(Ebook) Windows Kernel Programming, 2nd Edition by Pavel Yosifovich

(Ebook) Windows Kernel Programming, 2nd Edition by Pavel Yosifovich

IntroductionWho Should Read This BookWhat You Should Know to Use This BookBook ContentsSample CodeChapter 1: Windows Internals OverviewProcessesVirtual MemoryPage StatesSystem MemoryThreadsThread StacksSystem Services (a.k.a. System Calls)General System ArchitectureHandles and ObjectsObject NamesAccessing Existing ObjectsChapter 2: Getting Started with Kernel DevelopmentInstalling the ToolsCreating a Driver ProjectThe DriverEntry and Unload RoutinesDeploying the DriverSimple TracingSummaryChapter 3: Kernel Programming BasicsGeneral Kernel Programming GuidelinesUnhandled ExceptionsTerminationFunction Return ValuesIRQLC++ UsageTesting and DebuggingDebug vs. Release BuildsThe Kernel APIFunctions and Error CodesStringsDynamic Memory AllocationLinked ListsThe Driver ObjectObject AttributesDevice ObjectsOpening Devices DirectlySummaryChapter 4: Driver from Start to FinishIntroductionDriver InitializationPassing Information to the DriverClient / Driver Communication ProtocolCreating the Device ObjectClient CodeThe Create and Close Dispatch RoutinesThe Write Dispatch RoutineInstalling and TestingSummaryChapter 5: Debugging and TracingDebugging Tools for WindowsIntroduction to WinDbgTutorial: User mode debugging basicsKernel DebuggingLocal Kernel DebuggingLocal kernel Debugging TutorialFull Kernel DebuggingUsing a Virtual Serial PortUsing the NetworkKernel Driver Debugging TutorialAsserts and TracingAssertsExtended DbgPrintOther Debugging FunctionsTrace LoggingViewing ETW TracesSummaryChapter 6: Kernel MechanismsInterrupt Request Level (IRQL)Raising and Lowering IRQLThread Priorities vs. IRQLsDeferred Procedure CallsUsing DPC with a TimerAsynchronous Procedure CallsCritical Regions and Guarded RegionsStructured Exception HandlingUsing __try/__exceptUsing __try/__finallyUsing C++ RAII Instead of __try / __finallySystem CrashCrash Dump InformationAnalyzing a Dump FileSystem HangThread SynchronizationInterlocked OperationsDispatcher ObjectsMutexFast MutexSemaphoreEventNamed EventsExecutive ResourceHigh IRQL SynchronizationThe Spin LockQueued Spin LocksWork ItemsSummaryChapter 7: The I/O Request PacketIntroduction to IRPsDevice NodesIRP FlowIRP and I/O Stack LocationViewing IRP InformationDispatch RoutinesCompleting a RequestAccessing User BuffersBuffered I/ODirect I/OUser Buffers for IRP_MJ_DEVICE_CONTROLPutting it All Together: The Zero DriverUsing a Precompiled HeaderThe DriverEntry RoutineThe Create and Close Dispatch RoutinesThe Read Dispatch RoutineThe Write Dispatch RoutineTest ApplicationRead/Write StatisticsSummaryChapter 8: Advanced Programming Techniques (Part 1)Driver Created ThreadsMemory ManagementPool AllocationsSecure PoolsOverloading the new and delete OperatorsLookaside ListsThe “Classic” Lookaside APIThe Newer Lookaside APICalling Other DriversPutting it All Together: The Melody DriverClient CodeInvoking System ServicesExample: Enumerating ProcessesSummaryChapter 9: Process and Thread NotificationsProcess NotificationsImplementing Process NotificationsThe DriverEntry RoutineHandling Process Exit NotificationsHandling Process Create NotificationsProviding Data to User ModeThe User Mode ClientThread NotificationsImage Load NotificationsFinal Client CodeRemote Thread DetectionThe Detector ClientSummary