Discover and read the best of Twitter Threads about #windowsinternals
Most recents (8)
#WindowsInternals #Drivers (1/7)
Drivers are call back mechanisms to send or retrieve I/O between the operating system and devices such as NIC’s, Storage Controllers, and USB keyboards and mice.
They are typically loaded during the system boot sequence (after NTLDR but before Ctrl+Alt+Del presentation). (2/7)
They are typically loaded during the system boot sequence (after NTLDR but before Ctrl+Alt+Del presentation). (2/7)
Device load order groups ensure driver load in the correct order, such as A/V filter drivers loading after the NTFS.SYS has initialized as an example. (3/7)
Articles #WindowsInternals (1/6)
Introduction to DPCs
msdn.microsoft.com/en-us/library/… (2/6)
msdn.microsoft.com/en-us/library/… (2/6)
Deferred Procedure Call Details: osronline.com/article.cfm?ar…
RSS with Message Signaled Interrupts
msdn.microsoft.com/en-us/library/…
Timer Objects and DPCs
msdn.microsoft.com/en-us/library/…
Give Microsoft’s Scalable Networking Pack Another Look
windowsitpro.com/networking/giv… (3/6)
RSS with Message Signaled Interrupts
msdn.microsoft.com/en-us/library/…
Timer Objects and DPCs
msdn.microsoft.com/en-us/library/…
Give Microsoft’s Scalable Networking Pack Another Look
windowsitpro.com/networking/giv… (3/6)
Until threads that are suspended or blocked become ready to run, the scheduler does not allocate any processor time to them, regardless of their priority (2/8)
Because Windows implements a preemptive scheduler, if another thread with higher priority becomes ready to run, the currently running thread might be preempted before finishing its time slice. (3/8)
CPU Scheduler #WindowsInternals (1/9)
The system scheduler controls multitasking by determining which of the competing threads receives the next processor time slice. (2/9)
There is no single “scheduler” module or routine, the code is spread throughout the kernel in which scheduling-related events occur. The routines that perform these duties are called the kernel’s dispatcher (3/9)
CPU Idle States #Cstates #WindowsInternals (1/6)
C-states, also known as CPU Idle states, are states when the CPU has reduced or turned off selected functions. Different processors support different numbers of C-states in which various parts of the CPU are turned off. (2/6)
Generally, higher C-states shut off more parts of the CPU, leading to significantly reduced power consumption.
Processor Power Policy is owned and managed by the Windows Kernel Power Manager. (3/6)
Processor Power Policy is owned and managed by the Windows Kernel Power Manager. (3/6)
ISR vs DPCs #WindowsInternals #ProcessorDebug (1/5)
ISR: A software routine that hardware invokes in response to an interrupt. ISRs examine an HARDWARE interrupt and determine how to handle it. (2/5)
DPC: Software interrupt with a lower priority than the ISR
An ISR must perform very fast to avoid slowing down the operation of the device and the operation of all lower priority ISRs. (3/5)
An ISR must perform very fast to avoid slowing down the operation of the device and the operation of all lower priority ISRs. (3/5)
Performance Counter Series #4 #WindowsInternals #Perfmon
Logman.exe create counter Perf-Counter-Log (1/4)
Logman.exe create counter Perf-Counter-Log (1/4)
-f bincirc –v mmddhhmm –max 512 - This part of the command specifies that we are creating a Binary Circular file, sets the versioning to the mmddhhmm format, and the maximum log size to 512MB (2/4)
-c “\LogicalDisk(*)\*” “\Memory\*” “\Network Interface(*)\*” “\Paging File(*)\*” “\PhysicalDisk(*)\*” \Process(*)\*” “\Processor(*)\*” “\Redirector\*” “\Server\*” “\System\*” “\TCPv4\*” "\IPv4\*" - This part of the cmd specifies the counters to enable in the Data Collector (3/4)
Performance Counter Series #2 #WindowsInternals #Perfmon
Counter Types:
Instantaneous - Displays the most recent measurement, Single observation, or Sample of the value right now - example: Memory\Available Bytes (1/4)
Counter Types:
Instantaneous - Displays the most recent measurement, Single observation, or Sample of the value right now - example: Memory\Available Bytes (1/4)
Interval - Retrieves the current value of this counter at every measurement interval - example: Physical Disk\Disk Transfers/sec (2/4)
