On Thu, Aug 28, 2014 at 6:59 PM, Free, Bob <[email protected]> wrote: >> Microsoft's documentation on this is not as good as it could be > > When I wanted to learn and understand this stuff back in the NT > days, I went straight to the Custer(Russinovich)(Solomon book). I > have quite a stack of them now.
Indeed. Matter of fact, I've got the 5th edition on my desk right now (see my recent thread about network hangs). But even with that, there are things that are pretty murky. For example, what the heck is a "recognizer driver"? It has a defined symbolic name, SERVICE_RECOGNIZER_DRIVER, but most of the Microsoft documentation just says "Reserved". One document goes so far as to explain it as a "file system recognizer driver". Great, so what does *that* mean? /Windows Internals/ doesn't cover it, either, as far as I can tell. (I eventually found third-party documentation that explains that a filesystem recognizer driver is the thing responsible for determining if a given disk or partition is of a particular filesystem type, and thus triggers the loading of the actual filesystem driver. It's a separate driver so the kernel isn't bloated with filesystem implementations it doesn't need. Makes sense. But finding that out was ridiculously hard. Thanks to Snowden, it's easier to find top secret NSA documents than it was to discover this. ;-) ) -- Ben
