Windows 2000 秘密程序指南：程序员的Cookbook

4星 · 超过85%的资源需积分: 10 169 浏览量更新于2023-06-14 1 收藏 42.22MB PDF 举报

"Undocumented Windows 2000 Secrets - The Programmers Cookbook 是一本由Sven B. Schreiber编写的书籍，主要聚焦于Windows 2000操作系统中的未公开秘密，特别是针对程序员的实用技巧和知识。本书旨在揭示操作系统内核层面的一些隐藏功能和优化方法，帮助开发者更好地理解和利用Windows 2000系统。在‘Kernel’这一标签下，我们可以预期这本书会深入探讨Windows 2000的内核机制，包括但不限于进程管理、线程调度、内存管理、中断处理、设备驱动编程、系统调用以及内核模式下的编程实践。这些内容对于想要深入理解操作系统工作原理和开发底层软件的程序员来说极为宝贵。书中可能会涵盖如何利用未公开的API接口或者系统特性来优化程序性能，以及如何调试和解决与内核交互时遇到的问题。此外，还可能涉及到一些安全方面的话题，如如何防止或检测恶意代码对内核的攻击，以及如何通过非标准方法来提升系统的稳定性和安全性。值得注意的是，由于内容涉及“Undocumented”（未公开的）Windows 2000秘密，这意味着书中所分享的知识可能不在微软官方的公开文档或支持范围内。因此，开发者在使用这些技术时需要格外谨慎，因为它们可能不受微软的正式支持，且随着操作系统更新，某些秘诀可能变得过时或不再适用。此外，不恰当的使用可能会导致系统不稳定，甚至有可能违反软件使用协议。尽管如此，对于那些寻求独特解决方案或希望通过深入理解操作系统底层来提升其软件开发能力的程序员而言，这本书提供了难得的洞见。书中的案例研究和实战技巧将有助于读者扩展他们的知识边界，并在实际工作中解决棘手问题。总而言之，《Undocumented Windows 2000 Secrets - The Programmers Cookbook》是一本面向高级程序员和技术爱好者的技术宝典，它将带领读者探索Windows 2000操作系统中鲜为人知的一面，挑战常规编程思维，提升系统级别的编程技能。然而，使用这些技术时需谨慎，确保遵循最佳实践和行业标准，以避免潜在风险。"

XVIII PREFACE

don't opt for a multitome encyclopedia, you can either write a reference handbook,

such as Nebbett's (Nebbett 2000), or focus on specific topics, as Andrew Schulman and

friends did. Nebbett didn't leave much for other reference authors, but the in-depth

documentation of special Windows NT/2000 topics is still a wide-open field.

Like Undocumented DOS, this book of introduces Windows 2000 program-

ming topics that I have found both interesting and useful. In the

"undocumented"

business, there is always a danger of doing "art for art's

sake."

Unveiling undocu-

mented features of an operating system is usually very exciting and fulfilling for the

person doing the work, but might be quite irrelevant for others. Not everything that

is undocumented is automatically useful as well. Some operating system internals are

just internals in their strictest sense, that is, implementation details. However, many

internals of Microsoft systems are much more than that. Microsoft has a notorious

reputation for intentionally preventing the developer community from knowing too

much about their target operating system. My favorite example is the ingenious and

extremely useful MS-DOS Network Redirector Interface described in Chapter 8 of

the second edition of Undocumented DOS (Schulman et

al.,

1993). Much time

would have been saved and much trouble avoided if Microsoft had documented this

wonderful interface when they introduced it. Unfortunately, Microsoft has pursued

this information policy with the follow-up systems Windows 3.x, Windows 9x, Win-

dows NT, and Windows 2000. However, books such as this are being written to pro-

vide further information.

After introducing you to the basic architecture of Windows 2000 and helping

you to set up your workstation for Windows 2000 kernel spelunking, this book leads

you through some very exciting corners inside the world of kernel programming.

Typically, each chapter first discusses the essential theory you need to know about the

topic, and then immediately presents sample code to illustrate the respective features.

The language chosen for the samples is plain C. The probability is high that the

readers of this book are comfortable with C, and this language is well supported by

Microsoft's Windows 2000 development tools.

This book deliberately does not attempt to give a broad overview of the architec-

ture of the Windows 2000 kernel, although it discusses parts of it in some chapters. If

you are looking for such information, see Inside Windows 2000 (Solomon and Russi-

novich 2000) instead, which takes a very general and theoretical approach to the

Windows 2000 internals. Neither Inside Windows 2000 nor the Undocumented

Windows 2000 Secrets: A Programmers Cookbook Windows NT/2000 Native

API

Reference (Nebbett 2000) provide practical code examples and full-featured sample

applications that interact live with the system contains reprinted code samples in

abundance, accompanying the Windows 2000 concepts and features under discus-

sion. The companion CD contains all of this code in ready-to-run applications that

you can extend, tear to shreds for use in other applications, or simply use as is.

Basically, you will be led through the following topics:

XX PREFACE

• Chapter 2 introduces the Windows 2000 Native API, discussing the main

system service dispatcher, the various API function groups exported by

ntdll.dll and ntoskrnl.exe, and the data types most frequently used by

these components.

• Chapter 3 is a short and easy introduction to basic kernel-mode driver

development. It is by no means intended as a tutorial for heavy-duty

hardware driver developers. It simply points out essential information

required to understand the sample code in subsequent chapters, including

loading and unloading driver modules at runtime via the Service Control

Manger interface. Probably the most interesting highlight is the descrip-

tion of the customizable driver wizard included with full source code on

the companion CD.

• Chapter 4 is certainly the most challenging chapter for readers suffering

from hardware phobia, because it starts with a detailed description of the

Intel Pentium CPU features used by the Windows 2000 memory manager.

Anyone who survives this section is rewarded by extensive sample code of

a memory spy device that supports the visualization of prohibited memory

regions and internal memory manager data structures. Also included is a

Windows 2000 memory map that outlines how the system makes use of

the vast 4-GB address space offered by the Pentium CPU family.

• Chapter 5 explains in detail how you can hook Native API functions,

mainly focusing on call parameter monitoring and file/registry tracking.

This chapter makes heavy use of inline assembler code and CPU

stack twirling.

• Chapter 6 proposes a general-purpose solution for something that is com-

monly considered impossible in the Windows 2000 programming para-

digm: calling kernel-mode code from user-mode applications. The sample

code in this chapter builds a bridge from the Win32 subsystem to the main

kernel interfaces inside ntoskrnl.exe, hal.dll, and other core components.

The chapter also describes how to call nearly any kernel function as long

as its entry point is provided in the Windows 2000 symbol files.

• Chapter 7 delves deeply into the mysterious Windows 2000 object man-

ager. The internal structure of kernel objects is one of the best-kept secrets,

because Microsoft doesn't give you more information about an object

than an opaque

void*

pointer. This chapter unveils what this pointer really

points to, and how object structures and handles are maintained and man-

aged by the system. As a special feature, the layout of process and thread

PREFACE XXI

objects is discussed in detail. The last section of the chapter is a sample

application that displays the hierarchical arrangement of kernel objects by

tracing the relations of various undocumented object structures.

• Appendix A is related to Chapter 1 and contains all commands and com-

mand options of the Windows 2000 Kernel Debugger.

• Appendix B is related to Chapter 2 and summarizes several API functions

exported by the Windows 2000 kernel modules.

• Appendix C provides an extensive collection of Windows 2000 constants

and data types in alphabetical order. This reference list documents several

undocumented kernel structures introduced and used throughout the book.

As you see, this book discusses much information that merits the attribute

"undocumented," and some of the material has never been published before.

THE AUDIENCE OF THIS BOOK

Undocumented Windows 2000 Secrets: A Programmer's Cookbook is intended for

system programmers who want to maximize the features of their target operating

system. First disclaimer: If the target platform of your software is Windows 95, 98,

or Me (Millennium Edition), don't read any further. Because of the architectural dif-

ferences of the Windows

9x/Me

and NT/2000 platforms, you won't benefit from

reading this book. Second disclaimer: This book does not contain information on the

Alpha processor or multiprocessor

systems—I

will target the 32-bit Intel

i386

single-

processor platform exclusively. Third disclaimer: Be aware that this text is not writ-

ten for the faint-hearted. You will be faced with programming techniques the average

Win32 programmer has never seen. The Windows 2000 kernel is an entirely different

world, bearing little resemblance to the Win32 subsystem built upon it. Some of the

interfacing techniques introduced toward the end of the book might be new to even

experienced kernel-mode programmers. Let me put it this way: This is the book your

high-school teachers and Microsoft representatives have always warned you about!

If you are still reading on, you are obviously an open-minded, courageous

person who wants to know everything about the things lurking beneath the surface

of the Windows 2000 operating system. That's great! Even if you won't use the

know-how you gain from this book on a daily basis, you will certainly benefit from

it. Knowing what is going on under the surface of an application interface is always

advantageous. It facilitates debugging and optimization, and helps avoid unwanted

side effects caused by misconceptions about the hidden mechanics of the system.

XXII PREFACE

The only expertise I'm expecting from my readers is "talking

fluently and

basic knowledge of Win32 programming. If you have already written kernel-mode

drivers, you're in an even better position, but that's not a requirement. You will find

an introduction to kernel-mode driver programming in this book, telling you every-

thing you need to know within its scope. However, please note that this is not a

comprehensive kernel-mode tutorial. If you are specifically interested in kernel-

mode driver development, please get one of the good books that deal with this topic

exclusively (e.g., Viscarola and Mason 1999, or Dekker and Newcomer 1999).

Some chapters of this book include heavy use of inline assembly language

(ASM). I don't expect you to have thorough ASM programming experience, but a

basic knowledge of ASM will be certainly helpful. If you have never written a line of

ASM code, you may find these chapters difficult or you may choose to skip them

entirely. However, I encourage you to read at least parts of them, only skipping the

subsections that explain the details of the ASM code. Because the ASM code snippets

used in the samples are always well encapsulated in C function wrappers, you can

usually ignore their internals and still benefit from the remaining material that

surrounds them.

THE CONVENTIONS USED IN THIS BOOK

The target operating system of this book is Windows 2000. However, you will find

that most of the information also applies to Windows NT 4.0, and most of the sam-

ple applications run on this platform as well. Note that I am not covering Windows

NT 3.x. Although it is probably outdated now, NT 3.51 has been my favorite NT so

far because it was relatively small and fast and did not burn up too many CPU MIPS

in its user interface. With respect to Windows NT

4.0,1

have done everything to keep

the software compatible with this version, because it is still in use. Many companies

have designed their corporate networks for the classic Windows NT domain concept,

and they will need time to adopt the new Active Directory paradigm introduced with

Windows 2000. In some cases, it is not possible to provide common code for both

operating system versions because of differences in the layout of some internal data

structures. Therefore, some portions of the sample code contain version checking and

separate execution paths for different versions.

Concerning terminology, when I use the term Windows 2000, it usually

includes Windows NT 4.0 as well. Remember that this funny name is just a market-

ing gimmick to propel the sales of a system that should have been named Windows

NT 5.0. In the same way, the term Windows NT without a version specification

refers to the NT platform in general, including Windows 2000 and Windows NT 4.0.

Note again that Windows NT 3.x is not on the list. In discussing version-specific

剩余586页未读，继续阅读

u010263720

粉丝: 0
资源: 6

Windows 2000 秘密程序指南：程序员的Cookbook

Undocumented Windows 2000 Secrets

《Undocumented Windows 2000 Secrets》

Undocumented Windows 2000 Secrets.part1

Undocumented Windows 2000 Secrets--中文版

Undocumented Windows 2000 Secrets-ABC

Undocumented Windows 2000 Secrets - SOURCE CODE.zip

Undocumented Windows 2000 Secrets.rar_Undocumented Windows_undoc

Undocumented Windows 2000 Secrets 源码

Addison Wesley - Sven Schreiber - Undocumented Windows 2000 Secrets

Undocumented Windows 2000 Secrets 中文版

最新资源