Processes and Threads
This course starts off with a quick overview of process, threads and jobs. This is followed by discussions on process resources, hosting processes, critical processes, WOW64 processes and key differences between desktop applications and Windows store applications. The discussion then moves on to threads and covers the difference between user and kernel mode threads, system calls, thread stacks, thread pools followed by properties of threads like execution states, scheduling, affinity and priority. Attendees will also learn how to investigate process resource consumption, identify stuck threads and troubleshoot high CPU usage problems.
Synchronization
Windows makes synchronization mechanisms like events, semaphores, mutexes, critical sections, slim reader-writer locks, spin locks and interlocked operations available to applications and device drivers. This section discusses the mechanisms and highlights the key differences between them. Causes of application and system hangs and deadlocks are also covered.
Memory Management
Memory is required for most tasks that Windows performs. This section starts with a discussion on physical and virtual memory and the mapping between them. It covers process and kernel mode virtual address space, virtual address allocation, shared memory, memory mapped I/O, working sets, thread stacks, heaps, file system cache, kernel memory pools etc. Security features implemented in the memory manager like DEP, ASLR, SMEP are also covered. Typical problems with memory utilization like leaks and memory oversubscription issues are also covered.
Objects and Handles
Most operating system resources used by applications and drivers like files, events, shared memory, transactions etc. are implemented as objects and managed by the object manager. This section discusses handles, objects, object namespace, object lifetime management, process handle table, handle duplication etc. Handle leaks and object name space conflicts are also covered.
Services
Windows depends on services for some of its most critical functionality. This section covers the infrastructure provided by windows for running services, service control database, service dependencies, service hosting processes, security contexts that service run under, service isolation, triggering service startup etc. Service thread attribution and shared service isolation are also covered.
Security
Today security is of paramount importance in any operating system. This section covers the security infrastructure provided by Windows and their involvement in various operations that occur. It starts with an overview of the Windows logon process which results in the generation of a security token. This discussion is followed by coverage of security identifiers (SIDs), tokens, restricted tokens, impersonation, TrustedInstaller account, AppContainers, service specific SIDs etc. The discussion moves on to topics related to securable objects in Windows like security descriptors, discretionary access control lists (DACLs), system access control lists (SACLs), access control entries and access inheritance. The above concepts are brought together with a discussion on access checks, mandatory integrity levels, and owner rights.
