Windows Internals

Pavel Yosifovich is a developer, trainer, and author specializing in Microsoft technologies and tools. He is a Microsoft MVP and a Pluralsight author, and loves all things software. Pavel has been around since the days of 8-bit machines and still looks back fondly on his programming days on his Commodore 64. Alex Ionescu is Vice President of EDR Strategy at CrowdStrike and an internationally recognized expert in low-level system software, operating system research and kernel development, security training, and reverse engineering. He teaches Windows Internals courses around the world and is active in the security research community through conference talks and bug bounty programs. Mark Russinovich is Chief Technology Officer for Microsoft Azure, Microsoft's global enterprise-grade cloud platform. Mark is a widely recognized expert in distributed systems and operating systems. He co-founded Winternals Software and joined Microsoft in 2006 when it was acquired. He is the primary author of the Sysinternals tools and website, which include dozens of popular Windows administration and diagnostic utilities. David Solomon (retired) taught Windows kernel internals for 20 years to developers and IT professionals worldwide, including at Microsoft. His first book was Windows NT for OpenVMS Professionals. He then authored Inside Windows NT, 2nd edition, and later, with Mark Russinovich, coauthored the 3rd, 4th, 5th, and 6th editions of the Windows Internals series. David has spoken at many Microsoft conferences and was a recipient of the 1993 and 2005 Microsoft Support Most Valuable Professional (MVP) award.

• Chapter 1: Concepts and toolsWindows operating system versionsFoundation concepts and termsDigging into Windows internalsConclusionChapter 2: System architectureRequirements and design goalsOperating system modelArchitecture overviewVirtualization-based security architecture overviewKey system componentsConclusionChapter 3: Processes and jobsCreating a processProcess internalsProtected processesMinimal and Pico processesTrustlets (secure processes)Flow of CreateProcessTerminating a processImage loaderJobsConclusionChapter 4: ThreadsCreating threadsThread internalsExamining thread activityThread schedulingGroup-based schedulingWorker factories (thread pools)ConclusionChapter 5: Memory managementIntroduction to the memory managerServices provided by the memory managerKernel-mode heaps (system memory pools)Heap managerVirtual address space layoutsAddress translationPage fault handlingStacksVirtual address descriptorsNUMASection objectsWorking setsPage frame number databasePhysical memory limitsMemory compressionMemory partitionsMemory combiningMemory enclavesProactive memory management (SuperFetch)ConclusionChapter 6: I/O systemI/O system componentsInterrupt Request Levels and Deferred Procedure CallsDevice driversI/O processingDriver VerifierThe Plug and Play managerGeneral driver loading and installationThe Windows Driver FoundationThe power managerConclusionChapter 7: SecuritySecurity ratingsSecurity system componentsVirtualization-based securityProtecting objectsThe AuthZ APIAccount rights and privilegesAccess tokens of processes and threadsSecurity auditingAppContainersLogonUser Account Control and virtualizationExploit mitigationsApplication IdentificationAppLockerSoftware Restriction PoliciesKernel Patch ProtectionPatchGuardHyperGuardConclusion