Overview

This windows internal architecture course discusses the components, architecture and internals of the Windows operating system. Attendees gain a good understanding of the behind the scenes working of Windows, the various components that make up the core of Windows and the interactions between them. The knowledge acquired from this course can be applied to both applications and devices drivers.

Hands-on Labs

Every topic in the course is accompanied by a hands-on lab that involves usage of Debugging Tools for Windows (WinDBG), SysInternals Tools and the Windows Performance Toolkit (XPERF) to investigate the state of the system and identify problem symptoms on both 32-bit and 64-bit Windows systems.

Prerequisites

This is an intermediate level course that requires attendees to have a working knowledge of Windows and be familiar with OS concepts. Knowledge of programming languages is NOT required.

Course duration

3 Days

Topics

Processes and Threads

This course starts off with a quick overview of process, threads and jobs. This is followed by discussions on process resources, hosting processes, critical processes, WOW64 processes and key differences between desktop applications and Windows store applications. The discussion then moves on to threads and covers the difference between user and kernel mode threads, system calls, thread stacks, thread pools followed by properties of threads like execution states, scheduling, affinity and priority. Attendees will also learn how to investigate process resource consumption, identify stuck threads and troubleshoot high CPU usage problems.

Synchronization

Windows makes synchronization mechanisms like events, semaphores, mutexes, critical sections, slim reader-writer locks, spin locks and interlocked operations available to applications and device drivers. This section discusses the mechanisms and highlights the key differences between them. Causes of application and system hangs and deadlocks are also covered.

Memory Management

Memory is required for most tasks that Windows performs. This section starts with a discussion on physical and virtual memory and the mapping between them. It covers process and kernel mode virtual address space, virtual address allocation, shared memory, memory mapped I/O, working sets, thread stacks, heaps, file system cache, kernel memory pools etc. Security features implemented in the memory manager like DEP, ASLR, SMEP are also covered. Typical problems with memory utilization like leaks and memory oversubscription issues are also covered.

Objects and Handles

Most operating system resources used by applications and drivers like files, events, shared memory, transactions etc. are implemented as objects and managed by the object manager. This section discusses handles, objects, object namespace, object lifetime management, process handle table, handle duplication etc. Handle leaks and object name space conflicts are also covered.

Services

Windows depends on services for some of its most critical functionality. This section covers the infrastructure provided by windows for running services, service control database, service dependencies, service hosting processes, security contexts that service run under, service isolation, triggering service startup etc. Service thread attribution and shared service isolation are also covered.

Security

Today security is of paramount importance in any operating system. This section covers the security infrastructure provided by Windows and their involvement in various operations that occur. It starts with an overview of the Windows logon process which results in the generation of a security token. This discussion is followed by coverage of security identifiers (SIDs), tokens, restricted tokens, impersonation, TrustedInstaller account, AppContainers, service specific SIDs etc. The discussion moves on to topics related to securable objects in Windows like security descriptors, discretionary access control lists (DACLs), system access control lists (SACLs), access control entries and access inheritance. The above concepts are brought together with a discussion on access checks, mandatory integrity levels, and owner rights.