文档介绍：1. Concepts and Tools
In this chapter, we’ll introduce the key Microsoft Windows operating system concepts and
terms we’ll be using throughout this book, such as the Windows API, processes, threads, virtual
memory, kernel mode and user mode, objects, handles, security, and the registry. We’ll also
introduce the tools that you can use to explore Windows internals, such as the kernel debugger, the
Reliability and Performance Monitor, and key tools from Windows Sysinternals
(hnet/sysinternals). In addition, we’ll explain how you can use the
Windows Driver Kit (WDK) and the Windows Software Development Kit (SDK) as resources for
finding further information on Windows internals.
Be sure that you understand everything in this chapter—the remainder of the book is written
assuming that you do.
Windows Operating System Versions
This book covers the two most recent versions of the Microsoft Windows operating system
based on the Windows NT code base: Windows Vista (32-bit and 64-bit versions) and Windows
Server 2008 (32-bit and 64-bit versions). Unless specifically stated, the text applies to all versions.
As background information, Table 1-1 lists the releases of the Windows NT code base, their
internal version number, and the external product name.
Foundation Concepts and Terms
In the course of this book, we’ll be referring to some structures and concepts that might be
unfamiliar to some readers. In this section, we’ll define the terms we’ll be using throughout..
You should e familiar with them before proceeding to subsequent chapters.
Windows API
The Windows application programming interface (API) is the system programming interface
to the Windows operating system family. Prior to the introduction of 64-bit versions of Windows
XP and Windows Server 2003, the programming interface to the 32-bit versions of the Windows
operating systems was called the Win32 API, to distinguish it from the original 1