Abstract

This course is planned and organized to provide class attendees with practical experience on Windows C System Programming, and explain associated Windows system topics to allow students to understand how to expand their knowledge to create their own programs.

During this class we will cover concepts and programming techniques related to memory management and I/O operations as well as programming concepts involving kernel objects. Afterwards, we show to manage process creation from user programs. Class attendees will also learn how to create and manage threads, which supplements the previous topic about processes and introduces a key component under performance aspect. The second part of the course offers an extensive coverage on synchronization mechanisms such as interlocked functions, critical sections, semaphores, conditional variables and much more. Finally, the course presents, in its third part, a following up on thread pools and asynchronous operations.

This class will focus on Windows operating system and Visual Studio, exclusively.

Who Should Attend

This class should be attended by professionals interested in learning programming for reverse engineering and malware analysis on Windows as well as professionals who want to expand their current knowledge on reverse engineering and exploit development. Class attendees from different areas such as exploit development, incident response, threat hunting, reverse engineering pentesting and cyber defense will enjoy and benefit from this training.

Key Learning Objectives

This class has the following goals:

  • Review basic Windows internals concepts.
  • Learn how to write programs using memory and I/O mechanisms.
  • Learn concepts and how to write programs using kernel objects.
  • Learn techniques to write programs that manage processes and threads.
  • Master concepts and techniques to write programs that use synchronization mechanisms.
  • Learn how to manage thread pools through programming.
  • Learn concepts and how to write programs using Asynchronous I/O Operations.

Prerequisite Knowledge

Students should be have:

  • Previous experience on Windows operating systems.
  • Basic knowledge on any programming language.
  • Basic experience basic C programming could be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running Windows 11 x64.
  • Visual Studio and SDK installed (with WinDbg) on both Windows machines.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

  • Basics and Fundamental Constructions.
  • Memory.
  • Introduction to I/O Operations.
  • Kernel Objects.
  • Processes.
  • Threads.
  • Synchronization 1: Interlocked Function, Critical Sections and Mutexes.
  • Synchronization 1 (cont): SRWLock, Semaphores and Events.
  • Synchronization 2: Review, conditional variables and waitable timers.
  • Thread Pools.
  • Synchronous and Asynchronous I/O Operations.

Note: Topics can be added, merged or removed without prior notice!