Windows internals 8th edition

The definitive guide–fully updated for Windows 10 and Windows Server 2016

Delve inside Windows architecture and internals, and see how core components work behind the scenes. Led by a team of internals experts, this classic guide has been fully updated for Windows 10 and Windows Server 2016.

Whether you are a developer or an IT professional, you’ll get critical, insider perspectives on how Windows operates. And through hands-on experiments, you’ll experience its internal behavior firsthand–knowledge you can apply to improve application design, debugging, system performance, and support.

This book will help you:

· Understand the Window system architecture and its most important entities, such as processes and threads

· Examine how processes manage resources and threads scheduled for execution inside processes

· Observe how Windows manages virtual and physical memory

· Dig into the Windows I/O system and see how device drivers work and integrate with the rest of the system

· Go inside the Windows security model to see how it manages access, auditing, and authorization, and learn about the new mechanisms in Windows 10 and Server 2016

I’ve been living, breathing, and training in operating systems and cybersecurity technology for almost two decades, and there’s nothing I love more. In part thanks to my ground-breaking research and wealth of Windows Internals knowledge, I am honored to have been recently recognized by the United States Government as an Alien of Extraordinary Ability, “demonstrating internationally recognized extraordinary abilities in the sciences through sustained national or international acclaim.”

As a developer, I started my career as one of the key lead kernel developers on the open source ReactOS project, and re-implemented from scratch, based on reverse engineering and black box testing, large parts of the Windows XP/2003 kernel (which was, at the time, current). Throughout that work, I uncovered dozens of vulnerabilities and just plain old bugs in the kernel and its many associated subsystems and drivers, both in user-mode and kernel-mode. I then moved on to work at Apple, Inc. where I was an intern and then part-time remote software engineer while completing my studies, and worked on the Core Platform team, where I helped port both iOS and iBoot, as well as related drivers, to exciting new platforms, ARM architectures, and SOCs, as well as worked on interesting and varied user-mode infrastructure such as SpringBoard, Mach RPC, and CoreAnimation. Finally, I joined CrowdStrike, Inc., as part of its launch team over five years ago, where I initially started as its Chief Architect, responsible for the overall vision and design of its endpoint security product, and have recently taken on a new role as the Vice President of EDR Strategy, to help cement its lead in the market and unparalleled visibility into operating system behaviors.

As a reverse engineer, I began tearing apart Windows long before my involvement with ReactOS. While now having joined the relics of GeoCities, Planet Source Code was a popular coding website where developers compete against one another to win the coveted “Superior Code Award”. Each of my 8 submissions gathered exclusively five-star reviews, and I had won the award three times by the time I moved on. My ongoing reverse engineering work and research led me to first publish at Recon in 2006 and BlackHat in 2008, followed by many more security conferences, where I have now participated in for over a decade.

Finally, as a teacher and technical writer, I first began by publishing an 125-page paper on Windows Internals on Planet Source Code, which covered key windows structures in the NT kernel, and was one of the first to leverage the use of Microsoft’s Public Symbol Files (PDB) to extract type data from the kernel. I later followed-up with an entire reverse engineering overview of the Visual Basic 6 File Format, which was used by many decompilers at the time (as well as some contracting work on the side). Finally, I eventually published a similar guide on the NTFS File Format, which greatly helped the ntfs-3g Linux Project achieve a more consistent understanding of the various data structures involved. I began giving small presentations on ReactOS and NT internals at various locations, including a presentation at Waterloo University in Canada, which eventually led to my contracting with David Solomon Expert Seminars, Inc., a real titan in the Windows Internals training world. Just as Winternals and Mark Russinovich had been acquired by Microsoft, I was contracted to “fill his shoes” (an impossible task) and began giving regular trainings at Microsoft for David, followed by a growing list of additional customers and organizations.

I now own my own consulting company, Winsider Seminars & Solutions, Inc., and continue to focus on researching, writing, and writing, about Windows. Please visit our training offerings on the site at http://www.windows-internals.com to see if our topics are of interest, or feel free to shoot me an e-mail if you have something custom in mind.

Windows Kernel Internals (slides)

Some documentation for specifics on the Kernel itself, these documents and individual for each subject.

Sys-Internals Books and Debugging

Here is an assorted collection of books from Sysinternals and some topics on Debugging Windows

Windows for Dummies

Here are some books from the ‘for Dummies’ series specific to Windows OS

Other Windows Books

Время на прочтение2 мин

Количество просмотров27K

Представляем вашему вниманию очередную новинку нашего издательства — долгожданное шестое издание легендарной книги Windows Internals, написанное Марком Руссиновичем, Дэвидом Соломоном и примкнувшим к ним в новом издании Алексом Ионеску.

Шестое издание книги Windows Internals охватывает внутреннее ядро компонентов Windows 7 и Windows Server 2008 R2.

Эта книга поможет вам:

• Понять, как работает ядро системы и механизмы управления начиная от диспетчера объектов до реестра.
• Узнать больше о системе внутренней структуры данных, используя такие инструменты, как отладчик ядра.
• Изучить изнутри модель безопасности Windows, чтобы увидеть, как она разрешает доступ к данным.
• Понять, как происходит управление физической и виртуальной памятью в Windows.
• Изучить сетевой стек Windows начиная с верхов до самых низов, включая API протоколов драйверов и драйверов сетевых адаптеров.
• Понять проблемы доступа к файловой системе и проблемы при загрузке системы.
• Узнать, как анализировать сбои.

Много писать о книге, пожалуй, не имеет смысла — Windows Internals прекрасно знакома всем специалистам по администрированию Windows и разработке приложений как основной учебник для углубленного изучения ядра данной операционной системы.

К сожалению, исторически сложилось так, что релиз оригинального издания выходит, как правило, спустя несколько лет после очередного релиза Windows, и иногда печатное издание поступает продажу, когда актуальна уже новая версия ОС. Так случилось и в этот раз.

Еще одним нововведением издания стало то, что впервые книга была разбита на два тома, с полугодовалым разрывом в выходе. Соответственно, представляемое русское издание — это перевод первого тома Windows Internals, второй в данный момент готовится к выпуску в нашем издательстве.

Оглавление книги можно посмотреть здесь, а отрывок прочитать здесь.

• книга на piter.com (доступна электронная версия!)
• книга на ozon.ru
• страница книги на сайте Microsoft