Foreword

Having used and explored the internals of the wildly successful Windows 3.1 operating system, I immediately recognized the world-changing nature of Windows NT 3.1 when Microsoft released it in 1993. David Cutler, the architect and engineering leader for Windows NT, had created a version of Windows that was secure, reliable, and scalable, but with the same user interface and ability to run the same software as its older yet more immature sibling. Helen Custer’s book Inside Windows NT was a fantastic guide to its design and architecture, but I believed that there was a need for and interest in a book that went deeper into its working details. VAX/VMS Internals and Data Structures, the definitive guide to David Cutler’s previous creation, was a book as close to source code as you could get with text, and I decided that I was going to write the Windows NT version of that book.

Progress was slow. I was busy finishing my PhD and starting a career at a small software company. To learn about Windows NT, I read documentation, reverse-engineered its code, and wrote systems monitoring tools like Regmon and Filemon that helped me understand the design by coding them and using them to observe the under-the-hood views they gave me of Windows NT’s operation. As I learned, I shared my newfound knowledge in a monthly “NT Internals” column in Windows NT Magazine, the magazine for Windows NT administrators. Those columns would serve as the basis for the chapter-length versions that I’d publish in Windows Internals, the book I’d contracted to write with IDG Press.

My book deadlines came and went because my book writing was further slowed by my full-time job and time I spent writing Sysinternals (then NTInternals) freeware and commercial software for Winternals Software, my startup. Then, in 1996, I had a shock when Dave Solomon published Inside Windows NT, 2nd Edition. I found the book both impressive and depressing. A complete rewrite of the Helen’s book, it went deeper and broader into the internals of Windows NT like I was planning on doing, and it incorporated novel labs that used built-in tools and diagnostic utilities from the Windows NT Resource Kit and Device Driver Development Kit (DDK) to demonstrate key concepts and behaviors. He’d raised the bar so high that I knew that writing a book that matched the quality and depth he’d achieved was even more monumental than what I had planned.

As the saying goes, if you can’t beat them, join them. I knew Dave from the Windows conference speaking circuit, so within a couple of weeks of the book’s publication I sent him an email proposing that I join him to coauthor the next edition, which would document what was then called Windows NT 5 and would eventually be renamed as Windows 2000. My contribution would be new chapters based on my NT Internals column about topics Dave hadn’t included, and I’d also write about new labs that used my Sysinternals tools. To sweeten the deal, I suggested including the entire collection of Sysinternals tools on a CD that would accompany the book—a common way to distribute software with books and magazines.

Dave was game. First, though, he had to get approval from Microsoft. I had caused Microsoft some public relations complications with my public revelations that Windows NT Workstation and Windows NT Server were the same exact code with different behaviors based on a Registry setting. And while Dave had full Windows NT source access, I didn’t, and I wanted to keep it that way so as not to create intellectual property issues with the software I was writing for Sysinternals or Winternals, which relied on undocumented APIs. The timing was fortuitous because by the time Dave asked Microsoft, I’d been repairing my relationship with key Windows engineers, and Microsoft tacitly approved.

Writing Inside Windows 2000 with Dave was incredibly fun. Improbably and completely coincidentally, he lived about 20 minutes from me (I lived in Danbury, Connecticut and he lived in Sherman, Connecticut). We’d visit each other’s houses for marathon writing sessions where we’d explore the internals of Windows together, laugh at geeky jokes and puns, and pose technical questions that would pit him and me in races to find the answer with him scouring source code while I used a disassembler, debugger, and Sysinternals tools. (Don’t rub it in if you talk to him, but I always won.)

Thus, I became a coauthor to the definitive book describing the inner workings of one of the most commercially successful operating systems of all time. We brought in Alex Ionescu to contribute to the fifth edition, which covered Windows XP and Windows Vista. Alex is among the best reverse engineers and operating systems experts in the world, and he added both breadth and depth to the book, matching or exceeding our high standards for legibility and detail. The increasing scope of the book, combined with Windows itself growing with new capabilities and subsystems, resulted in the 6th Edition exceeding the single-spine publishing limit we’d run up against with the 5th Edition, so we split it into two volumes.

I had already moved to Azure when writing for the sixth edition got underway, and by the time we were ready for the seventh edition, I no longer had time to contribute to the book. Dave Solomon had retired, and the task of updating the book became even more challenging when Windows went from shipping every few years with a major release and version number to just being called Windows 10 and releasing constantly with feature and functionality upgrades. Pavel Yosifovitch stepped in to help Alex with Part 1, but he too became busy with other projects and couldn’t contribute to Part 2. Alex was also busy with his startup CrowdStrike, so we were unsure if there would even be a Part 2.

Fortunately, Andrea came to the rescue. He and Alex have updated a broad swath of the system in Part 2, including the startup and shutdown process, Registry subsystem, and UWP. Not just content to provide a refresh, they’ve also added three new chapters that detail Hyper-V, caching and file systems, and diagnostics and tracing. The legacy of the Windows Internals book series being the most technically deep and accurate word on the inner workings on Windows, one of the most important software releases in history, is secure, and I’m proud to have my name still listed on the byline.

A memorable moment in my career came when we asked David Cutler to write the foreword for Inside Windows 2000. Dave Solomon and I had visited Microsoft a few times to meet with the Windows engineers and had met David on a few of the trips. However, we had no idea if he’d agree, so were thrilled when he did. It’s a bit surreal to now be on the other side, in a similar position to his when we asked David, and I’m honored to be given the opportunity. I hope the endorsement my foreword represents gives you the same confidence that this book is authoritative, clear, and comprehensive as David Cutler’s did for buyers of Inside Windows 2000.

Mark Russinovich

Azure Chief Technology Officer and Technical Fellow

Microsoft

March 2021

Bellevue, Washington