Kernel-Mode Windows
Bug Checks
Bug Check 0x3E: Multiprocessor Configuration Not Supported
Bug Check 0x5D: Unsupported Processor
Bug Check 0x6B: Process1 Initialization Failed
Bug Check 0x79: Mismatched HAL
Bug Check 0x80: NMI Hardware Failure
Bug Check 0x9A: System License Violation
Bug Check 0x0100: Loader Block Mismatch
Bug Check 0x011D: Event Tracing Fatal Error
Bug Check 0x0124: WHEA Unrecoverable Error
HAL
Versions
3.51
4.0
5.0
5.1
5.2
6.0
6.1
6.2
6.3
10.0
Functions
Machine Check Architecture
HalBugCheckSystem
The x86 BIOS Emulator
Functions
x86BiosAllocateBuffer
x86BiosCall
x86BiosFreeBuffer
x86BiosReadMemory
x86BiosWriteMemory
Demonstration
Viewing the Firmware Memory Map
Kernel
Versions
3.51
SP5
4.0
SP3
SP4
5.0
SP1
SP3
SP4
5.1
SP1
SP2
SP3
5.2
SP1
SP2
6.0
SP1
SP2
6.1
SP1
6.2
Named Exports
Ordinal-Only Exports
6.3
Named Exports
Ordinal-Only Exports
10.0
API
Executive
Initialisation
The Product Suite
Software Licensing
Functions
ExFetchLicenseData
ExGetLicenseTamperState
ExSetLicenseTamperState
ExUpdateLicenseData
ZwQueryLicenseValue
Structures
License Data
I/O Manager
I/O Subroutines
IoAllocateIrpEx
IoInitializeIrpEx
IoSizeOfIrpEx
IRP Extensions
Functions
IoGetGenericIrpExtension
IoSetGenericIrpExtension
Implementation
IOP_IRP_EXTENSION
PnP Manager
IoGetDmaAdapter
Kernel
Deferred Procedure Calls
Structures
KDPC
Kernel Shim Engine
Driver Shims
Functions
KseRegisterShim
KseRegisterShimEx
KseUnregisterShim
Structures
KSE_COLLECTION
KSE_HOOK
KSE_SHIM
Memory manager
Page Combining
Implementation
MI_PAGE_COMBINING_SUPPORT
Modified Writer
Functions
NtCreatePagingFile
Implementation
MI_PAGING_FILE_SPACE_BITMAPS
MMMOD_WRITER_LISTHEAD
MMMOD_WRITER_MDL_ENTRY
MMPAGING_FILE
Partitions
Functions
NtCreatePartition
NtManagePartition
NtOpenPartition
Enumerations
MEMORY_PARTITION_INFORMATION_CLASS
Structures
MEMORY_PARTITION_CONFIGURATION_INFORMATION
MEMORY_PARTITION_INITIAL_ADD_INFORMATION
MEMORY_PARTITION_PAGEFILE_INFORMATION
MEMORY_PARTITION_PAGE_COMBINE_INFORMATION
MEMORY_PARTITION_TRANSFER_INFORMATION
Implementation
MI_PARTITION
MI_PARTITION_COMMIT
MI_PARTITION_CORE
MI_PARTITION_MODWRITES
MI_PARTITION_PAGE_LISTS
MI_PARTITION_SEGMENTS
MI_PARTITION_STORES
MI_PARTITION_ZEROING
MI_VISIBLE_PARTITION
System Loader
MmGetSystemRoutineAddress
Binary Search Bug
Run Time Library
RtlPrefetchMemoryNonTemporal
Structures
DISPATCHER_HEADER
DRIVER_EXTENSION
EPROCESS
Flags
Flags2
Flags3
ETHREAD
Cross-Thread Flags
Same-Thread Passive Flags
Same-Thread APC Flags
HAL_DISPATCH
HAL_PRIVATE_DISPATCH
KTHREAD
Versions
Original
Early 5.2
Late 5.2 to 6.1
6.2 and Higher
Thread Flags
Miscellaneous Flags
KPCR
KPRCB
KPROCESS
KTIMER
KUSER_SHARED_DATA
LOADER_PARAMETER_BLOCK
LOADER_PARAMETER_EXTENSION
MEMORY_ALLOCATION_DESCRIPTOR
PROCESSOR_POWER_STATE
Enumerations
KOBJECTS
Processor Support
CPU Identification
CMPXCHG8B
SYSENTER and SYSEXIT
Second Level Cache
Other TOCs (and approximate page counts)
Geoff Chappell, Software Analyst
(40)
Notes
(90)
Studies
Windows
Win32
(50)
The Windows Shell
(400)
Internet Explorer
(250)
Visual C++
(750)