It’s been a while since I gave the Windows Internals training, so it’s time for another class of my favorite topics!
This time I decided to make it more afordable, to allow more people to participate. The cost is based on whether paid by an individual vs. a company. The training includes lab exercises – some involve working with tools, while others involve coding in C/C++.
- Public 5-day remote class
- Dates: April 20, 22, 23, 27, 30
- Time: 8 hours / day. Exact hours TBD
- Price: 750 USD (payed by individual) / 1500 USD (payed by company)
- Register by emailing zodiacon@live.com and specifying “Windows Internals Training” in the title
- Provide names of participants (discount available for multiple participants from the same company), company name (if any) and preferred time zone.
- You’ll receive instructions for payment and other details
- Virtual space is limited!
The training time zone will be finalized closer to the start date.
| Objectives: | Understand the Windows system architectureExplore the internal workings of process, threads, jobs, virtual memory, the I/O system and other mechanisms fundamental to the way Windows works
Write a simple software device driver to access/modify information not available from user mode |
| Target Audience: | Experienced windows programmers in user mode or kernel mode, interested in writing better programs, by getting a deeper understanding of the internal mechanisms of the windows operating system.Security researchers interested in gaining a deeper understanding of Windows mechanisms (security or otherwise), allowing for more productive research |
| Pre-Requisites: | Basic knowledge of OS concepts and architecture.Power user level working with Windows
Practical experience developing windows applications is an advantage C/C++ knowledge is an advantage |
- Module 1: System Architecture
- Brief Windows NT History
- Windows Versions
- Tools: Windows, Sysinternals, Debugging Tools for Windows
- Processes and Threads
- Virtual Memory
- User mode vs. Kernel mode
- Architecture Overview
- Key Components
- User/kernel transitions
- APIs: Win32, Native, .NET, COM, WinRT
- Objects and Handles
- Sessions
- Introduction to WinDbg
- Lab: Task manager, Process Explorer, WinDbg
- Module 2: Processes & Jobs
- Process basics
- Creating and terminating processes
- Process Internals & Data Structures
- The Loader
- DLL explicit and implicit linking
- Process and thread attributes
- Protected processes and PPL
- UWP Processes
- Minimal and Pico processes
- Jobs
- Nested jobs
- Introduction to Silos
- Server Silos and Docker
- Lab: viewing process and job information; creating processes; setting job limits
- Module 3: Threads
- Thread basics
- Thread Internals & Data Structures
- Creating and terminating threads
- Thread Stacks
- Thread Priorities
- Thread Scheduling
- CPU Sets
- Direct Switch
- Deep Freeze
- Thread Synchronization
- Lab: creating threads; thread synchronization; viewing thread information; CPU sets
- Module 4: Kernel Mechanisms
- Trap Dispatching
- Interrupts
- Interrupt Request Level (IRQL)
- Deferred Procedure Calls (DPCs)
- Exceptions
- System Crash
- Object Management
- Objects and Handles
- Sharing Objects
- Thread Synchronization
- Synchronization Primitives (Mutex, Semaphore, Events, and more)
- Signaled vs. Non-Signaled
- High IRQL Synchronization
- Windows Global Flags
- Kernel Event Tracing
- Wow64
- Lab: Viewing Handles, Interrupts; creating maximum handles; Thread synchronization
- Module 5: Memory Management
- Overview
- Small, large and huge pages
- Page states
- Memory Counters
- Address Space Layout
- Address Translation Mechanisms
- Heaps
- APIs in User mode and Kernel mode
- Page Faults
- Page Files
- Commit Size and Commit Limit
- Workings Sets
- Memory Mapped Files (Sections)
- Page Frame Database
- Other memory management features
- Lab: committing & reserving memory; using shared memory; viewing memory related information
- Module 6: Management Mechanisms
- The Registry
- Services
- Starting and controlling services
- Windows Management Instrumentation
- Lab: Viewing and configuring services; Process Monitor
- Module 7: I/O System
- I/O System overview
- Device Drivers
- Plug & Play
- The Windows Driver Model (WDM)
- The Windows Driver Framework (WDF)
- WDF: KMDF and UMDF
- Device and Driver Objects
- I/O Processing and Data Flow
- IRPs
- Power Management
- Driver Verifier
- Writing a Software Driver
- Labs: viewing driver and device information; writing a software driver
- Module 8: Security
- Security Components
- Virtualization Based Security
- Hyper-V
- Protecting objects
- SIDs
- User Access Control (UAC)
- Tokens
- Integrity Levels
- ACLs
- Privileges
- Access checks
- AppContainers
- Logon
- Control Flow Guard (CFG)
- Process mitigations
- Lab: viewing security information
Pavel Yosifovich 