Windows Fundamentals
Course Description
Understanding Windows internals is essential for exploitation. Learn the architecture, security mechanisms, and attack surfaces.
Course Structure
Modules
Module 1: Windows Architecture (6h)
- Kernel vs User mode
- System components
- HAL and drivers
- Subsystems
Module 2: Processes & Threads (6h)
- Process structure
- Thread management
- Job objects
- Process creation
Module 3: Memory Management (6h)
- Virtual memory
- Paging
- Memory protection
- Heap and stack
Module 4: File System (5h)
- NTFS structure
- Permissions
- Streams
- Junctions and links
Module 5: Registry (5h)
- Registry structure
- Hives and keys
- Security permissions
- Auto-start locations
Module 6: Security Model (6h)
- Access tokens
- Security descriptors
- Integrity levels
- UAC internals
Module 7: Networking (5h)
- Windows networking
- SMB protocol
- Named pipes
- Network authentication
Module 8: Security Features (6h)
- Windows Defender
- ASLR and DEP
- Credential Guard
- Device Guard
Tools
| Tool | Purpose |
|---|---|
| Process Monitor | Process analysis |
| Process Explorer | Process details |
| Autoruns | Startup analysis |
| Registry Editor | Registry analysis |
📄️ Overview
Windows internals for security professionals: architecture, processes, and security mechanisms