Windows internals

What Hacker News says

1. elzbardicoNov 2022
   Windows Internals by Mark Russinovich. It is the bible of windows development.
   thread
2. GrumpyYoungManJul 2020
   "Windows Internals" 7th ed. part 1 and 2 by Mark Russinovich would be the definitive current reference on how Windows itself works but assumes knowledge of how operating systems in general work already.

   For general OS knowledge, I second the other poster's recommendation of Tanenbaum's "Modern Operating Systems"

   thread
3. ralishApr 2019
   I'm a bit rusty on this but from memory the overhead is by and large specific to the Win32 environment. Creating a "raw" process is cheap and fast (as you'd reasonably expect), but there's a lot of additional initialisation that needs to occur for a "fully-fledged" Win32 process before it can start executing.

   Beyond the raw Process and Thread kernel objects, which are represented by EPROCESS + KPROCESS and ETHREAD + KTHREAD structures in kernel address space, a Win32 process also needs to have:

   - A PEB (Process Environment Block) structure in its user address space

   - An associated CSR_PROCESS structure maintained by Csrss (Win32 subsystem user-mode)

   - An associated W32PROCESS structure for Win32k (Win32 subsystem kernel-mode)

   I'm pretty sure these days the W32PROCESS structure only gets created on-demand with the first creation of a GDI or USER object, so presumably CLI apps don't have to pay that price. But either way, those latter three structures are non-trivial. They are complicated structures and I assume involve a context switch (or several) at least for the Csrss component. At least some steps in the process also involve manipulating global data structures which block other process creation/destruction (Csrss steps only?).

   I expect all this Win32 specific stuff largely doesn't apply to e.g. the Linux subsystem, and so creating processes should be much faster. The key takeaway is its all the Win32 stuff that contributes the bulk of the overhead, not the fundamental process or thread primitives themselves.

   EDIT: If you want to learn more, Mark Russinovich's Windows Internals has a whole chapter on process creation which I'm sure explains all this.

   Show morethread
4. EvanAndersonDec 2016
   My respect for NT grew tremendously after reading one of the early editions of Mark Russinovich and David Solomon's "Windows Internals". I haven't seen more recent editions but I'd suspect they just as informative.

   The Wikipedia article on NT architecture is decent enough (https://en.wikipedia.org/wiki/Architecture_of_Windows_NT), and some quick searching brought up this slide-deck from 2008 that's pretty good too: http://www.cs.fsu.edu/~zwang/files/cop4610/Fall2016/windows....

   I'm most impressed w/ the kernel object manager and the pluggable user-mode "personalities". I've always dreamed of an NT "distribution" that didn't have Win32 but, instead, shipped with the Interix (aka Service for Unix) POSIX personality.

   Show morethread
5. marcocamposDec 2015
   For more about this, have a look at "Windows Internals" (6th edition is the latest, I believe) by Mark Russinovich, David Solomon and Alex Ionescu. It's an awesome book.
   thread
6. conductorMay 2015
   Windows Internals, Parts 1 and 2 by Mark Russinovich. And the leaked source code of NT4.
   thread