Introduction to Windows System Internals part I.pptVIP

Introduction to Windows System Internals part I by Tim Shelton Black Security redsand@ Outline Brief History of the Windows Operating Systems Unicode Explained Registry Basics Windows Services (services.exe) Startup Shutdown Procedures QA Windows History Overview Microsoft formed its team of 20 developers in November 1988 4 core developers wrote key components Began a dream to write an Advanced Operating System Designed for Desktops and Servers Secure, scalable Multi-Processor design All new code base Windows History Overview Cont. Microsoft announced its commitment to rigorous discipline Developers are required detailed documentation Developers are required peer code review Developers are required to unit test their code.. Windows History Overview Cont. Past – Personal Computing, 16-32 bits, Windows 9x code base, objective: bringing computers to the consumer.Features – usability and compatibility Present – Enterprise Computing, 32/64 bits, NT code base, solid architectural foundation, objective: reliability, performance, and to meed the demands for Server Processing. Future – Managed Code (.NET Framework), objective: World Domination (go figure!) Longhorn. Commitment of the NT Architecture Reliability – Crash proof Operating System Security – Built into design from day one. Portability – Multi-processor support, avoiding non-portable solutions, flexible hardware abstraction Layer Modularity – Space to grow and needs to be fulfilled. Performance – Microsoft is willing to sacrifice performance for all of the above. Common Windows Internal Tools File Monitor – [filemon] List DLLs loaded within specific process virtual address space – [listdlls] Kernel Debuggers [windbg, kd] Platform SDK and Windows SDK Live Kernel Debugging [livekd] Object Viewer – [winobj] Process Explorer – [procexp] replacement for taskmgr and much more! And More! Visit the Platform SDK or Add text output/ screen shots here and next few slides Unicode and