Developer/Security Expert
Duration: 5 Days
Course Description
Our flagship course aims to provide a variety of audiences the necessary skills and knowledge to have a thorough initial understanding of the design, architecture, and implementation of modern Windows operating systems. Providing two tracks — one for developers, and one for security experts — the course goes through nearly all core aspects of the kernel and its supporting components.
In the developer track, attendees will use tools such as Process Explorer, System Informer, WinObjEx64, and many other Sysinternals Tools in order to understand and troubleshoot the operation of Windows applications, services, and drivers. They will learn how to use the performance counter and tracing infrastructure to understand and monitor memory consumption, while learning the algorithms that drive virtual memory management, thread scheduling, wait dispatching, synchronization, ACL-based security access checks, I/O completion, and more. Developers will learn the basic algorithms and implementation of the object manager and registry, as well as key mechanisms such as IRQLs, APCs and DPCS. When needed, the Windows Kernel Debugger will also be used to drive further in-depth understanding of system data structures and behaviors.
In the security expert track, attendees will put greater emphasis of the use of the Windows Kernel Debugger, and learn its command set and capabilities inside out, including the development of WinDBG scripts and automation using NatVis and JavaScript. Using this knowledge, they will tear apart internal data structures to look for anomalies, learn the behaviors of various fields and bits, as well as learn how to analyze a system for forensic and real-time purposes to detect hidden processes, cached files, executable regions of memory, and more. A lower view into hardware-provided system security will be provided, such as deeper understanding of segmentation, system calls, and virtualization-based security.
Developer Course Outline
- Introduction and Tools
- OS Fundamentals
- Kernel Infrastructure
- Processes and Threads
- Memory Management
- System Mechanisms
- Security
- I/O System
The following topics are only discussed in the developer track:
System Components
WOW64, SuperFetch, I/O Manager, Registry
Thread & Memory Policies
Thread Scheduling, Job Objects, Paging Files, Commit Charge, Working Set, Wait Dispatching
Data Security
Authentication (Logon), Authorization (SIDs, SDs, ACEs & DACLs), Token Attributes & Claims, Integrity Levels
Security Course Outline
- Introduction and Tools
- WinDBG Primer
- OS Design
- Architecture & Fundamentals
- Core & Executive Mechanisms
- Execution & Memory Model
The following topics are only discussed in the security track:
System Architecture
x86/x64 CPU Design, User-mode Callbacks, Pico Processes, Secure Processes
Executive Components
Advanced Local Procedure Call (ALPC)
Forensics & Analysis
WinDBG Scripting & NatVis, LINQ, JavaScript, Registry Carving, Shared Memory/Cached File Forensics
Although the two tracks have a slightly different focus based on audience, many topics are covered in both flavors of the course.
Execution Fundamentals
Privilege Levels, Virtual Trust Levels (Hyper-V VTL), KPCR, KPRCB, NUMA & Topology, Timers, Interrupts, APCs, DPCs, IRQLs, System Calls, PatchGuard
Memory Fundamentals
Address Space Layouts, Hardware Page Translation, VADs, Code Signing, Pool Manager, PFN Database
System Fundamentals
Object Manager, App Container, Process Management, Protected Process Light, Sessions