RSS Feed Subscribe to the RSS feed Last updated:  31 Jul 2012

Stack Prefixes for the Executive (Vista)


Extracted from Windows Internals v5, pg 73 & 74 (page numbers may be 72 & 73)  Pages 66 & 67 in Windows Internals v6 - Part 1
This is a list of the most commonly used one's.  There is more discussion in the article "Inside the Native API" from Sysinternals.
More info/links listed here:  http://www.sysnative.com/forums/showthread.php/3061-What-is-xxx-in-win32k!xxxInternalGetMessage-Anybody-seen-that?p=22415&viewfull=1#post22415

This is for the stuff after the ! in the stack trace.

Variations:  
- The first letter of the prefix followed by an "i" (for internal) indicates an internal kernel function.
- The full prefix followed by a "p" (for private) indicates an internal process support function

Alpc - Advanced Local Inter-Process Communication
Aux - Auxiliary Kernel-Mode Library Routines and Structures
Cc
 - Common Cache
Clfs - CLFS Management Library Routines
Cm - Configuration manager
Dbgk - Debugging Framework for User-Mode
Dma - DMA Library Routines
Em - Errata Manager
Etw - Event Tracing for Windows
Ex - Executive Support Routines
FsRtl - File System Driver Run-Time Library
Hal - Hardware Abstraction Layer
Hvl - Hypervisor Library
Io - I/O Manager
Kd - Kernel Debugger
Ke - Kernel
Lsa - Local Security Authority
Mm - Memory Manager
Nt - NT System Services
Ob - Object Manager
Pf - Prefetcher
Po - Power Manager
Pp - PnP Manager
Ps - Process Support
Rtl - Run-Time Library
Se - Security
Sm - Store Manager
Tm - Transaction Manager
Vf - Verifier
Wdi - Windows Diagnostic Infrastructure
Whea - Windows Hardware Error Architecture
Wmi - Windows Management Instrumentation
Zw - Mirror entry point for system services