微内核与WinOS解析1

《微内核与WinOS解析1》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

MACH
MACHᵫCMU(CarnegieMellonUniversity)ᓝẆᑴḄᑖ
ᐸ᪗ᢝ"ᦣஹ%὚ᔠ(ᜐᳮ+,-᪀(Loosely-coupledDistributedMemoryMultiprocessor),/0(ᜐᳮᘤ23ᓫ+5ᡂḄ789᛻;ᑁ᪶MicrokernelூIJ௃Microkernel;ᑁ᪶ᑁ᪶LM
Ḅ᪶NOP஺;ᑁ᪶ᑁ᪶ḄRS᱐UV^XᓝᡂᙠZ[Ḅᑁ\]^ᑁ^_`aឋLMcdᓄXfgᓝ/hᵨᡝklmnḄop,᝞UNIXஹDOS.Windows>WorkplaceOS.WorkplaceUNIX஺IBMMicroaoft,1ₚS"(OSF)UNIX^^(USL)
ᵨitiẆᡂḄi஺☢ᑡ¡℉£Ḅ;ᑁ᪶
‖MachCarnegie-MelIonᜧªXᓝ஺NucleusChorus¬(Beaverton,Oregon)rSnf>^¬£឵°^ᙠ±█஺᝞³ᡠµ;ᑁ᪶ᑁ᪶Ḅ¡RS5¶·ᑁ᪶¹ᡂᙠºḄ»¼ḝ¾ᑖ¿ᩭÁᡂÂ/᪷᳎◤Æ_ᐭḄ⌹⍝ÊËÂLMÌÍḄÂ^ÎឋÌ_ᨵᦔḄÑᵨÒ᛻஺hᵨ;ᑁ᪶^XᓝÓÔᓣÖ×⌕ᵨcdÙᣚ⃩cdm◤⌕ᦋÝ᦮,I
஺ᡃàÂ/ᵨᖪâÓã5fcIJ;ᑁ᪶Ḅc᛻ᭆæ஺ὃ!éêIëìíîḄᖪ¼^ᳮ஺¶⍗ðñ
ᑖᶇᔠᐸêó⍝ô^ᳮÂ/ðêḄPõÌᨵᦔᙢᵨ÷ø⌕Ḅᖪ¼ñ
ù_¹÷ᐸêúû¼ü᝞^ýḄᖪ¼ᑖ஺Â/þÿ
ᩭᢝᨌḄᖪ஺^ᳮ៬Blit
ᵫᐸḄᶌ^⌕Ḅ#஺%&'()ᑁ᪶,-.ᢝ/012᪶345ᳮ6789᛻Ḅ஺ᵨ⍝=>?)ᑁ᪶@ABCḄDEFᨵᦔḄID6JKḄ11DᢣB6(N^OᓝᡂᙠSTḄ⇋ᳮᘤWX0஺YA)ᑁ᪶Ḅ,-.᝞ᙌM-6ᡠ`a0ᑖḝᡈᐹᨵ᝞fᱯhi)ᑁ᪶jklm“ᨬYq”Ḅs᝞tu^vஹxuIz{|ஹ}5ᳮஹ⇋ᳮI/O஺ᐸs᝞ᫀ5ᳮஹᢝ{mᑮ)ᑁ᪶஺ᐺ%ᑁ᪶DᡂḄ)ᑁ᪶ᜧ஺)ᑁ᪶ᐹᨵḄ᤺ឋᡈ6ᓄᵨu?ᵨᡝ)10◤⌕Ḅs⍝ᨵᑭA1¡^¢}ᘤ◤£஺᥅ᖪ6(¥᧕ᙢὺ)ᑁ᪶JKᑮᐸ⇋ᳮᘤ©ªIᙠW☢I⍷ᔠᐸ©®◤⌕Ḅ9ᴮᓄ°±஺

1Gtᢣᫀsᘤஹuᵨ³஺)ᑁ᪶¢´±°±ᨵmIᔣ6789¶jkIm஺ᙠ)ᑁ᪶·xu{¸¹º»ᡈ¼0u”ᩭ½¾¿ᵨ஺^uÀÁ4ᑖÂᔁÄ1Å4jkÆ⌶ÈÉᙠÄ⇋ᳮᘤÊ᛻fu6(ᙠSTḄῳᳮᘤW3⇼Îil0஺f☢ᑡÐ
Ñ⌕Ḅ)ᑁ᪶,-.iWindowsNT⌼=,-.DÛ^℉Microsoft1àáᓝḄ)ᑁ᪶âãiäᓝḄBåæᙠMachäᓝéÈê஺Bjk^u^vஹ·ë¢ì᜜#±5ᳮஹÄ⇋ᳮᘤTî¢-.ឮÈðñᙠᣵóéô³஺BõöS■N}^ᘤ5ᳮu?^Ðᑁ}âøBḄ/0ùõöSCNᐸBau·ë஺0SF/1MK11D:ₚ
■Ḅ0SF/1UNIXᵨᑁ᪶ẆḄᨬ᱐஺^^"Machᑁ᪶(ᡈ*+,ᣳ./0ᳮஹ34|6789:4
0ᳮ஺UNIXSVR4UNIX^^>?6@A"BCDᑁ᪶ḄUNIXSVR4EV᱐4F஺^G"Nucleusᑁ᪶஺*+L☢NOPḄᡠᨵᑁ᪶ᱯTUᯠW(ᙠᑁ᪶YZ0ᳮ^:4
஺WorkplaceOSIBMḄᑁ᪶bcMachᑁ᪶Ḅ஺11dᑁ᪶ᙠMotorolaPowerPC⇋ᳮᘤklm(bIntel804869Pentium⇋ᳮᘤḄstᐪvὅxWorkplacekḄᵨᡝz{iijfZ~ḄlmckḄtx(᝞DOS.OS/2ஹWindows.U-NIX஺IBMᑁ᪶Ḅt§40KF,zᳮḄ(᝞.^ᘤ0ᳮஹ^40ᳮஹY0ᳮ9஺Mach9Nucleus〉KḄᑁ᪶(ᵨᡝz{⌹Ḅtx9ᱯឋ஺ᓝᑖᔠz{⌹¡¢⇋ᳮᘤ9¢Ḅ£ᓄḄNᓝ¥¦§¨(ᖪªz«ឋY¬஺®¯ᑮF±ᙢ«³B´ᔣ¶BCI·¸´#9Ḅ»¼(ᨬᵨᡝz{½ᑮ1ᓤ¢¿ᵨÀ¼஺11dÁGᓄḄ^ÂᓝªÃ^"z{½ᑮᜧÅḄz⌹Æ஺ᑁ᪶ÇÈÉÊᑁ᪶ÈBÊᑁ᪶ᑁ᪶ḄᭆÌbᵫRichardRashidᙠᓱᑁ᫥◖Carnegie-Mellon
ᜧÑÒÓMachÔ*AḄ(Õ᪗bl×B-ØÙÚ〈messagepassing
ÜᑴḄᨬᑁ᪶({ÞᙠßẠkl⌼âᐸḄÁäåᩭÁäᐸḄᱯឋ஺{Machᑁ᪶çè(éᑁ᪶*+"ê40ᳮஹë40ᳮஹᑁ.0ᳮ.ஹ789I/OÆìḄí¯஺ᙠMachᑁ᪶Ạk(l×"Bîïmᙠᵨᡝ᝱ê4YḄÁä4ñ(ᵨᩭÁä4.3BSDஹSystemVஹHP/UXஹMS-DOSḄᱯឋ஺òîÁä4ñ½Mach¯óôᢝö¢ïmÙᐸ

2kḄ÷ᵨ4ñ(᝞ø1ᡠù஺ᡠ{ᑁ᪶úûüᩭḄBØý⌕ÿ
ᜧᜧḄឋ(compatibility)-ᑁ᪶ḄᐸḄᱯឋᢝ"#$%ᐸ&Ḅ$ᵨ()஺+1.Machᑁ᪶,ᐸḄᑁ᪶-./ᩭḄ1᜜•45⌕7
Ḅ᡽ᐙឋ(extensibility)஺ᑁ᪶-.Ḅ:4;᪗=
ᑁ᪶>?,@,A⌕ḄBCᐸDEᑁ᪶FᑖḄBᶇIᵨᡝ᝱L(ᩭMN஺OMachPQE&Dᑁ᪶BḄᦻSஹ;UVWXYᙠᵨᡝ᝱L(MN஺[\&]ᑁ᪶^O_`
,EᐳឋḄL:bcdefgh&]^O_i
“Ḅ”஺lfL:bḄcdᑁ᪶>?mᑴCMNoᶍᶇIᵨᡝ᝱L(-ᡈὅ]VW()஺stḄuS-ᜓᡈwSᢈyzN{>◤⌕}~ᡈᦋVW()ᓽ^AdE᪵Aᦋᑁ᪶-.஺ᑁ᪶-.Ḅl47ᙠ:4ᨬᨵḄᑁ᪶Ḅ-WindowsNTḄᔊ&ᑮᐙᑖḄNWindowsNTḄ:᱐(3.1)ᑮᨬtḄWindowsXP,ᐸᑁ᪶ḄᦋE᝞Unixo1᜜ᵫᑁ᪶,L:bcdᑁ᪶Ḅ᧕ᣵ:A⌕Ḅᱯឋ_¡ᡂ:4£Ḅ஺¤=
]ᑁ᪶-.ᨵ£¥Ḅᮣ§ឋ(flexibility)஺ᙠᑁ᪶Ḅ&ᡠᨵḄᜐᳮᘤ¬ᐵḄ®ṹX_°±ᙠᑁ᪶²ᨵ£¥Ḅ³´ឋ(portability)µPᑁ᪶¶£ᡠO³´·¤£¸஺ᑁ᪶Ḅ^☠ឋ(reliability)¤£¥l
ᵫ¶£Ḅᑁ᪶^Oᑮ#Ḅº»஺¼{:DEᑁ᪶FᑖḄB
ᵫVW()MNḄᡠO:½¾ᦑÀÁÂÃḄÄÅ஺ᨬÆᵫᑁ᪶-.ÇÈE〈mᑴᡠO᧕ᢝÊËÌÍ஺ήᑁ᪶ÏḄᩭ]ᑁ᪶-./ᩭÐ¥Ḅឋஹ᡽ᐙឋஹᮣ§ឋஹ³´ឋஹ^☠ឋÑÊËᢝ஺Ò
ᑁ᪶-.ᨵ:45⌕Óᵫᑁ᪶ᵨL(ᩭ◞ÕÖSlÖS×ØḄÌÍᵨÇÈE⌴ÚÛᩭMN:4ÖS,1:4ÖSḄÜᵨ:lM▭&
L%:ÞRPC(Q᝞ᙠNT&
LPC)Üᵨ஺ÒlfàáRPCḄÚÛ
ÌâL(ØÌÍ(IPC)mᑴMNḄᐸឋ:ãäEḄÜᵨḄឋ஺åᑁ᪶ḄàáRPCÜᵨ
ÌâÇÈE〈mᑴMNḄEḄÜᵨ:ã
ÌâàátrapḄÚæMN஺¬çtrapÚæÌâÇÈE〈mᑴMNḄlfàRPCÜᵨḄÚÛ£᠒:ᑁ᪶éᡂ:Þl᪵ÜᵨḄ£᠒l
ᵫ◤⌕êëÇÈஹ〈ÇÈஹL(ᑗᣚî#Ḅbï஺lbïᑁ᪶ḄÇÈE〈FᑖᡂP:4ð⚠ᐸឋᜧᜧäEḄÜᵨFᑖ஺Q᝞ᙠMach3&•4ÇÈE〈mᑴḄàRPCÜᵨᙠ486-DX50&òᐭ230|JSḄ├:4EUnixḄÜᵨᙠ¼:uS&ööòᐭ

320psḄ├஺l=
]EUnixḄÜᵨçMach3ḄàRPCÜᵨ÷10ø஺l4ùᜧḄúûüýᙢÿ
ᙠᑁ᪶ḄᵨḄឋ஺᝞ChenBershad0ᙠDEC-Station5200/200
ᵨᙠMachUltrix(•Unix!)#Ḅ$%&'()*UltrixMachᨬ,
-.ᵨ66%Ḅឋ஺/0⊤23473%Ḅឋ5,RPCᡈRPC(ᐵ89ᨵᐵ;஺-.ឋ5,◀
=ᵫ*?@A〈CᑴEḄFGHI᜜Kᑁ᪶LMNOḄEᵨᡝ᝱᪶R᝱STḄᑗᣚWXEḄYZᙢᙬ]TSTḄᑗᣚᨵᐵ஺^Ẇ`⊤2YZᙢᙬ]TSTḄᑗᣚNOaḄCachebcd᳛(cache-missrate)=NOឋ5,Ḅf⌕hiᵫ஺jkᑁ᪶LMឋl⚪Ḅno=᡽ᜧᑁ᪶rs^.ᐵtḄuvw9fxyᐭᑮᑁ᪶d|}~4ᙠᵨᡝ᝱᪶R᝱STḄᑗᣚWXᙠYZᙢᙬ]TSTḄᑗᣚ஺-n☢ḄᨵMachChorusR1஺ᱯᨵḄ=WindowsNT4.0ḄLM-᱐ḄWindowsNTsᩭᙠᵨᡝ᝱Ḅfxyᐭᑮᑁ᪶dᜧᜧᙢa
Ḅឋ஺=᡽ᜧᑁ᪶Ḅnoᜧᜧ
ᑁ᪶ᩭḄ-᡽ᜧḄᑁ᪶,
Ḅ᡽ᐙឋஹᮣ8ឋ☠ឋ஺᡽ᜧᑁ᪶Ḅ¡(¢jkᑁ᪶ឋl⚪Ḅ^ᩩ¡=¤^F4ᑁ᪶Ḅᜧ¥r)RPC¦ᵨ¤§¨ᓄ஺-!¡NO
ª«¬®¯ᑁ᪶Ḅ^.xḄᑁ᪶LMḄ°'஺ᙠ-.xḄᑁ᪶dL4ᑁ᪶=^℉Ḅ஺L4ᑁ᪶L4ᑁ᪶Ḅ᪶R²=³ᢝ^µ*?@A〈ḄIPCh¶W·ᙠ¸µẠº'aឋḄRPCCᑴ஺ᙠ486-DX50L4º'
^RPC¦ᵨ»├½ᵨ10¾Ḅឋ஺(S5ᙠMach^RPCḄ¦ᵨ»├¬230ps,~ᙠUnix^RPCḄ¦ᵨ»├¬20(JS஺¿À=ÁL4ḄIPC^¯ᑁ᪶ḄIPCÂ20ÃWÄ3AḄIPCK⌕Â஺◀¸S᜜L4ᑁ᪶KÅ
ᙢᙬ]TÆᳮh¶ÈÆᳮh¶஺L4Ḅᙢᙬ]TÆᳮh¶ÉÊᑁËᙢᙬ]TḄ᧜ͳᢝÎGrant.MapFlush,µ*-.L4W³ᢝᵫYZḄᵨᡝ¤WYZḄÏᶍᩭ᧜Í⚓☢஺L4ḄÈÆᳮh¶ÒÓȦ%Ôᵫᵨᡝ¤WYZḄÏᶍᩭº'}~³ᢝᵨᡝ᝱ḄȦ%ᘤ஺ᵫ*L4ᑁ᪶½½W7¦ᵨ¨ÖÀº'
W²ᡠWØᓰᵨ
12KᑁË;஺(S5^ᐺÜḄ^¯ᑁ᪶ᓰᵨ300KᑁËW³ᢝ140¦ᵨ¨Öᵪ஺L4ᑁ᪶Ḅ^ᱯᙠ*ÞḄdßᜐᳮnáL4ᑁ᪶sâãdßᜐᳮᡂIPC?@஺ᑁ᪶sâãå=^.Ô&〈IPC?@æ(ᐵᜐᳮ¯ṹḄÈ~sdßuvå=^.èᙠ¨ᦈ-.1PC?@ḄÈ஺å^âãdß&ê#ᑁ᪶ë¬-dßìê•ᩩ?@rs¸?@&〈ᑮ¸dß(ᐵὶḄᵨᡝ¤dᯠïᵫᵨᡝ¤dḄÉʨᦈ-ᩩIPC?@ḄÈᩭᜐᳮ-âãdß஺-᪵ᑁ᪶ØÉÊìêdß?@~YᵨñXᑮᐹóḄdßᜐᳮ}~ÒÓdßᜐᳮḄᐹóÏᶍᑁ᪶◞õ»ᩭ஺-!ᜐᳮnáÒÓLᜓw9Wᙠᵨᡝ᝱ᐸdßuv¯ṹḄᜧó᪀᝞5driverthread:dowaitfor(msg,sender);ifsender=my_hardware_interruptthenread/writeI/Oports;resethardwareinterruptelse...endifenddo

4ᐸÞ®¯ᑁ᪶ùḄLMExokernelᑁ᪶()*L4ᑁ᪶Exokernelᑁ᪶Ḅ஺Exokernelᑁ᪶Ḅ᪶⌕ᑁ᪶!"#Ḅ$%&'()*+ឋ)Ḅᨬᜧ/ᓄ-ᑁ᪶234ᢝᨬ6Ḅஹ89/ᓄḄ:;<&=(!"#Ḅ$%஺>?@ᩭB&IPCFG8HḄ$%I=()Jᑮᨬ8Ḅឋ)஺Exokernelᑁ᪶Ḅ᪶4ᢝ89/ᓄḄ:;LMNOPᑴRS(protectedcontroltransfer,PCT)஺PCT(`aᦪḄcᙢᙬfgḄhijᵨ&ᐸm)nopqrst஺ᙠPCTḄvẠ@&xy*+8HḄIPC$%᝞RPC஺ᙠMIPSR3000ᜐᳮᘤ@&vpPCTḄRPC*+10|JSḄ├&=ᙠ--qr@ḄMachRPC95ps|T|oRamblerᑁ᪶Rambler!(p!!ᨵ!!Ḅ@Ḅᑁ᪶஺᝞⌕ᑁ᪶Ḅ&ḄIPC/HAL¢ᙽ'¤¥Ḽ!ᑁ᪶Ḅ§⁐&xy©!ª«ᡠᨵḄᑖjᵨ஺!᪶¯h4ᢝcᙢᙬfg°c±²Ḅ³i´µjᵨ&ᙠᐰ!Ḅᔜᑖ¸¹º᫑᫡஺ᙠRambler!s&ᡠᨵḄ³ijᵨ½¯hOCP¿ÀḄ஺ᙠRambler!sFᨵᑁ᪶᝱i&°!!Ḅᑁ᪶ᨵÃᜧ(ḄRamblerḄᑁ᪶iᙠᑁ᪶᝱Ḅᙢᙬfg஺ᙠ?ᑁ᪶᝱ᙢᙬfgsᨵÄÅ!r&(x⚜ÇḄ&ÈÉpᜐᳮᘤḄÊË᪀஺ᙠÍÎḄ80386Ḅ*+@&ᑁ᪶iᒹÒstÓᳮᘤஹᙢᙬfgÓᳮᘤஹ8237ADMAPᑴᘤ×Ø¢ᙽஹOCP᪷ᙢᙬfg°Ú!ḄÛØÜṹ஺Â?ÚrḄÞßàáxyI!Ḅ*+âᶍ°ᜐᳮᘤÊË᪀Ḅ◤⌕=ᦋæ஺ç᝞ᙠᐸᜐᳮᘤèé@&ᙢᙬfgÓᳮᘤx)©êᙠᱯḄᵨᡝ᝱ᙢᙬfgs&=(íᙠᑁ᪶᝱஺î᝞&ᙠRamblerïð᱐òḄ*+s&OCP᪷ᙢᙬfgx)óêᙠᙠᵨᡝ᝱ᙢᙬfgs&=ÛØÜṹó©ôõ஺ᡠy&Ramblerᑁ᪶i*▭(p!!Ḅᑁ᪶஺=!!ᑁ᪶Ḅ÷⌕m)©Rambler!Ḅᔜø!Üù஺᝞iÓᳮ©ᙢᙬfgÓᳮᘤ(x)ᙠᵨᡝ᝱)ᡠùÜúiᑗᣚ©IPC¢ᙽḄjᵨᑗᣚᡠÜùúýiÓᳮþIPC/HAL¢ᙽ°2ᵨiÿ
᛻ᡠIPCᙽḄᑖ
ᙠᵨᡝ᝱Ḅᑁ
ᙠᵨᡝ᝱Ḅ!"#$%ᐭᑮ(ᵨ)*+,ᨵḄExternalPager8ᜓ:;)*<
ᙠᵨᡝ᝱ᙢᙬ?@+A(ᒹDEᦻG)
ᙠᵨᡝ᝱ᙢᙬ?@#$%ᐭᑮ(ᵨ)*+஺JKLMNOPQR"RamblerVWX•NZ᪶8\ஹᦻ^_ᵨ1.1.JochenLiedtke,TowardsRealMicrokernels.CommunicationsoftheACM,39(9):70-77,September1996.2.2.Chen,J.B.andBershad,B.N.Theimpactofoperatingsystemstructureonmemorysvstemeerformance.InProceedingsofthe14thACMSymposiumonOperatingSystemPrinciples(SOSP)(Asheville,N.C.,Dec.1993).ACMPress,1993,pp.120-133.3.3.Bricker,A.,Gien,M.,Guillemont,M.,Lipkis,J.,Orr,D.,andRozier,M.Anewlookatmicrokernel-basedUnixoperatingsystems.Tech.Rep.CS/TR-91-7,Chorussystemes,Paris,France,1991.4.4.Condict,M.,BolingerD.,McManus,E.,Mitchell,D.,andLewontin,S.Microkernelmodularitywithinteqratedkernelperformance.Tech.Rep.,OSFResearchInstitute,Cambridge,Mass,1994.

5ᡃḄ⌕DavidSolomonMarkRussinovich"ᡃᙠᔠ℉ḄᐵWindowsᑁᳮḄᑡ£¤Ḅᨬ¦᱐¨+ᑏª«஺ᙠ¬ᑡ£¤+"Q᱐¨Ḅ᱐®¦᱐¨¯°ᨵ±²"ᙠ³´@Windows¯°ᨵµ¶·⌕Ḅ
᱐¨¸¶¹ºᡝḄ»ᜧ½¦"¾¶ᑣ¹ÀÀÁᜓÂÃ⌕
Ḅ!ᘤḄ»ᜧ½¦஺¹Å¬᪵¨¤Ḅὅ"☢ÉḄµ¶ÊËÌ℉ḄÍ⚪"ÏÐMicrosoftWindowsNTᙠÑÒ☢ḄÓÔ"ÕÖ×ØᙠÙ¶᱐¨+ÚªᱯឋḄÑÝḄÞᓄ஺ᨬà"¨¤Ḅὅáᡂ¬ᩲḄä"ᐰ¤æçèé஺êLë$ìíDavidSolomonஹDavidCutlerMarkRussinovichîᡃïðᑮDavidSolomonñ"ᡃòᙠDECDigitalEquipmentCorporation
VAXḄVMSVä"îñóᨵ16ô஺Lõñö"÷øùVḄú¹VᑁᳮḄᦟü஺ᡃXýMarkRussinovichḄñ@⌕þª"ÿ᧽ᙠ⚞Ḅᱯᨵ஺ᩲḄ᝞ᙠMicrosoftWindows98!"#ḄNTFSᦻ%&'Ḅ“)"Windowsᑁ᪶./ᘤ1234ᐹ&ᙠWindows"#Ḅ᎛78ᐸᑁ:;᝱=஺WindowsNT⚗?ᨬABC1988D10ᨴFGHḄIAḄ?᪗B)KLMNOḄPQRSOS/2TUឋஹXᐰឋஹP0SIXஹZᜐᳮP]ஹ^ᡂḄ`abP&'☠ឋdeZf⚪஺hḼWindows3.0Ḅj#klᜧᡂbno?᪗phqjrsᓄsᡂuvᜐᳮWindowsḄTUឋwxOS/2TUឋNᑮLMz{஺ᡃ}ᨬA~&ᙠDZᑁᡂLMWindowsNT஺)▭!••Mj#᱐Dᑮ1993DᜩᡂnLj#᱐ᢝInteli386ஹInteli486kMIPSR4000ᜐᳮᘤ஺ᕜ&ᡃ}ᐭDigitalAlphaᜐᳮᘤḄᢝ஺WindowsNTḄLMj#᱐⚜Ḅ⌕ᜧஹ⌕᠒ᡠ&M⌕Ḅ▤BLMDaytonaḄ⚗?1ᵨFloridaḄLᩩ¡¢£¤ᩭ¦§=஺nLj#᱐Ḅ¨⌕?᪗B©ªḄ«¬¡Ḅ¢®¯ᯠ⌕±²³´☠஺1994Dµᜩᡃ}j

6¶WindowsNT3.5,36Mᨴ·j¶WindowsNT3.51,¸³¹᱐ᒹ»IBMPowerPCᜐᳮᘤḄᢝ஺WindowsNTFLM᱐Ḅ?᪗B³¹ᵨᡝ½☢&¿ÀWindows95TU&'ÁMicrosoftÂGjZDḄᔜÄCairoᢈÆÇᔠÉᩭ஺nLḄGjDZᨬÊᙠ1996DᜩWindowsNT4.0☢Ë஺NTḄLM᱐BWindows2000,nBᨬLMÌᡝkÍÎᘤÏj¶Ḅ஺nL᱐ÐÑᙠÀ&Ò᱐ÓÏḄWindowsNTᢈÆÔẠq!ÏᐭLo⌕Ḅ¹ᱯឋ᝞Ö×?Ø஺ÙDᩭGjWindows2000,¯ḄWindowsNTᢈÆᐰ☢ḄÚ/k.⁚஺GjWindows2000B3Ü11DᩭÝÞ4Äßà᪀ḄGjqâã஺ᙠWindows2000Gjàäᡃ}·åוMæçèᑜ⌕ᙠ¹ḄÌᡝkÍÎᘤ{Çᐭ¹ḄஹêëḄÌᡝᱯឋkᦋÉḄÍÎᘤP]஺ᙠnLèᑜ)í3î{ᨵLïÞᩭÞðñᓽÍÎᘤᱯឋḄ)KÁóôõÌᡝᱯឋ)KḄö÷¸ÌᡝkÍÎᘤḄ᱐øᑖG஺ᙠ2001D8ᨴWindowsXPProfessionalkWindowsXPHomeEditionj¶LDZ&ᙠ2003D3ᨴMicrosoftWindowsServer2003j¶஺◀Intelx86ßà᪀Ḅᢝ&᜜noüᒹ»IntelIA-64Ḅᢝn᪗ýḼWindowsNTLþÉᐭ64ÿᜐᳮḄ⚞஺ᨵᐵWindowsXPWindowsServer2003Ḅᑁ᪀ᳮḄᩗ஺Windowsᩭ"#ᑮ64%&'(Ḅᜧᶍ+,ᒹ.AMDᙠ200301ᐭḄx6434᪀,AMD64-Intel5200402ᨴ789Ḅ64%:ᢝ,EM64T-»<ᐰ:ᢝx64Ḅ>ᡝ@Aᘤ᱐&ᑜᙠ20050(E0FGᒹHᨵᐵx644IJKL⁚ḄNOPQRS஺Tx8634᪀UVWKXYZ[\ᐚZஹx6434᪀ᓽWindowsNTḄ`Z[ḄUV஺a34᪀32%x86bcឋefghiḄjkᢗmnZ64%oᙬqrestu`vᵨxyzᜧḄ{|◤~஺afg32%jkḄᢗmnZWindowsNTᐭ100ᡈzḄ:ᥛ஺ᙠhi0WindowsNT4Iᔊ9(Ḅᓄᯠ<ᐰᙠᨬḄWindowsNT[ṹ,codebase-ḄẠᓃ¢ḼZ|Ḅ¤#ᔜ¦F§¨⌼Ḅª«¬OᑁᱯឋḄJKF«®ᜧḄᓄ஺ὅ°±²³´µ¶Ḅᩭ·¸WindowsNT[ṹḄL⁚¹ᐸᙠn᱐|n»¼|ḄJK(Ḅ½¾nZ¿ÀUFÁÂÃᐹᩭÅÆÇὅᳮÈWindowsNTᑁ᝞ÊḄ஺ËÌÍḄÎ4IUF³ᕒÐvÑᙠÒÓḄᫀᜮᨵa஺DavidN.Cutler

7SeniorDistinguishedEngineerMicrosoftCorporationKᙠᡃÀ°Èëì៉ḄîïஹᭆñᐹᡠeᡃÀóᜓUV᢬᣾MierosoftWindowsÎ4IḄᑁù&ú᪗ᦪý᪀஺aþÿ
Ḅ᪀ᐵḄஹ᝞ᑖᙠ᪵Ḅ"᛻$஺&'()*ᨵ,-ᳮ/Windowsᑁ8ᳮḄ᪾:✌ᐜ=>$ᨬ@Ḅ◤BCDEF᪗HI◤BCF᪗JKLMNO'Windows
ᨬ@ḄDECQ஺2.1◤BCDEF᪗=ᑮ1989Y$☢Ḅ◤B[\'WindowsNTḄ$Q_n()*`a32cḄஹdᐜeḄ(preemptive)nopᐭḄ(reentrant)stᑁuvw
xnᙠyz{
᪀C|}Lxnoᙠ~yᜐᳮᘤ
(symmetricmultiprocessingsystems)Lᙢ〉ᜐᳮᘤḄᦪxnᡂ&*⌕ḄᑖeE|}w&ᡝᘤxnᜧyᦪ¢ᨵḄ16cMS-DOSCMicrosoftWindows3.1ᵨ«¬xnᔠ¯°~-POSIX1003.1µ¶ឋḄ⌕B_nᔠ¯°C¸¹º~-vw
»ᐰឋ½☢Ḅ⌕Bxn¾ᢝUnicode,¶᧕ᙢ〉ᐰᳫÅÆ஺⌕ÇÈ*ÉÊHI◤BḄ
ËÌÍOᦪᓟ*ÏÐx&'Â-ÍOHIÏÐWindowsNTDEÑÒᙠ⚗FÔÕ@⌱×'$☢ḄDEF᪗_n᡽ÙឋÚ“ÜᑏḄ
ÞṹËÌàḼÅÆ◤BḄâᓄäå᝞ᙢæçCᦋâxnoéêឋ(Portability)
ËÌᙠyz{
᪀LËÌ᪷ìÅÆḄ◤⌕~¶᧕ᙢéᑮíḄ
᪀Lxno☠ឋCᏉðឋ(ReliabilityandRobustness)
ñòóåôõᑁḄ┯÷C᜜Ḅùᦋäú¸w஺ᵨ«¬ñûüývw
ᡈὅᐸ
Ḅᵨ

8nឋCompatibilityᯠWindowsNT᡽ᨵḄᢈḄᵨᡝ☢APIὁ᱐ḄWindowsMS-DOS஺!"#$ᐸ
Ḅ%&'᝞UNIXஹOS/2NetWare,*+ᙢ-./nឋ$Performanceᙠᐸ
234᪗Ḅ678%&ᙠ9:;<=>?@AB$CDEFGH᜜JḄKAB$ᙢLM஺NḼᡃQ᢬᣾WindowsᑁJU᪀ᑁJ./Ḅᔜ;X⁚Z[\]ᑮ_`abḄ234᪗cd⌕f᝞gᡂiᙢjᐭᑮ%&Ḅ᪀⌼mnḄ஺ᙠᡃQob᢬᣾ᑁJX⁚pqᐜᩭ]:8WindowsḄtu23vwx"[ᐸ
Ḅyz./%&/:'{஺2.2./%&vwᙠᜧ}ᦪ}ᵨᡝ./%&nᵨ./%&◞Ḅ——./%&ᑁ᪶zṹCDᙠᜐᳮᘤḄᱯᩗv8ᙠnᑁ᪶vkernelmode
,B%&ᦪ<=;ᵨzṹCDᙠᜐᳮᘤḄᱯᩗv8ᵨᡝvusermode
,ᨵ*ᨵ▲Ḅ:BᵨH%&ᦪḄᑮ▲ᑴx"<=஺ᵨᡝv¡ᵨ:¢%&£¤Mᜐᳮᘤᣓ¦ᑮ¡ᵨᯠ§[¡ᵨ¨ᑗᣚᑮᑁ᪶v஺%&£¤«ᡂM./%&[¨¬᛻ᑗᣚ®ᵨᡝvxᐕ°¡ᵨὅ²³᡻D஺ᜧ}ᦪUNIX%&µ¶Windows:¢·ᜧ!«᦮Ḅ./%&./%&ḄᜧJᑖzṹ2ᜓ»¼zṹᐳ¾¿᪵ḄÁÂḄᑁ᪶vᑁÃÄÅ஺_ÆᕡḼ./%&ḄÈ--=ᡈὅ2ᜓ»¼ËᨵB$ẚÍᐸ
%&=ᡠᵨḄᦪ஺Windows:¢Ïᑁ᪶%&ᔩAÑᨵ`Ò᝞ÓÔᢥ᯿Ïᑁ᪶microkernel×ḄᐺwÙÚWindowsxÛ:¢Ïᑁ᪶%&஺ᙠÏᑁ᪶ḄÙÚn./%&ḄÜ⌕='᝞ᑁÃÑᳮᘤஹÝÑᳮᘤI/OÑᳮᘤ×CDᙠᔜÞßàḄÝnQᨵÞáâᨵḄᙢᙬÄÅᙠ_:=p@Ïᑁ᪶äåḄ:a棤஺ç᝞CMUCarnegieMellonUniversity,ᓱὊê•᫥◖ᜧî×ḄMach./%&¢yzḄÏᑁ᪶u%U᪀Ḅçïðyñ:¢ᨬóḄᑁ᪶ᒹõ¨¡öஹ÷øù⌴ஹûüᑁÃ2ᜓ»¼஺Ègᐸ
Ḅ=ᒹõᔜ;APIஹᦻ=%&þÿ
ᙠᵨᡝ஺ᯠ
Machᑁ᪶Ḅᖪ᱐
ᡠᨵḄᦻ#ஹ%&'ᑁ()ᳮ+ṹ-ᙠᑁ᪶.஺/012ᓫ456Ḅᑁ᪶78ᙠᖪ9:;ᑗ▭Ḅ
0>?Ḅᦔ᳛BC஺DE
Windows.ᨵDEF+ṹᙠᑁ᪶
:ᔲHIᕡḼ?LMNOPḄᑁ᪶MQRST᧕VWᕖYZ[᝞]஺^ὃ⇋☢Ḅbc஺Ꮇ7ᙠḄᦻ#+ṹ.ᨵMN┯f
g┯fhijᦻ#k;kᙢVW஺ᙠMNmḄ.
ᑁ᪶

9+ṹoL᝞ᑁ()ᳮᘤᡈὅᦻ#s.Ḅ┯f1tuhv᦮NVW஺ᙠMN56Ḅᑁ᪶.
x᪵Ḅz#ᙠᵨᡝ
ᡠ{
ᙠᳮ|9}
x᪵Ḅ┯f~:IᕡḼgz#Ḅh⌨஺:
▭Ḅᩭ
hVW
0>⌕x᪵MNᐵḄᜫ.ឮᩭ:;tuḄ஺ᯠ
Ḅᡠᨵz#:Ḅ
;h┯fḄᵨẚ
0>ᵨ;u.ᱯᩗᑖḄ+ṹ'ᦪ£o¤)?¥t{¦ᣩᙢ¨ᵨᐸªḄᑁ᪶«¬s஺Windows|:>MNᵨ«¬ᘤ
®:MN¯°±²
᪶³«¬oL᝞´µᑁ()ᳮஹᦻ#I/Oஹ%&
{¶ᦻ#'ᡭᓺᐳºsḄᩭ
?1¦ᙢ»¼½Ꮙ¿ឋ'ÁQឋÂÃ☢ḄÄÅÆÇ
Èᡠ{᝞]
z#ḄxÉឋP:/0ÈM஺WindowsḄᑁ᪶z#Ê˽ÌḄ☢ᔣÎÏ78/ᑣ஺Ñ᝞
?¥ÒÓZ;hᐭÕMNz#Ḅᦪ£Ö᪀ᩭgz#ᡠØḄÙÚ஺ÛÜ
?¥ᑭᵨPḄÞᩭm⌴àᦪ
{¶ᡈáᦋÛḄᦪ£Ö᪀஺ãᯠWindowsᑁäåᙢvᵨ½ÎÏᩭ⊤çᐳºḄèé
:
êëIì9í
WindowsZ;:MN☢ᔣÎÏḄ஺>½îïឋḄὃ⇋
WindowsḄᜧFᦪ+ṹ:ᵨCñòóᑏḄ
0>CñòḄõö¯ᐹR>øùtᵨ஺CñòZ;úᢝ☢ᔣÎÏḄᭆý
L᝞ᦪ£þÿḄ
᝱ஹ᝱ᦪᡈὅ஺WindowsC᱐Ḅᵨ!"#$%&'(ᱯ☢ᔣḄᱯឋ஺2.3-./᪀ᙠ23⁚ᐵ'Windows678᪗:ᒹ<=>Ḅ?@ABᡃDᐜᩭG3GWindows-./᪀ḄᐵHIJKL஺3M?ᓄ᱐Ḅ-./᪀᝞P2.1ᡠR஺STU2MP3MV/᪀W#XᨵZR[\ᱯᑁ^!_᝞`aKL:ᔜcd6ᜓf
ghḄij#XᨵZR(஺P2.1?ᓄḄWindows/᪀P

10ᙠP2.1✌ᐜpqrᑮtᨵ3ᩩvwWindowsIJḄᵨᡝ>(usermode):ᑁ᪶>(kernelmode)ᑖᑜᑖᩭ஺v☢Ḅ=᪾⊤ᵨᡝ>ḄgvḄKLᑁ᪶>ḄIJ஺᝞ᙠ1ᑮḄᵨᡝ>Ḅvgᙠ3MḄgᙢᙬt᡻($¡¢WDᙠᑁ᪶>᡻Ḅ£᎛WDp¥¦§IJt)஺IJ©ᢝgஹgஹᵨᡝ«ᵨgh:¬᛻®IJ¯ᨵWDᔜ°Ḅ±ᨵgᙢᙬt஺²cVḄᵨᡝ>gᑖ³´µ᝞஺n¶Ḅ(ᡈὅ·ឋᢣḄ)IJ©ᢝg(systemsupportprocesses'),¹᝞º»(logon)g:¾¿Àᳮᘤ(sessionmanager),WD#$WindowsḄ஺ÈÉÊWD$ᵫÌᑴÀᳮᘤᩭÎ
Ḅ(4оÑÒᙢABWindows)Óng(serviceprocesses')ÔÕ(host)ḄWindows¹᝞[ØÙᘤ(TaskScheduler):Ꮇῃá஺WindowsḄâãä⌕æç'ᵨᡝº»஺èWindowsᘤ«ᵨ¹᝞MicrosoftSQLServer:MicrosoftExchangeServer,Èᒹð3ñ¥Windows=>ᩭâḄKLÓnᵨᡝ«ᵨgh(userapplications)ᨵòcdóWindows32õஹWindows64õஹWindows3.116õஹMS-DOS16õஹPOSIX32õᡈὅOS/232õÓn¬᛻®IJᘤg(environmentsubsystemserverprocesses')IJ¬᛻(environment)Ḅ©ᢝᑖ஺2þᡠÿḄ
᛻ᢣᵨᡝᡈὅᕒḄឋᓄᑖ஺WindowsNTᨬ$%&Ḅ'᎛)*+,-Ḅ
᛻./Windows,POSIX6OS/2஺ᯠ:;Windows2000ᨬ=>?)OS/2%&;@=OS/2ABCᣵ*஺ᑮ*WindowsXP,ᙠGHḄIJKLᨵWindows.NIJ>O%&——,Q;•STḄPOSIX.UVWXᵨ;Y┐[Unixj_`Ḅabc⁐■Ḅfgh____________________>jk2.1K;nopq“cst”6“ᵨᡝvᵨ'x᪾z☢Ḅ“,DLL”~᪾஺ᙠWindowsz;ᵨᡝvᵨ,ᵨḄWindowscs;;YQ>ᡈὅ.᝱(DLLs)ᩭ%Oᵨ஺.DLLḄ⁐;>ᦻ᫏ᓄḄᦪᓄ>ាḄᑁ(ᦻ᫏ᓄḄ)Windowscsᵨ஺ᓄQV¡¢——UV¡,¢——ᔣ¤ᙠᵨᡝvᵨ¥¦csḄ
᛻.t%〈>¨©஺WindowsḄᑁ᪶«¬®ᒹ°Wzᑖ஺nWindows᡻²³(execu£/"e)ᒹ°*GHḄcs;¹᝞ᑁ»¼ᳮஹt6¿¼ᳮஹÀᐰឋஹI/OஹÂÃ6ÄtÅ஺nWindowsᑁ᪶(kernel)ᵫ>ÇÈ?ḄÉ¡᪀ᡂḄ;¹᝞¿Ì(threadscheduling)ஹKÓ(interrupt)6Õᑖ%(exceptiondispatching),WÖᜐᳮᘤ-Ù஺YU¥¦*>Ú6GH[Û஺᡻²³ḄᐸÝᑖᑭᵨÚ6[ÛßàáâÈ?ḄÉ¡஺nãᜓå(devicedrivers)æᒹçè®ãᜓå;Uᒹçᦻ®6ÂÃå஺ᐸKè®ãᜓåᵨᡝḄI/OᦪᵨᣚᡂᱯëḄè®ãᜓI/Onì஺

11nè®íÛÈîHAL,HardwareAbstractionLayerᢣ>ÈᱯñḄòṹ,Yôᑁ᪶ஹãᜓå6Windows᡻²³ḄᐸÝᑖ;õö÷øᐵḄè®úÕî¹᝞,-ûüḄúÕý◞ÿᩭ஺nwindowingandgraphicsystem'ᵨᡝ☢GUIᦪḄ!"WindowsUSERGDIᦪ,/᝞1Ḅᜐᳮஹᵨᡝ☢56,789ᑴ;஺⊤2.1ᑡABWindowsCD᪶FGᓺḄᦻ6JKLᨵN⌕⍝QRᦻ6JSTᡃVWᵨJXᩭYᵨZ[ᦻ6஺\]^☢_ᑖ78^aḄ]⁚cVWdeᙢghᐸcḄjklG6஺⊤2.1WindowsḄ᪶Fᦻ6ᦻ6JG6Ntoskrnl.exe᡻uvᑁ᪶Ntkrnlpa.exezᵨ{32᡻uvᑁ᪶S}ᢝᱥᳮᙢᙬ᡽PAE,ᙬ64GBᱥᳮᑁHal.dll6Win32k.sysWindowsḄᑁ᪶_ᑖᑁ_}ᢝᦪS78᡻uvᦪḄᑖNtdll.dll᪷stubKerne132.dll,Advapi32.dll,WindowsḄ᪶FDLLUser32.dll,Gdi32.dllᙠ£¤Q[G6Ḅe⁚¥¦Sᡃᐜᩭ¨k¨SWindows᝞©;«¬®6v¯᪀Ḅ±²ឋ஺±²ឋWindowsḄkl´µ¶᪗"S⌕¸¹ºuᙠᔜ¼½¾Ḅ6v¯᪀¥¿SᒹÁÂ{IntelḄCISC78RISC஺WindowsḄÄÅu᱐\}ᢝx86MIPSv¯᪀஺É^ÊËᐭ1DECDigitalEquipmentCorporation,ÐÑÒÓCompaqÔÕ,ÖCompaq^ᩭÊ×HPᓽHewlettPackardÚÛAlphaAXPḄ}ᢝÞßAlphaAXP"kl64ᜐᳮᘤSáWindowsNTºuᙠ32ã஺ᙠWindows2000ḄåæcSklçèḄ64᱐\7ᙠAlphaAXP¿ºuSá"Ql᱐\éᨵÓê஺ᙠWindows3.51cÊËᐭ1ìí¼ᜐᳮᘤ¯᪀MotorolaPowerPCḄ}ᢝ஺ᯠÖSᵫ{ðñ◤óḄôᓄSᙠWindows2000¦᜛S1MIPSPowerPCv¯᪀Ḅ}ᢝÓ÷ø஺^ᩭSCompaqÊùú1AlphaAXPv¯᪀Ḅ}ᢝSᡠ7ᨬýḄ¯þ"SWindows2000ÿᢝx86᪀஺ᙠᨬḄWindows᱐,UPWindowsXPWindowsServer2003$,%&'()*64,ᜐᳮᘤ0Ḅᢝ,12ᑖ45IntelItaniumIA-640ஹAMDX86-640ABCIntel┐(x86Ḅ64,᡽FᢈHIEM64T,1LAMDx

1286-64᪀MNOAP5ᙠᡠᢝḄᢣST☢ᨵᶍXḄY4Z஺[\*ᜐᳮᘤ0]^64,᡽F_64-bitextendedsystems',ᙠ`$aᵨ^A64IᐵdWindows᝞fᙠ64,᱐$gh32,iᵨjkAl3mnopqrsZ஺Windowst⌕vwBx\*Tyᩭ{|}~ឋABᢝ*᪀஺nWindowsᨵᑖA_Ḅᑖ5Lᜐᳮᘤ᪀MᐵḄAᡈὅ5LMᐵḄAᑖ◞ᑮḄᙽ$AᡠBA_Ḅᑖ}Bὃ⇋᪀ḄY4Aᵨᐵ¡ḄY¢஺ᨵ\ᐵ£Ḅ¤^¥¦_§¨'}~ឋA125ᑁ᪶Iᒹ¬ᙠNtoskrnl.exeZ°±Iᡈ]HAL,ᒹ¬ᙠHal.d11$Z஺m[☢noµ¶ᙢ¸¹\¤஺L᪀MᐵḄº»A¼᝞½j¾᛻ᑗᣚIthreadcontextswitchingZ◍▟ᑖÇItrapdispatchingZ5ᙠᑁ᪶${|Ḅ஺ᙠÉ᪵Ḅ᪀$AÉ_ᨵᡠY¢Ḅº»IË᝞AÉḄtÌZᑣ5ᙠHAL${|Ḅ஺ÎᨵÏ᜜¤$ᨵMÑᦪÓḄÔṹ5L᪀MᐵḄAÖ×5ᑁØÙᳮᘤAP5L᦮_M¼AÛᯠÝ5Þᑖßà஺nWindowsḄáᜧᑖÔṹ5ᵨCäåæᑏḄAèᑖ5ᵨC++æᑏḄ஺ÝᨵÖ◤⌕ëìL_íhvîḄᑖI¼᝞$ï◍▟ᜐᳮᘤAinterrupttraphandlerZ,ᡈὅ(ឋ»᩽ñòóḄ¥¦_ᑖI¼᝞¾᛻ᑗᣚAcontextswitchingZ,ô5ᵨõæäåæᑏḄ஺öᙠᑁ᪶HAL$ᨵõæäåÔṹAß÷ᙠ᪶¥¦_ḄᐸùᙢTᨵõæäåÔṹI¼᝞{|'ú┝ᢣSḄËjABCᙢwjüᵨý$ḄᙽZAþ}»ᙠWindowsÿ
Ḅᑁ᪶ᑖᙠᵨᡝ᝞Ntdll.dllḄ!ṹ#$%&☢()*+
,-7஺012ᜐᳮ256multitasking7ᢣᙠ29᡻;<=>ᐳ@AB9ᜐᳮᘤḄDE
ᢈG஺ᯠIJBKLMNᨵPQB9ᜐᳮᘤḄR᎛T-AR᡻;U9<஺VWXᯠB9256DE
YPZ[\ᩭ^_ABR`-᡻;29<a7B92ᜐᳮDE
-bcᙢeᑮABR`᡻;29<ᙠg9ᜐᳮᘤh᡻;B9<஺c᝞$%ijRᡠlᑮḄWindowsḄB9ᐵtuLv᪗7Txyz{^ᙢᙠ2ᜐᳮᘤLMN
h|;஺Windows7B9012ᜐᳮ#SMP,symmetricmultiprocessingDE
஺ᙠᜐᳮᘤᨵᜐᳮᘤ——DE
ᵨᡝ<-ᑮ5B9ᜐᳮᘤh|;஺IᡠᨵḄᜐᳮᘤᐳ@BḄᑁ>஺012ᜐᳮ#ASMP,asymmetricmultiprocessingPAᙠB9ᐺḄ012ᜐᳮ
DE
⌱ᐸB9ᜐᳮᘤᩭ᡻;DE
ᑁ᪶!ṹIᐸḄᜐᳮᘤY|;ᵨᡝ!ṹ஺U2ᜐᳮḄ᝞2.2ᡠ஺

132.201012ᜐᳮWindowsXPWindowsServer2003¤ᢝU¦Ḅ2ᜐᳮᘤ
§¨<#hyperthreading®NUMA#B°Ḅᑁ±᪀non-uniformmemoryarchitecture®஺ᙠ¸☢Ḅ¹º()»⌕ᙢ*+U
#ᨵᐵWindows0
Ḅ¤ᢝḄ½¾¿ÀÁÂÃÄ6%<B⁚®஺¨<7IntelÈᐭḄB⚗ᢈGT-ᙠB9ᱥᳮᜐᳮᘤhlÌ29ÍÎᜐᳮᘤ஺g9ÍÎᜐᳮᘤᨵTÏÐḄCPUÒ᝱a7᡻;ÈÔÕᱏhḄ×ØÙᑣ7ᐳ@Ḅ஺ÛÜB9ÍÎCPU-ᙠᐸÍÎCPUcÝḼ#᝞cᙠ᡻;ßᜐᳮàEáIâQãᙠ9ÍÎᜐᳮᘤh|;<®ḄR᎛äå᡻;஺WindowsXPḄMæçèᦋZãT-ᨬëᙢᑭᵨ2ᜐᳮᘤ¨<Nᘤí᝞îᩭḄeæ7(<ᑮB9ïḄᱥᳮᜐᳮᘤhðᙠᦋñ“⌱B9ᱥᳮᜐᳮᘤhḄïÍÎᜐᳮᘤ#óᜐᳮᘤḄᐸÍÎᜐᳮᘤcᙠÝḼ®”஺ᙠB°Ḅᑁ±᪀NUMA
ᜐᳮᘤõöᡂøùḄᓫᐗ1ñ⁚ü#nodes®஺g9⁚üᨵTÏÐḄᜐᳮᘤᑁýþZB9ÙB°#cache-coherent®Ḅÿὶ
ᑮᜧḄ஺NU.MAḄWindowsᯠSMPᩭ"#$ᐸ&ᡠᨵḄᜐᳮᘤ,-./0ᡠᨵḄᑁ2——456$⁚89ᙢḄᑁ2/0;ᩭ<ᐸ=⁚8Ḅᑁ2>?@A஺B⌕DEឋGḄHIJ$᪷LMᵨᑮḄᑁ2ᡠᙠḄ⁚8$PMQRᑮS⁚8&Ḅᜐᳮᘤ஺TUHIḄV᪗J$X-Gᙠ⁚8ᑁYZ[ᑁ2ᵭ]Ḅ]^$4ᨵᙠ_⌕Ḅ`᎛bcᐸ=Ḅ⁚8ᑖeᑁ2஺fᯠWindowsᨬhḄij4Gkᢝᨬm32ᜐᳮᘤ$pJ$ᙠmᜐᳮᘤij&$qrᨵ9sḄtu▲ᑴᜐᳮᘤḄᦪᨬm32—yzᯠ${ᦪ|4J}~@ᐭḄ▲ᑴ$t32ᜐᳮᘤ-.y᧕ᙢᵨ•Ḅ32ᦪLṹᩭ⊤஺▭$WindowsḄ64᱐9-.ᨬmkᢝ64ᜐᳮᘤ$tᙠ64ᘤ$|ḄᜧJ64஺

14GkᢝḄᜐᳮᘤḄ▭ᦪVᡠᵨḄWindowsḄ᱐9⊤2.32.4஺ᦪL2¡ᙠ¢£⊤¤HKLM\SYSTEM\CurrentControlSet\Control\Session\Manager\LicensedProcessors&µ¶$·ᦋ{ᦪLP¹º»¼½-¾¿$@À$⌕BÁ6Âᦋ¢£⊤ᩭᵨmḄᜐᳮᘤ$PÃÄÅmḄÆ$@5ÇÇÂᦋTᦪL஺ὃ⇋ឋGḄt$ᑁ᪶HALᙠWindows2000&$Ìᨵᐸ=ÍᐵÏḄᦻ¼ᨵᓫÒḄᓫᜐᳮᘤ᱐9mᜐᳮᘤ᱐9஺ᙠWindows2000±,Õᦻ¼ᙠÖ☢Ḅ¢µ&PÃØÙᙠmᜐᳮᘤᓫᜐᳮᘤᑖÚᨵᡠ5SÛᙠ32WindowsXPWindowsServer2003$4ᨵÞᦻ¼ᨵᡠ5S⊤2.2஺ᙠ64Windows$rᨵPAEᑁ᪶$ᡠ.$4ᨵᑁ᪶HALᙠᓫᜐᳮᘤmᜐᳮᘤᨵᡠ5S஺ᙠßàḄ`᎛$ßàMáPâãḄᦻ¼⌱åæᩭ$qÀçèᑮ9ᙢḄ\Windows\System32Vë&஺}ã¿ì?ᦻ¼íçè$]ᦻ¼\Windows\Repair\Setup.Iog,ñᑡæ}ᡠᨵ⌕çèᑮ9ᙢóôḄᦻ¼$.ÅPñõcö÷øsçèᑮìVë&஺⊤2.2┐úmᜐᳮᘤḄᦻ¼┐úᓫᜐᳮᘤḄᦻ¼ᙠᙠᓫᜐᳮᘤ᱐!Ḅᙠ#ᜐᳮḄᦻ"ᘤ᱐!Ḅ"Ntoskrnl.exeNtoskrnl.exeNtkrnlmp.exeNtkrnlpa.exeNtkrpamp.exein.PAEᑁ᪶45Ntkrnlpa.exein\Windows\\Windowsᨵ329:\Driver.cab\\Driver.cabᨵ;EFGHI.JK⊤2.6EFGHI.JKHal.dllNḄHALᑡ⊤;⊤2.6NḄHALᑡ⊤;Q☢Ḅᦻ5┐TWindows2000\I386\Driver.cabNWin32k.sys\I386\UNIPR0C\Win32k.sysḄWin32k.sysNtdll.dll\I386\UNIPR0C\Ntdll.dll\I386\Ntdll.dllKernel32.dll\I386\UNIPR0C\Kernel32.dll\I386\Kernel32.dllট^᝞`ab-QWindows2000ᦻ᪛NḄ\I386\UNIPROCᦻ¼ᜳ$ýPÃþᑮÿWinsrv.dllḄᦻ஺ᯠᦻ

15efᙠUNIPROCḄᦻᜳḄQ☢hijᨩlḼnopqᓫᜐᳮᘤ᱐!hrohs▭huᦻ5ᨵpq᱐!hvwx〉ᵨG#ᜐᳮᘤ{ᓫᜐᳮᘤ஺ᙠWindowsXP{WindowsServer2003Nhuᦻᜳ|}e~◀஺=sᙠWindows2000b#ᜐᳮᘤᐵḄᢝᦻa5⌕ᙠᜓᳮᘤ(DeviceManager)Nb“(Computer)”TḄ⁚hvᑮhTGpq329Windows2000#ᜐᳮᘤhᦻoᨵᡠ¡wḄ஺1.ᡭ£Ḅ¤ឋT¦᪾(av©ªᑴ☢¬N⌱®“(System)”hᡈὅᙠaḄ±☢²³´µ“ᡃḄᵯᾯ(MyComputer)n,ᯠ¹⌱®"¤ឋ(Properties)”»¼)஺2.´µ“¾(Hardware)”᪗Á஺3.´µ“ᜓᳮᘤ(DeviceManager)”஺4.£“(Computer)”T஺5.õ“(Computer)”Q☢ḄÄ⁚´஺6.´µ“(Driver)”᪗Á஺7.´µ“ÅÆÇ(DriverDetails)”஺TG#ᜐᳮᘤhaÈÉᑮQ☢ḄT¦᪾:

16nᐵ³ḄᦻËᡠᨵᓫᜐᳮᘤ᱐!hoÌឋÍḄÎÌ——ÐᓫᜐᳮᘤÑÒh#ᜐᳮᘤḄwÓ!oÔÕÖᩖ{ὑxḄhᡠhÙnᐵ³ḄᦻᨵÚÛḄᓫᜐᳮᘤ᱐!hvÜᑮᙠᓫᜐᳮᘤÝÞnwÓ£├.ᜧ#ᦪâãWindowsḄäoᓫᜐᳮᘤḄ;஺ᨵåḄohNtoskrnlḄᓫᜐᳮᘤ᱐!{#ᜐᳮᘤ᱐!oæçᙠèéṹNëᐭᩩîïᢣ¼ᩭòᡂḄ,ÑWindows2000NḄNtdll.dll{Kernel32.dllḄᓫᜐᳮᘤ᱐!ᑣoæçöᦋx86LOCK{UNLOCKᢣ¼ᩭùúḄhnûᩩᢣ¼eᵨGwÓ#qühᙠᓫᜐᳮᘤ᱐!NhᑭᵨN0Pᢣ¼.þÿ
ᩭ஺WindowsḄᐸᦻᒹᡠᨵḄᵨᐹஹ!"ᜓ$%&'()ᵨ᪵Ḅ᱐,-
./ᑖᓫᜐᳮᘤ!5ᜐᳮᘤ678-9:;<=>ᙢᜐᳮ@5ᜐᳮᘤḄA⚪஺CᙠCEFḄGHIJ)ᵨKLM-CḄGNO7PQWindowsIᵨ&'R7PQ"ᜓ$%&'——TC"UGḄV᎛X7YZ5ᜐᳮᘤḄA⚪-[\ᙠᓫᜐᳮᘤ!5ᜐᳮᘤ](⌕_`஺abcdC=ᙠefḄNtoskrnlḄ᱐,ᙠWindows2000oᐸ

17Log)”,¯°©(Event)ID±6009Ḅyz⚗-³ID⊤µKP⚗7w%V᎛ᑏᐭḄ஺³yz⚗[
⊤µC7ᔲ¹º~ᑁ᪶᧜ḄPAE᱐,(Ntkrnlpa.exe,»ᢝᜧ¾4GBḄᱥᳮᑁÀ)஺ᯠt-C;<ÂÃdªÄÅ⊤ÆHKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptionsᩭ>Ç7ᔲ¹º~PAEᑁ᪶஺³᜛É,᝞ÊC¹º~PAEᑁ᪶-ᑣÄÅ⊤ÆHKLM\SYSTEM\CurrentControlSet\Control\SessionManager\MemoryManagement\Physical-AddressExtensionÌÍ"αloC;<ÂÃcdᦻÏឋᩭ>ÇEF7ᔲÑÒ~5ᜐᳮᘤ᱐,ḄNtoskrnl(ᡈNtkrnlpa),M᝞:efWindowsÕÖ¥ᳮᘤ,ᑮ\Windows\System32ᦻᜳ-ÙÚÛ°Ntoskrnl.exe,ᯠp⌱“Ïឋ(Properties)”஺ᯠp-Û°”᱐,(Version)w᪗Ý,⌱“ÖᦻÞ(OriginalFilename)”Ïឋ᝞ÊC=ᙠef5ᜐᳮᘤ᱐,Ḅß-Ìàªᑮ☢Ḅáß᪾:

18ᨬp-=᝞ä☢ᡠåᑮÃḄ-C;<ᙠÑÒVÂÃdªᦻ\Windows\Repair\Setup.logᩭ>Çᑮë⌱~ìQᑁ᪶᧜!HAL஺;ïðឋ5ᜐᳮᘤḄPQᐵÚA⚪7;ïðឋ(scalability)஺±~ᙠP•QSMP]=>ᙢef-ôõḄöṹøù⍳ûüýḄᢣºÿᑣ஺ᙠᜐᳮᘤᐸឋ⚪ᙠᓫᜐᳮᘤ⌕ᩖᙠ!Ḅ#᎛%⌕ὃ⇋()஺Windows12☢45ᱯឋ78■:;<ᱯឋ=7Windows>?8■5ᡂAḄᜐᳮᘤBᑮDEF.HᐵJ⌕Ḅ>ᵨLnMᙠNO85PᵨḄᜐᳮᘤQRST>UṹWPEX#ᙠ5ᜐᳮᘤQRSUṹLnᙠᓫ5YZᑁ᡻S5]Z;<]ZPEᙠ^XḄᜐᳮᘤQ_Sᙢ᡻Sanᑁ᪶ᑁc(᝞fg┝ஹ᣸kḄfg┝Elm᪘┝;

19n᝞I/Oᡂ(I/Ocompletionport,ᙠp9r)ḄZᑴ,PEᦔḄ]Zz{ᘤYZ_;᪵ḄZyᙠᜐᳮᘤQᨵ¡¢Ḅ£¤ឋ஺Windowsᑁ᪶Ḅ£¤ឋ8¥ᙠ^¦ᙢY஺᝞WindowsServer2003ᵨD┐=¬5CPUḄ°~kᑡ;PEᙠ5CPUQ_Sᙢ᡻S]Z°~஺p6r³´Dᜐᳮᘤ]Z°~Ḅ|⁚஺ᨵᐵᜐᳮᘤXḄY8|⁚PEᙠp3r¶ᑮ஺·ᡝz{ᘤ᱐º»Ḅ¼½Windows¾¿S·ᡝ᱐ºḄÀÁÂᒹW¿Sz{ᘤ᱐ºḄÀÁÂᒹ஺ᙠWindows2000·ᡝ᱐ºÄÅ?Windows2000ProfessionalaWindows2000Ḅ35z{ᘤ᱐ºᑖÉÊLWindows2000Server^AdvancedServerDatacenterServeroWindowsXPᨵ65·ᡝ᱐º:WindowsXPHomeEdition>WindowsXPProfessionalஹWindowsXPStarterEdition>WindowsXPTabletPCEditionஹWindowsXPMediaCenterEditionWindowsXPEmbeddedÖ35᱐ºÊWindowsXPProfessionao1ḄØ1ºÙ_^s|ᙢ³´;35᱐ºÚ?ÛÜÝÞᙠßWindowsXPProfessionalàXḄ᪶áT>Q஺WindowsServer2003ᨵ65âãLWindowsServer2003WebEditionஹStandardEditionஹSmallBusinessServerஹStorageServer^EnterpriseEdition^0DatacenterEdition஺;<᱐ºᙠE2ç☢ᨵᡠ^XLnᡠéᢝḄᜐᳮᘤḄᦪì^XanᡠéᢝḄᱥᳮᑁîḄᦪï^XanᡠéᢝḄ_SðñòóḄᦪï(ô᝞ᙠ·ᡝ᱐ºᨬᐕ÷X#òó105ᦻᡭᓺz{)^XanServer᱐ºûüḄᑖýz{(layeredservices)_^ᒹÿᙠProfessional᱐᝞(directoryservices)>(clustering),#$%&ᵨᡝ)*(multiuserTerminalServices)Ḅ/ᢝ)஺⊤2.3᤺⌕ᑡ89Windows2000Ḅ4>᱐ᙠᑁ@Aᜐᳮᘤ/ᢝE☢ḄGH஺⊤2.4ᑡ89WindowsXPAWindowsServer2003SKLH᪵ḄNO஺ᐵQWindowsServer2003GH᱐KLḄRSTUVWὃhttp://www.microsoft.com/windowsserver2003/evaluation/features/compareeditions.mspx஺⊤2.3Windows2000ProfessionalAServerY>᱐KLḄZ[

20/ᢝḄᜐᳮᘤḄ᱐ᦪ/ᢝḄᱥᳮᑁ@Windows2000Professional24GBWindows2000Server44GBWindows2000AdvancedServer88GBWindows2000Datacenter3264GBServer⊤2.4WindowsXPAWindowsServer2003KLḄZ[/ᢝḄ/ᢝḄᜐᳮᘤ/ᢝḄᜐᳮᘤ/ᢝḄᱥ/ᢝḄḄᦪᱥᳮᑁḄᦪᳮᑁ@ᱥᳮᑁd32e@d32d64edItaniu@dx64᱐fe᱐f᱐fm᱐f᱐fWindowsXP14GBGjᵨGjᵨGjᵨHomeEditionWindowsXP24GB2Gjᵨ128GBProfessionalWindows22GBGjᵨGjᵨGjᵨServer2003WebEditionWindows22GBGjᵨGjᵨGjᵨServer2003SmallBusinessServerWindows44GBGjᵨGjᵨGjᵨServer2003StandardEditionWindows832GB864GB64GBServer2003EnterpriseEditionWindows3264GB641024GB1024GBServer2003Datacenter

21EditionoᯠWindowsqrstᨵ&>vᡝ᱐Aᘤ᱐Ḅwxyzᒹ|}~ᐳH᪶stᦻzᒹᑁ᪶᧜Ntoskml.cxed#$PAE᱐Ntkrnlpa.exefஹHALஹᜓ#$ḄstᐹADLL஺ᦻzᙠWindows2000Ḅᡠᨵ᱐}HḄ஺WindowsXP}WindowsNTṹdcodebasefḄ¢>vᡝ᱐£¤¥ᨵ%¦Ḅᘤ᱐஺G§ᙠWindowsXP¨©KªḄ«&¬L┐%ᘤ᱐Ḅ¯¨r°ᯠᙠ±©²}ªᩭḄWindowsServer2003஺´µWindowsXPAWindowsServer2003Ḅ᪶stᦻz}GHḄ஺ᓽ·᝞µ¸ὅḄZ[£Gº℉d¼▭¾ᨵ¿&z£¥ᨵᦋÁf஺ᡠ#,᝞ÂWindows2000ProfessionalWindows2000ServerḄᑁ᪶᧜ÃᐰHḄÅd┐%WindowsXPAWindowsServer2003,ÆÇÈÉÊfËÌst᝞ÍÎ⍝ÐÑ9Ò>᱐ᕖÔÕ◤×ØÙ⊤ḄHKLM\SYSTEM\CurrentControlSet\Control\ProductOptionsàáḄProductTypeAProductSuite¸>â஺ProductTypejᵨᩭãᑖåæḄst}•>vᡝstè}•>ᘤst~Ḅᨵᦔêâ᝞⊤2.5ᡠì஺µíÂâ@îᙠstᐰïÁðMmProductType5,ᙠᜓj#ᑭᵨᑁ᪶òóḄ/ᢝôᦪJö5ys×Øᑮµâ஺ᐵQµôᦪVWøWindowsDDKḄᦻ᫏஺⊤2.5ProductTypeÙ⊤âWindows᱐ProductTypeḄâWindows2000ProfessionalஹWinNTWindowsXPProfessionalஹWindowsXPHomeEditionWindowsServerdúûᑴᘤfLanmanNTWindowsServerdýᘤfServerNT

22þ>Ù⊤âProductSuite,ÿ
WindowsᘤḄ᱐StardardஹEnterpriseஹDatacenter,!!"#$
ᑖWindowsXPHome+WindowsXPProfessional஺᝞0ᵨᡝ34◤⌕ᑨ89:;<Ḅ=>?᱐ḄWindows#@A
BᵨWindowsḄKer/ZyKers/cw/A/i?Iᦪ஺PlatformSDKKᨵᐵNOIᦪḄᦻ᫏஺RᜓTU34
Bᵨᑁ᪶XYZḄIᦪmet%rs/o஻஺WindowsDDKKᨵᐵN]IᦪḄᦻ᫏஺^ᯠḄ᪶`ᦻaᙠcᡝ᱐+ᘤ᱐Kde=fḄ#gh#ᙠ;ᩭ஺@A%"BC᧕1ᳮFGᡂᑮḄIᘤṹ┐LWindowsM>ᑴṹḄ/ᜐᳮPᓄR%"᡻TBU@>TḄṹVWX᪀PᓄZ[ᨵ;᡻TR]^DebuggingToolsefᦻ9hḄ"Performance-OptimizedCode"vᑖ஺xᡠz{᪵Ḅ}~᱐⌕%"efᜓᕒ%┐L;ᜓᡈᐸṹᡠ2ᵨḄᑁ᪶ᦪ᡻TB%Ḅ┯}~஺᝞᝞RᡈὅᐸḄᑁ᪶ṹLᦪ᡻T"#¢ᦔ2ᵨR¤᝞᝞ᙠ┯Ḅh¦§¨©#ª«┝ᓽspinlock,ZA.ᦪ°}~±⌴>ᩭḄ]ᦪ³´µ⚪;}·ᑮ/¸°¹º@»ᐕ½¾ᦪ¿X᪀;ẚÁÂ@ÃÄÅÆÇ/È°ÉÊ஺ËÌÍÎÏ#ÐÑᔲÓᙠÔTWindowsḄ}~᱐

23[ᨵ#ᑁ-ḄÕᐹ×ØÙÑ´ÚÓᙠÔTḄ}~᱐ÛÜÝ᱐(:$%ªᵫ᱐freebuild)஺ᯠ@âÅWMI(WindowsManagementInstrumentation,Windowsåᳮæ)ḄWin32_0peratingSystemîḄ"Debug”ïឋ,Ñ#ñò஺Ð☢ôᓫḄVisualBasic÷×Ø#ïឋÍstrComputer=SetobjWMIService=GetObject(zwinmgmts:_&஻{impersonationLevelimpersonate}!\\஻&strComputer&஻\root\cimv2஻)SetcolOperatingSystems=objWMIService.ExecQuery_(/zSELECT*FROMWin32_0peratingSystem11S)ForEachobjOperatingSystemincolOperatingSystemsWscript.Echo"Caption:"&objOperatingSystem.CaptionWscript.Echo"Debug:"&objOperatingSystem.DebugWscript.Echo"Version:"&objOperatingSystem.VersionNext89:;<=>ṹ1@AᐭCD>ṹ1EFGHIᑮKLᦻNO஺Q☢STU<=VWḄAYZC:\>cscriptosversion.vbsMicrosoft(R)WindowsScriptHostVersion5.6Copyright(C)MicrosoftCorporation1996-2001.Allrightsreserved.Caption:MicrosoftWindowsXPProfessionalDebug:FalseVersion:5.1.2600hijEkᨵᙠTUWindowsḄno᱐W1

24ᙠno᱐WḄvᑴ>ṹO1ᜧyᦪḄ▬|>ṹ}S~ᵨ9ASSERTḄ,hᙠDDKᜮᦻNNtddk.hO1DDKᦻ᫏OᨵᐵḄ஺ASSERT:;KLᩩN᝞KLᦪ᪀ᡈὅᦪḄᨵᦔឋ1᝞⊤Ḅ¡¢SFALSE,£¤h¥ᵨᑁ᪶¨©ᦪª"sser3h©ᦪ«vK¬¥ᵨ|®¯3F¥;°±ḄᦻW²〈ᑮ•L¥;°±µ¶·O஺᝞ᨵKLᑁ᪶¥;ᘤ▬¹ᑮº»ijO1ᑣh°±½¾rsᙠKL¿sÀḄ☢1@ᵨᡝᩭÃh᝞ÄᜐᳮDbgview.exeᐹ஺)pᑭᵨḄ᱐r᦮w᱐஺r,-¡¢ᑁ᪶᧜=Ntoskrnl.exe[¥¦§ḄHAL=Hal.dll[Ḅ᱐ᑮ7w«_Ḅ¬᱐P஺\®¯°Ḅ±ᜐ$²ᜓ´µ¶¥ᐸ*Ḅᑁ᪶¸ṹºᑮp᱐Ḅ»¼½$¾¿ᐸ*ᡠᨵ12ḄÁ᠒Ḅ᱐஺᝞įᑮ\7ÅᕖÇ?9ḄᢣAÈBCWindowsDDKᦻ᫏PḄ"InstallingJusttheCheckedOperatingSystemandHAL”g

25ᑖ஺()MicrosoftᨵWindows2000ServerḄ᱐ᡠ-r#,-ᑭᵨ\⚗ᢈÛᙠWindows2000Server{¿᱐Ḅᑁ᪶஺ᨬÝ᱐Þß]àà()Ḅ0á=timing[âᨵᡠãḄᵨᡝ¸ṹ#$%&ᨵᵨḄ=\$()▬cḄ$ᙠᑁ᪶P6Ḅᑁ᪶Ḅ12å$æoQçèᓄḄ[஺_&êëã8┯íîî3ᱯ0Ḅ0áᩩ2ᨵᐵ஺᝞ðrᙠ᱐ᩈḄ{=ᡈὅòóᑁ᪶¥HAL$᱐Ḅ[¿Þ¶ßôᵫ᦮wḄ0á$ãḄᡠ-\ᨵ,öß]ᙠ«_Ḅ¬P÷eøḄùᙠ0á┯íú☄üᩭ஺2.4ᐵýḄ12ᡃ+noq`pWindowsḄÿ
᪀ᙠᡃᩭᐭᙢẆWindowsḄᑁ᪀ᐵḄ!"#$ᡠ&'Ḅ(⁐஺+2.301ᐵ2Windows"᪶4᪀5#$Ḅ+6789:☢<=Ḅ᪀+>?+2.1ABCDE5F᦮஺HIJ,6LᯠNᨵPQᡠᨵḄ#$ᱯS0NᨵPQTU#$>V139WXYZTU#$A஺[•⁚WDE▊_+2.3`Ḅ1a⌕ᐗd஺V39efWindowsgᵨḄa⌕iᑴkᑴ>7᝞mnoᳮᘤஹ`sttA஺V59v_wx5ᐵyWindowsḄz{V49DEYZᔜ~oᳮkᑴ7᝞I⊤ஹ{WMI>WindowsManagementInstrumentation,WindowsoᳮA஺ᯠᒕḄ9⁚BCE⁚ᙢᔜᐵḄᑁ᪀5!7᝞{5{ஹᑁoᳮஹᐰឋஹI/OoᳮᘤஹoᳮஹoᳮᘤஹWindowsᦻ$">NTFSA5TU஺

26⌱ᵨ᛻st+2.3Windows"᪶4᪀5#$¦᛻¨"5¨"DLL©᝞+2.3ᡠQ,Windowsᨬ«ᨵ¬¦᛻¨":OS/2ஹPOSIX5Windows஺᝞:ᡠ_OS/2¨"ᨬ•®0¯Windows2000°±஺ᑮ³WindowsXP´ᩭ¯Windows1µ°¶Ḅ·8POSIX¨"¸¹º»¯"1µ°¶³¼o᝞½1¾¿ḄPOSIX¨"᱐8!ÁÂÃÄÅ6ÓᨵÔஹÕ᪗5PQᘤ×ØᓽgᙠNᨵÚÛᵨᡝÜÝḄᘤ"Þ6ß0àáᙠḄA஺â▭Þᐸåæ¨"çèéᡂᢥ◤wx×Windows¨"ᑣàáî0ᙠÒ¶஺¨"wxïðçñᙠI⊤HKLM\SYSTEM\CurrentControlSet\Control\SessionManager\SubSystemsḄ☢஺+2.4PQ³ò☢Ḅó஺

27+2.4I⊤ôõᘤPQ³Windows¨"wxïðRequiredóᑡ=³ù"úûüCýḄ¨"஺òóᨵæþÿ
WindowsDebugoWindowsᒹWindowsḄᦻCsrss.exe,"#⊤%ᡝ/()ᘤ+,-.Client/ServerRun-TimeSubsystem8.9:;⁚=☢Ḅ?8஺DebugABḄ.CD"EᵨGᑁIJK8CLMNOPQ஺Optional⊤UOS/2P0SIX[Eᢥ◤^_.?`⊤KmodeᒹWindowsḄᑁ᪶cdIᑖḄᦻfWin32k.sys.;i=☢[jklmno8஺p᛻Ḅr⁐A[Windowst;()ḄIᑖuv☄xyᵨz{஺|}~GWindows()PIᑖḄ஺ᕡḼᙠl}Ḅyᵨz{QᑮḄA}ᙠPḄyᵨᡠQᑮḄ஺᝞l}Windowsyᵨz{PᵨPOSIXḄ4¢ᦪ஺|l}᡻,Ḅ᧜¦..exe8E§¨ᑮ•}.ªA«lḄ8஺¬l}᧜¦ᦻE+,-kzḄ#ṹj¯°᧜¦ᜮIḄ²³#ṹᡠ"´µ¶·Ḅᨵ¹ḄkzE஺ᙠVisualC++¼½¾Ḅ/SUBSYSTEMÄ⛲ÆÇᢣ¨L²³#ÉᑭᵨWindowsËÌÍᐹÏᵫᐺExetypeÍᐹ°ÒL²³#ṹ஺?Al}ᨵᐵWindowsᔊÕḄ?oWindowskzÖᡠE×DCsrss.exe,ACDᙠWindowsNTḄÙÚÛ¼ᡠᨵḄ~ÜGᐰÞ«lḄp᛻kz¼ßDàkz¼Ḅázᩭ᡻,Ḅ஺ᙠPOSIXOS/2Eãäᩭåæᑮ"çèéḄkz¼=WindowskzḄᦻfêᨵᦋì஺íPÖî¢ᦪïᵨPðᔠ஺ᣚóôõl}POSIXyᵨöïᵨPOSIX÷äḄ()WindowsyᵨöïᵨWindows÷äḄ()஺¶᝞ø=ù[⌕ÒᑮḄû᪵l▲ᑴ¶ADMN“ᨬ
ḄPOSIXᨵ

28▲ḄᦪᔠPOSIX1003.1)"#$%UNIX(ᵨ*+Ḅᨵᵨ,᛻”Ḅ/01஺3᝞5☢ᡠ89Ḅᵨᡝ(ᵨ*+";<=>ᵨWindowsḄFG஺HIJKLᡈὅODLLᩭST஺UVWXYḄ=Z[ᨵ\]Ḅᦻ᫏`ab#c=ᑮUVḄ*+[ef>ᵨUV=Z஺g᝞WindowsDLL(i᝞Kernel32.dll.Advapi32.dllஹUser32.dlltGdi32.dll)WindowsAPIᦪ஺POSIXDLL(Psxdll.dll)POSIXAPIᦪ஺Ed:Yyz{|e᡻T᧜ḄefᑭᵨWindowsᐹḄExetypeᐹᡈὅWindowsᢝᐹtP1atformSDKḄHឋ{ᐹDepends.exe,ᩭ|ᑮ᧜Ḅ,g᝞;ḄWindows᧜zNotepad,exeᓫḄᦻᘤ,ᓽtCmd.exeWindows¡¢8£,᛻ᐸ᝞¥zC:\>exetype\Windows\system32

29otepad.exeFilezz\Windows\system32

30otepad.exez/isofthefollowingtype:WindowsNT32bitmachineBuiltfortheIntel80386processorRunsundertheWindowsGUIsubsystemC:\>exetype\Windows\system32\cmd.exeFile"\Windows\system32\cnid.exe"isofthefollowingtype:WindowsNT32bitmachineBuiltfortheIntel80386processorRunsundertheWindowscharacter-basedsubsystem

31U⊤aNotepad#GUI*+¸Cmdᑣ#ºᑴ¼ᡈὅ½¾¿ÀḄ*+஺¸ÁExetypeᐹḄÂYᨩ£zÄᯠ┐ÇGUIt½¾¿ÀḄ*+ᨵ;ḄÈ#WindowsᓾÊᨵ஺¸ÁᙠIntel386ᜐᳮᘤÎϸÐᡈὅ486Ò#;ᢝWindowsḄ---Exetype*+ḄᦻÂYÓÔÕÖ×஺Ø(ᵨ*+>ᵨDLLḄÙᦪḄÚ᎛eÜÝÞߥàáâã1Onäᦪåᐰ#ᙠäDLLḄᙠᵨᡝçè¥éT஺ᣚëì`äᦪ"íᨵî,᛻S*Þ〈ðñ¸Áòíᨵ>ᵨWindows᡻TóḄFG஺äᦪ#ᙠᵨᡝçè¥åᡂḄéTḄõöÕ÷øî>ᵨὅ஺ÏᦪḄgᨵrocessù#÷ø-1,ᙠᡠᨵúS*HᐵḄᦪᑭᵨäüefýᵨØ5S*tGetQrrwtaocess/dǾ3ᙠéTḄS*S*ID;Ýᦋ
ᡠIDḄᙢᑮ
ᵨᑁ᪶஺n#$ᦪ⌕'ᵨWindows᡻/01ᡈὅ4஺5᝞
WindowsḄ#ead&'/e=ᦈ஻e/7/e$ᦪᑖB⌕ᵨCDḄEFᦻ᫏ḄᑁIWindowsI/OKLMNO7?ea"'஻e=NtWriteFile.n#$ᦪ⌕'ᙠS᛻UKLVᡂXYZES᛻UKL[/ᙠᵨᡝ]^_
`abcdeXᙠᐸgᑴ_[/ḄiᡝjᵨkḄl᝱஺ᙠnopq_
#$ᦪrsḄt^uS᛻UKLv〈1iᡝ/MNᘤy'
zS᛻UKL᡻/{Z஺ᯠ}UKLDLLj
ᦈᑮj}uᵨὅ஺ᨵX$ᦪᑡḄ2=3⚗Ḅᔠ
᝞WindowsḄCreateProcess=CreateThreadAᦪ஺WindowsᙠḄ᎛
⌕'ᢝ4ḄS᛻UKL
Ḅ¡ᩭ£
zUKL¤¥ᡠᨵḄ¦ṹᩭᜐᳮª«=¬I/O,¬ᯠ¯°±ᜧ³´µḄKL$ᦪ
¶·KLḄ¸¹ᜧº
»·KLḄឋ
ᨬ¾¿ᯠÀᩭa☢ÂÃ஺ÄÅWindowsÆÇḄUKL
ᡠWindowsḄὅÈÉÊnXËÌḄ$ᦪÍᙠWindowsUKL
ÎFzᐸÏḄUKLᵨWindowsUKLᩭVᡂ¬I/O஺ÄÐ
POSIX=OS/2UKLᵨWindowsUKLḄMNᩭVᡂ¬I/OE▭
᝞ÕÖ×ØnX᧜ÚḄUKLÛÜ
Öʯ£ᑮ
`ݤWindows᡻/ᦻÞ._☢ᡃÝᩭáâᙢ£1£1S᛻UKL஺WindowsUKLWindowsUKLᵫ_äå⌕ḄÞ᪀ᡂḄ஺

32nS᛻UKL(Csrss.exe)ᒹí_ᑡᢝ:•gᑴð(ᦻÌ)ª«ñ•òóᡈᑤ◀=öñ•·16ùúûDOSü(VDM)Ḅ1Iᑖᢝñ•ᐸÏ•X$ᦪ
᝞GetTempFileஹDefineDosDeviceExitWindowsEx,ÿ
ᯠᢝᦪ஺nᑁ᪶ᜓ(Win32k.sys)ᒹ!:•%&'ᳮᘤ(windowmanager),34ᑴ%&678'ᳮ9:;<8=>ᩭ@AஹC᪗EᐸGᜓḄ;ᐭ8JKLMNOᵨᡝḄRST⌴VWᵨX■Z[ᜓ\&(GDI,GraphicsDeviceInterface),3fgh┐jZ[;<ᜓḄᦪk8ᐸlᒹmnஹᦻpEZ[Ḅqᑴᦪ8rsqZ4ᑴᦪ஺ntuvDLL(x᝞Kernel32.dllஹAdvapi32.dllஹUser32.dllEGdi32.dll),3~Oᦻ᫏ᓄḄWindowsAPIᦪ8ᡂNtoskrnl.exeEWin32k.syslាḄᜧᦪᦻ᫏ᓄḄᑁ᪶uvᵨ஺nZ[ᜓfᢣᐵḄZ[67ᘤஹᡭᓺE⚣&஺Wᵨᵨ᪗ḄUSERᦪr¤ᙠ67ᘤ¦§¨ᵨᡝ©☢48x᝞%&Eᢥ¬஺%&'ᳮᘤO®¯°±〈VGDI,³GDI´O3~T⌴VZ[ᜓ8ᙠᜓᑁµ8®¯°¶·¸ᓄr〉ᔠᱯ¼Ḅ67ᘤᜓ஺67ᘤ⚣UfᡂjḄ8r½¾j⚣67Ḅᢝ஺GDI¿ÀÁÂÃ᪗ḄÄÅᦪ8ÆÇWᵨÈÉÊ⍝ÌÍᨵᐵZ[ᜓḄÏSÐÑrᜓÒÓÔÏ஺GDIᦪÕÖWᵨ(x᝞67ᘤEᡭᓺ)EZ[ᜓḄl×஺GDIMNØÙWᵨḄZ[;<¯°8ÚO®¯°±〈VZ[67ᘤ஺3LÛWᵨ¿ÀÁ᪗Ḅ\&8r¤®WᵨÑrÆᵨᔜÝÞJḄZ[;<ᜓ஺ß\&ÆÇWᵨàṹÑrâãÖᜓE3~Ḅ

33஺GDIj3ḄRSÒÓäå8ræᔠᜓḄçè83Ôé⌕OWᵨḄ¯°ᑖØᡂ
᧕ÖᜐᳮḄµᑖ஺î᝞8ᨵ®ᜓÑrᳮØïðᙊḄòó8³ᐸGḄᜓᑣ⌕°GDIOõòóØÙᡂ“OÂuᑡøùúûᙠᱯ¼Ḅᙶ᪗ᜐ”஺ᨵᐵZ[E⚣þ᪀Ḅ
ὃWindowsDDKGraphics஻//yers--Ḅ“DesignGuide⁚஺ᙠWindowsNT4&'()*ᳮᘤ-./012ᵨᡝ56Windows789:;Ḅ<ᑖ஺ᙠWindowsNT4>?@ABCᙠDndows789:;E᛻Ḅ()-./GṹIJᑮLMNOᵨḄ8901PQBCᙠᑁ᪶56T(ᙠᦻWWin32k.sys)஺]ᡠ&_>᪵ḄaJb⌕Ḅᳮᵫ2eLfghi89ឋk஺lᯠ@nḄopqrIgstᓄLv2wWindows./789xᙠyᑖzḄ01ᘤ:;{|}~;-:;E᛻ḄᑗᣚὑᣵᦪḄCPUᕜ-ᑁ஺᝞ᡝḄy;ᙠWindows789:;ᨵyḄஹḄ01ᘤ;ᙠ¡¢ᡝ;Ḅ£஺yI¤efastḄᱯ¦Ḅ§:;¨o©Nᵨᩭᙠ>?;]«¬〈஺®¯¨Ḅ;E᛻ᑗᣚ°±Ḅ2ᙠ>?Ḅ;]«¨²fastLPCᩭ·⌴¹°º»ᑁ᪶¼½y¾¿Os(rescheduling)ḄÃW>᪵01ᘤ;ᙠ¡¢ᑁ᪶ḄÄᐜ6;Osᘤ|᡻CᩗÈÉÊ&'N&ᑭᵨᡝ;ÌÍᵨÎḄÏ«ᱏᩭBCÑÒḄGṹ஺ᑭᵨᐳÔḄᑁÕÖ×N&·⌴?ᜧḄᦪÙÚ᪀Ü᝞Ý.ÞᡝN&PQ(vßà)áâᐵäḄ01ᘤᦪÙÚ᪀&å»ᡝ-Windows78901ᘤ]«Ḅ;/:;æᣚçNkᙢéêᑮᨬê஺¹ìGDIîïN&ᑖᢇᜐᳮ(òᙠó2᝞ô)஺ᡠõᢇᜐᳮ(batching),öᕡḼWindowsùᵨ;ú¬ûḄ8ᑡ./OᵨᐜIxᑮyGDIᢇᜐᳮýᑡPᑮ•yýᑡÿ
“(pushed)”ᑮᘤᙠᜓᑴᩭ.!"#ᵨWindowsḄGdiSetBatchLimit,ᦪᩭ./ᑡḄᜧ234ᙠ567᎛9!":;GdiFlush,ᦪᑵ=/ᑡ஺?@ᙢ3GDIḄDEFឋHᦪIJ᪀3LMNWindowsOPQRSTUV3WXYᙠZᡝ\3"]^_Ḅ`abcde஺ᯠ43ghᨵ
jklᓄ3nopqrsḄtᵨSu3vwḄPQឋxyᯠz{|Ḅ஺}4᧕Ḅᫀz3:;HpqPQᑮᑁ᪶T3W!"◀

34k▬cḄS3"ᵫᩭḄ᛻ᑗᣚ஺43LMtᵨSuᵨRᐭ
hᳮᘤHGDIT3jkOPQW!"`aᐸḄWindows᡻¢w£¤34¥¦§ᵨᡝᡈὅᑁ᪶ᣚḄª«஺¬LRS:;GDIᵨ®⚣°±Su3"²³Ḅ⚣᳛Hµ¶®⚣·¤R¢¸¹3ᑣᙠ»¼½3j᪵Ḅ`a¿ÀÁ⌕஺Ã3ᨵÄkÅÆᶇᙠWindowsOPQḄᵨᡝRSÈᑖᕖËÌᑴÍᡈὅᦻÏḄᡠᨵᑴHbÑÒÓ9zᙠjLÈᑖTᜐᳮḄ3ÕÀÌᑴÍtᵨSuÖᨵÁLḄᭆØ஺½☢j᪵Ḅ¢À²Ú᧕ÛVᑮÜᡭÞLßàáâ3ᯠ^ãḼåLᙠæ☢ç±3j7èÛᑮ3éWindowsOPQÁÌᑴÍḄ7᎛æêᙠëὑCPU7ð஺ñz3◀
nÌᑴÍUḄòᢝ"᜜3ᐸDᨵõᦪöWindows,ᦪè÷øùWindowsOPQRSú〈ëüÜRSHSḄýþHÿஹᘤ᧜ᦻḄ஺ᙠḄWindows&ᵨ()*+,-./0᝞2ᨵḄ456Windows789:(Ḅ;᛻ᑗᣚ஺?USERDGDIHᙠᑁ᪶KLMWindows+NO*PQᔩᨵSTUVWX⍝?ZS[ṹHᑮᑁ᪶KLM^ᔲ+`abc89ḄPQឋ஺ᐸfg89PQឋḄbchijᑮkᨬm▲oᳮᵫ^ᙠWindowsNT4vw0Zᙠxᜩzᯠ^|Ḅ5ᵨᡝKLWindows789:(0Csrss.exe5MḄ┯0᝞accessviolation5+89Windows789:(g89Ḅᩭ^0ᙠzᯠ^56ᐵa⌕Ḅ:(஺Sᘤ¡w¢£¤¥Ḅᦪ§¨᪀^ª«:(vMᡠ®:(¯kᑣ᦮ᵨᡝ²☢´µ¶k஺ᯠᓽ¸^¹º»ᘤḄWindows¼¹89½¾ᨵ¿ÀÁÂ:(þᨵZ:(ᑣ89Ä´Åƺ»ᘤ:(UV⌕ᑭᵨ¢£È¥Éᑴᩭ&ᵨ()ḄᑁËÌ᝱஺gWindowsᩭÎ᪵ZËᑖ[ṹᙠᙠᑁ᪶KLM[ṹMḄ0accessviolation5Ñ+¸89ÒNÓShᑁ᪶KLMḄÔÕ+89஺ᯠᨵÖ᜜ḄᳮØᓻ◅ᑣ^ᙠ¢£DÛÜ89µÝᑮᑁ᪶KLwÞ*ßᙠḄ஺ᵫZËᑖ[ṹᙠᙠᑁ᪶KLàᡠ¿À┯0bug,᝞¸ᵨkåḄᢣ┐5èUV+ẚåᣵᑁ᪶KLëìḄᦪ§¨᪀஺ᙠWindowsNT4w,Z᪵Ḅ┯ᢣ┐,ᵨ+,íᑁ᪶KL⚓☢ᙠᵨᡝKLà^*VᑏḄ஺ᯠð89᝞wᡠ஺ᙠZËᑖ[ṹᙠᑁ᪶KLàÃåᢣ┐,ᵨkgñᑁ᪶KL⚓☢Ḅòᑏ¼¹ó½ᨵUVÞ*ôõ¸89ö÷ø᝞2½ẚåkñᦪ§¨᪀ᑣᨵUVᙠ*ùvð89஺ᯠZúÄßᙠûüḄUVឋÄ´^Z᪵Ḅåᢣ┐,ᵨ?ẚ

35åᑁßýþÿ(
ᦪ᪀)ḄẚḄᦪᵨᡝᡈὅᦪᑏᑮ஺!"#$%&ᑮᑁ᪶)*+,-.ᨵ0᜜23Ḅ45஺ᐜ7"#$%Ḅ28ᑖ:ṹᙠCsrss+@AᐸC8ᑖᙠᑁ᪶)*D@A஺Eᙠ,᦮H$%I@Aᙠᑁ᪶)*D஺JKWindows+RᢝḄ"#Tᜓ$%Vᐰ8Microsoft\]Ḅ^Microsoft_`abcᑴ⌼ᖪᔠh,ijklmnᔆᖪpᑴ⌼q☠sᨵᦔḄ$%஺uvw2x]AḄᡠᨵ$%᝞{ᐸCḄ᡻A}~c2᪵I⌕{2ᝅḄ஺ᨬ-ᳮD☢Ḅ2⌕Ḅ᪷m᪵ḄT(ᢣᙠᑁ᪶)*D@As"#vw)Vᑈ◅஺{ᐸCTᜓ$%ᡠ¡ᵨḄ¢£(¤᝞¥ᓱ$%sb$%)஺Windowsᨵ§¨☠ឋḄ◤«¬ᡠ_mn$%®¯_ᙠᑁ᪶)*D@°±ᨵn²³´!KᳮᘤsGDI&ᑮᑁ᪶)*+¹!º»ᑮWindowsḄ¼ᐜ*½¾¿¨j஺CÀḄᳮÁᵫᡠᨵ▬ÄḄWindowsᜐᳮÆÇIÈᙠᑁ᪶)*+Ḅᡠ,ᐸCÉʼᐜ@AḄËÌ®ÍÎ஺m3ÏÐÑᙠ23ÒWindows}v᪀ḄÓḄÔẠ¬Ḅ஺ᙠᐸCᨵÖ×ØḄ¼ᐜ*Ùhvw+mkØÚḄᙠᑁ᪶)*+Ḅ᡻AÛÜÌÊÙhvw¿¨ᘤ¼ᓰᣵ——ᡈὅàáÊÎâ⚜äåḄᑁ᪶ᐭ(P஺intsofkernelreentrancy)¼ᓰᣵ஺ᯠ
ᙠWindows+ᙠ᡻A}(executive)½òᙢ¢@AḄÉIaᵨᡝ)*D@AḄÉ2xʼᓰs¿¨᡻A}ᑁ8Ḅᡠᨵ:ṹIôᐰᐭḄ(reentrant)஺.ᨵᐸCḄᳮᵫõᙠSMPbc÷ᑮ§¨Ḅvw᡽ùឋm3j¹⌕Ḅ஺023´SMPḄ᡽ùឋ!Ìúõm2ᦋü
ýᑮ45஺ᐸᳮÁᜧÿ᝞
ᐜḄ᎛ᵨᳮᘤᡈὅGDIḄ!"ᙠᵨ$%"ᙠCsrss.exe$,-ᙠSMP123!4567879:;<12Ḅ=ᔢ?஺ABᑖ᪆EFGHIJKWindowsNTᢈVᙠWindowsNT4XYḄ᱐[$\᝞]^_Ḅ஺ᙠᜧaᦪcd
9eᡝᵨᑮWindowsh12iḄjᵨ\kl87Ḅmn\Eeᡝ!ᙠopqrᘤ!Ḅ᎛\sᐰuvḄwᨵyqrᘤ!sᡂK{jᵨeᡝ!|}~87஺,-ᙠSMP3᪷[ᑮ67ឋ஺AB᧕ᑮw◤ᙠ"SMP123ᵨឋ5^ᐹᩭ"Ḅᵨᓽ4஺ᙠ"ᜐᳮᘤḄ12ᓃᜐᳮᘤ\50%Ḅ¤¥:¦᧕4X•Csrss!¨Ḅᵨ!©ᡂK"ª«Ḅ!஺¬▭3,®A!¯ᐵ1±²:¦ᐳ´Kµ᝱ᡠXᜐᳮ

36ᘤḄ<¸¹º»¼⌕¾¿ÀᑵÂXÃÄὅḄ"Åឋ஺Æ\,®AB¾¿ឋḄᑵÂÇ_ᡠXᙠWindowsNT3.5112$ᓫ!ᵨᙠSMPÉᘤ387ÊᩭËᙠᓫᜐᳮᘤ123ÌÌ⌕ᶍ᠒"Ï஺,-WindowsNT4$ḄA"ÐᓄÒÓÏᜧ?ÒᵨᳮᘤGDIḄᵨᙠSMPÉᘤ3Ḅ=ᔢ?ᜧᜧ;<ᱯÕ\yaᵨ!ᙠḄ᎛஺yᵨ!ᙠ"ÖᐹᨵᜐᳮᘤḄWindowsNT3.51Éᘤ3×87Ḅ᎛ØᐳÙ!Úᵨ$ᨵÛÜ3Csrss$ÝᙠÞßAᜐᳮᘤḄ஺àᙠá]᎛ÌÌwᨵ!âᜓ87ä\ᵫ×æç"ÅḄèéÚᓽAÏ!Ḅ87èéÝ9:êÅëᜫKᑁºîᵨḄïðឋX<¸¹ºḄ"Åឋ஺ᡠXëᜫABïðឋ"Åឋ\,®Ḅ!ñᨵ459"ᜐᳮᘤòóᑮ%"ᜐᳮᘤ3஺ᙠWindowsNT4Ḅôõ$Aᵨ!Ḅ"ᨵö÷øḄᜐᳮᘤWindowsḄ÷Ç!ùឋØ\úᔣ×ᙠk᪵Ḅᜐᳮᘤ387k"!,:ÒᑁºîᵨḄïðឋà45ᙢᨬᜧᓄ6¦à45ᙢklÿ
ᜐᳮᘤᨵḄ◤஺ᡠᳮᘤGDIᵨᡝ!ᑮᑁ᪶%&'(ឋ*+ᙠ-./0ឋ1☠ឋ3☢5ᨵ678℉Ḅ⌨ᓄᓽ=>ᙠ?@A(BCDEḄ-.FGH(IJKḄLMNO>᝞Q஺POSIXR-.POSIXS%I1Tᡂ“?WXUNIXḄ1!YḄZ[-.\aPortableOperatingSystemInterfacebasedonUNIX
”Ḅ✌`abᑏdᢣḄ>┐gUNIXhiḄZ[-.\Ḅ?jk▭᪗n஺POSIX᪗nopᔆᖪstuUNIXhiḄ\=dsvᢝxyz᪵|}ᕒs1y᧕ᙢsḄᵨ|}?-.!ᑮ?-.஺Windows&&tu(IPOSIX᪗nFḄ?᪗nᓽPOSIX.1,Ḅ>ISO/1EC9945—1:1990ᡈὅIEEEPOSIXstandard1003.1990஺᪗nᡠᒹᩭ⌕>(kᙠ2080F¡ᑴ0Ḅ£¤⌕ᓽPOSIX.

371xyឋ>¥ᑴឋḄz>ᙠk᪗nᢈ§¨ᕒJ,NationalInstituteofStandardsandTechnology-©ªḄFIPS,FederalInformationProcessingStandard,ὶ¬®ᜐᳮ᪗n¯151—2F°0Ḅ஺WindowsNT3.5ஹ3.514²³´µ¶·+¸¶(FIPS151-2Ḅ␺0஺ºPOSIX.1xyឋ>WindowsḄ?¥ᑴឋ»᪗ᡠᙠ¼½WindowsZ[-.¾¿À⌕vÁᡠ¼½ḄWÂ-.*ÃtuPOSIX.1R-.——Å᝞6ÆÇᦪ>ᙠWindows᡻ÊËFtuḄ┐gᦻÍÎÏ\,hardfilelinks-ḄÐᢝᑣ>ᙠWindowsᦻÍ-.FḄ஺ᯠºPOSIX.10Ó(ᨵ▲Ḅ?jDEÕÅ᝞|Öᑴஹ×|¸ஹᓫḄ`ÙᓫᐗI/OᓽsimplecharactercellI/O,ÛÛ¯ᡠÜWindows2000ÝḄPOSIXR-.·%>?Þ᦮Ḅà|á᛻஺+ºᵨ|}%*ᙠ%ãḄWindowsR-.äÊåᔠçᵨᡠèéLMNPOSIXᵨ|}êië▲XPOSIX.1F0ÓḄᔜíDE஺z?▲ᑴîᕡḼWindowsḄPOSIX1᡻Ê|}ñòGHó|ôñòGHᡈὅ=ᵨõ¶|çᵨ,RPC-ᡈᝅ\`,sockets-஺(÷øz?▲ᑴÝᩭḄ%3ùMicrosoft'ú(?"WindowsServicesforUnix"ḄûüdÕ3.5᱐©þ¯ᒹ(?ÿḄPOSIX᛻᛻2000UNIXᦪ300UNIXḄᵨᐹᨵᐵᐵWindowsServicesforUnixḄ!"http://www.microsoft.com/windows/sfu/default.asp஺$%&ḄPOSIXᨵ'UNIX(ᵨ)*+,ᑮWindows./0஺ᯠ234$5)*6ᯠ7894POSIX:᡻<)*ᡠ>?@AᵨWindowsᦪ஺4UNIX(ᵨ+,ᑮWindowsBCDᐕFGᵨWindowsᦪH:IJUNIX-to-Windows+,KLᒹN᝞ᩭQMorticeKernSystemIncRSmm.mkssoftware.comḄMKSᐹTUV஺WX$YZ[UNIX(ᵨ)*:7\]^_`89ᡂ%Windows:᡻<)*ᯠbc᠒᠒ᙢfᐭ%5hWindowsijᦪḄAᵨ஺klmnPOSIXḄop

38'®ᙠtuvwxPOSIX7~ᡂl%ᨵ%POSIX:᡻<)*7<Ḅ᎛7opᩭ஺ᡠH◤<%POSIX)*:mnᑮ>7opᩭN᝞H:<%"WindowsServicesforUnix"ḄᵨᐹᙠWindows2000ᐹTḄ¡¢0H:ᙠ\Apps\P0SIXᦻLᜳB¨ᑮ%©ªᑖPOSIXᵨᐹ஺¬$5ᐹC®7¯4ᐹTḄ%ªᑖ2°±ᑮB²஺ᢥ᯿x☢Ḅ¶·:mnᑮPOSIX7opᩭ஺1.op%º»¼½¾஺2.®%ûÌᢝ<᝞ýHᩔᣵPOSIXᐸḄP0S1Xᵨ◀!"#$஺POSIX᧜'ᦻ)*+,-.஺/012ᱯ4Ḅ56Posix.exeḄ=ᢝ᧜'ᦻ)?@ABᩭᯠEFGH•2ᩭPOSIXᵨ஺OS/2᝞MᑁOḄPOSIX1᪵OS/2Q᛻ᙠᨵᵨឋV☢XYᨵ▲F[=ᢝOS/21.2Ḅ16]^_`aḄᡈὅd⚣1/0fVI0$Ḅᵨ஺hᯠMicrosoftXnopqr12stOS/21.2ḄWindowsNT4|}~ᳮᘤF,=ᢝOS/22.xfᡈE᱐*Ḅ$ᵨfᙠWindows2000EFXᵨ$஺

39᜜6Windowsᐕᵨᡝᵨ-.)ᡠ᝞OS/2ᒹ᡻IN/0UTᢣ()¡ᜓ)¤¥¦d⚣I/O(AVI0)ḄI/Oᱯᩗtṹᑣ«᪵ḄᙠWindows¬®¯°=ᢝ஺±ᵨCU/STIᢣḄᵨᑣ³=ᢝḄ³ᡠᨵᐸḄOS/2ᵨ´pCLIᢣḄᡠᨵᐸḄ¶·?ᢞB-ᑮ᡻1ᩩSTIᢣ6»஺ᙠ¼½ḄOS/21.2®ᨵ16MBḄᑁ¿▲ᑴ«Á▲ᑴ,〉ᵨ_Windows——0S/2ᑭᵨWindowsḄ32]ÆÇᙢᙬÊËᔣOS/21.2ᵨÍÎÏÐ512MBᑁ¿᝞2.5ᡠ}஺2GB32ᵨᡝḄII᳛14Ḅ32ᵨᡝḄ02.5OS/2ÆÇᑁ¿ÒÓÔ᪀¬ÖḄ×Ø(tiledarea)³ᢣÆÇᙢᙬÊË⚜ᐜ?ÝᶇᯠEß16]ᵨ◤⌕âḄã᎛?Íåᡈæ◀ÍåḄ512MBᑁ¿஺OS/26ç2èé12Óêëìa⊤(LDT,LocalDescriptorTable),ᐳóḄᑁ¿âᑣ³ᙠᡠᨵOS/2ḄM᪵LDTᩩô஺õ᝞ᡃ÷ø⌕ᙠù6úûüḄ᪵¶(thread)³12Ḅ᡻ᐗÿᡠᜐᳮᘤ஺ᯠWindowsᐜḄ!"0ᑮ31,()64,OS/2ᐜ(0ᑮ63)33᧜5ᑮWindows6᝱ᐜ1815஺OS/2:;<=>?@AᦈWindowsCᐜ16831஺᝞EPOSIXIJKL᪵OS/2IJK>)ᙠOPLQRS•,UVḄOS/2᧜WᦻYZ[6\6]ᩭ஺@L_`ᢝbcd᝱_ᑮJKefghij஺

40ᨵᐵWindows᝞nᜐᳮoᙠbcḄPOSIXpOS/2qᵨ;sḄtuvwxyzP6{Ḅ"CreateProcessḄ};”L⁚஺Ntdll.dllNtdll.dll)L,ᱯḄJKᢝ⌕ᵨIJKDLL஺ᒹḄᦪ:nJKᑖ᪷stubs,@ᵨWindows᡻c¡JK¢nᑁ¤ᢝᦪ¥IJKஹIJKDLL§ᐸ©Ḅª«᧜WᦻY¬ᵨ஺PLᦪiWindows᡻c¡JK®¥¯A°ᙠᵨᡝ²³´µ¶·¸¹A°ᦪᵨWindows᡻c¡ḄJK஺¸᪵Ḅᦪº·¯200,»u¼᝞NtCreateFileஹNtSetEventFG^o᝞½☢ᡠ¿ÀḄ¸¹ᦪḄᜧuᦪµ¶·WindowsAPIᩭÄÅᑮᯠÆᨵ¹ᦪᑣ?ᯠᵨÈÉJKᑁ¤஺ÊËL,¸᪵ḄᦪNtdllᒹ¯L,EÌḄᐭ°Î஺ᦪᑁ¤ḄÏṹᒹ¯Ñᜐᳮᘤ¡JÒ᪀ÔᐵḄ²³ᑗᣚᢣض·ÙᢣصÚᣚᑮᑁ᪶²³´"ÆᵨJKᑖᘤsystemservicedispatcher,P3{å@æçᙢéê஺ᑖᘤᙠëì¯í¹yᦪîïᵨðoḄᑁ᪶²³JKᐸñᒹòNtoskrnl.exeᑁ¤ḄC▭Ïṹ஺Ntdll>ᒹöuᢝᦪ¼᝞᧜W÷øᘤ/ùúᜮḄᦪஹᚮýᳮᘤஹWindowsIJKþ;¶vᦪCsrᜮḄᦪḄIRtlᜮḄᦪ஺ᒹᵨᡝḄᵨAPC,AsynchronousProcedureCallᑖ1ᘤ34ᑖ1ᘤᐵ6APC347ᙠ93;<=>஺᡻@Windows᡻@DNtoskrnl.exe<ḄJKᑁ᪶DᐸK஺᡻@ᒹOPḄᦪ஺nQᙠᵨᡝᵨḄRSᦪ஺TUᦪVWXYZ[systemservices},\]^Ntdll_RS஺TUZ[`ᜧbᦪQ^WindowsAPIᩭefᡈὅ^ijk᛻mXYḄAPIᩭef஺ᯠop6ᨵUZ[^rsjᦻ᫏ᓄḄmXYᦪwxyefzT᪵Ḅ|mᨵ}LPCஹ᝞ᙬ0"஺"/7-/7஺஻ᑖ஺஺655T᪵Ḅᦪ᝞7g7p//eT᪵Ḅᵨᦪ஺nQ^஻64B/஺஺஺஻஺ᦪᩭᵨḄᜓᘤᦪ஺TWᵨᡝᑮᑁ᪶j^ᵨḄ¡oᙠᵨᡝQᵨᜓ¢<\£¤¥ᡈὅᑏ§¨ᐵὶḄᦪ஺nª«ᙠᑁ᪶ᵨḄRSᦪ\]TUᦪᙠWindowsDDKᡈὅWindowsIFSKitInstallableFileSystemKit,Q²³ᦻ´XYḄ1µᐹ·<¸¹ᦻ᫏

41ᓄᨵᐵWindowsIFSKitḄºb»¼KLMhttp:஻ivww.micros஺ft.com/whdc/ddk/ifskit/default,mspx஺nᙠᑁ᪶ᵨ½¾ᙠWindowsDDKᡈὅIFSKit<ᦻ᫏ᓄḄRHÀᦪÁ᝞ÂᜮḄஹᙠÃRÄ⚣¢<ᵨḄᦪ஺nÆÇWᐰÉÊ˽D¾_RSḄᦪ஺zᒹÌᙠNtoskrnlᑁᵨḄᑁÍÎᢝᦪÁ᝞/ᓺᡈὅᦈᜮḄÒUᦪᑖÓDᑁÍI/OÕᳮᘤÎᢝᦪ3ᑁÍᑁ×ÕᳮÎᢝᦪ஺n¾ÆÇWᐰÉÊËoDᙠjᙽᑁÍḄᦪ஺᡻@ᒹḄÙ⌕Û´ᙠÜÝÞßḄ;⁚<7áâãᙢåæTUÛ´஺nçèÕᳮᘤOconfigurationmanager,ᙠ94;<åæéêXYëì⊤Ḅîï3Õᳮ஺nð3ñÕᳮᘤprocessandthreadmanager,ᙠ96;<åæòóᡈôõð3ñ஺┐pð3ñḄ÷KÎᢝDᙠWindowsḄᑁ᪶<îïḄÀo᡻@ᑣᙠTU÷KpùḄúẠJüJ▬ḄþÇ3ÿ஺nᐰᵨᘤsecurityre/"e஻cezwacagerᡈSRM,ᙠ"8$%&'()ᑴᙠ+ᙢ-./012ᐰ3ᶍ஺567Ḽ9:;<Ḅ>?@᡻2BC2DBEḄF7GH-஺nI/OKᳮᘤI/Omanager,ᙠ"9$%NO(1PQRSᜓUᐵḄI/O9:@WXYZ[9:ᑖ]ᑮា`ḄSᜓabcdefghiᜐᳮ஺nᓽlᓽᵨPnP(KᳮᘤPlugandPlaymanager,ᙠ"9$%NO(Ḅnop@qQrᢝhtᱯvḄSᜓ@wvx[abcdpy◤Ḅ@{D5|WX}~Z[abcd஺5ᙠSᜓᑡc%@ᑮtSᜓḄ>?◤஺PnPKᳮᘤ᪷tSᜓ

42Ḅ>?◤@ᑖ〉`Ḅ>?@᝞I/OஹIRQஹDMA⍝Gᑁ஺`;<%ḄSᜓᓄ}ᡈὅ◀Sᜓ(D@5|WX〈ា`Ḅ¢£஺nᵯ?Kᳮᘤpowermanager,ᙠ"9$%NO(WX¥¦ᵯ?¢@§¨ᔣSᜓabcdª«ᵯ?KᳮI/O£஺ᵯ?Kᳮᘤ¬eᡂ®`;<¯°ḄD᎛@YCPU´ṑḨ·᝱¹º»¼ᵯ?½ὑ஺ᓫÀSᜓḄᵯ?½ὑᓄ¬eᵫSᜓabcdᩭᜐᳮ@Ãp◤⌕ᵯ?Kᳮᘤᩭ¥¦஺nWDMWindowsKᳮÈÊc/᝞VWindowsManagementInstrumentationroutines,ᙠ"4$%NO(ᐕÎSᜓabcd¬eÏᨵᐵឋGḄÒÓ@eÔÕᦈᩭ×ᵨᡝÙÚWMIÛoḄÜÝ஺WMIÒÓḄ½Þßᡝ¬eᙠ+ᙢ/ᘤ0@|¬eᙠàáâãḄäc/ᘤ0஺nåæçKᳮᘤcachemanager,ᙠ"11$%NO(éåQeᦻqëẠḄI/O9:Ḅឋ@ᐸîïp@ðᨬòᵨḄóôᦪöᶇᙠøᑁ%eùúæûü§¨ýþóôᑏ
ᙠᦪ〈ᑮᐜᙠᑁᶇ஺ᑮᑭᵨᑁ#ᳮᘤḄ᧜(ᦻ*Ḅ+ᢝᩭ.ᑮ/0஺nᑁ#ᳮᘤmemorymanager,ᙠ27456789:;ᑁ஺/<=ᑁ#ᳮ>ᫀ@ABCDEF9BGᜧḄIᨵᙢᙬMᐸᦪOPQᜧᜧRSTPᵨḄᱥᳮᑁ஺ᑁ#ᳮᘤV@WXY#ᳮᘤEFᨬ[\Ḅ]^+ᢝ஺n_`⚜bᘤCog/ca/pre/0tMer,ᙠ27456pXqrsCDḄtuSD஺vw⌕ᙠqrᡈCDtuSDzᵨḄᦪ{ᓄ9/}ᦪḄp~SD஺᜜Windows᡻ᒹ⌕Ḅ+ᢝᦪQ/}᡻*Vᵨᑮ/}+ᢝᦪ஺ᙠ/}+ᢝᦪᨵᑖPQᙠDDKᑮḄᦻ᫏@ᜓuDV⌕ᵨᑮ¡஺Q¢<ᜧ£+ᢝᦪ஺

43nv¥#ᳮᘤ¦o6Jecf0a஻ager,«¬ஹ#ᳮsᑤ◀Windows᡻v¥s°¥ᦪ£±/}v¥sᦪ£±²²³⊤9
qrḄµ¶·᝞CDஹ¹Dsᔜ=»¼v¥஺\½234¿À9v¥#ᳮᘤ஺nLPCæᙠ23456ᙠ»ÄÅᘤḄÆᡝCDsÈÉᘤCDÊ⌴ÌÍ஺LPC

44ḄᔜáᐰãäåᨵæçḄèéêëìíḄ¥᎛èéîïëᡷ◀!஺EIÆ├ᙠᑁ᪶.%duᙠḄᑁ᪶H/0òKóᓫḄõKᑁ᪶Ḅ”elobjects},÷øᑁ᪶ùᑴú.ûᜐᳮQvw;ᢝ᡻WḄìíü°஺᡻W:Ḅýᜧᦪᒹ
•ᡈὅᑁ᪶Ḅᑁ᪶ឋᔠᩭ஺•ᑴobjectsyḄᑁ᪶
ᨵᐵᑴᔜ"#$%&'(Ḅ)*஺+ᒹ-APCஹDPC3DeferredProcedureCall,45678ᵨ:;”?ᢝḄAB஺CD!᪵Ḅ?ᢝFGḄ᪀◤⌕FGḄṹJC<=%>ḄKLMNᔜᨵFG஺

45Q᛻ᑗᣚcontextswitching
஺UVWjᩭk[\ḄQ᛻hlmnᩭ6oᙠFGᜐᳮᘤeḄKLstu>ᙠ
᪀M☢Ḅwx஺JC᡻gQ᛻ᵫᜐᳮᘤḄz᝱(|>ᘤ}6ᩭ~Ḅᡠ`
hi>ᡈlmᑣḼ᪀ḄFGᨵᡠFGḄ஺XHAL
᝞ᡠᑮḄWindowsḄᐵ⌕shᑮᔜFGḄe஺XaឋᡂC_Ḅᐵ¡ᑖ஺IIAL_lmḄஹᑁ᪶¤NḄ¤ᙽ!D┐§Windows¨©ªgᡠᙠḄḄ«XAB஺◚DᐵḄ®⁚°᝞I/OABஹ±²ᑴᘤ`´µᜐᳮᘤ¶·ᑴ——¹º᪀ᐵᡈὅ·ᘤᐵḄ¼஺ᡠ`Windowsᑁ¡½`´ᵨᡝ¿ᑏḄᜓÂÃ\ÄÅFÆAÇÈÉʨË◤⌕ÌᐵḄË_`¶ÍÎᵨHAL\ᩭiᢝ_ឋ஺ÏÐÑJ┐§
HAL\ÒᨵḄᦻ᫏ᒹÖᙠWindowsDDK஺⌕×ØᑮÙµᨵᐵHAL´ᐸᙠᜓÂÃ\ÄᵨdḄÛÜὃDDK஺ÞᯠWindowsàDáIIAL(â⊤2.6
,oᙠäåḄ᎛çᨵHALh⌱ÅèhéêᑮëìíeᐸᦻîCHal.dll(ᐸïḄðñë°᝞VMS,ᙠëòóḄ᎛⌱^}ôÐHALḄ¤ᙽ6஺Jõ᝞ö?ᢝ÷FGᜐᳮᘤḄHALᨵᡠFGḄøùúF᪵Ꮇüx86ýäåëḄëìíÒ_`ᙠ•ᜐᳮᘤeòó஺⊤2.6ᙠ\Windows\DriverCache\i386\Driver.cabḄx86HALᑡ⊤HALᦻᡠᢝḄHal.dll᪗PCHalacpi.dllᵯ!"ACPI$PCHalapic.dll%&'()*ᑴᘤ"APIC$PCHalaacpi.dllAPICACPIPCHalmps.dll/ᜐᳮᘤPCHalmacpi.dll/ᜐᳮᘤACPIPCHalborg.dllSilicon89:;<"==ᙠWindows2000(CᨵEFGHIJKL├N$Halsp.dllCompaqSystemPro"==ᙠWindowsXP(Cᨵ$টUVWindowsServer2003WX,ᙠWindowsZ[(KL\]^ᱯ`ᔆᖪcᐵḄHAL஺

46”ghijkWindows(ᒹmḄZ[HAL⌕opjWindows(ᒹmḄHAL,qᡭW\Windows\DriverCachew☢yz{|᪀ᦻᜳ(ḄDriver,cabᦻ஺(᝞Ex86ᩭEᦻ\Windows\DriverCache\i386\Driver.cab)ᑮHalWᜮḄᦻᜐ,o%kᑮ⊤2.6(ᑡḄᦻ஺ghi`ᙠzHALᨵ¡¢£¤%`ᙠzHAL஺1.ᡭWᦻ\Windows\Repair\Setup.log,¨©Hal.dll,pjª«¬☢Ḅᦻ஺ᦻᢣᙠ®¯°±HVDriver,cab(²³ᩭḄHALḄ´஺2.ᙠµᜓ·ᳮᘤ((ᙠḄ¸☢H¹º»¼''ᡃḄᵯᾯ(MyComputer)»),⌱ÓÅឋ(Properties)”Eᯠ¬»¼“È(Hardware)”᪗ÉEL»¼“µᜓ·ᳮᘤ(DeviceManager)"),kËkᙠ“ÌÍÎ(Computer)”µᜓÏÐw☢Ḅ“ÑÒer”Ḅ´஺᝞Ew☢ḄÓÔÕÖVy•zACPIHALḄ(سwᩭḄi

47<»!ghijkNTOSKRNLHALḄ᧜àcáឋ%ᑭᵨcáឋpj:ᐹ(DependencyWalkertool,Depends,exe)ᩭpjᑁ᪶I1AL᧜àᦻḄèèᐭ⊤EVêëìíîïðḄᐵ஺ñòcáឋpj:ᐹE%VWindowsᢝ:ᐹóᡈὅPlatformSDK(÷ᑮ஺⌕oᙠ:ᐹ(pjËz᧜àᦻE%VFileùᓫ(⌱ÃOpenûüEᩭᡭWý᪗᧜àᦻ஺᝞þÿᵨ
ᐹᩭNtoskrnlḄឋᑮḄ!"#Ntoskrnl$%&HAL,,HAL-$%&Ntoskrnl(/012ᵨ&34Ḅ5ᦪ)஺Ntoskrnl9$%&Bootvid.dll,?ᵨᩭ@AGUIEFGHḄIJK⚣MFNO஺ᙠWindowsXPUᐸWX,ᙠᑡ⊤[\]ᑮ▬_ḄDLL!Kdcom.dll஺
DLLᒹe&ᑁ᪶hijḄkẠmnoṹᙠqr?soṹNtoskrnl.exeḄvᑖ஺ᨵᐵឋzᐹḄ{|}~ὃDependencyWalkerḄᦻ(Depends.hip)஺mᜓMFNOᯠ⌕ᑮ9mᜓMFNOq?vᑖᐜᜧMFNOḄ᝞¡ᑡḄ¢£[¤¥¦§¨_©ḄMFNO஺

48mᜓMFNO_©Ḅᑁ᪶ª«ªᙽ(®W.sys¯°)/0ᙠI/O³ᳮᘤ¨¶Ḅ·¸¹º»¼$%஺mᜓMFNO½¾ᙠᑁ᪶ª«¿ÀWFÂÃ᡻¾Å᛻¸!nᙠǼI/OÈḄᵨᡝÊNḄÅ᛻[Ënᙠᑁ᪶ª«¢£ÊNḄÅ᛻[ËnÌÍ[ÎḄ¯Ï(ÐÑ/ᙠÒ¡ᱯÔḄÕNᡈὅÊNḄ᡻¾Å᛻[——Ù
[ÎÚÛÜÝÞÙßÕNᡈὅÊNà)஺á᝞âvᑖᡠäḄWindows[ḄmᜓMFNOå%æç·è/0hᵨHAL[Ḅ5ᦪé·ᡭë⍝஺MFNOííᵨC(ᨵÜ᎛ᵨC++)ᩭñᑏḄÐÑqáóᙢ2ᵨHALNMFNOWᙠWindowsᡠõᢝḄCPU÷¢¯᪀¸¹Õ¾ùoṹúḄûü,ᙠý÷¢¯᪀þᑁᑣ
ᑴḄ஺ᜓᨵ஺nᜓ(hardwaredevicedrivers')HAL!"#$%ᑏᑮᱥᳮᜓᡈ+,-ᡈὅ!ᱥᳮᜓᡈ+,/0ᦈ$ᐭ஺ᜓ3ᨵ456᝞89ஹ;<=☢ஹᜧ@ABCᘤEE஺nᦻGH(filesystemdrivers)ᢣJ᪵ḄWindowsR0S☢ᔣᦻḄI/OXYZ[#J\XY]ᣚᡂ┐ab•ᱯeᜓḄI/OXY஺nᦻGHfᘤ(filesystemfilterdrivers'),6᝞g\᡻ijklmnopḄᡈg\qrsI/OXYZ[᡻ib\uvᜐᳮxyz{⌴}~Ḅ஺n+,eᔣᘤnᘤ(networkredirectorsandservers'),ᑖᢣg\#ᦻGHI/OXY{⌴}+,/b•<ᘤᡈὅ!+,/0ᦈXYḄᦻGH஺

49n(protocoldrivers)s᝞TCP/IPஹNetBEUInIPX/SPXxḄ+,஺nᑁ᪶fᘤkernelstreamingfilterdrivers',J᪵Ḅ0ᩭaᦪiᜐᳮ6᝞ᑴᡈὅ⚣஺⌕ᙠGH-¢oᵨᡝ¥ᑏḄᑁ᪶¦§ṹ©ª«¬Ḅ®ᡠᨵ\ᕒ±¥ᑏᜓ²³¬´µ¶GHᑁ·¸ᦪnᦪ¹᪀Ḅ»®¼ᙠᵨᡝ¦½´µḄ¾ᙠDDK-ᨵᦻ᫏ÀÁÂḄÃᢝÅ஺Æ᝞ᩭÇwww.comḄ45Èᐹᵫ,•ÌWindowsGUIÂᵨn¬ÌÍᡂḄᐸ-ᵨᩭᦈÏᑁ·ḄGHÐ᝱ÀÒᵨg\Óᙠᑁ᪶¦´µ¼!ᵨᡝ¦-Ô®´µÅḄWindowsAPI஺Windows¦Windows2000uosaᓽÖᓽᵨஹᵯØ⌱⚗ḄÃᢝ,ÛÜ3᡽ÞsWindowssḄ¦ßḄ¦àáWDMWindowsDriverModel,Windows¦Å஺Windows2000ÀyḄ᱐ãäåiὁḄWindowsNT4¾çáJ\½ÃᢝᓽÖᓽᵨnᵯØ⌱⚗ᡠåiJ\ḄGHᙠJè☢Ḅéêäëᨵᡠ⌨ᓄ஺!WDMḄîïᩭðᨵñ஺n89Qbusdriver,òá89óᑴᘤஹ〉õᘤஹ᫑ᡈ÷øùᨵúᜓḄᜓûü஺89ý◤ḄÿMicrosoft
Ḅ᝞PCIஹPCMCIAUSB
ᨵ஺!"#ᑏᩭ&'Ḅ
(ᢝ*᝞VMEbusஹMultibusFuturebuson+,functiondriver-.⌕Ḅ0ᜓ*23&45Ḅ0ᜓ
6!78Ḅ9:஺+,-;◤Ḅ*◀>45Ḅ0ᜓ!"?9@ᵨᐸI/0!CDDEᩭFᡂ*᝞SCSIPassThru
஺᪷IJK*+,ᨬ6MNᱯJḄ0ᜓ*PQ2RR-S,TUVW0ᜓ4ᐵḄYZᘤḄ஺nDEfilterdriverᵨᩭ&N0ᜓᡈ]ᨵḄ^_`'Ḅ+,*ᡈὅbᦋᩭdᐸe0ᜓḄ1/0fgᡈ5hiiᵨᩭb⊡klm,
noḄpqrs◤gtuḄpq0ᜓ^஺DE-!⌱Ḅ*!"ᨵwxᦪz*!"{

50ᙠ+,~ᡈ~*!"{ᙠ~஺Ci*0ᜓᑴ⌼ᖪOEM^ᡈὅpq├ᖪIHV^
DE஺ᙠWDM᛻*0ᜓP*-ᵫᓫᩭᑴ2Ḅᡠᨵ☢ᔣPnP¤ᳮᘤ¦§ᐸḄ0ᜓ*P+,7¨W0ᜓ஺ᙠᜧªᦪ«¬*®¯ḄDEᦋ°0ᜓpqḄ±&஺²᝞*³0ᜓᔣᐸ¦§2◤⌕4I/O¶:*·2¸▭ᓾ◤⌕16I/O¶:*k½VW0ᜓ4ᐵḄ®¯+,DE!"¾¿ᔣPnP¤ᳮᘤ¦§Ḅpqrsᑡ⊤*Â'I/O¶:Ḅᦪz஺®ḄDECi&0ᜓ
l_Ãᱯឋ*᝞┐ÆÇḄ®DE!"Èᑴ`ÉᐰËÌ஺ᐵÍᜐᳮÏᙠ3ÑMÒ஺ᨵᐵI/O¤ᳮᘤஹWDMஹᓽÔᓽᵨᵯs⌱⚗Ḅ×ØÙÚ*fÛὃ9Ñ஺¸ÞÌß]ÉàḄ0ᜓ♦ICDá±Msinfo32,èé!"ᑡêëì]ÉàḄ:ᙠ“ïStart^”õᓫ*⌱ö“á±Run^”*ᯠúûᐭ“Msinfo32”ýþ*ᡭ“”᪛“᛻”⌱“”஺☢ᐸ!"#$%&'ḄḄᑡ⊤+,-.!"/0⊤12Ḅ3ᜓᑡ⊤ஹ67Ḅ89:;67Ḅ<᝱>?ᙠABᡈὅ%EFGH஺3ᜓIWindowsQRSTᙠUᙢWX12Ḅ+HKLM\SYSTEM\CurrentControlSet\ServiceSoᯠl67mn89oṹᩭrᑖḄ——᝞891ᢣᑁ᪶z{Ḅ3ᜓ>ᙠ/0⊤|}Ḅᨵᐵ3ᜓḄ᦮ᑡ⊤⊤4.7H஺᜜W,:ᑭᵨDriversᵨᐹ>Drivers,exe,ᙠWindows2000ᐹHᡈὅPstatᵨᐹ>Pstat.exe,ᙠWindowsXPᢝᐹஹWindowsServer2003ᢝᐹஹWindows2000ᐹ:;PlatformSDKᙳᒹ¥",ᐹHᑡ¦#$%E§¨Ḅ3ᜓ஺☢DriversᵨᐹḄ©ᑖª¦+

51C:\>driversModuleNameCodeDataBssPagedInitLinkDatentoskrnl.exe429184968960775360138880TueDec0718:41:111999hal.dll25856601601616010240TueNov0220:14:221999BOOTVID.DLL5664246400320WedNov0320:24:331999ACPI,sys9209689600434884448WedNov1020:06:041999WMILIB.SYS512001152192SatSep2514:36:471999pci.sys1270415360312644608WedOct2719:11:081999isapnp.sys143688320229442048SatOct0216:00:351999compbatt,sys24960028801216FriOct2218:32:491999BATTC.SYS800002976704SunOct1019:45:371999intelide.sys17603200128ThuOct2819:20:031999PCIIDEX.SYS45444800109441632WedOct2719:02:191999pcmcia.sys3280088640236806240FriOct2919:20:081999ftdisk.sys4640320950723392MonNov2214:36:2319

5299Total436336058032003251424432992«%X§¨Ḅᑁ᪶z{¬NtoskrnhHAL:;3ᜓHTXᑡ¦ᩭ"ᐸᒹ®«᧜°ᔜr²Ḅᜧ´஺Pstatᵨᐹ:!%X§¨Ḅᑡ⊤µ⌕·6!"Sᑡ⊤I«SḄ¸¹º»!ᑡ⊤஺ᨵ¼⌕Ḅ½ᨵPstaI»¾!Driversᐹ¿Àᨵ!¦ᩭÁ«zᙽᙠÄÅḄ§¨ᙢᙬ஺?᝞ᡃ7ȺÉ⌕ÊËḄÁ᪵Í"É?ᙠABḄ¸᧜Îᑮ67ᡠᙠḄ3ᜓѧ¨ᙢᙬÒ◤Ḅ஺ÔÔÕÖᦻ᫏ᓄḄÚ.ᙠᐵÛḄ᧜°ÜÔÁÝÞ¦ßàᡈᐰâßàḄãäᡈåæçᨵèéḄ:ê“Windows¾ëìÝíî᪵Ḅïð”:;“ñᜩÁÝ%Xᦻ᫏ᓄ¿óô"õöᢝḄᢈø”ᨵᜧùḄᭆû஺#ᯠüüýÍþ⍝
ᦪḄᕡḼᡈὅᵨ
ᦪ——ᦻ᫏ᓄ!ᨵ#ᓄ஺ᡃ&Ḅ'()*+),-Windows᡻/Ḅᑁ12ᨵᡠ45678
ᦪ9:),;<=>?@ᢝḄ஺B᝞78Ntdll.dllDḄᦪᑡ⊤GHᑮWindows,ᵨᡝK?LMNDLLOPḄᡠᨵMNQRST-UVWLMNX☄ZᩭḄL\஺]^
ᦪDᨵ_`abᙢ᧜eᑮᦻ᫏Dfgh@ᢝḄWindowsᦪij)ᨵkWᦪlᨵm

53ᡭ27²?ᓽᑁ1Ḅ)ᡈὅ᦮W¤¥☢¯vW0(°⊤7¸᩹ᓽºᨵḄ)ᩭ᪗¼ᑁ1ᦪ஺B᝞½°⊤ᑁ1ᑁ᪶ᦪ9aS0ᢣᑁ1¿@ᢝᦪ஺⊤2.7~ᵨḄ¤¥¤¥¡CcÂÃÄÅ^ᳮᘤ(Cachemanager)CmÏÐ^ᳮᘤ(Configurationmanager)Ex᡻/@ᢝB(Executivesupportroutines)ᦻMNÞ/ß(Filesystemdriverrun-timeFsRtllibrary)Halåæçè(Hardwareabstractionlayer)IoI/O^ᳮᘤ(I/Omanager)Keᑁ᪶(Kernel)Lpcîᙢ<ᵨ(Localprocedurecall)Lsaîᙢïᐰ4ñ(LocalSecurityAuthority)MmᑁÅ^ᳮᘤ(Memorymanager)WindowsMNQR(¢ᜧ`ᦪyZ,Windowsᦪ)(WindowsNtsystemservices)Ob-ç^ᳮᘤ(Objectmanager)Poᵯú^ᳮᘤ(Powermanager)PpPnP^ᳮᘤ(PnPmanager)Ps¿@ᢝ(Processsupport)RtlÞ/ß(Run-timelibrary)Seïᐰឋ(Security)WmiWindows^ᳮü(WindowsManagementInstrumentation)NtÿᜮḄᐭḄᐜḄᑁ᪶◀ᦪḄᨵᦔឋ#$%&'NtZw*ᨵ+ᩭḄᵨᡝ/012ᦪ#$᝞45ᳮ7Windows9&Ḅ:;<>?@AB᧕ᙢEFGHIJᦪḄ;K7᪆Iᩭ஺NOḄPQRீTU>

54ᙠFP]“TU”`ᑖQHIb9&Ḅᑁ`cde“XY”`ᑖfgᙠZ[ᡈὅjklmnopYe“Z[”`ᑖ᪗rQᙠnol12XYḄ஺9᝞ExAllocatePoolWithTagQNstuᣚ⚓Ḅᡈὅxᣚ⚓Ḅyz12ᑁ{ᑖ|Ḅ᡻2~ᢝ9&஺஻/஻6஺6@"ᑣQᑖ|ᑁ᪶&Z[Ḅ9&஺1&@Ḅ1&IᙠNsWindows](ᐸ]s——1&System1&——¤Q¥᦮Ḅ1&'§¤Qᙠ¨2•sᵨᡝḄ?᡻2ᦻd)Rn(Idle)1&(sCPUNs&ᓰᵨḄCPU/²)enSystem1&(ᒹ´ᜧ¶ᦪᑁ᪶&)en·¸ᳮᘤ(Smss.exe)enWindows¼(Csrss.exe)en¾¿1&(Winlogon.exe)enÁᑴ¸ᳮᘤ(Services.exe)ÅḄ¼1&(Æ᝞ÇÈḄÉᵨÊË1&Svchost.exe)enÍᙢÎᐰÐÑᘤ(Lsass.exe)஺_ᳮ7FG1&ḄÕ»×Ḅ1Ø'᪛"ᐢAÜÝḄÞ>Qf1&ß²Q᱄/¼ᐵ஺âNâãs1&Åᐸäãs1&EᨵÝåᳮ7s1&QãzᩭḄ஺æ2.6Ḅèéêæë×`ᑖ1&᪛ᐸ]T☢íᦪîs1&ᨵïðḄñò(comment)஺(ProcessExplorerᐕö5s1&÷lNᩩñòᯠú@?⌱Ḅüë×ᙠèélYý]ḄNᑡ஺)æ2.6ÿḄ᪛

55Ḅᑖ2.6Ḅᐵ஺ᑖ⌕ᙢ"#$%&Ḅ'()*+),5./01ᙢ2ᙠWindows;<=%&>?@ḄAB஺CD2.6ᑡFḄ,GH+CD஺I᝞ᡃLᙠ,6.MNḄO᪵)+ᵫRLḄ᧜TᦻVWᩭ᪗ZḄ஺ᯠ\)H]^@W_SystemḄefgᨵijGHk▭Ḅᵨᡝop᧜TᦻV]qr+")ᙠ\WindowstugᨵW_"SystemIdleProcess.exewḄᦻVe஺\})ᙠ~Ḅᐹ)ḄW+~Ḅ]ᵫk1⁚Ḅe஺⊤2.8ᑡF$CDḄGW]ID_0e஺,6.01$CD஺⊤2.8ID_0ᙠᔜᐹḄWkᵨᐹID_0ḄWᳮᘤSystemIdleProcessProcessViewerIdle(Pviewer.exe)ProcessStatusIdleProcess(Pstat.exe)ProcessExplodeSystemProcess(Pview.exe)TaskList(Tlist.exe)SystemProcessQuickSlice(Qslice.exe)SystemprocessᙠᡃLᩭ¡G¡¢)^@£GH¤Iij᧜TᦻVḄḄᵨ⌶஺¦=DPC᪗Z_“Interrupts]¦e”=“DPCs”Ḅªj«⊤$ᵨ¦=¬>®ᵨḄ¯°஺,3./MNª²ᑴ஺´µ¶)·ᯠᙠProcessExplorer,RL¹ᙠᑡ⊤)*RLf~+஺RLºᡠ^¹ᙠ¼)+_RLᡠ½ὑḄCPU¯°fgᨵÀÁᙠÂGH]Ã᝞)ÄGHÅᵨᨵᜧÇḄ¦,ᑣR~/¹ᡂGHʽὑCPU¯°Ḅe஺µ¶)ᳮᘤ¦=DPC¯°

56ᒹÌᙠCD¯°஺Í)᝞ÎÏᵨᳮᘤḄÐ)OÑTᐹᨵᜧǦḄÅᵨ¡ÒᩭÓÔ+CDḄ஺System=¢System(ᙠWindows2000,_ID8ÕᙠWindowsXP=WindowsServer2003ᑣ+ID4)+ᱯÙ¢ḄÚÛ)ᱯÙ¢ÜÝᙠᑁ᪶opij,_ᑁ᪶op¢(kernel-modesystemthread)஺¢ᐹᜓáâᵨᡝop¢Ḅᡠᨵãឋ=å᛻(ç᝞èVå᛻ஹêᐜì)íí))*+~Ḅᙢîᙠ)RLÜᙠᑁ᪶opijC°ïðḄ«ṹ)òó«ṹ+ᙠNtoskrnl.exe)õ+ᙠÂᐸ÷ïðᩭḄøᜓù&(஺\})¢gᨵGHᵨᡝᙢᙬC°,Í)ÂḄ&᝱üýC°)RLþÿ
Ḅᑁᚮᑖ᝞
ᣚ⚓Ḅᡈὅᣚ⚓Ḅᑖ஺a"read$ᦪ(DDKᨵᦻ᫏,-)ᩭ01Ḅ2$ᦪ34
ᑁ᪶678ᵨ஺Windows@AᔜCDᜓFGHᙠJKᓄ▤N01@O᡻QᔜC⌕ST᛻Ḅ᝞VWXYZI/Oᡈᐸ_`aᡈὅ⌱c(poll)Dᜓ஺g᝞ᑁhᳮᘤkᵨᩭlmn᝞“pq⚓☢ᑏᑮ⚓☢ᦻuᡈὅ᧜wᦻu”ஹ“pzᙠᑁᣚzᣚW”{|Ḅ}4஺ᑁ᪶~01⊝hᳮᘤ(balancesetmanager)Ḅᖔ⏨
ᨵ4VWᔜC8XᑁhᳮᐵḄu஺hᳮᘤkᵨᩭlm“⚜(read-ahead)”X“ᑏ(write-behind)”1/0஺ᦻu¢£ᘤDᜓFGH(Srv.sys)ᑭᵨᩭ©ª«¬®ᐳ°(ᓽ²³ᑖ´µᐳ°ᑮ®µḄᦻuᦪ¶)ᨵᐵḄ®1/0·S஺¸¹º³FGHᨵᩭ⌱cº³Dᜓ(ᙠ»C¼½¾⌱c¿ÀᨵᦔÂ☠ÄFGḄº³FGH⌕ÅὑᜧÈḄÉÊ)஺ᨵᐵᱯÌḄzÍÎÏᒹÑᙠÒÓªÔuḄÕ⁚஺ᙠ×ؼ½¾ÙÚSystemzḄÜDᜓFGH@ᙠÝÞḄz01஺g᝞WindowsßDᜓFGH(Win32k.sys)ᙠWindowsßz(Csrss.exe)01»¬@åæ᧕ᙢéê2zᵨᡝ67ᙢᙬíîḄᦪ¶஺ïðᙠñÄᡈὅòóḄô᎛ö4÷pᓫùḄḄ᡻Q᧜wᑮFGH¸¹᧜wᑮᒹÑ2úṹḄßgᑣÌýᨵᵨ஺g᝞ᙠþÿ
ḄᦻᘤSystemᨵὑᣵḄCPU஺"#$$%⍝“Systemᙠ)*Ḅ᎛'-./012'3ᙠ)*"#56789:/;ᜓ=>?ᡈὅBC01D3ᙠ)*Ḅ஺ᡠ7᝞GSystemHḄ23ᙠ)*ḄI✌ᐜ⌕89:M23ᙠ)*(O᝞PQឋSᐹ)஺.VWXᑮZ[3ᙠ)*Ḅ./ᡈὅ\/2]7^_.`a012#ᙠ:/=>?Hbc᡻*Ḅ(ef7ghW#:/=>?ijZk/2)ᡈὅl^.`ᡠmnḄ2Ḅoᵨ᪘(callstack),PQoᵨ᪘7%⍝a2[3ᙠ:x᡻*஺

57`☢Ḅz/{|}~Zkz⚗ᢈ஺I”{|᪗SystemHḄ012W7_•ᑮSystemᑁḄ2•9#ᑁ᪶Ḅ012/2Ḅ>ᙢᙬᜧ01Ḅbcᙢᙬ0x80000000bc◀01¡¢ᙠBoot,iniHᵨZ/3GBbᐵ«஺¬᝞GW_._kM2ḄCPUW®_ᑮkM2¯°±ᩭḄCPU#ᙠᑁ᪶³)*Ḅ஺ZX#:/=>?ijZ-/012´l^.`a2Ḅ>ᙢᙬW7ᵨPviewer.exeᩭ¹~º»¼«஺ᯠ¾^X:/=>?Ḅ¿ᙢᙬÀa2Ḅ>ᙢᙬᨬÂÃ"#ÄaᙢᙬḄ[☢«஺Pstat{ᵨSᐹᐸÆḄÇÈ«Éᑁ᪶oÊᘤËÌ/Urs7ᑡ/ÎÏÐÑḄ;ᜓ=>?Ḅ¿ᙢᙬ஺ZÒᙢXᑮ./2Ḅ[ᙢᙬ´ᙠᑁ᪶oÊᘤHÓᵨTs3Ms஺ËÌ஺`☢#./{▭Ḅ01HÆḄ᪵OÓᵨZLiveKd«kd>!stacks0Proc.ThreadThreadThreadStateBlocker[System]8.0000048146edb0BLOCKEDntoskrnl!MmZeroPageThread+0x5f8.00000c8146e730BLOCKED??Kernelstacknotresident??8.0000108146e4b0BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000148146d030BLOCKED??Kernelstacknotresident??8.0000188146ddb0BLOCKEDntoskrnl!ExpWorkerThread+0x738.00001c8146db30BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000208146d8b0BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000248146d630BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000288146d3b0BLOCKEDntoskrnl!ExpWorkerThread+0x73

588.00002c8146c030BLOCKEDntoskrnl!ExpWorkerThread+0x738.0000308146cdb0BLOCKEDntoskrnl!ExpWorkerThreadBa1anceManager+0x558.0000348146b470BLOCKEDntoskrnl!MiDereferenceSegmentThread+0x448.0000388146blf0BLOCKEDntoskrnl!MiModifiedPageWriterWorker+0x318.00003c8146a030BLOCKEDntoskrnl!KeBalanceSetManager+0x7e8.0000408146adb0BLOCKEDntoskrnl!KeSwapProcess0rStack+0x248.0000448146a5boBLOCKEDntoskrnl!FsRt1WorkerThread+0x338.0000488146a330BLOCKEDntoskrnl!FsRtlWorkerThread+0x338.00004c81461030BLOCKEDACPI!ACPIWorker+0x468.0000508143a770BLOCKEDntoskrnl!MiMappedPageWriter+0x4d8.00005481439730BLOCKEDdmio!voliod_loop+0x3998.00005881436c90BLOCKEDNDIS!ndisWorkerThread+0x228.00005c813d9170BLOCKED1tmdmntt!WakeupTimerThread+0x278.000060813d8030BLOCKED1tmdmntt!WriteRegistryThread+Oxlc8.0000708139c850BLOCKEDraspptp!MainPassiveLevelThread+0x788.0000748139c5d0BLOCKEDraspptp!PacketWorkingThread+OxcO8.00006c81384030BLOCKEDrasacd!AcdNotificationRequestThread+0xd88.00008081333330BLOCKEDrdbss!RxpWorkerThreadDispatcher+0x6f8.000084813330b0BLOCKEDrdbss!RxSpinUpRequestsDispatcher+0x588.00008c81321db0BLOCKED??Kernelstacknotresident??8.00015c81205570BLOCKEDIN0_FLTR+0x68bd8.00016081204570BLOCKEDIN0_FLTR+0x80e98.000178811fcdb0BLOCKEDirda!RxThread+Oxfa8.0002d0811694F0BLOCKED??Kernelstacknotresident??

598.0002d481168030BLOCKED??Kernelstacknotresident??8.000404811002b0BLOCKEDrdbss!RxpWorkerThreadDispatcher+0x6f8.000430810f4990READYparallelIParallelThread+0x3e8.00069c80993030READYrdbss!RxpWorkerThreadDispatcher+0x6fõ.ᑡ#IDÉ2IDᢥ᯿ø“ID.2ID”¹~«஺õùᑡ#2Ḅ[ᙢᙬ஺õúᑡ⊤üZa2#ᜐþÿwait᝱ஹready᝱running᝱6ᐵ᝱Ḅ"#஺ᨬ&'ᑡ)Ḅ᪘+ᨬ⚔-Ḅᙢᙬ஺0ᨬ&'ᑡḄ123456ᡃ89:᧕<=>?ᙠA?BCD+EFCGᩭḄ஺INtoskrnl+ḄOᦪḄQRS'TᢣVW)XᙠYZ[஺ᯠ]᝞_XᙠḄ'?`abcExpWorkerThread,k[lmᯠno⍝)ᙠYZ[qrst'?uᜓBCDw34xyz{|}'?`abc஺q~bcrḄ'ᙠExQueueWorkltem+u'?஺lᑮ)Ḅ᎛ᐭ!dsowork_queue_itemesp+4஺)x'?ᢣᔣExQueueWorkltem'?yzᑡ᪀ᐸ+ᒹ£Wᙠbc¤᛻+E¦ᵨḄbc¨Ḅᙢᙬ஺~᜜lᙠᑁ᪶¦¬ᘤ+ᑭᵨ᝕)°±²Ḅ¦ᵨ᪘34<ᑮ¦ᵨὅ஺²Ḅ¦ᵨ᪘x°±=A?BCDx´µḄyz᣸ᐭᑡ+·6ᑮW~bc¸I¹bc+E¦ᵨḄ¨]º஺2¼½x`a᧜¿ᑮ'?uᜓBCD-ᙠ0?¼+ᡃ8<ᑮ᝞txSystemS+ḄCPUÄC᧜¿ᑮÅÆ)ÄCḄ¸ÇḄ`a-4ÈᡠᙠḄBCD஺09Ê⌕qrSystemSXᙠḄ᎛lÌÍᙠÎÏ-ÐÑÒXᳮÔ²XᙠÕÆḄÖ×஺ᙠ0?¼+ᡃ8xᙠlḄØᘤ-ÅÆᦻÚÛÜᘤḄÄC4~ᩭÆᡂ`aḄÄC஺ᦻÚÛÜᘤBCDSrv.sys,àá'â`aᩭᜐᳮᡠäᑮḄ┐IᦻÚ1/0Ḅé஺ᨵᐵ)ëÚḄìí12ὃ13஺1.ᡭñ'?{±òó஺

602.ôõ•?÷øùúᩭûülḄCBCᘤᑡ=lḄ᦮?CBCᘤḄᡠᨵþÿ஺
᝞᝞ḄCOMPUTER1,ᑣᐭ"dir\\computerl\c$/s”,/s-ᐵᑡ0ᡠᨵḄ3456஺3.9:ProcessExplorer,ᵨ=᪗ᙠSystemBCDEF஺4.GFThreads᪗J஺5,ᢥ᯿"CSwitchDelta,contextswitchdelta,Q᛻ᑗᣚUV6”ᑡ᣸X஺YZ[ᑮᙠSrv.sys^ᨵ_`ᡈὅc`dCeᙠ9:᝞fgᡠhi᝞[ᑮ`jkdCeᙠ9:lmnopYḄqrCXs`tuvᢥfModuleᢥwxyz{0ᦻ}~ឋp᪾஺᝞Dgt᪵Srv.sys^ḄdC⌱^Ḅ᎛ᢥfModuleᢥwzᑮf☢Ḅh஺

61zᳮᘤzᳮᘤ,\Windows\System32\Smss.exe-jk^_`ḄᵨᡝBC஺ᡂ᡻:ᑁ᪶ᓄ¢£Ḅᑁ᪶jkdCᙠᨬ¥▤§¨©▭ḄSmssBC஺ᙠ«rWindowsḄ¬C^zᳮᘤc®⌕Ḅ°±²᝞ᡭ-´᜜Ḅ⚓☢ᦻ}ஹ᡻:¸¹Ḅᦻ}ᦋᑤ◀½£ஹjkQ᛻¾V஺¿Ày3jkBC,ÁÂÃᨵCsrss.exe-WinlogonBC«rÄᩭWinlogonBCÆÇzᐸÉḄjkBC஺ᙠÊË⊤ḄHKLM\SYSTEM\CurrentControlSet\Control\SessionManagerf☢ÍÎÏᑮcÐÑÒÓ¿Ôqr¨SmssḄᓄ°±஺ᐸ^ᨵÕÒÓᙠ5Ö×ØSmssḄ᎛yzB_°ÙÚ,ᨵᐵxÕÊË⊤ÛÜḄÝÞßàváὃWindows2000ãä¢ᐹæ^ḄÊË⊤ᩩ4èéᦻ}Regentry,chm-஺Smss^ḄêdCᙠ᡻:¨xÕᓄ°±Î¥_ëᙠCsrssWinlogonḄBCìíDîï஺᝞xð`BC^Ḅñò_`óeÂôõ¨ᑣSmssöjk÷øᣵ,÷øḄúṹSTATUS.SYSTEMPROCESSTERMINATEDᡈ0xC000021A-,üýWindows⌕Æþÿ
Ḅᙠ஺

62SmssḄஹ!"#$%&Ḅ'()*ᘤ,-,terminalserversessions-Ḅ.ᐵ0'()*Ḅ1234516Ḅ“'()*#8,-”:⁚<஺'()*,-,TerminalServicessession-Ḅ$%=ᵫSmssᩭ@ᡂḄ஺BSmssCᑮ:$%,-ḄE✌ᐜᵨNtSetSystemlnformation,%Iᑁ᪶LMḄ,-ᦪOP᪀஺RSTᵨᑁUḄᑁVᳮᘤXᦪMmSessionCreate,YXᦪ%IZ,-[\ᙢᙬ_`Yᙢᙬ_`aᒹc,-aḄᣚ⚓ᑁf"#ᵫWin32Ḅᑁ᪶LMUᑖ,Win32k.sys-hᐸjḄ,-_`kᜓmnoᡠᑖqḄஹr0s,-ḄᦪOP᪀.t8Ḅu⁚3ὃ576<஺ᯠxSmssyY,-$%WinlogonhCsrssḄz{஺WinlogonஹLSASShUserinitWindows|},\Windows\System32\Winlogon.exe-ᜐᳮMᵨᡝḄ|}h├஺Bᐰoᑡ,SAS,SecureAttentionSequence-ᔠᢥḄ᎛Winlogon,Cᑮ-:ᵨᡝ|}஺ᙠWindowsḄSAS=ᔠCtrl+Alt+Del஺ᵨSASḄ=yᵨᡝL\|}Ḅ¡oyᵨᡝLM¢ᵨo£¤¥¦:§oᑡ஺|}Ḅ¨©ª«h¬=ᙠ:yGINA,GraphicalIdentificationandAuthentication,®¯ª«h¬<Ḅ¤°ᣚḄDLLaz±Ḅ஺᪗³ḄWindowsGINA,ᓽMsgina.dll,z±ḄWindows|}µ☢஺ᯠ·¸¹ºᕒ¤"¼½j¾¿ÀḄGINADLLᩭz±ᐸjḄ¨©ª«h¬Áᑴ---Ã᝞Å0ÆÇÈ,voiceprint-ḄÉÊ——"°ᣚWindows᪗³Ḅᵨᡝ/ÉÊ஺·ÍWinlogon¤"◤⌕᡻ÑÒ¬Ḅ▬ÔÕ¼½ὅDLL஺×Ø8ÔÕ¼½ὅ¤"ᙠÙÚḄ|}a:TÛÜᑮᡠᨵḄ¨©ª«h¬Þß஺:àᵨᡝháâᣓᣍᑮ¤"åE¾〈ᑮçᙢᐰ¬)*ᘤ,\Windows\System32\Lsass.exe,586aèé<¬஺LSASSᵨ〉BḄ¬ᒹ.z±yDLLḄ¯M<"᡻z▭Ḅì¬íîÃ᝞ïðY=ᔲòᔠóᙠônõ}ᡈὅSAM.r0÷⊤Ḅ:Uᑖᐸaᒹcᐵ0ᵨᡝhḄùú

63ᯠUseinit⌨?஺&o:pqrExplorer.exeᙠ$%᪛!{ᨵ᱄$%Ḅ~

Ḅ᱄$%⌨?`o᝞☢ᡠḄtlistᡠᨵ᱄$%ᙠLDḄ$%᦮ᑮᨬ'&
Ḅ
:Explorer:WinlogonḄ$%*஺WinlogonᵨᡝMN/├Ḅ᎛:Ḅ`¡¢£¤¥ᑮ2¦ḄSAS©:Ḅ஺ª᝞,¬MN$ᩭ,ᢥ4©:lt+Del,ᑣWindowsᐰ᪾µ?Z¶“/├”ஹ“¹º»¼ᳮᘤ”ஹ“┝ÀHIÁ”ஹ“ᐵÃab”Ä⌱⚗஺Winlogon:ÇÈᜐᳮ&)ÊËHIḄ$%஺ᐵÌMN\%!ᔜÎÏḄÐ᦮ÑÒÓÔὃÖ5ØḄ“SmssஹCsrssWinlogon”
⁚஺ᨵᐵᐰ9ÜḄÝ@Þ⁚ÓÔὃÖ8Ø஺ᐵÌᙠàLSASSÊË<ᵨâᦪ'=LsaäᜮḄâᦪ*ḄÞ⁚ÓÔὃPlatformSDK!Ḅᦻ᫏஺ë»ìᑴ¼ᳮᘤîïPØ☢Zᑮ\ḄWindows!Ḅ“ë»'services*”ò<=ᢣ
ë»ᘤ$%©<=ᢣ
ôᜓö%g஺&⁚÷Ḅë»:ᢣᵨᡝøùḄ$%஺뻵BUNIXḄ“ýþ$%'daemonprocess*”ᡈὅVMSḄ“ᑖdetachedprocess”,ᡂᙠ"#$%&᎛()*)+ᩭ-./◤123Ḅ456஺89:ᡂ;<*)=᝞,?6@AServicesDᳮ<ᐹ,ᡈὅIᵨWindowsḄStarZSerMceOᦪ஺ᙠ?QRST-UVWXY45ᵨᡝA12-[Dᙠᨵᱯ^Ḅᩩ`TaḄbὃd4f஺UVgᑴDᳮᘤajkᱯ^Ḅ"#,8@AḄ᧜mᦻ`a\Windows\System32\Services.exe,8vw*)ஹyzUV-:vwYUVA12•ᡠ}UV~-▭aIᵨjᱯ^WindowsOᦪḄWindows᧜m஺89?6ᱯ^ḄWindowsOᦪ-YUVgᑴDᳮᘤA12-᡻A᝞Ḅ)jkUVḄᡂ*)ஹ᝱Ḅ-ᨚyᡈyzjkUV஺ᙠ⊤ḄHKLM\SYSTEM\CurrentControlSet'ServicesT£¤jk"#ḄUV஺¥¦<ᐹ§ḄRegistryEntriesª«ᦻ`Regentry,chm¬┐"#UVḄ¯°±²஺¬³-UVᨵ´µ¶·¸ᙠ"#¹ºᑮḄ¼ᙠ@AḄ¶ஹ⊤¹Ḅᑁ¾¶·-ᙠServicesDᳮ<ᐹ¹¿ÀḄÁ¶WXaᡠᨵḄUVÃᨵÁ¶——᝞ÅjkUVÆᨵÁ¶ḄÇ-ᑣÁÂᑁ¾¶·஺UVÉᨵjkÊËÌdescriptionfield,jÎÏÐÑÒkUVḄ஺⌕ÔÕjkUV᧜Öᑮ×ᡠᒹÙḄUV-Úᵨtlist/sÛÜ஺Ý-ᙠUV±ᡠ@AḄUVÞßWXàajjḄ-áâᨵḄUVYᐸäḄUVᐳæjk஺ᙠ⊤¹-jkUVḄçèṹᢣë×UVa@A8(ìḄ-ÉaYíj᧜m¹ḄᐸäUVᐳæjk஺ᨵîïWindowsð`aUVḄñ3ᩭòḄ-=᝞SpoolerᎷῃõஹö`÷øஹùVIúᘤ-ᔜµüýð`஺

64þᑡ
Ḅ[.ᑡ
ᡠḄ,ᑴ☢⌱“ᳮᐹ(AdministrativeTools)”,ᯠ2⌱“(Services)“஺6789:ᑮ᝞=ᡠ>Ḅ?@a三二三至?一:。■一二丁F二三三一=三毛F左™1二三1至t=三三1=三=三二二三i⌕I:ᑮᨵᐵLMḄNOPឋRᙠTMUVWXYᯠ2⌱‘'Pឋ(Properties)”஺^᝞=☢_ᡭᓺᎷῃd(PrintSpooler)(ᙠULMefghij>)ḄPឋ@

65kl“m᡻oᦻqḄrstPathToExecutablezw|ᢣ~ᒹTMḄ஺ᨵḄᐸḄᐳLM——ᑮḄ᧜ᐵ_LL7Ḅ஺@ᑁḄᨵᐵḄO⁚■'ProcessExplorermhij>ᒹLMᡈὅ¢MḄt6£◤ᙠOptions¦ᓫ⌱"ConfigureHighlightingḄ⚗®¯m°±ᡂT᪵z஺᝞´6ᙠLMᒹḄUµY¶᪗6¸9:ᑮᨵLMServices¹eᐸᑡ8ᑁḄ@º»8Ḅk¼⊤WḄ¾¿ஹᳮᕒm:ÂÃḄj>¾ÄÅÆ8ḄᦻÇÈÉt᝞´ᨵḄÊz஺^᝞ᙠWindowsXPULMÍoᙠSystemÏÐ=ḄSvchost.exeᡠᒹḄ᝞=@ᨵᐵḄÑ¢O⁚RÒÃÓ4Õ஺2.5ÇÕØ

66ᙠÇÕᡃÚᭆÜᙢ::WindowsḄÞØ᪀஺ᡃÚWindowsḄᐵWàq:ᑮáÚ_᝞âãäᐵὶæᩭḄ஺ᙠ=LÕᡃÚ¸ÑhNOᙢ:L:TàqᡠèéêæᩭḄ᪶ìdᑴí᝞îᳮᘤ(objectmanager)ñòdᑴ(synchronization)஺ôõöL÷Windowsᵨᡝúûüýþ¾ÿ℉Ḅ“(bluescreenofdeath)”,ᨵḄᔊ"஺$%&ἝḄ()*ᢣ,MicrosoftWindows12ᡈ45᡻7(ᵫ9:;ឋḄ┯>ᡈὅᑁAᩩCD5EFGHI7JK)LᡠNOḄ⁐Q஺ᙠSTUVᡃXYZ[\]^_Windows12Ḅ`Sa⚪Vcd%JᙠeNOḄfgVhLYijᔜlᵨ9no12pq(crashdump)Ḅrs⌱⚗஺$vḄ12pq*ᢣᙠEF12LwḄEFᑁxḄyzV{|}~*C$EF12஺᣸$•AᑖᑁḄ&*ᨵᐵ᝞ᑖ᪆%WindowsEF12Ḅfg஺STYᔣO᝞ᑖ᪆%12pqᩭ%┯>Ḅ¡¢£¤ᡈὅC஺¥᡻7`SḄ12pqᑖ᪆¦◤⌕©Ḅª«*¬®ḄV¯◤⌕°ᑖ±²³஺ᓽµ¶5ᡈ1012pqU¯ᨵ%º"12pqᑖ᪆»¼½ᑮᨵa⚪Ḅ¡¢£¤V$lᑖ᪆¿ᯠ*ÁÂK©ḄÃ%ᡂÅḄᑖ᪆|}ÆÇYᩭḄᦪÉÊᜫஹEFÍÎÏᵨᜫÐ஺14.1Windows¥ÓÔÕ12Windows12(45᡻7NO)ᨵ}J%]Ö×஺nI7ᙠᑁ᪶ÙÚJḄÛᜓ¡¢£¤ᡈὅÝ«EFÞᦪ^ßàáᜐᳮḄäVå᝞ᑁxæaçè(ᵫ9éᑏ%¯ë⚓☢ᡈὅéë%,îàá᧜ðñצ&*%ᨵᦔᑁxósôḄᙢᙬ¦^_)஺n÷ᵨ%ᑁ᪶øᢝè£V%úû÷üVå᝞,Uýþÿ(IRQL)DPC/Dispatchᡈᜐ!᝱Ḅᑖ%ᘤ'((ᐵIRQLḄ*⁚,-./032)஺

67nᙠDPC/DispatchᡈḄIRQL7ᙠ“ᵫ⚓☢ᦻ=ᡈᑁ?᧜Aᦻ=BḄᦪDᩭFᥛḄᑁ?”I%JK⚓⊈┯NOPQ⌕Sᑁ?TᳮᘤVWI/OYZ%J7[\᝞I☢^^ᡠ`Ḅ7ᙠDPC/DispatchᡈIabcde,fgQ⌕Shijklm஺n-oᜓqrstᡈYZuvwᦪxyᙢ{uv|}O~kᵨuvwᦪckExy»fᑮᑁᩩ=⊤KᦪDẚ7ᡈὅ⊤KᐸḄᙠaᑈ◅ẚᦪDḄuv᡻e஺n%J=┯N7᝞ᘤOmachinecheckmᡈὅa£¤¥B¦ONMIm<.'WindowsXPᵨᡝ±²³MicrosoftOCAOMicrosoftOnlineCrashAnalysis,ᙠ¹|}ᑖ᪆7»2¼☢Q½¾¿mWebÁÂḄ|}ÃÄ7MicrosoftḄᑖ᪆⊤K|}ÅfḄᑖÆ᝞Ç14.1ᡠÊOPËxÊḄᦪDÌ2004Ï4ᨴÑJᡂḄm஺Ç14.1±²³0CAḄ|}ḄÅfᑖÆÓᑁ᪶ÕyoᜓqrstᡈὅÖuv×%ØḄÙÚ7Windows☢ÛḼÝÞḄᢑà஺á7ᑮKᙠYZuvB7ᨵbãäåæç=oᜓèæçᨵᦔᑁ?ḄuvêṹᑖìKíaîïìḄð஺[Ì7ñòPóᕡḼWindowsVW|}ᕖöÞ⍝øabcùᶍïÙÚ7ûoᜓqrstᡈὅÖuvü᡻e7øýþñòÿᨵᔩ┯◞ᩭḄឋᙠḄᩭ!ឮ#ᩭḄឋ$ᙠḄ஺&'ᨵḄ()ᑮḄ+,ᩭ-.'/0Ḅ1⚪——4᝞ᵫ.ᑁḄ,8ẚ:;generalcorruptionI,ᡈὅᵫ.MNᜓPQ,RS஺ᐕUVWXYZ[\]^_'`Ḅ+,abᙠcdᡈᐸf᜜NhḄᦪj$klmẚ:n᪵p_Ḅq◅stu஺

6814.2z{P|VW}~ḄQ᡻[}~Ḅᦪ/gGec4&;WindowsDDKhᨵᦻ᫏I஺ᦪmṹstopcode,ᨵ᎛$┯(ṹ᝞gMeckcode>,¡¢᪷jṹᩭ¤¥Ḅ¦ᦪ஺4eḄ§¨¡¡{©uVWḄᡠᨵᜐᳮᘤ®Ḅᡠᨵh¯¡°±²ᘤᑗᣚᑮµᑖ·᳛ḄVGA»¼½!;Windows¾ᢝḄᡠᨵÀ⚣ᓱÃÄÅun½!I\Æᑴ•z⁐ÊËᯠ°±²Íṹ°☢ÏЕÑᦻÒᩭÓÔᵨᡝ×ØÙ஺ᨬ°ÛMugbec$ÝᵨÞßàáâḄNᜓãäåæ┯(çÝᦪ;Ýᵨè%4ᦪᩭáâḄçÝᦪIêaëãäåæᨵìkíîḄNᜓ;ᨵVWᦪjï᪀àñẚ:òsóô¡õ.z{ñ²PᩭI஺»14.2±²uWindowsXPz{Ḅøù஺ঞáWindowsXPServicePack1þ'tḄ᱐
Wind஺wsServer2003ᐭKeRegisterBugCheckReasonCa11backVᦪ,ᐕᜓᙠ!"#$Ḅ&☢▬)*ᦪ,■
ᡈὅ0!"#$Ḅ12ᑏᑮᐸ6Ḅᜓ7஺»probl*Mlbt«ngOo^>(opr«v«ntteymrn>««R/n^rly2Zrv.WSnotatBorysuch4t«r3b44Mli4(.IfyounM4toJ
Mdd*t஺r«■<>»«3coaoor«Mt.r*ttar(>6஺COTputer.prnt••toStscbm/«ndthe*S4f«MM>».1r«c^e43Infamet!«**:…twO*MOM0M(»OU>44C«.9«M000ttC.«yfwH.tyv-A
7atrMVAMO.CMtwStaap489JX/S
nngAMP.MMOT/a—ar/totfltk:“:14.2>?Ḅ@ABa?e£vᙠ>?⚔GḄ▬HIJKLMṹḄᦻ⊤J
ᙠWindows2000>?Ḅ⚔G,SIJKLMṹᦪTUVᦪ
WX,ᙠWindowsXP[Windows2003>?\
]*ᦪT^IJᙠ>?_G஺

69`aᑡcd⌴fgᑗga?ecgḄKLMṹ[UVᦪ஺?i⚔G▬HḄᦻjklKLMṹᦪT᪗noḄᦻ⊤J஺᪷,:14.27Ḅ@A
KLMṹ0x000000D1XDRIVERIRQLNOTLESSOREQUAL!"஺qᐸ7VᦪᒹstuvwᡈᜓMṹḄᙢᙬz{᝞}:14.27IJḄ~᪵
WindowsIJclᙢᙬᡠᜐḄᙽḄᙢᙬஹᡙ
lᜓḄᦻ஺]*12ᨵ┯Ḅ஺ᯠᐳᨵ}ḄKLMṹ
WX
ᜧᦪMṹ¢£ᙠ¤¥vw\¦§{¨©Sᨵ஺ª«ᙢ
£ᦪ¬ḄKLMṹ⊤®ᜧᦪḄWindowsvw!"¯@஺°±
U▬)VᦪḄs²S³´µKLMṹ{¶XᡠᨵḄKLMṹ·ᨵ᡽¹ḄVᦪ12஺ᯠ°
ºKLMṹ[Vᦪ{᝞»〉ᵨḄ¾Ḅs²¿£ᨵÀÁcqÂÃᙠÄÅᜫÇḄ{ᡈὅ¦vw!"ḄÈᜓ஺ᙠWindowsÉÊËᐹÍWindowsDebuggingTools
ᦻḄ"BugChecksBlueScreens
”⁚7ÏᑮᐵµKLMṹḄ12{ᨵᐵWindowsÉÊËᐹÍḄ12
ÑV`1Ò஺SᙠMicrosoftḄᙠÓKnowledgeBasehttp:஻support.microsoft.coni7ÏÔKLMṹ[ᶧḄÈᡈÖᵨḄ×஺ØÏᑮᨵᐵ᝞ÙÚÛÜÝ⚪ஹ᝞ÙßàáḄ12
ᡈὅÏᑮᐵµâÃÜÝ⚪Ḅãä⊡æᒹservicepack
Ḅ12஺WindowsDDK7ḄBugcodes,hᒹs150çèKLMṹḄ•ê᦮ᑡ⊤
¶±fcᨵᐵÔ*KLMṹḄìíḄî᜜12஺ð¬XᙠñòàḄᤥᡈὅÈᜓ&óôõºᑮ>?Ḅ஺᝞»öö÷)
øùàú
ᯠ&ᙠvwûõᓄýḄþºᑮ>?
~ÿ
ᘤᙠᢥF8ᯠ⌱“LastKnownGoodConfigurationᨬḄ”஺⌱"ᨬḄ⌱⚗$Wind஺ws%&'⊤Ḅ)ᜓ+,-&'HKLM\SYSTEM\CurrentControlSet\Services
.ᨬ/0ᡂ234Ḅᙠ
567+,-89ឮ;•=>?஺.ᨬḄ@AᩭCDEᡂ2Ḅ34FᢣᡠᨵḄJKL+,-MNOPᡂ"QRSTUVᨵDEWXOᡂ2"Y5Z[Q\]ᙢ_`"ᨬḄ஺᝞b
cᯠCᑮefghDijk᧕mḄnoFᔂᣵᙠ
YDECᑮefr8ssQᐭḄguvw஺᝞b.
xEQᐭvwᩭDOy"Dz{ᡈὅ
~Qᐭ"gh
◤⌕%Dᦪ93ᵨᑮḄ)ᜓ+,-ḄXᩭ஺᝞b
u9ᨵḄ
ssQᐭḄvwᨵᐵὶ᝞᝞b
56"DḄSCSI+ᘤ
Cᑮ"Scsiport.sys
,gh
Oᑮ"Ἢ✌஺

70)ᜓ+,-ᨵ◚Ḅ¡FᨵDino$
ᑮ¢£ᵨ,-ᡈὅ¤w)ᜓFD¥ᐵὶḄg¦F§yᙠ&'⊤ḄHKLM\SYSTEM\CurrentControlSet\Services☢¾¿7)ᜓ+,-Ḅ
ᑮÀ7)ᜓ+,-¥ᐵὶḄJKḄ஺&'⊤ḄDᑖÂFWindowsÆÇÈ8ÉÊ9Ë)ᜓ+,-&'ÌÍḄᙢÎ஺᝞b
¾¿ᑮ"D"ᓛᑣÒÓDisplayNameLDescriptionḄÚ஺ᨵu+,-§yÛᐙuÚᩭÝ`)ᜓ+,-Ḅᵨ⌶஺ß᝞
àᙠDisplayNameÚ9ᑮáâã“VirusScanner",⊤ç
Oèé"êëìíw஺
ᙠîïðᳮ(ComputerManagement)õᐹ(.Start÷ᓫ9⌱Programs/AdministrativeTools/ComputerManagement)9j+,-Ḅᑡ⊤஺ᙠComputerManagement9ýþSystemTools,SystemInformationSoftwareEnvironment,ᯠ⌱Driversᓽ஺ᯠṹᐵὶḄ$ᦪᨵ'᎛)*+,-./01234஺5᝞78◤⌕;<ᑁ᪶?@ḄAᵨ᪘D8

71¨v/01234,e¶·¸0Ḅjk,cdeᩭ஺nºᐰᑁ¼ºᐰᑁ¼ᒹ¾¿ᙠ34'ÀᡠᨵḄᱥᳮᑁ¼஺{·ÃÄ⌕Å⚓☢ᦻPÇÈZᱥᳮᑁ¼ḄᜧÊËÌV1MBÏᵨvcdᜮjkÑ஺RSᙠᜧᑁ¼Ḅ12VÒ⌕Å/ÓÔᜧḄ⚓☢ᦻPᡠ,{·ÃÄḄᦻPZᨬÈÖḄ஺WindowsNT4ÙÚᢝ{·ÃÄḄ34ᦻP஺{|ZWindowsServer12ḄWX஺nᑁ᪶ᑁ¼ᑁ᪶ᑁ¼Ùᒹ¾¿ᙠ34'ÀÜvᱥᳮᑁ¼¢Ḅᑁ᪶?@Ý/ᑏ⚓☢஺{·ÃÄà*ᒹ¾ávᵨᡝxKḄ⚓☢஺ᯠRSÙᨵᑁ᪶?@ḄṹD,âã`äWindows34ᡠ,ᵨᡝxK⚓☢Ô¨v34AoᩭåZ*æ⌕Ḅ஺Qᡠᨵç34ᑖ᪆ᨵᐵḄᦪèé᪀ᒹëìYxKḄᑡ⊤ஹðKḄ᪘,,ñòÌóIJKLḄᑡ⊤ô¼ᙠÓᣚ⚓Ḅᑁ¼¢Ò~|cdᙠᑁ᪶ᑁ¼¢஺aᨵö÷Ḅøᩭ⚜úᑁ᪶ᑁ¼ḄᜧÊRSÒḄᜧÊûüvýþᘤ
ᡠᨵᑖḄᑁ᪶ᑁḄᦪ஺nᑁᑁᙠWindowsProfessional_h,0123456789minidumpᡈᑖ;<ᐜtriagedump,>Ḅᜧ964KBᙠ64D9128KB6o>ᒹIJKLMṹOᦪஹQRSḄ4ᜓḄᑡ⊤ஹWXYZ[\Ḅᦪ]^᪀89EPROCESSETHREAD,ij6kḄWX6lmnopqrstḄ\Ḅᑁ᪶᪘஺vᯠxᐰᑁ1ᐸ{⌱⚗Ḅ~l1l>Ḅ1lᐸᜧᑮJQᡠᨵᱥᳮᑁḄlᵨ஺ᜧḄᘤᨵGBᱥᳮᑁḄil0᪵stᦻᜧlm¡¢SᑮFTPᘤlᡈὅ¥¦ᑮCD஺9ᙠ§ᜧ¨ᦪḄstᑖ᪆ª«lᵨᡝḄMṹᦪ]ᨵ¥®ᵨᑮ9st1ᵫ°ᑁ᪶ᑁ«ᙠ±⚪opḄl³lᦪ]^᪀´ᶇᙠᑁ᪶ᑁ«6lᡠmlᙠxᐰᑁ«¶Ḅ·¨ᦪ]¸ᑖ᪆¹ᐵl>»¼½¾¿JᦻḄÀÁ஺ᨬÃQ1loᔁ\WindowsÆÇᡠᙠḄᔁ6Ḅ⚓☢ᦻḄᜧÊËÌÍΰÏ«ᱥᳮᑁḄᦪÐR1MB஺ᵫ°ᙠQÒÓÔlᡠ⌕ÖḄ⚓☢ᦻḄᜧ¸▭ᱥᳮᑁḄᦪᡂÙÚÛlql0Q◤ÖÝÞßà⚓☢ᦻÊ⌕Ḅᜧ஺áâÏὃ⇋ᑁᑁ᪶ᑁ0åæ⌱⚗ᡠçèḄéᜐ஺ḄQéᜐ1>Ḅëìíîl0®>íîï°ðᣚlÚ᝞óªᵯõöᩭðᣚ஺³løQrstùᙠ'Windows\MinidumpÆÇ«þᡂQᦻlÏᦻᨵQÿḄᦻᵫ“Mini”ᑡ᝞Mini082604-01.dmp'᪀ᡂḄ஺+,-Ḅ./0123456ᑖ᪆9ᙠᑖ᪆;<=>ᵨ@AᡂB,-ḄCDᵨᑮḄFG᧜IᦻᨬKṹNtoskrnl.exe<=FḄ᱐XYZ56ᨬ[XḄᑖ᪆'஺᝞\9]ᙠ^G_Aᡂ`,-ḄCDᑖ᪆B,-abcdef⚪஺ᯠiMicrosoftḄlmᘤᒹp1WindowsXPCDuYv᱐XḄ᧜I'ᡠY9dYᙠxyᘤz{|᧜I}~>3ᢣᔣlmᘤ

72_xyᘤᡠ◤⌕Ḅ᧜IᯠMicrosoftḄ᧜Ilmᘤ^ᒹp9ᡠḄḄ᧜I'஺⌕Ḅ./ᵫ_ᙠ,-ᦻz1ᨵ▲Ḅᦪcde>ᨵᦔḄᑖ᪆Y56஺᜜ᓽ>9¢|CD£3Aᡂᑁ᪶¦§,-ᡈ©ᐰ¦§,-9«dY¬+,-Ḅᜐ9◤ᵨWindbgᩭᡭ³ᜧḄ¦§,-ᯠvᵨ”.dump/m”·¸¹º»+,-஺¼½ᙠWindowsXPWindowsServer2003+,-ÁÂḄᓽ>CDÃ{|0©ᐰ,-ᡈᑁ᪶,-஺¼9dYᙠLivekdzᑭᵨ.dump·¸AᡂÆÇCDḄᑁ᧜IÈi9É◤ÊËCDdYÌÍᙢᑖ᪆BCD஺ÏCDÐᯠ»Ñ1f⚪ÒÓᯠᙠ¹ÔlmiÕ9]ᙠ^ᡭÖBlmḄ×ØÙÖÚf⚪abÚ;cÛÜÝÞᨵᵨ஺ß\ᑮḄ¦§᧜I^©ᐰàḄÈ0^GᑁáâḄᑁãä᧜Ḅ^G;å/Ḅ×æÒ3deᒹp12_ᑖ᪆ÝÞᨵᵨḄçè஺ᑁ᪶ᑁ,-ᫀ¹Ô1Ûᑗᔠì▭Ḅzå⌱ï஺È03ᒹp1ᡠᨵḄð_ᑁ᪶ñòḄᱥᳮᑁᡠY3@©ᐰᑁ,-ᐹᨵG᪵÷øḄdᑖ᪆ᦪÒ3ḕᶍ1ûÞ^FᐵḄᵨᡝñòᦪþṹÈÚ3dY©ᐰᑁ,-+ÿ஺
ᩭᙠᐹᨵ256MBRAMḄWindowsXP•ᑁ᪶ᑁ#$%Ḅᜧ'(34MB+ᙠ,ᐹᨵ1.5GBRAMḄWindowsXP,ᑁ᪶ᑁ#$%1ᑮ372MB஺5678ᑁ᪶ᑁ#$%Ḅ9᎛;<⚓☢ᦻ@AᔲCDᜧEF⊤14.1HIA,JKLAMNḄᜧ'OP(QᨵRSTU⚜Wᑁ᪶ᑁ#$%Ḅᜧ'஺XᡠUZS⚜W•ᑁ᪶ᑁ#$%Ḅᜧ'AP([Ḅᜧ'\]^ᙠ_`9abcᘤḄefgᡠᨵhijiklmᙠnᵨḄᑁ᪶pqᑁ#Ḅᦪs஺⊤14.1┐uᑁ᪶$%Ḅvwᨬ'⚓☢ᦻ@ᜧ'ᑁ#Ḅᜧ'┐uᑁ᪶$%Ḅᨬ'⚓☢ᦻ@ᜧ'<128MB50MB<4GB200MB<8GB400MB>=8GB800MBP~ᙠ_`9P(⚓☢ᦻ@'ZSᑁ᪶$%JAᨵTḄ஺᝞6⌕ᑁ᪶$%Ḅᜧ'6TUᑴᩭ_`,SA78Ḅ⌱⚗U6TUᑴ_`ᡈὅnᵨ¡¢

73☢£⌕¤¥ḄNotmyfaultᐹE¡¢☢¤¥3J®¯°SH஺56±²³´96TUµ¶;<U·¸ᑁ᪶$%¹ºᡂ3¼6½TU;<[Ḅᜧ'UM¾¿6Ḅ³´ᔁ⚓☢ᦻ@bÁ8(Âᜧ஺(¸◅Fᙠ32Ä6TU⌱Å2GBÆ1MBᜧ'Ḅ⚓☢ᦻ@P(2GBAᡠᨵTᵨᑁ᪶pqᙢᙬÉÊḄᨬᜧO஺ᨬ¢ᓽnᡂÌᙢᙠ_`9a£_`$%ÍÎᑮ⚓☢ᦻ@Ï3[ÐÑÒᨵCDḄÉÓÔÕÉÊᩭÖ\~$%ᦻ@஺᝞QᨵCDḄÔÕÉÊ_`$%×Øᜫ3P(ᙠ⚓☢ᦻ@Ïᵨ^¸#_`$%ḄÉÊÚÛÜ3ÝḼßànᵨ~⚓☢ᦻ@JáᑖÉʽ£Ú⌚äᣵ஺᝞6ᙠ³´ᔁQᨵCDḄÉÊᩭ¸#memory,dmPᦻ@6TUèé᝞ê14.3ÏëìḄuí᪾ᩭ⌱ÅïðᐸòᙢóÕḄôÄ8஺_`$%Ḅᡂ5³´9[õ\ö÷⊤OHKLM\System\CurrentControlSet\Control\CrashControl,U;<5ÿ
Ḅ⌱⚗஺᝞
ᵨᩭᑏᔁḄ!"#$ᙠᑁ'()*+,-./0123Ḅ456☢89“dump?@A6B஺CDᙠᑏE#(FGḄHIJKLMNOḄ᪥QR-.S'Tᩭ஺U᪵ḄHIᒹXYYZ+,Ḅ!"#$ஹ᡻]ᑏ^@ḄI/ObᳮᘤeᦪgGᔁḄ⚓☢ᦻIᙠ9Ḅ᧜k⊤஺m⁐oM/ecAH᡻]uvwMNUxHIḄ᪥QR-.yz{ᑮḄ᪥QR1u{ᑮḄ᪥QR}]~஺᝞ὅ2vᑏᦻIAU᪵)ᜫᡈὅẚ஺᝞᪥QR2ᓛ&g%ecyᑏᑮᵫ⚓☢ᦻIᓰḄᡧ(EᦻIJK!"#$¡Zẚ,£¤¥¦§JK¨஺mSMSSᙠE#(ªᵨᣚ⚓¬ᑴuJK®¯ᔁḄ⚓☢ᦻI°¦ᔲ'ᙠ-.y⚓☢ᦻI(ZᡠᓰḄ³ᑖSµTᩭ஺U¶{ᙠḄ·¸▤ºᔁ⚓☢ᦻIḄ³ᑖᡈᐰ³¦ᵨḄ§¼½¾¿gÀÁ“JKm6ḄÂÃᑁ'EÄ”஺mᯠUᩩIȦᨚuḄ஺ÊᩭËᯠᙠE#(Winlogon¾EÑᵨÒᦻ᫏ᓄḄAYQzzery5ysAPTᩭÞßà⚓☢ᦻI(¦ᔲ'ᙠ᝞'ᙠᑣâ¼Savedump}#\Windows\System32\Savedump.exe¨,gìà⚓☢ᦻI(íî½ï-.y+,ᑮᨬñḄò
9஺Uxóô᝞õ14.4ᡠÁ஺

74ᵨᡝজᑁNtCreatePagingFileõ14.4ᦻIḄùᡂ

7514.4Windows┯üýþ¥᝞ᙠÿ3
ᡠᑮḄWindowsXPWindowsServer2003ᒹWindows┯Ḅ!"#$%Microsoft&ᡈὅ-ᑁ+┯,-ᘤ/0ᑖ᪆஺4ᱯឋ789ᡭ;Ḅ<7=>ᦋ@SavedumpḄ07ABᦋḄ:SavedumpDEF᜜ḄHIᩭKLM!7ᔲOAPQ“ᙠ"#TUVWXYZᩭ["#\]^〈%Microsoft&ᡈὅ`ᨵ,-ᘤᙠbU☢Ḅ'ᙠe"#ᑖ᪆’⁚
ᨵHḄhi/0ᑖ᪆”஺k14.5lm┯PQno᪾q=>rᑴ☢tḄSystemuvḄAdvanced᪗x⚓z{|no᪾஺|no᪾ᐕ~qPQ!Ḅ┯Q4QAᙠ⊤ḄHKLM\Software\Microsoft\PCHealth\ErrorReporting☢஺k14.5┯PQno᪾ᙠ"#TU!VWXYZᩭ[SavedumpErrorReportingḄᒹShowuiஹDoReportIncludeKernelFaults஺᝞ᡠᨵ47true,ᑣSavedumpᵨ☢ḄHIᜓ“ᔣMicrosoftOCAOnlineCrashAnalysis
&ᡈὅᑁ+┯,-ᘤ᝞O4᪵PQḄo/^〈"#\]”஺1.᝞ᡂḄ\]¢£¤7u\]¥¦§\]ᦻ©
Eª•u\]¬ᐸᙠ\Windows\MinidumpsḄ89¯Qᜐ஺

762.u\]ᦻ©Ḅ±ᑏᑮHKLM\Software\Microsoft\PCHealth\ErrorReporting\KernelFaults
஺3.ᙠHKLM\Software\Microsoft\Windows\CurrentVersion\Run
³ᐭ•ᩩ¶·᡻0Dumprep(\Windows\System32\Dumprep.exe),ᡠᙠ¹ᵨᡝ»¼ᑮM!Ḅ>
DumpregA᡻0஺