Extracted
from Windows Internals v5, pg 73 & 74 (page numbers may be 72 &
73) Pages 66 & 67 in Windows Internals v6 - Part 1
This is a list of the most commonly used one's. There is more
discussion in the article "Inside the Native API" from Sysinternals.
More info/links listed here: http://www.sysnative.com/forums/showthread.php/3061-What-is-xxx-in-win32k!xxxInternalGetMessage-Anybody-seen-that?p=22415&viewfull=1#post22415
This is for the stuff after the ! in the stack trace.
Variations:
- The first letter of the prefix followed by an "i" (for internal)
indicates an internal kernel function.
- The full prefix followed by a "p" (for private) indicates an internal
process support function
Alpc -
Advanced Local Inter-Process Communication
Aux - Auxiliary Kernel-Mode Library Routines and Structures
Cc -
Common Cache
Clfs - CLFS Management Library Routines
Cm -
Configuration manager
Dbgk -
Debugging Framework for User-Mode
Dma - DMA Library Routines
Em -
Errata Manager
Etw - Event
Tracing for Windows
Ex -
Executive Support Routines
FsRtl - File
System Driver Run-Time Library
Hal -
Hardware Abstraction Layer
Hvl -
Hypervisor Library
Io - I/O
Manager
Kd -
Kernel Debugger
Ke - Kernel
Lsa - Local
Security Authority
Mm -
Memory Manager
Nt - NT
System Services
Ob -
Object Manager
Pf -
Prefetcher
Po - Power
Manager
Pp - PnP
Manager
Ps -
Process Support
Rtl -
Run-Time Library
Se -
Security
Sm - Store Manager
Tm -
Transaction Manager
Vf -
Verifier
Wdi - Windows Diagnostic Infrastructure
Whea -
Windows Hardware Error Architecture
Wmi -
Windows Management Instrumentation
Zw -
Mirror entry point for system services