Abstract

This course is planned and organized to provide class attendees with practical experience on Windows Internals and offer an appropriate coverage on its internal structures.

We offers an intensive course that delves into different topics and structures involved with Windows internals as well potential applicability of such structures for programming and reverse engineering. At the first part of this training, we will explain concepts about processes and threads, as well as we will explain how to interact with associated structures, and also how to retrieve important information of an online system by using WinDbg. The following section will present multiple aspects about memory management, which heap and its mechanisms are the most important, and how to interact with such structures internally.In the next section of the training, we will cover concepts about a complex theme that is I/O and Device Drivers, and we will delve into concepts and structures. Proceeding with the training, and one of most important chapters of the course, we will explain and show associated structures on Windows Security.

At the second part of this course, we will present to students concepts and structures of system mechanisms, which is a complex theme and includes concepts about hardware, synchronization, APC, WNF and other interesting mechanisms. The next topic covers hypervisors, which are a complex and critical feature of modern versions of Windows version, and we explain related concepts and few of multiple existing structures. The next section explains and shows information on Registry and Windows services, and as a supplement, concepts and internals of contemporary components such as WMI, ETW and related concepts. Finally, the training provides to class attendees with internals about NTFS and caching. Finally, we will learn basic details about the booting and shutdown Windows process.

This class will focus on Windows operating system, WinDbg and Visual Studio, exclusively.

Who Should Attend

This class should be attended by professionals interested in learning Windows internals for reverse engineering and malware analysis on Windows as well as professionals who want to expand their current knowledge on the referred topic. Class attendees from different areas such as exploit development, incident response, threat hunting, reverse engineering, pentesting and cyber defense will enjoy and benifit from this training.

Key Learning Objectives

Students attending this class:

  • Learn how to setup and use WinDbg to investigate internal structures.
  • Learn how to perform patch diffing.
  • Learn about internal archictecture.
  • Learn about process and thread internals.
  • Learn details about memory management.
  • Learn details about I/O systems.
  • Learn details about Windows security.
  • Learn details on system mechanisms internals as well how to investigate associated structures.
  • Learn details about virtualization internals and how to investigate associated structures.
  • Learn Registry and Windows services internals as other components such as WMI and ETW.
  • Understand caching and NTFS concepts and structures.
  • Understand the Windows booting and shutdown procedure.

Prerequisite Knowledge

Students should be have:

  • Previous experience on Windows operating systems.
  • Previous experience on WinDbg or any other debugger.
  • Knowledge on reverse engineering or malware analysis.
  • Previous experience programming might be useful.
  • Basic experience with disassemblers such as IDA Pro could be useful.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running Windows 11 x64.
  • Visual Studio and SDK installed (with WinDbg) on both Windows machines.
  • IDA Pro (preferred) or IDA Free installed on all system.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

  • Introduction and Lab Configuration
  • WinDbg
  • Kernel Debugging
  • Patching Diff
  • Concepts and Architecture
  • Process and Threads
  • Memory Management
  • I/O Systems
  • Security
  • System Mechanisms
  • Virtualization and Hypervisors
  • Registry and Windows Services
  • NTFS | Caching
  • Initialization and Shutdown

**Note: Topics can be added, merged or removed without prior notice!**Additional lab instructions will be sent to students prior the class.