Windows Internals with Sysinternals
2 day webinar/virtual class - presented by David Solomon

Description

Spend 2 days with David Solomon exploring the internals of key Windows kernel components and mechanisms with the Sysinternals tools in this 2 day webinar (a subset of our full 5 day Windows OS internals class that we teach regularly to companies worldwide, including Microsoft).  The class is scheduled on a Monday and Wednesday to allow you a work day in between.

The webinar is transmitted via Microsoft Live Meeting and requires you install the Live Meeting client (the web client does not support voice over IP).  Joining instructions will be sent out the week prior to registered attendees.  Audio will be transmitted via the internet (phone dial in will be available if VOIP quality is not good enough - from past classes, 90% of attendees get clear audio from the VOIP).

Topics include kernel architecture, memory management, thread scheduling, interrupt processing, time accounting, and crash dump analysis. This knowledge will help you help you troubleshoot difficult system problems as well as understand the true meaning behind key system performance counters. Developers benefit by being able to understand the platform more deeply, which enables understanding performance tradeoffs as well as being able to debug system level issues more effectively.

If you want to follow along and try some of the tools referenced during the class, see the computer setup instructions.

Watch a Sample

You can view or download a 5 minute sample of a recent webinar:

Course Outline
1. Introduction

2. Tools Introduction

  • Process Explorer
  • Process Monitor
  • Autoruns

3. Kernel Architecture

  • Kernel evolution
  • Address Space Layouts
  • Kernel integrity mechanisms
  • Memory Protection Model
  • Multiprocessor support
  • Executive, Kernel, and HAL

4. System Mechanisms

  • Processes & Threads
  • System Threads
  • Interrupts & DPCs
  • Time Accounting
  

5. Processes, Threads and Thread Scheduling

  • Process, thread and job data structures
  • Process startup and exit
  • Priority Spectrum
  • Thread scheduling algorithms

6. Memory Management

  • Core Mechanisms
  • Virtual Address Translation
  • Working Set Management
  • File System Cache Manager
  • Physical Memory Management
  • Superfetch
  • Paging Files

7. Crash Dump Analysis

  • Why Windows crashes
  • What happens at the crash
  • Basic crash dump analysis
  • Harder dump analysis
  • System hangs