Windows Internals 5th Edition

Windows Internals 5th Edition Errata from Windows Internals 5th edition's technet page, they saying:"If you have general feedback for us, find an inaccuracy, or have a suggestion for the next edition, please send e-mail to syssite@microsoft.com. We'll post corrections and tool updates to this page."

p. 42: “lm mv nt” should be “lm vm nt”


p. 89: “......is at interrupt number 0x91...” should be “...is at interrupt number 0x81...”


p. 154: The process ID 0x408 should be 0xAAC in "The following command displays full details about the handle table for process ID 0x408"


p. 191: ExTryToAcquireResourceExclusiveLite is not documented.

p. 237: The example of hypervisor processor assignment should read: “For example, one child partition could be scheduled on logical processors 1,2,3 and 4, while a second child partition is scheduled on processors 5 6,7 and 8.”

p. 243: The first instance of the address 82227ea5 in “82227ea5 ebfc jmp nt!FsRstTeardownPerFileContexts+0x169 (82227ea5)” should be 82228eaa

p. 263: In step 6, launch Regedit by selecting Jump To from the Event menu


p. 265: The -i switch in the psexec command has Process Monitor run on the session 0 desktop


p. 497: The reference to the SetSecurityInfo and SetNamedSecurityInfo APIs should instead refer to SetEntriesInAcl


p. 520: The handle command in the experiment should read: handle -a 15cd5


p. 673: Figure 8-14, “Disk port driver” should be enclosed with a medium grey box, as it is on page 675, Figure 8-15


p. 716: “through which applications can disable DEP or their own images.” should be “through which applications can disable DEP on their own images.”


p. 719: “32 bit Windows can support up to 128GB of physical” should be “32 bit Windows can support up to 64GB of physical”


p. 748: Figure 9-14, the address FFFF080000000000 should be FFFF80000000000