February: Blog Post List

This is hopefully going to be the upcoming blog posts for February:
  • VTables and Virtual Functions
  • Thread Storage Slots
  • I/O Completion Ports
  • IRP Queues
  • PE Header Sections
  • Registry Internals
  • URBs and USB Internals
I'm also going to explore the I/O Manager more, since I haven't written much about it, and to be honest haven't read anything properly which is related to I/O for a while.


Comments

Post a Comment

Popular posts from this blog

Virtual Address Descriptors (VADs) - !vad

Image
Virtual Address Descriptors can provide useful information about the address space of a specified process. They provide information about the PTE Protection Bits, inheritance of the page and wherever the page is being shared among between processes ( section object ). VAD Trees are based upon a programming algorithm called a AVL Tree, an example and explanation of one can be found here on Sysnative .  Extension The root of the VAD tree can be found using the !process extension. The VADs field indicates the number of VADs or nodes within the AVL Tree. The AVL Tree is essentially the VAD Tree. The far right column indicates the PTE protection bits, and the next column indicates the page state. The last or first arrow (depending on how you look at it), shows the depth of the VAD within the VAD Tree. The Start and End fields indicate the memory range.  At the bottom of the VAD tree, you'll always see the above line, it indicates the total number of VADs within the VAD Tree and p...
Read more

Debugging Stop 0x124 - PCIe Errors Part 2

Image
Continuing from Part 1, this second part is going to elaborate on the errors which were described in my previous blog post. Here, I would strongly recommend you download the PCIe 1.1 Specification, which isn't freely available to download from the PCIe website, but you can find a copy on Google. The error table is available in section 6.2.7 of the PCIe 1.1 Specification. In general, here is what the PCIe AER Extended Capability Structure looks like: Let's begin with the Unsupported Request Error ( UR ).  Unsupported Requests are basically requests which are not supported, they can be a result of several things. One being the device power states , any I/O TLP or Memory related TLP request being sent when the power state is D1, D2 or D3 is treated as a unsupported request (see section 5.3.1). I'll explain TLP's later. There are several errors which can cause a Unsupported Request error, from the PCIe 1.1 Specification, here is a listing with the references to the appropri...
Read more

Debugging Stop 0x1 - APC's and Guarded Regions

Image
This is the first Stop 0x1 , which I actually came across on my own, and to be honest is one of those bugchecks which doesn't contain any information at all really, as a result of when the bugcheck is produced. To really understand, how this bugcheck works and why it happens, you need to understand the concept of APCs and their types, and also how they are used with Critical Regions and Guarded Regions. APCs are quite a lengthy subject, and therefore I will not explain completely how they work and their internals, but will provide some useful references for you to read or take note of. They are wonderfully explained in the Windows Internals book, which I absolutely recommend that you purchase. Brief Explanation of APCs   APC's are a form of asynchronous interrupt, and run within the context of a particular thread or process address space. They can allow page faults, call system services, wait for objects and their handles and acquire objects.  APCs are called APC objects, an...
Read more