Windows Internals

Developer/Security Expert

Duration: 5 Days

Course Description

Our flagship course aims to provide a variety of audiences the necessary skills and knowledge to have a thorough initial understanding of the design, architecture, and implementation of modern Windows operating systems. Providing two tracks — one for developers, and one for security experts — the course goes through nearly all core aspects of the kernel and its supporting components.

In the developer track, attendees will use tools such as Process Explorer, System Informer, WinObjEx64, and many other Sysinternals Tools in order to understand and troubleshoot the operation of Windows applications, services, and drivers. They will learn how to use the performance counter and tracing infrastructure to understand and monitor memory consumption, while learning the algorithms that drive virtual memory management, thread scheduling, wait dispatching, synchronization, ACL-based security access checks, I/O completion, and more. Developers will learn the basic algorithms and implementation of the object manager and registry, as well as key mechanisms such as IRQLs, APCs and DPCS. When needed, the Windows Kernel Debugger will also be used to drive further in-depth understanding of system data structures and behaviors.

In the security expert track, attendees will put greater emphasis of the use of the Windows Kernel Debugger, and learn its command set and capabilities inside out, including the development of WinDBG scripts and automation using NatVis and JavaScript. Using this knowledge, they will tear apart internal data structures to look for anomalies, learn the behaviors of various fields and bits, as well as learn how to analyze a system for forensic and real-time purposes to detect hidden processes, cached files, executable regions of memory, and more. A lower view into hardware-provided system security will be provided, such as deeper understanding of segmentation, system calls, and virtualization-based security.

Developer Course Outline

  • Introduction and Tools
  • OS Fundamentals
  • Kernel Infrastructure
  • Processes and Threads
  • Memory Management
  • System Mechanisms
  • Security
  • I/O System

The following topics are only discussed in the developer track:

System Components

WOW64, SuperFetch, I/O Manager, Registry

Thread & Memory Policies

Thread Scheduling, Job Objects, Paging Files, Commit Charge, Working Set, Wait Dispatching

Data Security

Authentication (Logon), Authorization (SIDs, SDs, ACEs & DACLs), Token Attributes & Claims, Integrity Levels

Security Course Outline

  • Introduction and Tools
  • WinDBG Primer
  • OS Design
  • Architecture & Fundamentals
  • Core & Executive Mechanisms
  • Execution & Memory Model

The following topics are only discussed in the security track:

System Architecture

x86/x64 CPU Design, User-mode Callbacks, Pico Processes, Secure Processes

Executive Components

Advanced Local Procedure Call (ALPC)

Forensics & Analysis

WinDBG Scripting & NatVis, LINQ, JavaScript, Registry Carving, Shared Memory/Cached File Forensics

Although the two tracks have a slightly different focus based on audience, many topics are covered in both flavors of the course.

Execution Fundamentals

Privilege Levels, Virtual Trust Levels (Hyper-V VTL), KPCR, KPRCB, NUMA & Topology, Timers, Interrupts, APCs, DPCs, IRQLs, System Calls, PatchGuard

Memory Fundamentals

Address Space Layouts, Hardware Page Translation, VADs, Code Signing, Pool Manager, PFN Database

System Fundamentals

Object Manager, App Container, Process Management, Protected Process Light, Sessions