Windows Internals & Software Drivers for Microsoft Students

Overview

This seminar is designed for Microsoft software engineers and architects who need to understand the details of the major Windows architectural components, as well as how to create software only kernel-mode drivers that serve as “extensions” to the Windows operating system. The seminar includes a review of basic Windows architecture, then discusses the details of driver structure, including the I/O and PnP subsystems, device discovery, enumeration, and I/O request processing. Other extension mechanisms, such as Object Manager, Process Manager, and Registry callbacks are discussed. The seminar also includes in-depth discussions of the Windows Kernel, process and thread instantiation, and the Memory Manager.

During lab sessions, participants create and modify software-only drivers to perform various kernel-mode tasks. Note that this seminar focuses on the development of drivers that service as Windows “operating system extensions” but do not service any hardware. Thus, while the basic concepts of drivers for devices are discussed, the lab sessions focus strictly on the development of software (i.e. pseudo) drivers which typically use “legacy” or “NT V4” style interfaces (as opposed to PnP).

Details

Length: 4 days

Format: Lecture and Lab

Cost and Date: Please see Learning Central for the latest information.

For More Info

Please email OSR’s Seminar Team or call 603-595-6500

Target Audience

Security researchers and engineers involved in security and threat analysis/modeling, who need a solid understanding of key Windows internals and data structures, and the options available to monitor and extend the actions of the Windows operating system. This seminar is also recommended for engineers who need to gain the prerequisite information before attending an OSR File Systems seminar.  This seminar is not appropriate for engineers who need to develop filter drivers for Windows hardware devices. Those students should instead opt for OSR’s Writing WDF Drivers I: Core Concepts seminar.

Prerequisites

This is not a seminar for beginners without knowledge or experience in operating systems. Rather, it is an intense, practical, architectural study of specific parts of the Windows O/S, interspersed with practical exercises. Students attending this seminar will need a good understanding of general O/S concepts and will be well served by starting with at least a basic Windows O/S architectural concepts (such as can be gained by reading Windows Internals by Russinovich, Solomon, and Ionescu).

Due to the hands-on orientation of this seminar, attendees will be assumed to be able to use Windows at a user level, including using Visual Studio (VC++). Working knowledge of the C programming language, and how to read and write to a file using Win32 (CreateFile, ReadFile, WriteFile) are also assumed.

Due to the highly compressed nature of this seminar, we will assume students taking this seminar already know how to compile and link a Windows driver using their team’s internal build environment (which is typically Razzle) or that they can easily learn this after they return from taking this class. In class, we use Visual Studio and the Windows Driver Kit (as described in Note on the Lab Environment, below).

We will also assume that students know the basics of installing, connecting, and using WinDbg. While clever students who have never used WinDbg will be able to learn what they need to know “on the fly” during lab sessions, knowing this info prior to the seminar will ensure that students spend their time during the lab sessions focused on learning core Windows and driver development topics, not on mastering the mechanics of the hooking up the debugger.

Note on the Lab Environment

Starting with Windows 8, the build environment that is used by customers to build drivers for Windows (the Windows Driver Kit) differs greatly from the build environment used internally by most groups.  To avoid syncing an enlistment for each student (and in so doing putting confidential information on lab machines) this class will use Visual Studio and the publically available Windows Driver Kit for labs. But don’t worry: Using the public tools for labs won’t restrict what you learn in the class in any way. Everything you learn in lab will be directly transferable to building and debugging driver code in your team’s internal build environment, whether that environment uses Visual Studio and the WDK, Razzle, or something else.

Hardware Requirement

Each student will need to bring a pre-configured and tested laptop with them to the seminar.  This laptop will be used for doing lab assignments.

The hardware and software requirements for this seminar are described on our OSR Seminar Laptop Setup Requirements page.

You’ll note that the class requires VMware for your laptop.  And you’re probably wondering if you can substitute Hyper-V in place of VMWare in class.  The answer to this is “yes, but we don’t recommend it.”  We want to be able to properly support you during your seminar experience, with answers to your questions and assistance with any problems you may discover.  Because we use VMWare for development internally at OSR, it’s the virtualization platform that we fully understand and that we’re confident we can help you with.  If you *really* want to use Hyper-V, you can… but only if all of the following conditions are true:

1. You have significant, hands-on, experience configuring and using Hyper-V as a kernel debugging target for driver testing.  This includes configuring the Hyper-V guest system as a debug target for WinDbg running on the host system.

2. You will not require any help using, installing, configuring, or managing Hyper-V from the OSR seminar staff during your seminar.

If you have any questions, don’t hesitate to contact OSR’s Seminar Team.

After This Seminar

This seminar provides you with the necessary information to attend OSR’s Developing File Systems for Windows seminar.

Seminar Outline