Windows Internels 4th Edition --Just a collection

1. System component

Component	Processor Execution	Responsibilities
Master Boot Record (MBR) code	16-bit real mode	Reads and loads partition boot sectors.
Boot sector	16-bit real mode	Reads the root directory to load Ntldr.
Ntldr	16-bit real mode and 32-bit or 64-bit protected mode; turns on paging	Reads Boot.ini, presents boot menu, and loads Ntoskrnl.exe, Bootvid.dll, Hal.dll, and boot-start device drivers. If a 32-bit installation is booted, switches to 32-bit protected mode; if a 64-bit installation is booted, switches to 64-bit long mode.
Ntdetect.com	16-bit real mode	Performs hardware detection for Ntldr.
Ntbootdd.sys	Protected mode	Device driver used for disk I/O on SCSI and Advanced Technology Attachment (ATA) systems where the BIOS is not used.
Ntoskrnl.exe	Protected mode with paging	Initializes executive subsystems and boot and system-start device drivers, prepares the system for running native applications, and runs Smss.exe.
Hal.dll	Protected mode with paging	Kernel-mode DLL that interfaces Ntoksnrl and drivers to the hardware.
Smss	Native application	Loads Windows subsystem, including Win32k.sys and Csrss.exe, and starts Winlogon process.
Winlogon	Native application	Starts the service control manager (SCM), starts the Local Security Subsystem (LSASS), and presents interactive logon dialog box.
Service control manager (SCM)	Native application	Loads and initializes auto-start device drivers and Windows services

 

2. Paged Pool & Nonpaged Pool

• Nonpaged pool Consists of ranges of system virtual addresses that are guaranteed to reside in physical memory at all times and thus can be accessed at any time (from any IRQL level and from any process context) without incurring a page fault. One of the reasons nonpaged pool is required is because of the rule described in Chapter 2: page faults can't be satisfied at DPC/dispatch level or above.

• Paged pool A region of virtual memory in system space that can be paged in and out of the system. Device drivers that don't need to access the memory from DPC/dispatch level or above can use paged pool. It is accessible from any process context.