The Windows Internals Master path broadens and deepens your understanding of the inner workings of Windows. You’ll become an expert in the Windows kernel, understand how OS components work under the hood, and generally be proficient in tackling any problem or research project on Windows.
Windows architecture.
Windows executive components inner workings.
User and kernel Debugging with WinDbg.
How to use various tools to gain insight into kernel objects.
Understand how the x86/x64 processors features are used by Windows.
What is this all about?
The Windows OS is the most used OS in the world. As such, it’s a popular platform for applications, services, and unfortunately, also a target for malicious actors. This path deepens your understanding of the inner workings of Windows, so you can tackle almost any project, such as security research, performance optimization, debugging, and more. The path focuses on Windows Internals and related topics, such as the x64 processor as the most commonly used CPU type on Windows platforms today.
Meet the instructor:
Software developer, trainer, consultant, author, and speaker. Co-author of "Windows Internals" 7th edition (2017). Author of "Windows Kernel Programming, 2nd ed" (2023), "Windows 10 System Programming Part 1" (2020) and Part 2 (2021), Author of "Windows Internals" series of courses on PluralSight.
Specialties: Software development (mostly) on the Windows platform, using C++, COM, .NET, and kernel APIs. Technologies including: DirectX, XNA, WPF, Silverlight, MFC, ATL, WTL, WCF, Kernel Device Drivers, Win32 API, Windows Internals, Rust, .NET, C++/CLI, UWP, C++11/14/17/20, Rust.
What's inside?
Students of this learning path will gain access to the following courses:
This course provides the fundamental knowledge of Windows concepts and architecture, including processes, threads, virtual memory, system calls, DLLs, handles and objects. This will serve as a good foundation for the following courses which focus on programming.
This course continues where Day 1 left off, digging deeper into processes – process creation and destruction, types of processes and more. Job objects are also described, including their extension called Silos that is the basis of Windows container implementation. Finally, threads are discussed, including scheduling and management.
This course deals with various kernel mechanisms. From interrupts and exceptions, through thread synchronization, NT global flags, Event Tracing for Windows, and finally Wow64.
This course deals with memory management. From process virtual memory page states, and protection, to virtual address translation performed by the CPU, to the various user mode and kernel mode APIs as they relate to memory.
The last “day” in the Windows Internals series deals with two topics. The I/O system is described, including the use of device drivers, and their integration into the system as whole. Then many security mechanisms are discussed, from access tokens, security descriptors, to access checks and integrity levels, among others.
This course teaches the basics of the x86/x64 assembly language from the ground up. It focuses on integrating it into C/C++ applications, but also shows how to write stand alone applications with assembly only.
Picking up where part 1 left off, this course dives into the architecture of modern x64 processors, describing their mode of operations, focusing on those used by modern operating systems like Windows, while describing the various mechanisms of the processor used on Windows, such as system calls, interrupts and more.
This course dives into the WinDbg debugger, and how to effectively use it in user mode and kernel mode debugging, as well as the analysis of kernel mode dump files.
The Sysinternals tools are free powerful tools that provide deep insight into Windows. This course dives deeper into the following tools, while discussing Windows Internals details: Process Explorer, WinObj, DebugView, VMMap, CPU Stress, Not My Fault, and LiveKd.