᨵNOḄஹQFḄᘤ+#ᙠRSHᡝ+#ḄTU஺WXfastḄᱯZḄ["#\]^_`ᵨᩭᙠcd+#efg〈3i஺jk\Ḅ+#-᛻ᑗᣚlmḄᙠcdQFḄ+#ef

34fastLPCᩭs⌴3iulvwᑁ᪶$yz{|}(rescheduling)Ḅc᪵ᘤ+#ᙠRSᑁ᪶Ḅᐜ+#}ᘤ&᡻ᩗ`ᑭᵨHᡝ+#ᵨḄfᱏᩭḄṹ஺ᑭᵨᐳ¡Ḅᑁ@¢£¤`s⌴dᜧḄᦪ¦§᪀©᝞ª«Hᡝ`¬(®¯)°±ᐵ³Ḅᘤᦪ¦§᪀´wHᡝ,WindowsᘤefḄ+#/"#¶ᣚ·`¸ᙢº»ᑮᨬ»஺u¾GDIÂÃ`ᑖᢇᜐᳮ(ÇᙠÈ᝞É)஺ᡠËᢇᜐᳮ(batching),ÌᕡḼWindowsÏᵨ#ÐgÑḄᑡ}ᵨᐜᑮGDIᢇᜐᳮÓᑡ$¬ᑮÓᑡÔÕÖ“Ø(pushed)”ᑮᘤu¾ᙠÛÑ^ᜓÝÞᑴÑᩭ.á`wᵨWindowsḄGdiSetBatchLimitâᦪᩭ^ãÓᑡḄᜧä2¾ᙠåæ᎛L`

35GdiFlushâᦪᑵéÓᑡ஺6êᙢGDIḄ®¯ëឋ,ᦪ¦§᪀í1Windows"#$îïð¢@ᙠHᡝñ´òóḄ°±ôõö÷஺ᯠ2·ùᨵcdᓄFGúûḄÏᵨ#ÐüýḄឋ¸þᯠlÿḄ஺᧕Ḅᫀᑮᑁ᪶!◀#

36%▬'Ḅ()*ᵫ,-ᩭḄ/᛻ᑗᣚ஺3456ᵨ)89ᵨ:ᐭ<=ᳮᘤGDIC%DEFGHᐸJḄWindows᡻STUVWXYZᵨᡝᡈὅᑁ᪶ᣚḄ^_஺`4a:)GDI9ᵨb⚣de)8f3ghḄ⚣᳛-jkb⚣lV:Smnᑣᙠ,qrsC᪵ḄEFGHuvw⌕஺#yᨵ{%|}ᶇᙠWindowsDḄᵨᡝ:)ᑖᕖᑴᡈὅᦻḄᡠᨵᑴᙠC4ᑖᜐᳮḄvᑴ6ᵨ)8fᨵw4aḄᭆ஺s☢C᪵ḄSvg᧕ᑮᡭ4aᯠ¡Ḽ£4aᙠ¤¥☢¦eC§¨©ᑮªWindowsDwᑴḄ§᎛¤¬ᙠὑCPU§²஺³◀<´ᑴUḄµᢝ᜜ᐸJ¸ᨵ¹ᦪ»aWindows¼ᦪ©½¾¿WindowsD:)À〈Â:)()ḄÃÄÅÆஹÈÉdeᘤÊË᧜Í*ΧᦻVḄÃÄ஺4ÏÐ4a¬ᙠÑSḄWindows6ᵨ)8Ò©ÓÔgÕÖ᝞ØᨵḄÙÚÛWindowsD:)Ḅ/᛻ᑗᣚ஺USERGDIßᙠᑁ᪶Windows©'Òàáᔩᨵ%ãäåæ⍝C%^ṹßᑮᑁ᪶ᔲ©êwëìḄàáឋ஺ᐸî´àáឋḄëìïðñᑮ<ᨬó▲õᳮᵫᙠWindowsNT4ùúÖCᙠûᜩýᯠ¬þḄÚᵨᡝWindowsD:)ÖCsrss.exeḄ┯᝞accessviolation!"#$Windows()*+,Ḅ-.ᩭ012ᙠ4ᯠ16ᐵ8⌕Ḅ)*஺#$;<=>?@ᘤBCDEFGHḄᦪJK᪀M1N,O)*PᡠRST)*UVᑣ᦮ᵨᡝ[☢]^_V஺ᯠ`ᓽb1c$deᘤ-.ḄWindowsfcghᨵjklm)*nhᨵo)*ᑣp]qr-.#$deᘤ)*st⌕ᑭᵨEFvHwᑴᩭyz{ᵨ*|Ḅᑁ~᝱஺+,Windowsᩭ0᪵o~ᑖṹ2ᙠ-.ᙠᑁ᪶ṹḄaccessviolationb!"<`#$ᑁ᪶Ḅ!"஺ᯠ`ᨵ᜜Ḅᳮᓻ◅ᑣ1ᙠEF^ᑮᑁ᪶RDᙠḄ஺ᵫ,o~ᑖṹ2ᙠ-.ᙠᑁ᪶ᡠRjk┯bug,᝞bᵨV¤Ḅᢣ┐§stẚ¤ᣵᑁ᪶ª«ḄᦪJK᪀஺ᙠWindowsNT4RD,o᪵Ḅ┯ᢣ┐¯ᵨ¯°#$ᑁ᪶⚓☢ᙠᵨᡝ1tᑏḄ஺ᯠ³!"᝞Dᡠ>஺2ᙠo~ᑖṹ-.ᙠᑁ᪶n¤ᢣ┐¯ᵨV+´ᑁ᪶⚓☢Ḅµᑏfc;¶gᨵst·¸b!"¹º»᝞¼gẚ¤V´ᦪJK᪀ᑣᨵstᙠ½P³!"஺ᯠ`o¾pᙠ¿ÀḄstឋp]1o᪵Ḅ¤ᢣ┐¯ᵨÂẚ

37¤ᑁÃÄÅ(`1ᦪJK᪀)stḄK¼1Èẚ¤VḄᦪJÉÊËᵨᡝ*|ᡈὅȤᦪJᑏᑮVÎÏB஺Âyz*|ᑮVᑁ᪶R³ÐᨵÑ᜜¿stḄÒÓ஺ᐜDyz*|Ḅ~ᑖṹᙠCsrss-.ᐸØ~ᑖᙠᑁ᪶-.஺2ᙠ,᦮yz*|§-.ᙠᑁ᪶Ù஺ÚÛWindowsÜᢝḄÞᜓyz*|ᐰ~1Microsoftã°Ḅä1Microsoftåæçèéᑴ⌼ᖪᔠcRíîïªo<ᔆᖪtñᑴ⌼òs☠ᨵᦔḄyz*|஺õö°.Ḅᡠᨵyz*|᝞ᐸØḄ᡻.øùé᪵§⌕úûᝅýþḄÿ
஺ᨬᳮ☢Ḅ⌕Ḅ᪷᪵Ḅ(ᢣᙠᑁ᪶"#$%&'()*+,-)/0ᑈ◅஺345678ᐸ:ᜓ<=>ᡠ@ᵨḄBC(D᝞Fᓱ<=>(HI<=>)஺WindowsᨵRSTU☠ឋḄ◤YZ[ᡠ\]<=>^_\ᙠᑁ᪶"#$ᒹᨵ]abcdef&'gᳮᘤ(GDIlᑮᑁ᪶"#nofpqᑮWindowsḄrᐜ#8tuvTwx஺:yḄᳮzᵫ6ᡠᨵ▬}ḄWindowsᜐᳮᙠᑁ᪶"#nḄᡠᐸ:rᐜ$%Ḅ^R஺ᙠWindows,᪀ḄḄẠZḄ஺ᙠᐸ:78ᨵḄrᐜ#,-nḄᙠᑁ᪶"#nḄ᡻%
0,-vTᘤrᓰᣵ——ᡈὅ¤¥w¦⚜¨©Ḅᑁ᪶ᐭ(P஺intsofkernelreentrancy)rᓰᣵ஺ᯠ·ᙠWindowsnᙠ᡻%(executive)t»ᙢB$%Ḅ½ᵨᡝ"#$%Ḅ¿rᓰ(vT᡻%ᑁÀḄᡠᨵÁṹÃᐰUᐭḄ(reentrant)஺Åᨵᐸ:ḄᳮᵫÆRᙠSMPHÉÊᑮSTḄ,-᡽Ìឋwxo⌕Ḅ஺ÍdeSMPḄ᡽ÌឋfÎÆᦋзÑᑮÒÓ஺ᐸᳮzᜧÕ᝞ÖᐜḄ᎛Øᵨ>(&'gᳮᘤᡈὅGDIZḄÙÚÛÜÝÞÞᙠØᵨ>nÍÞᙠCsrss.exenÎáᙠSMP,-ÝÞUw/%$%·âS,-Ḅãᔢ¦஺ᑖ᪆¤ç:yRWindowsNTᢈëᙠWindowsNT4íḄ᱐n᝞»ïḄ஺ᙠᜧ8ᦪñòóᡝØᵨ>ᑮWindows+,-ôḄvᵨ5õ$%Ḅ^¤óᡝᙠ4ö÷uᘤḄ᎛ÃᐰøùḄ¥ᨵú÷uᘤÃᡂRüvᵨóᡝýþÿ
஺ᙠSMP᪷ᑮឋ஺᧕ᑮ◤ᙠ"#SMP$%ᵨឋ'(ᐹᩭ+,"#-.Ḅ012ᵨ34ᓽ6஺789ᙠ"#:ᜐᳮᘤḄ$%ᓃ?#ᜐᳮᘤ@A7B50%ḄFGHI᧕6J9•#CsrssO3P-.Ḅ2ᵨO3QᡂS"UV2ḄO3஺W▭YZ#O3[\]^ᐵ$`aHIᐳcSd᝱ᡠJᜐᳮ

38ᘤḄghijkl⌕nopᑵrJstZὅḄ"vឋ஺wAYnoឋḄᑵrxyᡠJᙠWindowsNT3.51$%zᓫO3012ᵨ34ᙠSMP|ᘤ}ᩭ~ᙠᓫᜐᳮᘤ$%⌕ᶍ᠒"஺WindowsNT4zḄ"ᓄᜧᵨᳮᘤGDIḄ2ᵨ34ᙠSMP|ᘤḄᔢᜧᜧgᱯA#2ᵨO3ᙠ.Ḅ᎛஺Z#2ᵨO3ᙠ"ᐹᨵ:ᜐᳮᘤḄWindowsNT3.51|ᘤ.Ḅ᎛ᐳ#O32ᵨ34zᨵZ#CsrsszZ#ᙠZ#ᜐᳮᘤḄ^஺¡ᙠ¢£᎛ᨵZ#O3¤ᜓ¦Aᵫ¨©"vḄª«ᓽO3Ḅª«¬Hv®ᜫSᑁj±ᵨḄ²³ឋJ´ghijḄ"vឋ஺]ᡠJ8®ᜫ²³ឋ"vឋAY-.ḄO3µᨵ6'¬"#ᜐᳮᘤ¶·ᑮ¸"#ᜐᳮᘤ஺ᙠWindowsNT4Ḅ¹ºzZ#2ᵨO3Ḅ?"#@ᨵ»¼½ḄᜐᳮᘤWindowsḄ¼xO3¾ឋA¿ᔣᙠÁ᪵ḄᜐᳮᘤÁ"#O3Hᑁj±ᵨḄ²³ឋ¡6'ᙢᨬᜧᓄI¡6'ᙢÁÅÆÇ?#ᜐᳮᘤÈᨵghijḄ◤É஺ᡠJÊHË]7ᳮᘤGDI¬ᵨᡝª«·ᑮᑁ᪶ª«ÎgSឋ'HIᙠ$%ÏÐឋ6☠ឋÒ☢Ôᨵ¢£Õ℉Ḅ⌨ᓄᓽAᙠ"#ØÙSÚÛÜÝḄ$%zÞßS#8àḄáâãäA᝞஺POSIXæ$%POSIXç6J,ᡂ“"#éUNIXḄ6·êḄëy$%ìaPortableOperatingSystemInterfacebasedonUNIX
”Ḅ✌ïðñᑏ»ᢣḄA┐UUNIXõöḄëy$%ìḄ"÷ø▭᪗¤஺POSIX᪗¤úûᔆᖪþWUNIXõöḄì¬H»þÿᢝ
᪵ᕒ᧕ᙢḄᵨᑮ஺Windows!"#$%POSIX᪗'(Ḅ᪗'ᓽPOSIX.1,*+Ḅ,-.ISO/IEC9945—1:1990ᡈὅIEEEPOSIXstandard1003.1990஺2᪗'3ᡠ5ᒹ78ᩭ:⌕.<#=>?@ABᙠ20DE80FG(HIᑴKḄABLM⌕NᓽPOSIX.

391
ឋ.PᑴឋḄ.ᙠ?@᪗'QᢈSTᕒU,NationalInstituteofStandardsandTechnology-VWḄFIPS,FederalInformationProcessingStandard,ὶYZ[ᜐᳮ᪗'^151—2(_KḄ஺WindowsNT3.5ஹ3.51Q4ab5*+cdefghe#FIPS151-2Ḅ␺K஺j

40'®ᙠª«¬®POSIXy5ýþᡂñÿ
ᨵ
POSIX᡻Ḅ᎛ᩭ஺ᡠ!◤
POSIX#$%ᑮ'ᩭ(᝞*+
,"WindowsServicesforUnix"=Ḅ>ᵨ@ᐹBᙠWindows2000FG@ᐹHḄIJKᙠ\Apps\P0SIXᦻPᜳRSᑮ
TUᑖPOSIX>ᵨ@ᐹ஺WXYZ@ᐹ[\]^_FG@ᐹHḄ
Uᑖ`abᑮRc஺ᢥ᯿f☢Ḅhi$%ᑮPOSIXᩭ஺1.
lmnopq஺2.ProcessExplorerBtuᳮᘤcHxy
fPOSIXz{[|ᨵᙠB}#~*ᙠR[|ᨵPsxss.exetc஺ProcessExplorer᪛Ḅᩭotᑡ⊤BᢥfCtrl+Tᓽc஺3.
POSIX(᝞,"WindowsServicesforUnix”=ḄCShellᡈὅKornShellBᡈὅWindows2000FG@ᐹHRḄPOSIX@ᐹ(᝞\Apps\POSIX\Ls.exec஺4.ᑮProcessExplorerRWXᑮḄPsxss.exet~Smss.exeḄ
tB᪷ḄᘤK
o◞Ḅ¡¢\£t¤^_
t`¥ᯠ~oḄc஺⌕¨ᙠWindowsR©ª«¬
POSIX®ᵨ⌕¯°ᵨPlatformSDKRḄPOSIXᜮᦻP«´ᦻP஺POSIX᡻ᦻP◤⌕¬POSIX´Psxdll.dll஺µ_ᙠ¶·¸¹fWindowsº»ᡂᢥ◤POSIXᡠz

POSIX®ᵨḄ᎛POSIXtBᓽPsxss.exec½¾ᩭ஺ᙠ¿ÀÁ{']
ÂᢝB᝞ÄᩔᣵÇPOSIXtÈÉ#\¤ÊᐸÌḄP0S1X®ᵨÇ◀οÀÁc஺POSIX᧜ÐᦻPÑÒ[\Â஺ÓÔ
ᱯÖḄ×_Posix.exeḄØᢝ᧜ÐᦻPᩭᯠÙ'ÊÚÛ•tᩭPOSIX®ᵨ஺OS/2᝞£ᑁ»ḄPOSIX
᪵OS/2à᛻ᙠᨵᵨឋã☢}Îäᨵ▲'æØᢝOS/21.2Ḅ16èéêëìḄᡈὅ⚣I/OBVI0cḄ®ᵨ஺ïᯠMicrosoft}>ñòó
ôõOS/21.2ḄWindowsNT4÷ouᳮᘤø'[\ØᢝOS/22.xBᡈùÙ᱐ÑḄc®ᵨB`ûᙠWindows2000üÙ'}\ÊᵨÇc஺

41ý᜜µ_Windows\ᐕᵨᡝᵨᡠ᝞OS/2ᒹ᡻IN/0UTᢣ(ᜓ)"#$%⚣I/O(AVI0)ḄI/Oᱯᩗ*ṹᑣ-᪵ḄᙠWindows012345ᢝ஺89:ᵨCU/STIᢣḄᵨᑣ<5ᢝḄ=<>?ᡠᨵᐸBḄOS/2ᵨCDECLIᢣḄFᡠᨵᐸBḄGHIᢞKᑮ᡻MᩩSTIᢣOP஺ᙠQRḄOS/21.22ᨵ16MBḄᑁT▲ᑴ=-W▲ᑴXY〉ᵨ[Windows——0S/2\>?ᑭᵨWindowsḄ32^_`ᙢᙬcdeᔣOS/21.2ᵨghij512MBᑁT᝞2.5ᡠk஺2GB32ᵨᡝḄII᳛14Ḅ32ᵨᡝḄ02.5OS/2\>?_`ᑁTlmn᪀0pḄqr(tiledarea)<ᢣ_`ᙢᙬcd⚜ᐜIuᶇᯠxy16^ᵨ◤⌕|Ḅ}᎛Igᡈ◀gḄ512MBᑁT஺OS/2\>?OFMm⊤(LDT,LocalDescriptorTable),8ᐳḄᑁT|ᑣ<ᙠᡠᨵOS/2FḄ᪵LDTᩩ஺᝞ᡃ⌕ᙠ6Ḅ9᪵G(thread)?M᪵OS/2\>?²<ᙠ¶M·¸¹•»¼ḄOS/2᧜½ᦻ}¿ÀÁKᩭ஺³MuᢝÃÄ᝱ᑮ>?IÅÆÇÈOP஺

42ᨵᐵWindows᝞ÑᜐᳮᙠÃḄPOSIX"OS/2ᵨḄÙiÚÛÜÝÞ6Ḅ"CreateProcessḄá”M⁚஺Ntdll.dllNtdll.dll?5ᢝéê⌕ᵨ[\>?DLL஺ᒹíWîïḄðᦪ:n>?óôᑖDT᪷÷stubsú,³ᵨWindows᡻ü>?óôýnᑁ5ᢝðᦪh\>?ஹ\>?DLLCᐸBḄQR᧜½ᦻ:ᵨ஺MÿᦪWindows᡻ᙠᵨᡝ!"ᦪ#ᵨWindows᡻Ḅ஺!᪵Ḅᦪ'200+,-.᝞NtGreateFileஹNtSetEventJJ^0᝞1☢ᡠ45Ḅ!"ᦪḄᜧ-ᦪ78WindowsAPIᩭ=>?ᑮAᯠCᨵ"ᦪᑣFᯠGHIᵨJKLᑁNO஺PJQR+!᪵ḄᦪNtdllᒹWR+XYḄᐭ[஺ᦪᑁNḄ\ṹᒹW^ᜐᳮᘤb᪀dᐵḄᑗᣚᢣijᢣikᣚᑮᑁ᪶mC#ᵨᑖoᘤAsystemservicedispatcher,z3|}~ᙢO஺ᑖoᘤᙠ"ᦪ#ᵨ0Ḅᑁ᪶ᐸᒹNtoskrnl.exeᑁNḄ▭\ṹ஺NtdllᒹW-ᢝᦪ.᝞᧜ᘤA/ᜮḄᦪOஹᚮ¡ᳮᘤஹWindows¢£¤¥ᦪACsrᜮḄᦪO§R¨Ḅ©ª¤A«/ᜮḄᦪO஺GᒹWᵨᡝḄ¬¤#ᵨAAPC,AsynchronousProcedureCallOᑖoᘤ¯¬°ᑖoᘤAᐵJAPC¯¬°}ᙠz3|±²O஺᡻Windows᡻³Ntoskrnl.exeḄ´µAᑁ᪶³ᐸµO஺᡻ᒹW¶·Ḅᦪ஺nᙠᵨᡝ#ᵨḄ¸¹ᦪ஺!"ᦪºsystemservices},»¼NtdllI¸¹஺!"½ᜧ-ᦪWindowsAPIᩭ=>ᡈὅÀR+Á᛻¢ḄAPIᩭ=>஺ᯠCPJᨵ"ÃÄR+ᦻ᫏ᓄḄ¢ᦪÈÉÊ=>GHA!᪵ḄË¢ᨵÌLPCஹÎ᝞ᙬ0"Ñ"/7-Ô/7஺஻ᑖ஺஺655!᪵ḄØÙᦪ§Î᝞!᪵ḄÚᵨᦪÛÛO஺n஻64B/஺஺஺஻Þ஺ᦪᩭ#ᵨḄßᜓáâᘤᦪ஺!mᵨᡝᑮᑁ᪶R+ᵨḄãCᙠᵨᡝ#ᵨßᜓáâ¤ä»F^åᡈὅᑏKLᐵὶḄᦪ஺nè8ᙠᑁ᪶#ᵨḄ¸¹ᦪ»¼!"ᦪᙠWindowsDDKᡈὅWindowsIFSKitAInstallableFileSystemKit,îïᦻðḄoñᐹóOôõᦻ᫏

43ᓄAᨵᐵWindowsIFSKitḄö-¥÷EMNhttp:஻www.micros஺ft.com/whdc/ddk/ifskit/default,mspx஺nᙠᑁ᪶#ᵨøùᙠWindowsDDKᡈὅIFSKitᦻ᫏ᓄḄ¸HûᦪA.᝞üᜮḄஹᙠý¸þ⚣
ᵨḄᦪ஺nᐰḄᦪ஺ᒹᙠNtoskrnlᑁᵨḄᑁ'(ᢝᦪ*+᝞-/ᓺᡈὅᦈ3ᜮḄ56ᦪ7ᑖ9ᑁ'I/O<ᳮᘤ(ᢝᦪ?ᑁ'ᑁ@<ᳮ(ᢝᦪ஺nᐰ*AᙠBCDᙽᑁ'Ḅᦪ஺᡻GHᒹIJ-KḄL⌕NO7ᙠPQRSḄT⁚VWXYᙢ[\]6NO஺n^_<ᳮᘤOconfigurationmanager,ᙠ`4T[\bcdefg⊤Ḅij?<ᳮ஺nk?l<ᳮᘤprocessandthreadmanager,ᙠ`6T[

44oᡈpqk?l஺┐sk?lḄtu(ᢝᙠWindowsḄᑁ᪶ijḄ{A᡻GHᑣᙠ]6tus}Ḅ~ẠJ▬Ḅ?஺nᐰᵨᘤ7secur/tyre/"e஻cezwacagerᡈSRM,ᙠ`8TᑴᙠPᙢ¡iGᐰ¢ᶍ஺¤¥Ḽ§¨deḄ©ª*᡻Gs«G¬s}Ḅ¥?®஺nI/O<ᳮᘤI/Omanager,ᙠ`9T°±ijJ²³ᜓµᐵḄI/O§¨*bcV]6§¨ᑖ·ᑮាºḄ³ᜓ
-»k¼ᜐᳮ஺nᓽ¿ᓽᵨ7PnP<ᳮᘤPlugandPlaymanager,ᙠ`9T°±ḄÁÂ*J(ᢝBCᱯḄ³ᜓ*ÄÅ6
Æ◤Ḅ*ȬÉbcÊ]6
஺ᙠ³ᜓᑡÌÍ*ÎÏᑮÐC³ᜓḄÑO©ª◤Ò஺PnP<ᳮᘤ᪷ÔÐC³ᜓ

45Ḅ©ª◤Ò*ᑖ^〉ºḄÑO©ª*+᝞I/OÖ×ஹIRQஹDMAÜ⍝?ᑁ@Þ_஺ºdeḄ³ᜓßᓄ7áᡈὅâ◀³ᜓ¬*Ébcä〈ាºḄæOÜç஺nᵯª<ᳮᘤpowermanager,ᙠ`9T°±bcéᵯªæO*êëᔣ³ᜓ
íîᵯª<ᳮI/OÜç஺ᵯª<ᳮᘤï-^_ᡂñºdeòóḄ¬᎛*ÜÍVCPU_÷ṑḨú᝱üAýþᵯªÿὑ஺ᓫᜓḄᵯὑᓄᵫᜓᩭᜐᳮ◤⌕ᵯᳮᘤᩭ஺nWDMWindowsᳮ)+,ᑗ"WindowsManagementInstrumentationroutines,ᙠ0423456ᐕ8ᜓ9:ᨵᐵឋ>?@AḄBCDEᦈᩭGᵨᡝJKWMIMNḄOP஺WMIBCḄQRᡝᙠSᙢUᘤVWᙠXYZ[Ḅ\UᘤV஺n]^_`ᳮᘤcachemanager,ᙠ01123456b]cᦻefgẠḄI/OklḄឋ>ᐸnopᨬrsᵨtḄuvᦪxyᶇᙠ{ᑁ`3}~^,uvᑏklᙠᦪx9〈ᑮuvᐜᙠᑁ`3ᶇ6஺ᑮᑭᵨᑁ`ᳮᘤḄ᧜ᦻeḄᢝᩭnᑮ஺nᑁ`ᳮᘤmemorymanager,ᙠ0723456¡c¢£ᑁ`஺¤ᑁ`ᳮ¥ᫀf§¨©bªc¨«ᜧḄᨵᙢᙬ¯ᐸᦪ°ᜧᜧ±t²ᵨḄᱥᳮᑁ`஺ᑁ`ᳮᘤWf]^_`ᳮᘤbªᨬgSḄ´µᢝ஺n¶·⚜¹ᘤCog/ca/pre/0tMer,ᙠ0723456Ä^ÅÆ?©ḄÇt஺ÈÉ⌕ᙠÅÆᡈ©Çt3sᵨḄᦪxËᓄcÌᦪxḄÄÍt஺Î᜜Windows᡻ÑÒÓᒹÕÖ×{⌕ḄᢝØᦪVÌ᡻ÑÒ×eWᵨᑮÌᢝØᦪ஺ᙠÌᢝØᦪ3ÙÚÛᨵÜᑖᙠDDK3ßᑮàáḄᦻ᫏ãfᜓW⌕ᵨᑮä஺åÖᜧæᢝØᦪ஺

46nÈçᳮᘤ,o6Jecf0a஻ager6,ìíஹᳮ?ᑤ◀Windows᡻ÑÒÈç?ñçᦪxæòÌÈç?ᦪxæòóóô⊤cklÅÆḄö÷᝞©ஹù?ᔜ¤ûüÈç஺Sý032ÿ
ᳮᘤ஺nLPCᙠ3ᙠᘤḄᡝ"#$%&ᘤ"#'()⌴+,஺LPC-RPCRemoteProcedureCall,/0#1ᵨḄ345ᮣ7Ḅ8ᓄ᱐;஺<=ḄRPC-ᢣ?@AḄᡝ"#$%&ᘤ"#'(ḄBCDE᪗G஺nHIJLMNḄOᐳQRSTᦪV᝞XYZᜐᳮஹ]^_`ஹᦪabcdᣚ,gJhᐰj᪀ᜐᳮl஺n᡻Rnoᢝq#V᝞rsᑁuᑖwᣚ⚓Ḅ$yᣚ⚓Ḅᑁuzஹ{┝Ḅᑁu}~gJᱯbcḄ${nfastmutexes஺ᑁ᪶ᑁ᪶-ᵫNtoskrnl.exeḄHTᦪgJnrj᪀ḄoᢝV᝞$¡ᑖ¢᪀ᡂḄ஺Ntoskrnl.exeḄ

47Ḅᔜ\]ᐰ_`
aᨵbcḄ67deJfGghiḄj᎛67delmgᡷ◀W஺*=├ᙠᑁ᪶q#rsᙠḄ
ᑁ᪶/0tu:vᓫḄ;<
x:ᑁ᪶;

48M%®᛻ᑗᣚGcontextswitchingU஺¶·¨¸ᩭ¹ºN⌱¼®᛻ᑗᣚ9ᵨ᪵Ḅ½¾G$ºNḄ᡻À®᛻?ÁªÂᩭúNḄ®᛻?ÄÅÆᩭUÇ%ᙠᜐᳮᘤ$Ḅ)*jÊË%ªᙠ1!"᪀«☢ḄÍÎ஺\]᡻À®᛻%ᵫᜐᳮᘤḄÐ᝱GÒªᘤ&UᩭTḄᡠ9Ó1ÔÕ}Ö?ÁªᡈÄÅᑣ%EḼ!"᪀Ḅ'ᨵᡠḄ஺ÙÚ¸GHALU᝞ÛRÜÝÞᡠ{ᑮḄWindowsâãḄᐵä⌕åj%^?ᑮᔜæḄç<$஺ÙÚ¸%èæឋᡂ]Ḅᐵä+ᑖ஺IIAL%ÄÅḄஹᑁ᪶ì¬Ḅìᙽ^{|m┐ïWindowsðñòÀᡠᙠḄç<Ḅó¸஺^◚õm45ᐵḄö⁚H᝞I/Oஹ/ùúᑴᘤ9füᜐᳮᘤýÔ=ᑴ——:;4!"᪀5ᐵᡈὅ
ᘤᐵḄ஺ᡠWindowsᑁᵨᡝᑏḄᜓ!"#$%&'()*+,-◤⌕0123ᐵḄ456,-789:ᵨHAL>ᩭ@ᢝ7BCឋ஺EFGHIJ┐LGMHAL>NᨵPḄᦻ᫏ᒹTᙠWindowsDDKY஺⌕Z[ᑮ]^ᨵᐵHALᐸᙠᜓ!Yᵨ`Ḅ45abὃDDK஺dᯠWindowsfghijIIALlm⊤2.6r,tuᙠvwḄ6᎛yᨵHjHALz⌱Y"|z}~ᑮᐸᦻHal.dlllᐸḄ᝞VMS,ᙠḄ6᎛⌱HjFHALḄᙽr஺J᝞ᢝj#ᜐᳮᘤḄHALᨵᡠ#Ḅ#G᪵Ꮇ£Hjx86¦vwḄN7ᙠ§•jᜐᳮᘤ஺⊤2.6ᙠ\Windows\DriverCache\i386\Driver.cabYḄx86HALᑡ⊤HALᦻᡠᢝḄHal.dll᪗´PCHalacpi.dll·¸¹º»ᵯ½%¾lACPIrPCHalapic.dll·¸7Y¿ÀᑴᘤlAPICrPCHalaacpi.dllAPICACPIPCHalmps.dll^ᜐᳮᘤPCHalmacpi.dll^ᜐᳮᘤACPIPCHalborg.dllSiliconÄÅÆÇlÈÈᙠWindows2000YÊᨵË̦Í#Î├ÐrHalsp.dllCompaqSystemProlÈÈᙠWindowsXPYÊᨵrটÖ×WindowsServer2003ØÙᙠWindowsÚÛY#ÎfgᱯÝᔆᖪᐵḄHAL஺

49“áâ£ãäWindowsYᒹTḄÚÛHAL⌕ZåãWindowsYᒹTḄHAL,aᡭØ\Windows\DriverCacheç☢éjêë᪀ᦻᜳYḄDriver,cabᦻ஺(>᝞LFx86ᩭïðᦻu\Windows\DriverCache\i386\Driver.cab)òᑮHalØᜮḄᦻᜐ,oPð7äᑮ⊤2.6YᑡEḄôMᦻ஺áâ£õÝ+ö÷ᙠøùújHALᨵûüý`7õÝ+ö÷ᙠøùújHALo1.ᡭØᦻ\Windows\Repair\Setup.log,Hal.dll,☢Ḅᦻ஺ᦻᢣᙠ"#$%&'Driver,cab,-./ᩭḄHALḄ3஺2.ᙠ5ᜓ7ᳮᘤ,(ᙠ;Ḅ<☢&=>?@''ᡃḄᵯᾯ(MyComputer)”)K⌱M“Oឋ(Properties)”Kᯠ?@“T(Hardware)”᪗WKX?@“5ᜓ7ᳮᘤ(DeviceManager)"),[\[ᙠ“]^_(Computer)”5ᜓ`ab☢Ḅ“cder”Ḅ3஺e᝞Kb☢Ḅghij'k•mnoACPIHALḄqr,s.bᩭḄt

50<»!xyt[NTOSKRNLHALḄ᧜ឋ;ᑭᵨឋᐹ(DependencyWalkertool,Depends,exe)ᩭᑁ᪶I1AL᧜ᦻḄ/ᐭ⊤K'Ḅᐵq஺ឋᐹK;'WindowsᢝᐹᡈὅPlatformSDK,¤ᑮ஺⌕§ᙠᐹ,\m᧜ᦻK;'File©ᓫ,⌱MOpen«¬Kᩭᡭ®¯᪗᧜ᦻ஺᝞°;±ᵨᐹᩭ[NtoskrnlḄឋKb²;³[ᑮḄ\m´/eµt¶·KNtoskrnl¸¹HAL,HALº¸¹Ntoskrnl(»±ᵨ¼½Ḅ¾ᦪ)஺NtoskrnlÀ¸¹Bootvid.dll,ÂᵨᩭxÃGUIÆÇghḄÈÉ⚣ËÇÌÍ஺ᙠWindowsXPÏᐸ,;ᙠᑡ⊤,ÒÓ[ᑮ\m▬dḄDLLtKdcom.dll஺DLLᒹÖᑁ᪶×ØᘤḄÙẠ5ÛÜṹKᙠÞßKÂàÜṹNtoskrnl.exeḄ\áᑖ஺ᨵᐵឋᐹḄäåæçèéKêëὃDependencyWalkerḄíîᦻ(Depends.hip)஺5ᜓËÇÌÍðᯠ⌕ᑮñ9óô$õ5ᜓËÇÌÍKöÞKÂ\áᑖᐜᜧù$õ\bËÇÌÍḄ`aKúûü\b᝞ýᑡ/;Ḅqr,þÿ
Ḅ஺

51ᜓḄᑁ᪶ᙽ(.sys)!ᙠI/O&ᳮᘤ)*Ḅ+,-./0123஺ᜓ45ᙠᑁ᪶678F:;᡻5=᛻-?@nᙠB1I/OCDḄᵨᡝGḄ=᛻HInᙠᑁ᪶JKGḄ=᛻HInLM?NHOḄP(QRSᙠTUᱯWḄXᡈὅGḄ᡻5=᛻H——\]HO^_`ab\cXᡈὅGdN)஺e᝞g?hᑖᡠkḄWindowsHḄᜓqSr3st+,)u!vᵨHALHḄzᦪ|+,ᡭ~⍝஺ᵨC(ᨵ`᎛ᵨC++)ᩭᑏḄQReᙢᵨHALᙠWindowsᡠᢝḄCPUJ᪀-.X5ṹḄᙠ?NJ᪀ᑁᑣXᑴḄ஺ᜓᨵ6;¡஺n+,ᜓ(hardwaredevicedrivers')HAL¢£+,¤¥¦§ᑏᑮᱥᳮᜓᡈª«Hᡈὅ¤ᱥᳮᜓᡈª«g3ᦈ¦ᐭ஺+,ᜓ®ᨵ¯°¡±᝞²Gஹ´µ¶☢ஹᜧ¹º»¼ᘤ½½஺nᦻ,JK(filesystemdrivers)ᢣÀ᪵ḄWindows@3Â☢ᔣᦻ,ḄI/OÄÅqÆ¥ÀÇÄÅÈᣚᡂ┐ÌÍ•ᱯWᜓḄI/OÄÅ஺nᦻ,JKÏᘤ(filesystemfilterdrivers'),±᝞ÐÇ᡻5ÑÒÓÔÕḄᡈÐÇÖ×ØI/OÄÅqÆ᡻5ÍÇÙÚᜐᳮ-ÜÝÞ⌴à6áâḄ஺nª«ãWᔣᘤäåᘤ(networkredirectorsandservers'),ᑖæᢣÐÇ¥ᦻ,JKI/OÄÅÞ⌴ફgÍçµᘤᡈὅ¤ª«g3ᦈRÄÅḄᦻ,JK஺

52nèé(protocoldrivers)êëØì᝞TCP/IPஹNetBEUIIPX/SPX-Ḅª«èé஺nᑁ᪶íÏᘤkernelstreamingfilterdrivers',À᪵Ḅîï31ᩭðÌᦪñíX5òóᜐᳮ±᝞ôᑴᡈὅõö÷ø⚣஺⌕ûᙠJKHüᵨᡝᑏḄᑁ᪶ṹ
ý?Ḅþÿᡠᨵᕒᑏᜓᑁᦪᦪ᪀Ḅ#$%&'ᙠᵨᡝ+,-./Ḅ0ᙠDDK1ᨵᦻ᫏456Ḅ7ᢝ9஺;᝞ᩭ>www.comḄ?@Aᐹᵫ,•FWindowsGUI6ᵨFGᡂḄᐸ1ᵨᩭᦈKᑁḄL᝱4NᵨOP/ᙠᑁ᪶+,-'Rᵨᡝ+,1S&9ḄWindowsAPI஺Windows+TWindows2000UVWXᓽZᓽᵨஹᵯ]⌱⚗Ḅ7ᢝ`ab᡽dWWindowsWḄ+TfḄ+TghWDMWindowsDriverModel,Windows+T9஺Windows20004iḄ᱐kl/mnὁḄWindowsNT40phq.7ᢝᓽZᓽᵨᵯ]⌱⚗ᡠmnqḄᙠqr%☢Ḅtulvᨵᡠ⌨ᓄ஺RWDMḄyzᩭ{ᨵ-|஺n}~TQbusdriver,h}~ᑴᘤஹ〉ᘤஹ᫑ᡈᨵᜓḄᜓ஺}~◤ḄMicrosoftv1Ḅ}~T'᝞PCIஹPCMCIAUSB
lᨵF}~஺|%b/ᑏ}~ᩭhfḄ}~7ᢝ᝞VMEbusஹMultibusFuturebusontTfunctiondriver⌕Ḅᜓh56ḄᜓW/Ḅ஺tTb◤Ḅ◀56Ḅᜓ/¡¢ᵨ'ᐸI/0/£}~}~£¤Tᩭ¥ᡂ᝞SCSIPassThru
஺᪷§¨tTᨬWª«ᱯ§Ḅᜓ®¯¯°t±²ᜓ5ᐵḄ´µᘤḄ஺n£¤Tfilterdriverᵨᩭh«ᜓ'ᡈ¶ᨵḄ9UVfḄtᡈὅ¸ᦋᩭ>ᐸºᜓḄ1/0»¼ᡈ6½'bᵨᩭ¸⊡O¿tÀÁḄÂÃÄ]◤¼ÅÆḄÂÃᜓ9஺£¤T/⌱Ḅ/ᨵÇᦪÈ/É

53ᙠFtTÊËᡈÊ-b/Éᙠ}~TÊË஺ÌÍᜓᑴ⌼ᖪ'OEM9ᡈὅÓÔÂÃ├Öᖪ'IHV9v£¤T஺ᙠWDMÜ᛻1XÞFᜓßà.ᵫᓫFᩭᑴḄᡠᨵ%☢âF}~TãäᔣPnPèᳮᘤêëᐸ}~ËḄᜓFtTì²ᜓ஺ᙠᜧ@ᦪîï-ðñòḄ£¤TᦋóᜓÂÃḄnh஺;᝞ôFᜓᔣᐸ}~Têë◤⌕4FI/O÷0ø▭ᓾ◤⌕16FI/O÷OýF±²ᜓ5ᐵḄðñòt£¤T/þÿ
ᔣPnPᳮᘤḄᑡ⊤I/OḄᦪ"஺$%Ḅ&'()*+,ᜓ./012ᱯឋ5᝞+┐89:Ḅ$%&';<=ᑴ?$@ᐰBC஺ᐵEFGᜐᳮIᙠK3MFNO஺ᨵᐵI/OᳮᘤஹWDMஹᓽVᓽᵨXᵯ⌱⚗Ḅ\]^_`aὃK9M஺defCgh@iḄ,ᜓ♦I(&jkMsinfo32qr;<ᑡstuvwFh@iḄ:ᙠ“z{|Start”ᓫF⌱“jk|Run”,ᯠᐭ“Msinfo32”ᡭz“vw”᪛Fz“᛻”⌱“vw”஺☢+ᐸF¡tuh@iḄḄᑡ⊤f¢£¡¤¥⊤F¦§Ḅ,ᜓᑡ⊤ஹ¨©Ḅª<«¨©Ḅ¬᝱|®ᙠjkᡈὅh±²³஺,ᜓXWindows¶·¸¹ᙠº+ᙢ¼½¦§ḄfHKLM\SYSTEM\CurrentControlSet\ServiceSoᯠʨ©(&+ªËṹᩭÎᑖḄ——᝞ª1ᢣᑁ᪶ÕÖḄ,ᜓ|ᙠ¤¥⊤F×ØḄᨵᐵ,ᜓḄÙ᦮ᑡ⊤`aÛ⊤4.7஺ß᜜á¼âq;<ᑭᵨDriversdᵨäᐹ|Drivers,exe,ᙠWindows2000äᐹèFᡈὅPstatdᵨäᐹ|Pstat.exe,ᙠWindowsXPêᢝäᐹèஹWindowsServer2003êᢝäᐹèஹWindows2000äᐹè<«PlatformSDKFᙳᒹï¡¢äᐹᑡstuvwFh±?ðḄ,ᜓ஺☢DriversdᵨäᐹḄñᑖsf

54C:\>driversModuleNameCodeDataBssPagedInitLinkDatentoskrnl.exe429184968960775360138880TueDec0718:41:111999hal.dll25856601601616010240TueNov0220:14:221999BOOTVID.DLL5664246400320WedNov0320:24:331999ACPI,sys9209689600434884448WedNov1020:06:041999WMILIB.SYS512001152192SatSep2514:36:471999pci.sys1270415360312644608WedOct2719:11:081999isapnp.sys143688320229442048SatOct0216:00:351999compbatt,sys24960028801216FriOct2218:32:491999BATTC.SYS800002976704SunOct1019:45:371999intelide.sys17603200128ThuOct2819:20:031999PCIIDEX.SYS45444800109441632WedOct2719:02:191999pcmcia.sys3280088640236806240FriOct2919:20:081999ftdisk.sys4640320950723392MonNov2214:36:2319

5599Total436336058032003251424432992ò+h½?ðḄᑁ᪶ÕÖóNtoskrnhHAL<«,ᜓ¹½ᑡsᩭ¡ᐸFôᒹõò+᧜÷Fᔜ+ÎùḄᜧû஺Pstatdᵨäᐹô;

56ᡭ27á?ᓽᑁḄ)ᡈὅ᦮ÕÖ☢Þ0(ß⊤`7ç᩹ᓽéᨵḄ)ᩭ᪗ëᑁᦪ஺᝞ìß⊤ᑁᑁ᪶ᦪaS0ᢣᑁîsᢝᦪ஺⊤2.7[ᵨḄÕÖÕÖÓÉCcñòóô©ᳮᘤ(Cachemanager)Cmþÿᳮᘤ(Configurationmanager)Ex᡻ᢝ(Executivesupportroutines)ᦻ#$%&'()*(Filesystemdriverrun-timeFsRtllibrary)Hal0#123(Hardwareabstractionlayer)IoI/Oᳮᘤ(I/Omanager)Keᑁ᪶(Kernel)Lpc<ᙢ>?ᵨ(Localprocedurecall)Lsa<ᙢAᐰCD(LocalSecurityAuthority)MmᑁIᳮᘤ(Memorymanager)Windows$%LM(NᜧPᦪRSTUWindowsVᦪ)(WindowsNtsystemservices)ObW2ᳮᘤ(Objectmanager)Poᵯ[ᳮᘤ(Powermanager)PpPnPᳮᘤ(PnPmanager)Ps\ᢝ(Processsupport)Rtl)*(Run-timelibrary)SeAᐰឋ(Security)WmiWindowsᳮ^(WindowsManagementInstrumentation)aNtbᜮḄ$%LMᐭfgḄhijklmᐜḄopqrstUᑁ᪶qrjuvw◀yzᦪḄᨵᦔឋ}~>jUNtZw$%LMᨵmᩭḄopqrUᵨᡝqr\zᦪ}~᝞ᳮyWindows$%Ḅ^ja᧕ᙢSTVᦪḄ᪆Tᩭ஺Ḅrீ><¡¢>

57ᙠr¤j“”§ᑖST©Ḅᑁ§ª#«“¡¢”§ᑖ¬yᙠW2ᡈὅ°[±²y³´µ¢«“W2”§ᑖ᪗·yᙠ³´±\¡¢Ḅ஺᝞jExAllocatePoolWithTag¸¹ºuᣚ⚓Ḅᡈὅ½ᣚ⚓Ḅ¾¿\ᑁIᑖÀḄ᡻ᢝ஺ÁÂ஻ᑣᑖÀÅÆÇᑁ᪶ÈW2Ḅ஺$%\aÉḄ$%\ÊTËᙠ̸Windows$%¤Íᐸ¤Ï¸——ÑÒ\ÓSystem\——ÅÔÕ᦮Ḅ\jUk×ÅÔᙠ)•¸ᵨᡝqrḄ᡻ᦻ#ÙnÑÒÍIdleÙ\Í̸CPU¸ÈjᓰᵨÑÒḄCPUÜÙ«nSystem\ÍᒹÞᜧPᦪᑁ᪶qr$%ÈÙ«nÊßᳮᘤÍSmss.exeÙ«nWindowsá$%ÍCsrss.exeÙ«nâã\ÍWinlogon.exeÙ«nLMäᑴᳮᘤÍServices.exeÙÓkæÆḄáLM\Íç᝞$%èéḄêᵨLMëì\Svchost.exeÙTn<ᙢíᐰCDLMᘤî"ass.exeÙ;_Uyᳮ\Ḅᮣ$j»ô$%Ḅ\%'᪛"ᐢøùḄúû¬j\üÜ᱄/áᐵ$஺ÿ
ᐸᨵᳮᩭḄ஺2.6Ḅ!"#$ᑖ᪛ᐸ'(☢*ᦪ,-.ᨵ/0Ḅ123comment:஺3ProcessExplorerᐕCDEFGᩩ12ᯠJKL⌱ḄNO"#ᙠGQERS'Ḅᑡ஺:2.6UVḄ-.᪛

58WXYḄZ$ᑖ[\2.6'"#Ḅᐵ^-.஺_`ab$ᑖc⌕ᙢfghiḄjklm5opqrᙢs\ᙠWindowsxyzhi{'|}Ḅ~஺2.6'ᑡḄm-.஺᝞ᡃᙠm6o'Ḅ᪵ᵫḄ᧜ᦻᩭ᪗Ḅ஺ᯠa3K}ESystemḄ:ᨵ▭ḄᵨᡝO᧜ᦻ3f,ᙠ\Windows£¤XᨵE"SystemIdleProcess.exe”Ḅᦻ:஺¨ᙠ©ªḄ«ᐹ'Ḅ"#®©ªḄ3ᵫ¯r⁚Ḅ±²:஺⊤2.8ᑡḄb®3IDE0:஺m6o'qr2஺⊤2.8IDE0ᙠᔜ¸«ᐹ'Ḅ®ᵨ«ᐹIDE0Ḅ®¹º`ᳮᘤSystemIdleProcessProcessViewerIdle(Pviewer.exe)ProcessStatusIdleProcess(Pstat.exe)ProcessExplodeSystemProcess(Pview.exe)TaskList(Tlist.exe)SystemProcessQuickSlice(Qslice.exe)Systemprocess¯ᙠᡃᩭ

-.ÆK}Ç᧜ᦻḄ-.Ḅᵨ⌶஺'ÉzDPC᪗E“Interrupts3'É:”z“DPCs”ḄaÌÍ⊤ᵨ'ÉzÎÏ{ÐᵨḄÑÒ஺m3opa̸Ôᑴ஺Ö1×ØᯠᙠProcessExplorer',Ù"#ᙠᑡ⊤'l©஺ÚᡠKÙ"#ᙠa²EᡠÜὑḄCPUÑÒᨵßàᙠ¹á'3â᝞ã0ᵨ-.ᨵᜧåḄ'ɹº,ᑣ©pÙ"#ᡂèÜὑCPUÑÒḄ:஺1×¹º`ᳮᘤ'ÉzDPCÑÒ

59ᒹêᙠ-.ÑÒ'஺²ë᝞ìíᵨ¹º`ᳮᘤḄîïa¸ᐹᨵᜧå'ɹºḄ0ᵨ-.
ðᩭñòḄ஺Systemz-.ÆSystem(ᙠWindows2000,EID8óᙠWindowsXPzWindowsServer2003'ᑣID4)¸ᱯ÷ÆḄøùa¸ᱯ÷Æúûᙠᑁ᪶OX,®Eᑁ᪶O-.Æ(kernel-modesystemthread)஺-.ÆᐹᜓÿᵨᡝḄᡠᨵឋ᛻(᝞᛻ஹᐜ)Ḅᙢᙠ"#$%ᙠᑁ᪶()*+,-./01Ḅ2ṹ45672ṹᙠNtoskrnl.exe/CᙠDEᐸG0ᡃIᩭḄKᜓMNO/஺QR+,SᨵTUᵨᡝIᙢᙬ-.,XYDEḄN᝱[\-.#$]^_`ab+,Ḅᑁ[ᚮ/ᑖe᝞`TUᣚ⚓Ḅᡈὅjᣚ⚓Ḅk/ᑖe஺+,lan"readqᦪ(DDK/ᨵᦻ᫏wx)ᩭyzḄ{qᦪ%|`ᑁ᪶/}ᵨ஺WindowsᔜKᜓMNOᙠ+,ᓄ▤yz+,᡻*ᔜ⌕᛻Ḅab᝞I/OᡈᐸGᡈὅ⌱(poll)TUKᜓ஺᝞ᑁ[ᳮᘤᵨ+,ᩭ¡᝞“£¤⚓☢ᑏᑮ⚓☢ᦻᡈὅ᧜©ᦻ/”ஹ“£Iᙠᑁ[/ᣚIᣚ”«¬Ḅ|஺ᑁ᪶®yzT•U°±²⊝´ᳮᘤ(balancesetmanager)Ḅ+,#µ¶·¸ᖔ⏨T»`Qᨵ¼|ᔜ½}¾ᑁ[ᳮ¿ᐵḄÁ஺ÂÃÄ[ᳮᘤÅᵨ+,ᩭ“⚜Ç(read-ahead)”“ÊËᑏ(write-behind)”1/0஺ᦻÏÐᘤKᜓMNO(Srv.sys)ᑭᵨ+,ᩭÕÖ×7½ØÙᐳÛ(ᓽÝÞᑖßà¸ᐳÛᑮØÙàḄᦻᦪá)ᨵᐵḄØÙ1/0â஺ãäåÞMNOÅᨵTU+,ᩭ⌱åÞKᜓ(ᙠ6æç(⌱è0ᨵᦔX±TU☠/ëMNḄåÞMNO⌕ìὑᜧïḄ+,ðñ)஺ᨵᐵᱯó+,ḄITôõöᒹøᙠùú¿ÖûḄü⁚/஺ᙠþÿ
SystemḄᜓᙠḄ!"஺$᝞Windows,ᜓ(Win32k.sys)ᙠWindows,(Csrss.exe)!"789:;<᧕ᙢ?@AᵨᡝDEᙢᙬGHḄᦪJ஺KLᙠMNᡈὅQRḄS᎛UVWXᓫZḄḄ᡻\]᧜_ᑮab᧜_ᑮᒹdAeṹḄ,$ᑣhijᨵᵨ஺$᝞ᙠlm;nḄᦻpqrᘤtSystem;ᨵVuvὑᣵyKzḄCPUSH஺}}~⍝“KSystemᙠ\ḄS᎛''ᙠ\"hᜓᡈὅpᙠ\Ḅ஺ᡠ᝞SystemḄᙠ\Ḅ✌ᐜ⌕h:ᙠ\($᝞]ឋVᐹ)஺LᑮKᙠ\ḄᡈὅRAᙠ᡻\Ḅ(b¡¢LV!"9)ᡈὅQRᡠ£¤ḄḄ¥ᵨ᪘(callstack),]¥ᵨ᪘~⍝AKᙠ«᡻\஺

60☢Ḅ®¯°±9⚗ᢈ´஺I"®¯¶᪗¸¹SystemḄL•ᑮSystemᑁ¼Ḅ•hᑁ᪶DEḄ7¾¿ḄÀᙢᙬÁᜧGHḄᙢᙬÃÄÅÆ0x80000000◀iÊËSᙠBoot,iniᵨ/3GBᐵÐ஺8Ñ᝞L9:ḄCPUSHLXuᑮ9:ÒÓÔᩭḄCPUSHÁᙠᑁ᪶DEÖ\Ḅ஺¾¹!"×QRAḄÀᙢᙬÃLᵨPviewer.exeᩭÙ±ÚÛÜÐ஺ᯠÞRḄßᙢᙬàAḄÀᙢᙬᨬâãÃäAᙢᙬḄ☢Ð஺Pstat®ᵨᐹÃᐸæ¹ḄçèÐéᑁ᪶¥êᘤëì/íîersÁᑡ¹¿ðñîmḄᜓḄßᙢᙬ஺¾;òᙢᑮḄKᙢᙬ×ᙠᑁ᪶¥êᘤóᵨ/S3Ms஺ëì஺☢Æ®▭Ḅæ¹Ḅ᪵$ÃóᵨLivcKdжkd>!stacks0Proc.ThreadThreadThreadStateBlocker[System]8.0000048146edb0BLOCKEDntoskrnl!MmZeroPageThread+0x5f8.00000c8146e730BLOCKED??Kernelstacknotresident??8.0000108146e4b0BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000148146d030BLOCKED??Kernelstacknotresident??8.0000188146ddb0BLOCKEDntoskrnl!ExpWorkerThread+0x738.00001c8146db30BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000208146d8b0BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000248146d630BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000288146d3b0BLOCKEDntoskrnl!ExpWorkerThread+0x73

618.00002c8146c030BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000308146cdb0BLOCKEDntoskrnl!ExpWorkerThreadBa1anceManager+0x558.0000348146b470BLOCKEDntoskrnl!MiDereferenceSegmentThread+0x448.0000388146blf0BLOCKEDntoskrnl!MiModifiedPageWriterWorker+0x318.00003c8146a030BLOCKEDntoskrnl!KeBalanceSetManager+0x7e8.0000408146adb0BLOCKEDntoskrnl!KeSwapProcess0rStack+0x248.0000448146a5boBLOCKEDntoskrnl!FsRt1WorkerThread+0x338.0000488146a330BLOCKEDntoskrnl!FsRtlWorkerThread+0x338.00004c81461030BLOCKEDACPI!ACPIWorker+0x468.0000508143a770BLOCKEDntoskrnl!MiMappedPageWriter+0x4d8.00005481439730BLOCKEDdmio!voliod_loop+0x3998.00005881436c90BLOCKEDNDIS!ndisWorkerThread+0x228.00005c813d9170BLOCKED1tmdmntt!WakeupTimerThread+0x278.000060813d8030BLOCKED1tmdmntt!WriteRegistryThread+Oxlc8.0000708139c850BLOCKEDraspptp!MainPassiveLevelThread+0x788.0000748139c5d0BLOCKEDraspptp!PacketWorkingThread+OxcO8.00006c81384030BLOCKEDrasacd!AcdNotificationRequestThread+0xd88.00008081333330BLOCKEDrdbss!RxpWorkerThreadDispatcher+0x6f8.000084813330b0BLOCKEDrdbss!RxSpinUpRequestsDispatcher+0x588.00008c81321db0BLOCKED??Kernelstacknotresident??8.00015c81205570BLOCKEDIN0_FLTR+0x68bd8.00016081204570BLOCKEDIN0_FLTR+0x80e98.000178811fcdb0BLOCKEDirda!RxThread+Oxfa8.0002d0811694F0BLOCKED??Kernelstacknotresident??

628.0002d481168030BLOCKED??Kernelstacknotresident??8.000404811002b0BLOCKEDrdbss!RxpWorkerThreadDispatcher+0x6f8.000430810f4990READYparallelIParallelThread+0x3e8.00069c80993030READYrdbss!RxpWorkerThreadDispatcher+0x6f23ᑡ567ID897ID:ᢥ᯿=>“67ID.97ID”ABC஺2Eᑡ597ḄGHᙢᙬ஺2Kᑡ⊤MNO975ᜐQRS:waitCU᝱ஹXY:readyCU᝱[\5]^:runningCU᝱:`ab26cᐵQ97U᝱ḄefC஺ᨬh3ᑡ5O97Ḅ᪘jᨬ⚔lḄᙢᙬ஺mᨬh3ᑡḄnopqrsᡃuvw᧕yz[{|975ᙠ~|7jᩭḄ஺QNtoskrnljḄ97[ᦪḄ63ᢣMNO97ᙠ஺ᯠ[᝞ᙠ]^Ḅ9753|97:ExpWorkerThreadC,ᯠ⍝O97ᙠ[¡¢£¤3|¥ᜓ7§pq¨©ª«¬3|97஺¡®[¯°97^¢Ḅ±3²³5[ᙠExQueueWorkltemj¥µ3|¶·஺Gᑮ¹O¶·Ḅº᎛[¼ᐭ!dsowork_queue_itemesp+4஺OÀÁ¨ÂÃÄ23|Åa[ÆᢣᔣExQueueWorkltem:3|©ªÈᑡÉ᪀C[ᐸjᒹÍNᙠ97Î᛻jÐᵨḄÒ7Ḅᙢᙬ஺®᜜[ᙠᑁ᪶ÐÖᘤjᑭᵨ᝕ÀÁ:OÀÁABGHḄÐᵨ᪘CpqyᑮÐᵨὅ஺GHḄÐᵨ᪥¨ÂABz[5~|7¨ÜÝḄ©ª᣸ᐭÈᑡj[ßsᑮN®97:àQá97jÐᵨḄÒ7âC஺2Åãä¨97᧜æᑮ3|¥ᜓ7lᙠm|Åãj[ᡃuÂyᑮ[᝞¤¨System67jḄCPUé᧜æᑮêëOéḄàìḄ97l:qíÆᡠᙠḄ7C஺mvï⌕[¡¢GSystem67ᙠ]^Ḅº᎛[ñòᙠ97óôlõö÷ᳮùGHᙠúëḄûü஺ᙠm|Åãj[ᡃu¨ᙠḄýᘤlêëᦻÿ
ᘤḄᩭᡂḄ஺ᦻ
ᘤSrv.sys,ᩭᜐᳮ#ᡠ%ᑮḄ┐(ᦻ1/0Ḅ,-஺ᨵᐵ01Ḅ2345,6ὃ813:;஺1.ᡭ>?@ABCDE஺

632.GH•?JKLMᩭNOPḄCᘤᑡSPḄ᦮?CᘤḄᡠᨵUV஺W᝞᝞YPḄZ[\]^_COMPUTER1,ᑣhᐭ"dir\\computerl\c$/s"/s>ᐵᑡSᡠᨵḄwUV;஺3.xyProcessExplorer,ᵨ|᪗ᙠSystem஺4.Threads᪗஺5,ᢥ᯿"CSwitchDeltacontextswitchdelta,᛻ᑗᣚ;”ᑡ᣸஺P0ᑮᙠSrv.sysᨵ?ᡈὅ3?ᙠxy᝞ᡠC᝞YPᑮ•?ᙠxyP¡(Ḅ_¢?£¤,ᢥModuleᢥ¥¦§¨©Sᦻªឋ(¬᪾஺᝞£᪵¯Srv.sysḄ°⌱Ḅ²᎛ᢥModuleᢥ¥´¨µᑮ☢Ḅ·C¸Y஺

64¨¬¹ᳮᘤ¨¬¹ᳮᘤ\Windows\System32\Smss.exe-_8?Ḅᵨᡝ»¼஺½¾¿ᡂ᡻yÁÂᑁ᪶ÅÆᓄÈÉḄᑁ᪶»¼ᙠᨬË▤ÍÎÏ▭ḄSmss஺ᙠÑWindowsḄH¨¬¹ᳮᘤ½¾Ò3Ó⌕ḄÕÖ×᝞ᡭ>Ø᜜Ḅ⚓☢ᦻஹ᡻yÜÝḄᦻᦋ]Âᑤ◀áÉஹ᛻â஺#ã§wGäåᨵCsrss.exe-ÂWinlogonÑæᩭWinlogonçè¨ᐸêḄ஺ᙠëì⊤ḄHKLM\SYSTEM\CurrentControlSet\Control\SessionManager☢PîïᑮÒ3ðñ45#òÎSmssḄÅÆᓄÕÖ஺ᐸᨵ45ᙠ85:óôSmssḄ²᎛§¨Õõöᨵᐵ¦ëì⊤÷ÂøḄùúûü,6ὃWindows2000ýþÈᐹ
Ḅ⊤ᩩᦻRegentry,chm-஺Smss
Ḅᙠ᡻ᓄᙠCsrssWinlogonḄ!"#$%&஺᝞()*!
Ḅ+,*-./01ᑣSmss34567ᣵ967Ḅ:ṹ

65LMSmss%&NOP45ḄQRஹTUVWXYZḄ0[\]ᘤ_`,terminalserversessions-ḄQR9ᐵD0[\]ḄbcQdef1gḄ“0[\]Wi*_`”⁚l஺0[\]_`,TerminalServicessession-ḄXY<ᵫSmssᩭoᡂḄ஺qSmssrᑮ*XY_`ḄQRMt✌ᐜTᵨNtSetSystemlnformation,QRYxᑁ᪶{|Ḅ_`ᦪ~᪀஺BTᵨᑁḄᑁEᳮᘤᦪMmSessionCreate,ᦪYx_`ᙢᙬᙢᙬ
ᒹ_`
Ḅᣚ⚓ᑁEWᵫWin32P45Ḅᑁ᪶{|ᑖ,Win32k.sys-ᐸḄ_`ᜓᡠᑖḄஹD*_`Ḅᦪ~᪀9iḄ¡⁚Qdὃf7gl஺ᯠSmss@_`XYWinlogonCsrssḄ¤¥஺WinlogonஹLSASSUserinitWindows¦§!,\Windows\System32\Winlogon.exe-ᜐᳮ©ª|ᵨᡝḄ¦§├஺qᐰ¯ᑡ,SAS,SecureAttentionSequence-±ᔠ³´ᢥJḄM᎛Winlogon·_rᑮ*ᵨᡝ¦§QR஺ᙠWindows$¸¹ḄSAS<±ᔠ³Ctrl+Alt+Del஺ºᵨSASḄ»?<@¼½ᵨᡝ¾¿À{¦§ÁḄÂÃÄÅ?@ᵨᡝ{|ÆᵨÇÈGÉʳËᑡ஺¦§ÁḄÌÍÎϹÐ<ᙠ*Ñ@GINA,GraphicalIdentificationandAuthentication,ÒÓÎϹÐlḄÈÔᣚḄDLL
¤ÕḄ஺᪗×ḄWindowsGINA,ᓽMsgina.dll,¤Õ¸¹ḄWindows¦§Ù☢஺ᯠÛÜÝÞᕒÈàáâãäḄGINADLLᩭ¤ÕᐸḄÌÍÎϹÐåᑴ---è᝞éDêëì,voiceprint-Ḅíî——ÔᣚWindows᪗×ḄᵨᡝÑ/ÂÃíî஺ÛñWinlogonÈNOÀ◤⌕᡻óô¹ÐḄ▬Nö÷àáὅDLL஺ùGúºIi*ö÷àáὅÈᙠ./Ḅ¦§Á
ûüᑮᡠᨵḄÌÍÎϹÐþÿ஺
ᵨᡝᣓᣍᑮ〈ᑮᙢᐰᘤ!,\Windows\System32\Lsass.exe,"8#$%&'(஺LSASS)ᵨ〉+Ḅᒹ./01DLLḄ23'᡻(/▭Ḅ6789᝞;<=>ᔲ@ᔠBCᙠEFGHᡈὅSAM.KLMN⊤Ḅ
Pᑖᐸ$ᒹSᐵLᵨᡝUḄVW'$ḄXY஺ᙠᡂ[\ᡂ]LSASS)ᵨᐰ^ᵨ_`ᘤ$Ḅ
abᦪ.d᝞ᵨGreateToken,eᡂ
afghij,accesstokenobject-,=ijᒹS+kᵨᡝḄᐰlm஺ᯠ]Winlogonᑭᵨpfghᩭrs=ᵨᡝtu$Ḅvw!஺x.ᡈxy'vw!zBCᙠMN⊤{HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon}ḄMN⊤~ᦪeri”஻$.>Useinit.exe,>ᙠ=MN⊤~$ᑡa᧜'஺Userinit᡻(=ᵨᡝ᛻$Ḅ
yvwᓄ8.9᝞(HஹᵨUᶍ'ᯠ]ᙠMN⊤$<■e஻~.ᙠk☢ᑮḄ᪵ḄWinlogon{Ḅ}☢'rs
a!ᩭ(VWḄ᜜!.>Explorer.exe-஺

66ᯠ]Useinit⌨஺x§>1¨©Explorer.exeᙠ!᪛$²ᨵ᱄!Ḅµ¶

Ḅ᱄!⌨·§᝞k☢ᡠ¹ºḄtlistᡠᨵ᱄!»ᙠ(Ḅ!)᦮ᑮᨬ¾¿.ÀÁx
0jḄÂ
ÃÄÅ>ÆExplorer>WinlogonḄÉÊ!'஺Winlogon»Ë+ᵨᡝHM├ḄÍ᎛>EFḄ·ÏÐÑÍ+ÒÓᑮ{ÔḄSASÍ×>EFḄ஺d᝞,+ÙHᩭ]Úᢥ}Ctrl+Alt+Del,ᑣWindowsᐰiu᪾t0ã“M├”ஹ“æFçèᳮᘤ”ஹ“┝ë8ì”ஹ“ᐵí”î⌱⚗஺Winlogon>ñòᜐᳮxyôõ8Ḅ!஺ᐵLH!$ᔜa÷øḄ\᦮ù&úûὃ"5#Ḅ“SmssஹCsrssWinlogon”
⁚஺ᨵᐵᐰḄ⁚ὃ8஺ᐵᙠLSASSᵨᦪ!"Lsa%ᜮḄᦪ'Ḅ⁚ὃPlatformSDK2Ḅᦻ᫏஺567ᑴ9ᳮᘤ<=>?☢AᑮCḄWindows2Ḅ“56!services'”N"ᢣPQ56ᘤRST"ᢣPQUᜓWXSY஺Z⁚[Ḅ56\ᢣᵨᡝ^_ḄRS஺56`aUNIXḄ”fgRS!daemonprocess'”ᡈὅVMSḄ“ᑖnRS!detachedprocess'”,ZqRS"rstᡂvᙠwxyz᎛|X}X~ᩭ◤_ḄCS஺T"rstᡂ}X!᝞,CServices9ᳮᐹᡈὅᵨWindowsḄStarZSerMceᦪ'஺ᙠZq56ᵨᡝR9ᙠᨵqᱯḄᩩZ\vḄ!ὃ4'஺567ᑴ9ᳮᘤ\PQᱯḄwxRSḄ᧜aᦻ\\Windows\System32\Services.exe,¤¥}Xஹ§¨56RST¤¥Zq56RSR.ᡠª56SY«▭®\ᵨ¯PqᱯWindowsᦪḄWindows᧜a஺CZqᱯḄWindowsᦪ567ᑴ9ᳮᘤR"°᡻²᝞³´ḄXµ¶·¸PQ56Ḅᡂ¹}Xஹº»¼q½¾᝱ḄÀ"Áᨚ§ᡈ§¨PQ56஺ᙠ·¸⊤ḄHKLM\SYSTEM\CurrentControlSet'ServicesË̯PQwxḄ56஺ÍÎᐹÏḄRegistryEntriesÒÓᦻ!Regentry,chm'ÔÕ¯┐½wx56Ḅ×ØÙÚ஺ÔÛ56ᨵÜÝÞ߶àᙠwx2áᑮḄâᙠḄRSÞஹ·¸⊤2ḄᑁäÞß"ÁᙠServices9ᳮᐹ2åæḄçèÞ!\ᡠᨵḄ56éᨵçèÞ——᝞ëPQ56ìᨵçèÞḄíᑣçèᑁäÞß'஺56ï"ᨵPQðñò!descriptionfield',"RPóôõöQ56Ḅ¹v஺⌕øùPQ56RS᧜úᑮûRSᡠᒹýḄ56"þᵨtlist/sÿ஺ᙠᡠḄḄᨵḄᐸḄᐳ!஺ᙠ"⊤$!Ḅ%&'ṹᢣ*+,-./Ḅ01᧜3$Ḅᐸᐳ!஺ᨵ45Windows=>?Ḅ@AᩭCDḄE᝞SpoolerMᎷῃPQஹS>TUஹVWXᘤ?Zᔜ\]^=>஺

67C_`ᑡbcdefḄ[.iᑡbcjkl$ᡠefḄ,nopᑴ☢s$⌱u“wᳮJᐹ(AdministrativeTools)”,ᯠ⌱u”(Services)“஺,ᑮ᝞ᡠḄb`a三二三至?一:。■一二丁F二三三一=三毛F左™1二三1至t=三三1=三=三二二三i⌕ᑮᨵᐵ!Ḅឋᙠ!¡ᯠ⌱u''ឋ(Properties)”஺¤᝞☢ᡭᓺᎷῃP(PrintSpooler)(ᙠ!§$¨©ª«¬)Ḅឋ`

68“᡻ᦻ>Ḅ°±MPathToExecutableQw·ᢣ*+ᒹ¹!Ḅº஺»¼ᨵḄᐸḄᐳ1!——oᑮḄ᧜¾ᐵkḄ஺C_`¿ÀᑁÂḄᨵᐵḄ⁚■'ProcessExplorer?ª«¬ÄÅᒹ¹+!ᡈὅ5!ḄMÈ◤ᙠOptionsËᓫ$⌱u"ConfigureHighlighting$Ḅ⚗ÓÔ?ÕÖᡂ᪵Q஺᝞Ùᙠ!ᒹ¹+ḄÚ¡Û᪗Ýᑮᨵ!ServicesÞ§ᐸ$ᑡb+,ᑁÂḄ`ßà+,Ḅ"⊤Ḅáâஹwᳮᕒ?äåḄ¬á?Zæç,ḄᦻèéêM᝞ÙᨵḄëQ஺¤᝞ᙠWindowsXP!ᙠSystemîïḄSvchost.exe$ᡠᒹ¹Ḅ᝞`ᨵᐵḄð5⁚ñåò4ô஺2.5èô÷

69ᙠèô$ᡃùᭆûᙢ+WindowsḄýkl÷᪀஺ᡃù¿À+WindowsḄᐵ=>ᑮ+-ù᝞ÿ
ᐵὶᩭḄ஺ᙠᡃᙢᡠᩭḄ᪶!"#ᑴ%᝞'()ᳮᘤ(objectmanager):;<#ᑴ(synchronization)஺BCDEWindowsᵨᡝKLMNOPQ℉Ḅ“TUV#(bluescreenofdeath)”,ᨵḄ]^_`abᔊN஺dἝḄfghᢣjMicrosoftWindowslmᡈop᡻r(ᵫtuvឋḄ┯yᡈὅᑁ|ᩩ~p!"r)ᡠḄT⁐U஺ᙠᡃWindowslmḄ⚪ᙠTUḄ;_ᔜᵨtlm(crashdump)Ḅ⌱⚗஺¡Ḅlmhᢣᙠ!"lm¢Ḅ!"ᑁ£Ḅ¤¥¦§¨©ª«¬h®¯°±²!"lm஺³᣸•|ᑖᑁ·Ḅ¸¹ºdh»¼ᨵᐵ᝞½ᑖ᪆²Windows!"lmḄ¿À஺_ᔣªÂ᝞½ᑖ᪆®lmᩭÃĬ®┯yḄÅÆÇÈᡈὅ஺É᡻rḄlmᑖ᪆Ê◤⌕ÍḄÎÏhÐÑÒḄÓ◤⌕BᑖÔÕÖ±஺ᓽØD5®ᡈ10®lmÓᨵ®ÜNlmᑖ᪆ÝÞßᑮᨵ⚪ḄÅÆÇÈᑖ᪆áᯠhãäÍḄå²ᡂçḄᑖ᪆§èéᩭḄᦪëìᜫஹ!"ï#:ðᵨᜫñ஺14.1WindowsÉôõölmWindowslm(op᡻rºTU)ᨵ÷ø஺nrᙠᑁ᪶ùúḄûᜓÅÆÇÈᡈὅýÏ!"þᦪÿ
ᜐᳮḄ᝞ᑁ(ᵫᑏ
⚓☢ᡈὅ
᧜"#$%&'
ᨵᦔᑁ*+,Ḅᙢᙬ%/0)஺n4ᵨ
ᑁ᪶7ᢝ9:;<=>4?᝞@ABCDE(IRQL)JDPC/DispatchDEᡈVWDEXYZ
ᜐ[\]^᝱Ḅᑖaᘤcd(ᐵIRQLḄf⁚,Bijk3m)஺

70nᙠDPC/DispatchDEᡈVWḄIRQLDEXᙠ“ᵫ⚓☢ᦻrᡈᑁ᧜"ᦻr@Ḅᦪtᩭ7ᥛḄᑁ”xay
⚓⊈┯|}~⌕CᑁᳮᘤYZ
I/Oay᝞x☢ᡠḄᙠDPC/DispatchDEᡈVWDEx&YZ,$J⌕C<=>4?஺n-
ᜓ9ᡈᦪᙢ}¡4ᵨᦪckExy»$J£¤¥ᑮ
ᑁ§ᩩr⊤ªᦪt«¬ẚ®ᡈὅ⊤ªᐸ°Ḅ±²³ᙠ&ᑈ◅ẚ®ᦪtḄ±¶·[¸¹º᡻஺nay¼r┯|᝞½ᘤ¤¾}machinecheckᡈὅ&ÂÃÄ@A}NMI<.cWindowsXPᵨᡝÏÐÑMicrosoftOCA}MicrosoftOnlineCrashAnalysis,ᙠ×ᑖ᪆ÙmÚ☢ÛÜÝWebßàḄáâMicrosoftḄᑖ᪆⊤ªã$Ḅᑖä᝞14.1ᡠç}~èçḄᦪt'2004ë4ᨴíyᡂḄ஺14.1ÏÐÑ0CAḄḄã$ᑖä
ᑁ᪶ïᜓ9ᡈὅð/a
ñ¸ḄXWindows☢òḼôõḄᢑ÷஺øX£¤¥ᑮᙠ@ᨵùúû¼rᜓüúûᨵᦔᑁḄýṹ§ᑖÿḄ஺ᕡḼWindowsᕖ"#⍝%&'()ᶍ+,-.ᜓ0123ᡈὅ6789:;<᡻>&?@ABᨵDEFᔩ"┯I'J◞LMᩭḄO'ឋQᙠḄSTUVWᩭ'(XFYZ[\Jឮ^FᩭḄO'ឋAQᙠḄ஺_ᨵO'ḄJ`aᑮḄ+,ᩭcd_efḄg⚪——j᝞ᵫdᑁQḄ,nẚpqgeneralcorruption{,ᡈὅᵫd}V.ᜓ'~,஺ᐕ789:>

7114.2¡78Ḅ¢£¤~᡻>Ḅ¥ᦪ"e§/gGec4&qWindowsDDKᨵᦻ᫏{஺¥ᦪ¯°±²³ṹstopcode,ᨵµ᎛A·┯I`¸ṹ¹᝞gMeckcode<,»§¼°᪷±²³ṹᩭ¾¿ḄÀᦪ஺4eḄgq%ec4»Â78ḄᡠᨵᜐᳮᘤÇḄᡠᨵÈ»ÉWÊËᘤᑗᣚᑮÎᑖÐ᳛ḄVGAÔÕÖ\qWindows×ᢝḄᡠᨵÙ⚣ᓱÜÝÞZÖ\{<ßᑴ•°⁐ãäᯠÉÊËæ±²³ṹÉ☢èé•ᦻêᩭëìᵨᡝïð஺ᨬÉ`§/gOecAóᵨôõö÷øḄ.ᜓ0123┯I`¸ùó¥ᦪqXFóᵨ4?"4¥ᦪᩭ÷øḄùó¥ᦪ{û-0123ᨵü±²%ýḄ.ᜓqᨵO'78ᦪþ᪀
ẚᩭ஺14.2WindowsXPḄ()*+஺ঞ-WindowsXPServicePack1567Ḅ᱐9:Wind஺wsServer2003=ᐭKeRegisterBugCheckReasonCa11backWᦪ,ᐕ@AᜓCDEFᙠ()HIJKḄL☢▬O(PᦪRᡈὅUHIJKḄVWᑏᑮᐸ[ḄAᜓ\஺»probl*Mlbt«ngOo^>(opr«v«ntteymrn>««R/n^rly2Zrv.WSnotatBorysuch4t«r3b44Mli4(.IfyounM4toJ
Mdd*t஺r«■<>»«3coaoor«Mt.r*ttar(>6஺COTputer.prnt••toStscbm/«ndthe*S4f«MM>».1r«c^e43Infamet!«**:…twO*MOM0M(»OU>44C«.9«M000ttC.«yfwH.tyv-A
7atrMVAMO.CMtwStaap489JX/S
nngAMP.MMOT/a—ar/totfltk:“14.2Ḅ*+஻`a?e£vᙠ⚔dḄ▬efghṹḄᦻ9⊤ᙠWindows2000Ḅ⚔dlfghṹᦪm:n)oᦪpqᙠWindowsXP5Windows2003rsPᦪmᙠtd஺

72u(vᑡx⌴zKeBugCheckExḄfghṹ5n)oᦪ஺{⚔d▬eḄᦻ9|}~fghṹᦪm᪗Ḅᦻ9⊤஺᪷R14.2\Ḅ*+fghṹ0x000000D1q()DRIVERIRQLNOTLESSOREQUALHI஺ᐸ\()oᦪᒹᡈAᜓCDEFhṹḄᙢᙬ᝞14.2\Ḅ᪵Windows~ᙢᙬᡠᜐḄᙽḄᙢᙬஹᡙ:~AᜓCDEFḄᦻ஺sPVWᨵ¡¢£¤¥¦┯¨Ḅ©஺ªᯠ¬ᐳᨵ(®¯)Ḅfghṹpq°ᜧ¯ᦪhṹ²³ᙠ´µr¶·¸¹lᨵ஺º»ᙢ³ᦪ¼½Ḅfghṹ⊤¾ᜧ¯ᦪḄWindowsHI¿*஺ÀÁn)▬OoᦪḄÂlÃÄfghṹÅqᡠᨵḄfghṹᨵ᡽ÇḄoᦪVW஺ᯠÀ¥Èfghṹ5oᦪ᝞É〉ᵨḄÌḄ³ᨵ¡¢£¤ÍÎÏÐᙠ
ÑᜫÓḄ©ᡈὅ=¶HIḄÔAᜓ஺¤ᙠWindowsÕÖ×ᐹÙ,WindowsDebuggingTools-¢£ᦻḄ"BugChecks,BlueScreens-”(⁚\ÛᑮᐵfghṹḄVWᨵᐵWindowsÕÖ×ᐹÙḄVWÝo½u1Þ஺¤lᙠMicrosoftḄᙠßKnowledgeBasehttp:஻support.microsoft.coni\¥Ûà()fghṹ5ᶧḄÔᡈâᵨEFḄã஺¤¡äÛᑮᨵᐵ᝞åæçèé⚪ஹ᝞å6ëìḄVWᡈὅÛᑮᐵíÐèé⚪Ḅîï⊡ñᒹ,servicepack-ḄVW஺WindowsDDK\ḄBugcodes,hᒹ150)òófghṹḄ•)õ᦮ᑡ⊤ÅÁzᨵᐵàPfghṹḄ÷øḄù᜜VW஺û¼¤qᙠüý()ëḄì´µᡈὅÔAᜓLþÿ
ᑮḄ஺᝞ᯠᙠᓄ"Ḅ#$
ᑮ%&'()*ᘤᙠ,-./0ᢥ2F83ᯠ⌱5“LastKnownGoodConfiguration6ᨬ89Ḅ:;<=”஺⌱5ᨬ89Ḅ:;<⌱⚗'(@Wind஺wsABC⊤ḄEᜓBC3,HKLM\SYSTEM\CurrentControlSet\Services-GᨬHIᡂKḄ;<6ᙠLMN(O=PឮR•TUV஺Gᨬ89:;<ḄWXᩭ
ZᡂKḄ[ᢣᡠᨵḄ_`abcdeᡂfghijᨵZkl8dᡂK6m5nopqᙢstᨬ89Ḅ:;<=஺᝞uᯠ
ᑮ%&vwx᧕zḄ{|[ᔂᣵᙠmZ
ᑮOᐭḄ%஺᝞GZᐭ(ᩭd"0ᡈὅ0ᐭ:%&◤⌕AᦪPᵨᑮḄEᜓḄl2ᩭ஺᝞,PᨵḄᐭḄᨵᐵὶ6᝞᝞LMḄSCSIᘤ:
ᑮScsiport.sys-,%&'¡8d¢ᑮ£¤Ἢ✌஺

73§Eᜓᨵ◚©Ḅª[ᨵv{|'(@¢ᑮ«¬ᵨᡈὅEᜓ[®ᐵὶḄ%¯[°"ᙠBC⊤ḄHKLM\SYSTEM\CurrentControlSet\Services32☢ÇÈNEᜓḄ'(¢ᑮÉNEᜓ®ᐵὶḄ_`Ḅ஺BC⊤ḄᑖË[WindowsÏÐÑOPÒEᜓBCÓÔḄᙢÕ஺᝞ÇÈᑮ■ᓛ;ᑣÙ¢ÚDisplayNameaDescriptionḄá஺ᨵ°"âᐙáᩭätEᜓḄᵨ⌶஺æ᝞'¡çᙠDisplayNameáP¢ᑮèéê“VirusScanner",⊤ï8dðñòóôõ஺'(ᙠö÷*øᳮ(ComputerManagement)ýᐹ(GStartÿᓫ
⌱Programs/AdministrativeTools/ComputerManagement)
!Ḅᑡ⊤஺ᙠComputerManagement
'(SystemTools,SystemInformation.SoftwareEnvironment,ᯠ2⌱Driversᓽ5஺ᯠ6789ṹ.;<ᐵὶḄ?ᦪᨵB᎛DEFGHIJKLMNO஺P᝞R5S◤⌕VWᑁ᪶Z[Ḅ\ᵨ᪘_SW`abcKNOḄ!ᡈὅLMfg஺6h,ijWindowsLMlḄmnojpᙠLMNOBqrstuḄicR5SvᨵBwxyzᙠ{|lḄ}~஺ᡠGWindowsᙠmnz⌕ᨵᐵLMNOḄ}~xyᑮᓃG2oᑖ᪆஺ᡃᐭᑮzJ<⚪NOᦻg஺14.3NOᦻgᙠmnzᡠᨵḄWindowsLM¡¢j£LMNOBLM¤pxyzᨵᐵ£¥LMḄ¦᝱Ḅ}~஺R5G¨©ᵨᡝ«☢ᑮ®¡¢¯°pᡭ(²ᑴ☢´
ḄSystemµᐹᯠ2ᙠSystemProperties·᪾
¹ºAdvanced᪗½ᯠ2¹ºStartupAndRecoveryᢥÀ஺WindowsXPProfessionalLMḄmn¡¢᝞14.3ᡠ஺14.3NO¡¢

74·JKLMNOGzÂÃÄKḄ}~5Gxyzᩭ஺nÆᐰᑁÈÆᐰᑁÈᒹÊËᙠNOBÌᡠᨵḄᱥᳮᑁÈ஺ÃÏÐ⌕Ñ⚓☢ᦻgÓÔpᱥᳮᑁÈḄᜧÖ×Øl1MBÚᵨxyᜮ}~Ü஺ijᙠᜧᑁÈḄLMlÝ⌕ÑJ<ÞßᜧḄ⚓☢ᦻgᡠGÃÏÐḄᦻgpᨬÔáḄ¡¢஺WindowsNT4ãäᢝÃÏÐḄNOᦻg஺pWindowsServerLMḄmn¡¢஺nᑁ᪶ᑁÈᑁ᪶ᑁÈãᒹÊËᙠNOBÌæᱥᳮᑁÈ
Ḅᑁ᪶Z[ç/ᑏ⚓☢஺ÃÏÐéEᒹÊêᵨᡝḄ⚓☢஺ᯠ6ijãᨵᑁ᪶Z[Ḅ9ṹ_5GëìuíWindowsNOᡠGᵨᡝ⚓☢¨ß·NO\ᩭîpEï⌕Ḅ஺6h.ᡠᨵðNOᑖ᪆ᨵᐵḄᦪñò᪀ᒹô£¥õoḄᑡ⊤ஹ£¥÷Ḅ᪘,GøùØú!Ḅᑡ⊤ûÈᙠÞᣚ⚓ḄᑁÈ
Ýxyᙠᑁ᪶ᑁÈ
஺vᨵýþḄÿᩭ⚜ᑁ᪶ᑁḄᜧḄᜧᘤᡠᨵ!"#$ᑖ&Ḅᑁ᪶'(ᑁḄᦪ*஺nᑁᑁ.ᙠWindowsProfessional_t,?@ABCDEFGminidumpᡈᑖIJᐜ.triagedump,Ḅᜧ64KB.ᙠ64P128KBEoᒹUVWXYṹ[ᦪஹ]^_ḄCᜓ!"Ḅᑡ⊤ஹcdefg!h!Ḅᦪij᪀.GEPROCESSETHREAD,uv6wḄcdExyz{|}~Ḅh!Ḅᑁ᪶᪘஺ᯠᐰᑁ@ᐸ⌱⚗Ḅ@Ḅ@ᐸᜧᑮVᡠᨵᱥᳮᑁḄ*ᵨ஺ᜧḄᘤᨵGBᱥᳮᑁḄ¡¢£u?᪵¥¦§~ᦻ©ªᜧx§«_ᑮFTPᘤᡈὅ®¯ᑮCD஺ᙠ°ᜧ±ᦪḄ~ᑖ᪆³!´ᵨᡝ'(ḄYṹᦪi¢¶ᨵ®·ᵨᑮ.~@ᵫᑁ᪶ᑁ´ᙠ¹⚪z{Ḅ¢»ᦪij᪀¼ᶇᙠᑁ᪶ᑁ´Eᡠxᙠᐰᑁ´¾Ḅ¿±ᦪiÀᑖ᪆¢ÁᐵÃÄÅÆÇVᦻ©ḄÈÉ஺ᨬË@z¦ᔁ.\WindowsÎÏᡠᙠḄᔁEḄ⚓☢ᦻ©ḄᜧÒÓÔÕÖ´ᱥᳮᑁḄᦪ*×^1Ø஺ᵫᙠÙÚÛᡠ⌕ÝḄ⚓☢ᦻ©ḄᜧÀ▭ᱥᳮᑁḄᦪ*ᡂàáâ|?◤Ýäåæç⚓☢ᦻ©Ò⌕Ḅᜧ஺èéὃ⇋ᑁᑁ᪶ᑁ?ìí⌱⚗ᡠîïḄðᜐ஺Ḅðᜐ@Ḅòóôõ?·ôõö÷ᣚá᝞ú³ᵯüý©ᩭ÷ᣚ஺»þ}~ÿᙠ'Windows\MinidumpᡂᦻᦻᨵḄᦻᵫ!"“Mini”%&'()*ᑡ,-.᝞Mini0824-01.dmp7᪀ᡂḄ஺:;<Ḅ=>?@ABCDEᑖ᪆Hᙠᑖ᪆IJKLᵨNᡂ;<ḄOP&ᵨᑮḄRS᧜Uᦻ-ᨬWṹNtoskrnl.exeJKR!Ḅ᱐bcdDEᨬebḄᑖ᪆7஺᝞fHgᙠhSiᡂj;<ḄOP&ᑖ᪆;<klmnop⚪஺ᯠsMicrosoftḄ!,vwᘤᒹz@WindowsXPOP}c~᱐bḄ᧜U-)!,7ᡠcHncᙠᘤ᧜ULBᢣᔣ!,vwᘤ

75iᘤᡠ◤⌕Ḅ᧜U-ᯠMicrosoftḄ᧜UvwᘤhᒹzHᡠḄ*Ḅ᧜U7஺⌕Ḅ=>ᵫiᙠ;<ᦻ@ᨵ▲ḄᦪmnoL¡ᨵᦔḄᑖ᪆£cDE஺¤᜜ᓽLH§OP¨Bᡂᑁ᪶«¬;<ᡈ®ᐰ«¬;<H°nc±¡:;<Ḅ²ᜐH◤ᵨWindbgᩭᡭ¸ᜧḄ«¬;<ᯠ~ᵨ”.dump/m”»¼½¾¿:;<஺ÀÁᙠWindowsXP)WindowsServer2003&:;<ÅÆḄᓽLOPÇ?®ᐰ;<ᡈᑁ᪶;<஺ÀHncᙠLivekdᑭᵨ.dump»¼ᡂÊËOPḄᑁ᧜UÌsHÍ◤ÎÏOPncÐÑᙢᑖ᪆OP஺ÓOPÔᯠ¿Õ@p⚪Ö×ᯠᙠ½ØvwsÙHgᙠhᡭÚvwḄÛÜÝÚÞp⚪klÞImßàáâᨵᵨ஺ãf¡ᑮḄ«¬᧜Uh®ᐰäḄÌ?hSᑁåæḄᑁçè᧜ḄhSIé>&ḄÛêÖBnoᒹz@Aiᑖ᪆áâᨵᵨḄëì஺ᑁ᪶ᑁ;<ᫀ½Ø@ßᑗᔠð▭Ḅé⌱ó஺Ì?Bᒹz@ᡠᨵḄôiᑁ᪶õöḄᱥᳮᑁᡠcBN®ᐰᑁ;<ᐹᨵS᪵ûüḄnᑖ᪆ᦪÖBḕᶍ@ÿ
ᐵḄᵨᡝᦪṹᐰᑁ஺ᩭ"ᙠ$%ᐹᨵ256MBRAMḄWindowsXP9:;•%ᑁ᪶ᑁḄᜧ?34MBBᙠC$%ᐹᨵ1.5GBRAMḄWindowsXP9:;,$%ᑁ᪶ᑁHᑮJ72MB஺LMNOᑁ᪶ᑁḄP᎛9:RS⚓☢ᦻWXᔲZ[ᜧ\]⊤14.1_`X,abcXdeḄᜧf?gᨵhi⚜k$%ᑁ᪶ᑁḄᜧ஺lᡠni⚜k•%ᑁ᪶ᑁḄᜧX?ḄᜧopqᙠrsPtuvᘤḄxy9:ᡠᨵz{|{}~ᙠᵨḄᑁ᪶ᑁḄᦪ஺⊤14.1┐ᑁ᪶Ḅᨬ⚓☢ᦻWᜧ9:ᑁḄᜧ┐ᑁ᪶Ḅᨬ⚓☢ᦻWᜧ<128MB50MB<4GB200MB<8GB400MB>=8GB800MBᙠrsP?⚓☢ᦻWni$%ᑁ᪶aXᨵḄ஺᝞M⌕$9:;$%ᑁ᪶ḄᜧMᑴᩭ$rs,¡iXNO¢Ḅ⌱⚗¥M¦§ᑴ¨©$9:rsᡈὅᵨ¬®

76☢¯⌕°±ḄNotmyfaultᐹ\¬®☢°±Jaº»¼i_஺LM½¾¿ÀPMÁÂRSÃÄ$%ᑁ᪶ÅᡂJÇMÈRSḄᜧdÉÊMḄ¿Àᔁ⚓☢ᦻW¢uÌO?ᜧ஺?Ä◅©]ᙠ32Î9:;M⌱Ï2GBÐ1MBᜧḄ⚓☢ᦻW?2GBXᡠᨵᵨᑁ᪶ᙢᙬÓÔḄᨬᜧf஺ᨬ®ᓽ9:ᡂÖᙢᙠrsPt¯rs×Øᑮ⚓☢ᦻWÙJÚÛÜᨵZ[ḄÓÝÞßÓÔᩭàoᦻW஺᝞gᨵZ[ḄÞßÓÔrsáâᜫJ?ᙠ⚓☢ᦻWÙᵨqÄrsḄÓÔäåæJçḼ9:éêᵨ⚓☢ᦻWaëᑖÓÔȯä⌚îᣵ஺᝞Mᙠ¿Àᔁ;gᨵZ[ḄÓÔᩭÄmemory,dmPᦻWMòó᝞ô14.3ÙõöḄ÷᪾ᩭ⌱Ïùúᐸü¬ᙢýß;Ḅþ$%ÎO஺rsḄᡂL9:¿ÀPÿ
⊤HKLM\System\CurrentControlSet\Control\CrashControl,Ḅ"#$%⌱⚗஺᝞*+,-./$%012034ᵨᩭᑏ89ᔁḄ;<=>?@ABCᙠᑁFGH.IJK0LMNO3./P=>?QRḄST0☢VW“dump[']^_஺`aᙠᑏ"#$%bBGcdḄef0ghijk3lḄ᪥no0LMpFqᩭ஺r᪵ḄefᒹuvvwJKḄ;<=>?@ABCஹ᡻z"#$%ᑏ{]ḄI/Oᳮᘤᦪ0d89ᔁḄ⚓☢ᦻfᙠ;

77ø14.4"#$%ᦻfḄûᡂ

7814.4Windows┯þÿ
᝞ᙠ3ᡠᑮḄWindowsXPWindowsServer2003ᒹWindows┯Ḅ!"#$%&'()Microsoft*ᡈὅ-ᑁ/┯01ᘤ3"4ᑖ᪆஺8ᱯឋ;<=ᡭ?Ḅ@;ABᦋDSavedumpḄ4;EFᦋḄ;SavedumpHIJ᜜ḄLMᩭOPQ$%;ᔲSETU“ᙠ&'WXYZ[\]ᩭ^!&'_`a〈)Microsoft*ᡈὅcᨵ01ᘤᙠeX☢Ḅ'ᙠh&'ᑖ᪆’⁚ᨵ"LḄkl3"4ᑖ᪆”஺n14.5op┯TUqr᪾tABuᑴ☢wḄSystemx#yḄAdvanced᪗{⚓}~qr᪾஺qr᪾ᐕtTU$%Ḅ┯U8UEᙠ⊤ḄHKLM\Software\Microsoft\PCHealth\ErrorReporting☢஺n14.5┯TUqr᪾ᙠ&'WX$%YZ[\]ᩭ^SavedumpErrorReportingḄᒹShowuiஹDoReportIncludeKernelFaults஺᝞ᡠᨵ8;true,ᑣSavedumpᵨ☢ḄLMᜓ“ᔣMicrosoftOCAOnlineCrashAnalysis
*ᡈὅᑁ/┯01ᘤ᝞S8᪵TUḄr3a〈&'_`”஺1.᝞¢ᡂḄ_`¤¥¦;x_`§¨©_`ᦻ«I¬•x_`®¯!ᐸᙠ\Windows\MinidumpsḄ<=±Uᜐ஺

792.!x_`ᦻ«Ḅ³ᑏᑮHKLM\Software\Microsoft\PCHealth\ErrorReporting\KernelFaults஺3.ᙠHKLM\Software\Microsoft\Windows\CurrentVersion\Runµᐭᩩ¸¹᡻4Dumprep(\Windows\System32\Dumprep.exe),ᡠᙠᵨᡝ¼½ᑮQ$%ḄB#Dumpreg!E᡻4஺