Index

Symbols

! (exclamation points), 40

.NET Framework, 6–7

64-bit address space layouts, 357–359

64-bit extended systems, 50

A

AAM (Admin Approval Mode), 729

access

access checks, 621–624

access masks, 624

access tokens, 20, 677

ACEs (access control entries). See ACEs

ACLs (access control lists). See ACLs

object access auditing, 679–681

access checks, 621–624

access control entries. See ACEs

access control lists. See ACLs

access masks, 624

access tokens, 20, 677

accounting (quantums), 233

accounts

privileges, 668–675

Bypass Traverse Checking privilege, 675

super privileges, 675–676

rights, 668–670

User Account Control. See UAC

ACEs (access control entries)

conditional ACEs, 667–668

GUI security editors, 664–665

overview, 650–653

trust SIDs, 657–658

ACLs (access control lists)

assigning, 656–657

determining access, 659–665

GUI security editors, 664–665

inheritance, 656–657

overview, 650–653

Owner Rights SIDs, 662

activation contexts, 163

address spaces

64-bit address space layouts, 357–359

ARM address space layouts, 356–357

canonical addresses, 359

creating processes, 140–142

dynamic allocation, 359–365

image bias, 368

PTEs, 355–356

quotas, 364–365

sessions, 353–355

setting address limits, 363–364

types of data, 348–349

user address spaces. See user address spaces

viewing address usage, 361–363

x64 virtual address limitations, 359

x86 address space layouts, 349–352

x86 session space, 353–355

x86 system address space layouts, 352–353

address translation

ARM virtual address translation, 381–382

overview, 371

page tables, 375–376

PTEs, 375–376

TLB, 377–378

viewing, 378–380

write bits, 376–377

x64 virtual address translation, 380–381

x86 virtual address translation, 371–375

Address Windowing Extensions (AWE), 22, 323–324

addresses, canonical, 359

Admin Approval Mode (AAM), 729

administrative rights (UAC), 729–732

advanced audit policy, 683–684

affinity manager, 336

affinity masks

extended affinity masks, 276–277

symmetric multiprocessing, 53

threads, 275–277

allocating

address spaces

dynamic allocation, 359–365

quotas, 364–365

memory, 310–315

API Sets (image loader), 173–176

APIs (application programming interfaces)

API Sets (image loader), 173–176

AuthZ, 666–667

COM (component object model), 5

.NET Framework, 6–7

overview, 4

Windows Runtime, 5–6

AppContainers

brokers, 709

capabilities, 699–703

handles, 705–708

lowboxes, defined, 134

object namespaces, 703–705

overview, 684

security environment. See security environment

tokens, 690–692

UWP apps, 685–687

UWP processes, 687–692

AppIDs, 756–757

application programming interfaces. See APIs

applications. See also processes

APIs. See APIs

AppContainers. See AppContainers

AppIDs, 756–757

AppLocker, 757–762

classic apps, 103

desktop apps, 103

immersive apps, 103

large address spaces, 351

modern apps, 103

UWP apps, 685–687

AppLocker, 757–762

applying priority boosts, 249

architecture

components, 61–62

kernel mode, 47–49

overview, 47–49, 61–62

user mode, 47–49

VBS, 59–61

ARM address space layouts, 356–357

ARM virtual address translation, 381–382

ASLR. See address spaces

assertions

compilers, 753

fast fail failure codes, 754–756

operating system, 753

overview, 752–753

assigning

ACLs, 656–657

processors (groups), 271–273

assured authentication, 718–719

asymmetric multiprocessing, 51

asynchronous I/O, 511

atom tables, 697–698

attributes

AppContainer security, 695–697

converting, 131–135

trustlets, 125

auditing (security)

advanced audit policy, 683–684

global audit policy, 682–683

object access auditing, 679–681

overview, 677–679

authentication

policies (Credential Guard), 616–617

users, 713–718

Kerberos, 714–715

MSV1_0, 713–714

viewing active logon sessions, 715–717

AuthZ API, 666–667

Autoboost, 254

auto-elevation (UAC), 732–733

AWE (Address Windowing Extensions), 22, 323–324

B

balance set manager

priority boosts, 247

working sets, 421–422

bandwidth, reserving, 551–552

binary planting, 160

bitmaps (CFG), 744–747

BNO isolation, 708

brokers (AppContainers), 709

buckets (heaps), 335

built-in trustlets, 125

bumps, 549, 551

bus drivers, 493

Bypass Traverse Checking Privilege, 675

C

caching files, 513

calculating load address, 368–369

cancelling I/O

overview, 537

thread termination, 539

users, 537–538

canonical addresses, 359

catalog files (Plug and Play), 574

CBAC (Claims-Based Access Control), 667

CC (Common Criteria), 607

CFG (Control Flow Guard), 741

bitmaps, 744–747

image loader, 750–751

kernel CFG, 751–752

overview, 741–742

strengthening, 747–749

suppression, 741, 748

viewing, 742–744

CFI (control flow integrity), 740

checked build (kernel debugging), 57–58

checking large address space support, 351

Claims-Based Access Control (CBAC), 667

class drivers, 494

classic apps, 103

classification, memory combining, 461

clients, memory limits, 447–449

clock cycles, 233–234

clock interval, 232

clustered page faults, 387–388

collided page faults, 387

COM (component object model), 5

combining memory

classification, 461

combined pages release, 464–465

creating shared PTEs, 462–464

overview, 459–460

page combining, 462

searching, 460

viewing, 465–467

command prompt windows, opening, 13

commands

! (exclamation points), 40

!address, 746

!ca, 408, 411

!cpuinfo, 233

!dbgprint, 58

!dd, 380

!devnode, 562–563

!devobj, 504–506, 524

!devstack, 521

!dq, 379

!drvobj, 504–506, 512, 517

!file, 408

!fileobj, 509

!handle, 109, 408, 707

!heap, 338

!heap -i, 341–343

!heap -s, 340

!irp, 519, 522, 541

!irpfind, 521

!job, 180–182, 265, 294

!list, 167

!lookaside, 331

!memusage, 410

!numa, 270

!object, 502–504

!partition, 448

!pcr, 77, 260

!peb, 109–110, 166

!pfn, 443

!poolused, 328

!popcaps, 597

!popolicy, 598

!prcb, 77s

!process, 109, 180–181, 197, 261, 518

!pte, 375, 379, 466

!ready, 230–231

!runas, 180

!sd, 655

!session, 353

!silo, 189

!smt, 268

!sysptes, 355

!teb, 201–205

!thread, 109, 197–199, 201, 261, 518

!token, 637

!vad, 402

!verifier, 557

!vm, 307

!vm 4, 355

!wdfkd.wdfldr, 580

!wmiprint, 58

!wsle, 420

.process, 109–110

~, 202, 209

at, 8

AuditPol, 682

bang commands, 40

cron, 8

dd, 380

docker, 190

dt, 40–42, 78, 108, 182

dump, 40

g, 70, 265

k, 70, 210

lm, 112

poolmon, 327

powercfg /a, 592

powercfg /h, 591

powercfg /list, 598

q, 43

runas, 101

schtacks, 8

start, 218–219

u, 71

ver, 3

winver, 3

commit charge

memory manager, 313

page faults. See page faults

commit limit

commit charge, 394–396

memory manager, 313

committed pages (private pages), 310–313

Common Criteria (CC), 607

communication, secure, 614–615

compilers, assertions, 753

completion ports, 541–546

component object model (COM), 5

components

architecture, 61–62

I/O, 483–488

memory manager, 302–303

security, 608–611

SuperFetch, 473–474

compression (memory), 449–456

concurrency (threads), 542

conditional ACEs, 667–668

configuring

DFSS, 290–292

quantum, 237–238

Connected Standby, 594

consent elevation (UAC), 729

consoles, 67

container notification (I/O), 552

containers (silos)

ancillary functionality, 189–190

containers, 190–191

contexts, 186–188

creating, 188–189

isolation, 184–186

monitors, 187–188

objects, 183–184

overview, 183

context switches, 215

context switching, 255–256

contexts

activation contexts, 163

context switches, 215

context switching, 255–256

Direct Switch, 255–256

directed context switch, 19

image loader, 163

jobs (silos), 186–188

threads, 18

Control Flow Guard. See CFG

control flow integrity (CFI), 740

controlling

power, 599–600

quantums, 234–235

converting attributes, 131–135

copy-on-write, 321–323

cores (threads), 52

CPU

rate limits, 292–295

sets, 278–283

starvation, 246–248

Credential Guard

authentication policies, 616–617

Kerberos armoring, 616–617

NTOWF/TGT key, 613–614

overview, 612–613

passwords, 613

secure communication, 614–615

UEFI, 616

credential providers (DLLs), 98

CSR_PROCESS data structure, 105, 111–112

CSR_THREAD data structure, 195, 205–206

D

DAC (Dynamic Access Control), 666

DACLs. See ACLs

data

address spaces, 348–349

loading, 471–472

Data Execution Protection (DEP), 319–321

data structures

PFN, 440–443

processes

!process command, 109

CSR_PROCESS, 105, 111–112

DXGPROCESS, 105

EPROCESS, 105–108

ETHREAD, 105

KPROCESS, 106–107

W32PROCESS, 105, 113

threads

CSR_THREAD, 195, 205, 206

ETHREAD, 194–201

KTHREAD, 194–201

databases

dispatcher database, 228–230

image loader, 164–168

loaded modules database, 164–168

deadline scheduling, 254

debuggers

kernel-mode debugger, 210–212

user-mode debugger, 209–210

debugging

DebugActiveProcess function, 39

DebugBreak function, 194

heaps, 342–346

kernel-mode debugger, 210–212

kernel debugging. See kernel debugging

unkillable processes, 539–541

user-mode debugger, 209–210

Debugging Tools for Windows (kernel debugging), 38–42

kernel-mode debugging, 39–40

user-mode debugging, 39

viewing type information, 41–42

Deferred Procedure Calls (DPCs)

I/O, 490–492

stacks, 401

demand paging, 413

DEP (Data Execution Protection), 319–321

Dependency Walker

exported functions, 34–35

HAL image dependencies, 80–82

subsystems, 62–63

design goals (Windows), 45–46

desktop apps, 103

determining access (ACLs), 659–665

device drivers

bus drivers, 493

class drivers, 494

device objects, 500–507

dispatch routines, 504, 517–518

driver objects, 500–507

Driver Verifier. See Driver Verifier

file objects, 507–510

filter drivers, 493

function drivers, 493

installing, 571–575, 577

IRPs

dispatch routines, 517–518

layered drivers, 533–536

overview, 525–528

user address spaces, 528–531

KMDF, 578–587

layered drivers

IRPs, 533–536

overview, 494–496

loading, 575–577

opening devices, 507–510

overview, 82–83, 492–496

port drivers, 494–495

power manager, 596

routines, 498–500

support, 560–561, 569–571

types, 492–496

UMDF, 578–581, 587–590

Universal Windows Drivers, 85

viewing, 85–88, 496–498

WDF. See WDF

WDK (Windows Driver Kit), 43–44

WDM, 83–84, 493–494

Device Guard, 617–619

device objects (device drivers), 500–507

devices

drivers. See device drivers

device stacks, 563–569

devnodes, 563–569

enumeration, 561–563

opening, 507–510

support, 560–561

trees, 561–563

DFSS (dynamic fair share scheduling), 289–292

Direct Swit0ch, 255–256

directed context switch, 19

dispatch events, 239–240

dispatch routines

device drivers, 504

IRPs, 517–518

dispatcher database, 228–230

dispatchers, 215

displaying. See viewing

DLLs

credential providers, 98

DllMain function, 154

image loader

import parsing, 168–170

name redirection, 162–163

name resolution, 160–162

safe DLL search mode, 160

viewing DLL load search order, 163–164

Ntdll.dll, 70–72

overview, 8

subsystem DLLs, 48

subsystems, 62–63

DPCs (Deferred Procedure Calls)

I/O, 490–492

stacks, 401

driver objects (device drivers), 500–507

Driver Verifier

I/O, 554–555

memory

IRQL checking, 557

low resources simulation, 557–558

miscellaneous checks, 558–559

pool tracking, 556–557

special pool, 555–556

overview, 552–554

drivers. See device drivers

dumping

device trees, 562–563

dump command, 40

ETHREAD structure, 197–198

KTHREAD structure, 197–198

silo contexts, 187–188

DXGPROCESS data structure, 105

Dynamic Access Control (DAC), 666

dynamic allocation (address spaces), 359–365

dynamic fair share scheduling (DFSS), 289–292

dynamic processors, 295–296

E

editions (Windows), 54–57

EMET (Enhanced Mitigation Experience Toolkit), 370

enclaves (memory), 467–472

Enhanced Mitigation Experience Toolkit (EMET), 370

entries (PFN), 443

enumeration (devices), 561–563

environment (AppContainers security)

overview, 693–695

viewing atom table, 697–698

viewing security attributes, 695–697

EPROCESS data structure, 105–108

EPROCESS object, 138–140

ETHREAD data structure, 105, 194–201

events

dispatch events, 239–240

notification events, 423–425

examining. See viewing

exclamation points (!), 40

executing initial thread, 148

executive, 72–75

executive process object, 138–143

executive resources (priority boosts), 242–243

exiting threads, 260

experiments

allocating memory, 311–313

Bypass Traverse Checking Privilege, 675

calculating load address, 368–369

checked build, 57–58

checking large address space support, 351

configuring quantums, 237–238

creating maximum number of threads, 399

debugging unkillable processes, 539–541

dumping

device trees, 562–563

ETHREAD structure, 197–198

KTHREAD structure, 197–198

silo contexts, 187–188

identifying trustlets, 129

launching programs at low integrity levels, 641–642

Performance Monitor kernel mode/user mode comparison, 26–27

setting address limits, 363–364

tracing process startup, 149–154

troubleshooting pool leaks, 329–330

using virtual service accounts, 647–650

viewing

access masks, 624

active logon sessions, 715–717

address translation, 378–380

address usage, 361–363

AppContainer atom table, 697–698

AppContainer capabilities, 701–703

AppContainer security attributes, 695–697

AppContainer tokens, 690–692

brokers, 709

CFG, 742–744

CFG bitmaps, 746–747

clock cycles per quantum, 233–234

control areas, 408–412

CPU rate limits, 293–295

CPU sets, 279–283

CPU starvation, 247–248

CSR_PROCESS structure, 112

CSR_THREAD structure, 206

DEP, 321

device drivers, 85–88

device objects, 502–506

devnodes, 568–569

DLL load search order, 163–164

driver catalog files, 574

driver dispatch routines, 517–518

driver INF files, 573

driver objects, 504–506

driver power mappings, 596

drivers, 496–498

DSS, 290–292

enabling privileges, 673–675

EPROCESS data structure, 107–108

ETHREAD structure, 196–201

exported functions, 34–35

fast I/O, 512–513

file objects, 508–509

file virtualization, 726–727

filtered admin tokens, 645–646

foreground boosts, 243–245

free page lists, 429–430

global audit policy, 682

GUI boosts, 245–246

HAL image dependencies, 80–82

heaps, 338–341

idle threads, 260–262

image loader, 156–157

integrity levels, 628–631

I/O priority boosting/bumping, 551

I/O priority throughput, 549–551

IRPs, 518–519, 521–524

jobs, 180–183

kernel stacks, 400–401

kernel type information, 41–42

KMDF drivers, 580–581

KPCR, 77–78

KPRCB, 77–78

KTHREAD structure, 196–201

loaded modules database, 166–167

look-aside lists, 331–332

memory, 305–308

memory compression, 455–456

memory partitions, 458

memory-mapped files, 316–317

MMCSS priority boosting, 252–253

modified page lists, 430–435

notification events, 424–425

NUMA processors, 270–271

object access auditing, 679–681

page files, 390–392, 397–398

page priorities, 437

pageheap, 344–346

PEB, 110–111

PFN, 427–428

PFN entries, 443

pool size, 326–327

power availability requests, 603

power states, 592–593

prefetch file reads and writes, 415–416

processes, affinity, 275–276

processes, data structures, 109

processes, process tree, 12–13

processes, Process Explorer, 16–18

processes, Task Manager, 9–11

protected processes, 118–119

PTEs, 355–356

ready threads, 230–231

section objects, 406–407

security descriptors, 654–656

service processes, 97–98

services, 97

sessions, 353–355

SIDs, 626–627

SMT processors, 268–269

SRPs, 764

stacks, 521

standby page lists, 430–435

subsystems, 62–63

swap files, 393

system power capabilities, 597–599

system service dispatcher, 70–71

TEB, 201–205

thread freezing, 265–266

thread pools, 299–300

thread priorities, 219–222

thread states, 224–228

threads, clock interval, 232

threads, kernel-mode debugger, 210–212

threads, protected processes, 213

threads, user-mode debugger, 209–210

token stored handles, 706–708

tokens, 635–640

trust SIDs, 658

UMDF drivers, 580–581

user address spaces, 366–367

UWP processes, 689–690

VADs, 402–403

virtual page files, 393

Windows edition enabled features, 56–57

working sets, 418–421

zero page lists, 429–430

exploit mitigation

assertions. See assertions

CFG. See CFG

control flow integrity, 740

overview, 735

process mitigation policies, 735–740

extended affinity masks, 276–277

F

facilities (Windows edition enabled features), 56–57

fast fail failure codes, 754–756

fast I/O, 511–513

fast user switching, 30, 475

fault-tolerant heaps (FTH), 347–348

fibers, 19

file mapping objects, 20

file objects (device driv0ers), 507–510

files

caching, 513

catalog files, 574

file mapping objects, 20

INF files, 573

mapped-file I/O, 513

memory-mapped files, 315–317

page files. See page files

virtualization (UAC), 722–727

filter drivers, 493

filtered admin tokens (SIDs), 645–646

filters (function drivers), 493

firmware, 29

flags, converting, 131–135

flow (IRPs), 519–520

foreground threads, 243–245

frameworks

.NET Framework, 6–7

power management framework, 600–601

WBF (Windows Biometric Framework), 719–721

free pages

lists, 429–430

memory manager, 310–313

freezing threads, 264–266

FTH (fault-tolerant heaps), 347–348

functions

AllocConsole, 63

AvTaskIndexYield, 254

BaseThreadInit, 160, 170

ConvertThreadToFiber, 19

CreateFiber, 19

CreateFile, 34

CreateProcess, 101–104, 129–131, 134, 157

CreateProcessAsUser, 101–103, 139

CreateProcessInternal, 101–103

CreateProcessInternalW, 129, 131, 134–138, 146–147, 150

CreateProcessWithLogonW, 101–103

CreateProcessWithTokenW, 101–103

CreateRemoteThread, 193–194

CreateRemoteThreadEx, 194, 206–207

CreateThread, 193–194, 199, 208

Csr, 71–72

DbgUi, 72

DebugActiveProcess, 39

DebugBreak, 194

DeviceIoControl, 73

DgbPrintEx, 58

DllMain, 154

drivers, 493

Etw, 72

Ex, 73

ExitProcess, 154

exported, 34–35

GetQueueCompletionStatus, 176

GetSystemTimeAdjustment, 232

GetThreadContext, 18

GetVersionEx, 2

HeapAlloc, 332

HeapCreate, 332

HeapDestroy, 332

HeapFree, 332

HeapLock, 332

HeapReAlloc, 332

HeapUnlock, 332

HeapWalk, 332

Inbv, 73

Io, 73

IoCompleteRequest, 241

Iop, 73

Ke, 75

KeStartDynamicProcessor, 295

KiConvertDynamicHeteroPolicy, 287

KiDeferredReadyThread, 274, 284

KiDirectSwitchThread, 256

KiExitDispatcher, 241, 256

KiProcessDeferredReadyList, 274

KiRemoveBoostThread, 241, 250

KiSearchForNewThreadOnProcessor, 283

KiSelecthreadyThreadEx, 267

KiSelectNextThread, 266–267

Ldr, 70–71

LdrApplyFileNameRedirection, 175

Mi, 73

MiZeroInParallel, 303

NtCreateProcessEx, 104, 120

NtCreateThreadEx, 207

NtCreateUserProcess, 104

NtCreateWorkerFactory, 298

OpenProcess, 39

overview, 7–8

PopInitializeHeteroProcessors, 286

prefixes, list of, 87–88

PsCreateSystemThread, 194

PspAllocateProcess, 104, 138

PspComputeQuantum, 235

PspCreatePicoProcess, 104

PspInitializeApiSetMap, 175

PspInsertProcess, 104, 143

PsTerminateSystemThread, 194

QueryInformationJobObject, 179

ReadFile, 25

ReadProcessMemory, 20

ResumeThread, 264

Rtl, 72

RtlAssert, 58

RtlCreateUserProcess, 104

RtlGetVersion, 55

RtlUserThreadStart, 208

RtlVerifyVersionInfo, 55

secure system calls, 71

SetInformationJobObject, 275

SetPriorityClass, 218

SetProcessAffinityMask, 275

SetProcessWorkingSetSize, 222

SetThreadAffinityMask, 275

SetThreadIdealProcessor, 278

SetThreadSelectedCpuSets, 279

subsystem DLLs, 63

SuspendThread, 264

SwitchToFiber, 19

system services, 72

SystemParametersInfo, 178

TerminateJobObject, 179

TerminateProcess, 154

TermsrvGetWindowsDirectoryW, 170

TimeBeginPeriod, 232

TimeSetEvent, 232

TpAllocJobNotification, 176

UserHandleGrantAccess, 176

VerifyVersionInfo, 2, 55

VirtualLock, 314

WaitForMultipleObjects, 256

WaitForSingleObject, 256

Wow64GetThreadContext, 19

WriteProcessMemory, 20

ZwUserGetMessage, 210

G

games (priority boosts), 251–254

global audit policy, 682–683

granularity (memory), 314–315

groups

claims, 718

processors, 271–273

scheduling

CPU rate limits, 292–295

DFSS, 289–292

dynamic processors, 295–296

overview, 287–289

GUI

security editors, 664–665

threads (priority boosts), 245–246

GUIDs (Switchback), 171–173

H

HAL (hardware abstraction layer)

overview, 79–82

viewing image dependencies, 80–82

handles

AppContainers, 705–708

token stored handles, 706–708

hardware

firmware, 29

HAL. See HAL

kernel support, 78–79

hashes (AppContainer atom tables), 697–698

heaps/pools

affinity manager, 336

buckets, 335

debugging, 342–346

FTH (fault tolerant heaps), 347–348

HeapAlloc function, 332

HeapCreate function, 332

HeapDestroy function, 332

HeapFree function, 332

HeapLock function, 332

HeapReAlloc function, 332

HeapUnlock function, 332

HeapWalk function, 332

leaks, 329–330

LFH (low-fragmentation heaps), 335–336

look-aside lists, 331–332

NT heaps, 334

non-paged pools, 325

overview, 324–325, 332

paged pools, 325

pageheap, 343–346

poolmon command, 327

processes, 333

randomizing (user address spaces), 369

security, 341–342

segment heaps, 336–337

size, 325–327

special pools, 325, 555–556

synchronization, 334–335

thread pools, 297–300

tracking, 556–557

types, 334

usage, 327–329

viewing, 338–341

heterogenous multiprocessing, 52

heterogenous scheduling, 286–287

hibernation, 475

hiding. See viewing

hierarchies (jobs), 179–180

host (consoles), 67

hybrid jobs, 183

HyperGuard, 768–769

hypervisor, 27–28

I

IBAC (Identity-Based Access Control), 667

ideal node, 278

ideal processor, 277–278

identification

AppIDs, 756–757

trustlets, 129

identities (trustlets), 125–126

Identity-Based Access Control (IBAC), 667

Idle process, 89–90

idle threads, 260–263, 267

image bias, 368

image loader

activation contexts, 163

API Sets, 173–176

binary planting, 160

CFG, 750–751

DLL import parsing, 168–170

DLL load search order, 163–164

DLL name redirection, 162–163

DLL name resolution, 160–162

early initialization, 157–160

loaded modules database, 164–168

overview, 155–156

post-import process initialization, 170

safe DLL search mode, 160

Switchback, 171–173

viewing, 156–157

images

HAL, 80–82

image bias, 368

loading. See image loader

native images (subsystems), 72

opening, 135–138

randomizing (user address spaces), 367–369

immersive applications, 103

immersive processes, 103–104

impersonation (SIDs), 642–644

implementation (SAS), 712

importing DLLs, 168–170

INF files, 573

inheritance (ACLs), 656–657

initial thread

creating, 144–146

executing, 148

initializing

memory enclaves, 469, 472

processes

creating processes, 148–149

image loader, early, 157–160

image loader, post-import process, 170

subsystem, 146–147

Winlogon, 711–712

in-paging I/O, 386–387

input. See I/O

installing drivers, 571–575, 577

integrity levels (SIDs), 628–631, 641–642

interfaces (APIs)

API Sets (image loader), 173–176

AuthZ, 666–667

COM (component object model), 5

.NET Framework, 6–7

overview, 4

Windows Runtime, 5–6

internal synchronization, 308

Interrupt Request Levels (IRQLs), 488–490, 557

invalid PTEs, 384–385

inversion

I/O priorities, 549

priority boosts, 246

I/O

asynchronous, 511

cancelling

overview, 537

thread termination, 539

users, 537–538

completion ports, 541–546

components, 483–488

concurrency, 542

container notifications, 552

device drivers. See device drivers

DPCs, 490–492

Driver Verifier, 554–555, 557

fast I/O, 511–513

file caching, 513

in-paging I/O, 386–387

I/O manager, 485–486

IRPs (I/O request packets). See IRPs (I/O request packets)

IRQLs, 488–490, 557

mapped-file I/O, 513

overview, 483–488

Plug and Play

catalog files, 574

device enumeration, 561–563

device stacks, 563–569

device support, 560–561

device trees, 561–563

devnodes, 563–569

driver installation, 571–575

driver support, 560–561, 569–571

INF files, 573

overview, 559–560

power manager

controlling power, 599–600

drivers, 596

overview, 590–594

performance states, 601

power availability requests, 602–603

power management framework, 600–601

power mappings, 595

power states, 590–594

system capabilities, 597–599

priorities. See priorities

priority boosts, 241–242

processing, 486–488

scatter/gather I/O, 513

synchronous, 511

thread-agnostic I/O, 536–537

WDF. See WDF

I/O manager, 485–486

I/O request packets. See IRPs

IoCompletion object, 542

IRPs (I/O request packets), 513

cancelling 537–539

dispatch routines, 517–518

flow, 519–520

layered drivers, 533–536

overview, 513–515, 525–528

stacks, 515–519, 521

synchronization, 531–533

user address spaces, 528–531

viewing, 518–519, 521–524

IRQLs (Interrupt Request Levels), 488–490, 557

isolation (jobs), 184–186

J

jobs

creating, 178–179

hierarchies, 179–180

hybrid jobs, 183

limits, 177–178

overview, 20–21, 176–177

silos. See silos (jobs)

viewing, 180–183

K

Kerberos

armoring, 616–617

authentication, 714–715

kernel

debugging

checked build, 57–58

Debugging Tools for Windows, 38–42

kernel-mode debugging, 39–40

LiveKd, 43

overview, 38

symbols, 38

threads, 210–212

type information, 41–42

user-mode debugging, 39

hardware support, 78–79

jobs. See jobs

kernel CFG, 751–752

kernel mode. See kernel mode

KPCR, 76–78

KPRCB, 76–78

objects, 75

overview, 75

patches

processes

defined, 106

structure, 141

secure kernel, 59–61

stacks, 400–401

user address spaces, 369

kernel mode

architecture, 47–49

user mode comparison, 23–27, 46

kernel patches

HyperGuard, 768–769

overview, 764–765

PatchGuard, 765–768

kernel processor control block (KPRCB), 76–78

kernel processor control region (KPCR), 76–78

KMDF (WDF), 578–587

KPCR (kernel processor control region), 76–78

KPRCB (kernel processor control block), 76–78

KPROCESS data structure, 106–107

KTHREAD data structure, 194–201

L

large address spaces, checking support, 351

large pages (memory manager), 303–304

last processor, 277–278

launching programs at low integrity levels, 641–642

layered drivers

IRPs, 533–536

overview, 494–496

layouts

64-bit address space layouts, 357–359

ARM address space layouts, 356–357

user address spaces, 365–367

x86 address space layouts, 349–352

x86 system address space layouts, 352–353

lazy evaluation, 323

leaks (pools), 329–330

Legacy Standby, 594

levels

SID integrity levels, 628–631, 641–642

thread priorities, 215–219

LFH, 335–336 (low-fragmentation heaps), 335–336

lightweight threads, 19

Linux subsystems, 68–70

lists

look-aside lists (pools), 331–332

minimum TCB list, 117

page lists, 429–435

LiveKd, 43

load address (user address spaces), 368–369

loading

data (memory enclaves), 471–472

drivers, 575–577

images. See image loader

load address (user address spaces), 368–369

locking/locks

memory, 314

priority boosts, 241

logging (SuperFetch), 474–475

logical prefetcher (working sets), 413–416

logon

assured authentication, 718–719

group claims, 718

overview, 710–711

SAS implementation, 712

user authentication, 713–718

Kerberos, 714–715

MSV1_0, 713–714

viewing active logon sessions, 715–717

WBF, 719–721

Windows Hello, 721

Windows logon process, 98–99

Winlogon initialization, 711–712

look-aside lists, 331–332

low resources simulation, 557–558

LowBox. See AppContainers

low-fragmentation heaps (LFH), 335–336

M

managing

power. See power manager

working sets, 417–421

mandatory labels (SIDs), 630

mapped page writer, 438–439

mapped-file I/O, 513

mappings (power), 595

masks

access masks, 624

affinity masks. See affinity masks

memory

address spaces. See address spaces

address translation. See address translation

AWE (Address Windowing Extensions), 22, 323–324

combining, 459–467

compression, 449–456

Driver Verifier

IRQL checking, 557

low resources simulation, 557–558

miscellaneous checks, 558–559

pool tracking, 556–557

special pool, 555–556

enclaves, 467–472

heaps/pools. See heaps/pools

limits

physical memory, 446–447

Windows clients, 447–449

Memory Compression process, 91

memory manager. See memory manager

NUMA (non-uniform memory architecture). See NUMA

page faults. See page faults

partitions, 456–458

PFN. See PFN

section objects, 405–412

stacks, 398

SuperFetch. See SuperFetch

VADs (virtual address descriptors). See VADs (virtual address descriptors)

virtual memory, 21–23

working sets

WSRM, 222–223

Memory Compression process, 91

memory manager

allocating memory, 310–315

attaching to the process, 310

AWE, 323–324

commit charge, 313

commit limit, 313

committed pages, 310–313

components, 302–303

copy-on-write, 321–323

DEP, 319–321

free pages, 310–313

granularity, 314–315

internal synchronization, 308

large pages, 303–304

lazy evaluation, 323

locking memory, 314

memory-mapped files, 315–317

NX page protection, 319

overview, 301–302

pages, defined, 304

protecting memory, 317–319

reserved pages, 310–313

services overview, 309–310

shareable pages, 310–313

shared memory, 315

small pages, 303–304

viewing memory, 305–308

memory-mapped files, 315–317

minimal processes, 104, 120

minimum TCB list, 117

miscellaneous checks (Device Driver), 558–559

mitigating exploits. See exploit mitigation

mitigations (security), 370

MMCSS (Multimedia Class Scheduler Service), 239, 251–254

model (operating system), 46–47

modern apps, 103

modern processes, 103–104

Modern Standby, 594

modified page lists, 430–435

modified page writer, 438–439

modules (image loader), 164–168

monitors (silos), 187–188

MSV1_0 authentication, 713–714

Multimedia Class Scheduler Service (MMCSS), 239, 251–254

multiple sessions, 29–30

multiprocessor systems

affinity masks, 53, 275–276

asymmetric, 51

CPU sets, 278–283

extended affinity masks, 276–277

heterogenous, 52

ideal node, 278

ideal processor, 277–278

last processor, 277–278

NUMA systems, 269–271

overview, 268

processors

groups, 53, 271–273

number per group, 273

selecting, 284–286

state, 274

scheduler scalability, 274

selecting, 283–284

SMT systems, 268–269

symmetric, 51–53

multitasking (operating system), 51

N

namespaces, 703–705

native images, 72

native processes, 104

.NET Framework, 6–7

nodes

devnodes, 563–569

ideal node, 278

processors, 52

no-execute (NX) page protection, 319

non-paged pools, 325

non-uniform memory architecture. See NUMA

notification events, 423–425

NT heaps, 334

Ntdll.dll, 70–72

NTOWF/TGT key, 613–614

NUMA (non-uniform memory architecture)

overview, 404

processors, 270–271

systems, 269–271

numbers

processors per group, 273

threads, creating maximum, 399

NX (no-execute) page protection, 319

O

objects

device drivers

device objects, 500–507

file objects, 507–510

driver objects

device drivers, 500–507

dispatch routines, 504

EPROCESS object, 138–140

executive process object, 138–143

file mapping objects, 20

IoCompletion, 542

jobs. See jobs

kernel objects, 75

namespaces (AppContainers), 703–705

object access auditing, 679–681

overview, 30–31

section objects, 405–412

security

access checks, 621–624

ACEs. See ACEs

ACLs. See ACLs

DAC, 666

overview, 619–621

security descriptors, 650–656

SIDs. See SIDs

virtual service accounts, 646–650

OneCore, 3–4

opening

command prompt windows, 13

devices, 507–510

images, 135–138

operating system (OS)

assertions, 753

model, 46–47

multitasking, 51

scalability, 53

OTS (over-the-shoulder ) elevation, 729

output. See I/O

over-the-shoulder (OTS) elevation, 729

Owner Rights SIDs, 662

P

packets. See IRPs

PAE (Physical Address Extension), 371

page directory entry (PDE), 374

page directory pointer entry (PDPE), 374

page directory pointer table (PDPT), 372

page faults

clustered page faults, 387–388

collided page faults, 387

commit charge

commit limit, 394–396

page file size, 397–398

in-paging I/O, 386–387

overview, 383–384

page files

overview, 389–390

swap files, 392–393

viewing, 390–392

virtual page files, 393

PTEs

invalid PTEs, 384–385

prototype PTEs, 385–386

soft page faults, 384

page files

overview, 389–390

reservations (PFNs), 443–446

size (commit charge), 397–398

swap files, 392–393

viewing, 390–392

virtual page files, 393

page frame number. See PFN

page lists, 428–435

page table entries. See PTEs

page tables, address translation, 375–376

paged pools, 325

pageheap, 343–346

pages

combining

memory combining, 462

releasing, 464–465

committed pages, 310–313

defined, 304

faults. See page faults

files. See page files

free pages, 310–313

mapped page writer, 438–439

memory manager, 310–313

modified page writer, 438–439

page frame number. See PFN

page lists. See page lists

page tables, address translation, 375–376

paged pools, 325

pageheap, 343–346

PDE (page directory entry), 374

PDPE (page directory pointer entry), 374

PDPT (page directory pointer table), 372

PFN. See PFN

priorities, 436–437, 476–478

PTEs (page table entries). See PTEs

reserved pages, 310–313

shareable pages, 310–313

states, 425–428

SuperFetch, 476–478

parameters, validating, 131–135

parsing DLLs, 168–170

partitions, 456–458

passwords (Credential Guard), 613

patches (kernel). See patches (kernels)

HyperGuard, 768–769

overview, 764–765

PatchGuard, 765–768

PatchGuard, 765–768

PCB (process control block), 106

PCR (processor control region), 260

PDE (page directory entry), 374

PDPE (page directory pointer entry), 374

PDPT (page directory pointer table), 372

PEB (Process Environmental Block), 105

overview, 105

setting up, 143

viewing, 110–111

performance

Performance Monitor. See Performance Monitor

robust performance, 478–479

states, 601

SuperFetch, 478–479

Performance Monitor

kernel mode/user mode comparison, 26–27

overview, 36–38

PFN (page frame number)

data structures, 440–443

entries, 443

mapped page writer, 438–439

modified page writer, 438–439

overview, 425–428

page files (reservations), 443–446

page lists, 428–435

page priorities, 436–437

page states, 425–428

viewing, 427–428

Physical Address Extension (PAE), 371

physical memory limits, 446–447

Pico

creating processes, 104

overview, 121–122

subsystems, 68–70

placement policies (working sets), 416–417

Plug and Play (PnP)

devices

catalog files, 574

device stacks, 563–569

devnodes, 563–569

driver installation, 571–575

driver support, 569–571

enumeration, 561–563

INF files, 573

support, 560–561

trees, 561–563

drivers, 560–561

overview, 559–560

policies

advanced audit policy, 683–684

authentication policies, 616–617

Credential Guard, 616–617

global audit policy, 682–683

process mitigation policies, 735–740

SRPs (software restriction policies), 757, 762–764

trustlets, 124–125

Windows edition enabled features, 56–57

pools

size, 326–327

threads, 299–300

usage, 327–329

port drivers, 494–495

portability (Windows), 50–51

ports

completion ports, 541–546

port drivers, 494–495

power manager

Connected Standy, 594

controlling power, 599–600

drivers, 596

Legacy Standy, 594

Modern Standy, 594

overview, 590–594

performance states, 601

power availability requests, 602–603

power management framework, 600–601

power mapings, 595

power states, 590–594

system capabilities, 597–599

PPL (Protected Processes Light), 115–120

preemption (threads), 257–258

prefetcher (working sets), 413–416

prefixes (functions), 87–88

priorities. See also priority boosts

I/O

bandwidth reservation, 551–552

boosts, 549, 551

bumps, 549, 551

inversion, 549

overview, 546

strategies, 547–548

viewing throughput, 549–551

pages, 436–437

SuperFetch, 476–478

threads

levels, 215–219

real-time, 218–219

viewing, 219–222

priority boosts. See also priorities

applying, 249

Autoboost, 254

balance set manager, 247

CPU starvation, 246–248

deadline scheduling, 254

dispatch events, 239–240

executive resources, 242–243

foreground threads, 243–245

games, 251–254

GUI threads, 245–246

I/O, 241–242

locks, 241

MMCSS, 239, 251–254

multimedia, 251–254

overview, 238–239

priority inversion, 246

removing, 250

scheduling category, 251

unwait boosts, 240–241

private pages (committed pages), 310–313

privileges (accounts), 668–675

Bypass Traverse Checking privilege, 675

super privileges, 675–676

.process, 109–110

process control block (PCB), 106

Process Environmental Block (PEB), 105

overview, 105

setting up, 143

viewing, 110–111

Process Explorer, 14–18

process reflection (SuperFetch), 480–482

process tree, viewing, 12–14

process VADs, 402–403

processes. See also applications

access tokens, 677

attaching to the process, 310

console host, 67

creating

address space, 140–142

converting attributes, 131–135

converting flags, 131–135

executing initial thread, 148

executive process object, 138–143

initial thread, 144–146

initializing process, 148–149

initializing subsystem, 146–147

kernel process structure, 141

opening images, 135–138

overview, 101–104, 129–130

setting up EPROCESS object, 138–140

setting up PEB, 143

tracing startup, 149–154

validating parameters, 131–135

data structures

!process command, 109

CSR_PROCESS, 105, 111–112

DXGPROCESS, 105

EPROCESS, 105–108

ETHREAD, 105

KPROCESS, 106–107

W32PROCESS, 105, 113

debugging unkillable processes, 539–541

heaps, 333

image loader. See image loader

immersive processes, 103–104

jobs. See jobs

kernel processes, 106

minimal processes, 104, 120

minimum TCB list, 117

mitigation policies, 735–740

modern processes, 103–104

native processes, 104

overview, 8–18

PCB (process control block), 106

PEB (Process Environmental Block). See PEB (Process Environmental Block)

Pico. See Pico

protected processes. See protected processes

reflection (SuperFetch), 480–482

secure processes. See trustlets

system processes. See system processes

terminating, 154–155

trustlets. See trustlets

UWP processes, 687–692

VADs, 402–403

viewing

DLL load search order, 163–164

image loader, 156–157, 163–164

PEB, 110–111

Process Explorer, 14–18, 118–119

process tree, 12–14

protected processes, 118–119, 212–213

Task Manager, 9–11

processing I/O, 486–488

processor control region (PCR), 260

processors

groups

assigning, 271–273

number of processors per group, 273

scheduling (dynamic processors), 295–296

symmetric multiprocessing, 53

ideal processor, 277–278

KPCR, 76–78

KPRCB, 76–78

last processor, 277–278

nodes, 52

multiprocessor systems. See multiprocessing/multiprocessor systems

NUMA, 270–271

PCR (processor control region), 260

selecting, 284–286

SMT, 268–269

state, 274

programs. See applications

Protected Process Light (PPL), 115–120

protected processes

overview, 113–115

PPLs, 115–120

viewing

Process Explorer, 118–119

threads, 212–213

protecting memory, 317–319

prototype PTEs, 385–386

PspInsertProcess function, 104, 143

PTEs (page table entries)

address spaces, 355–356

address translation, 375–376

creating shared PTEs, 462–464

defined, 372

invalid PTEs, 384–385

prototype PTEs, 385–386

Q

quantums (threads), 258–260

accounting, 233

clock cycles, 233–234

clock interval, 232

configuring, 237–238

controlling, 234–235

overview, 231–232

registry value, 236–237

variable quantums, 235–236

quotas (address spaces), 364–365

R

randomization (user address spaces)

heap, 369

images, 367–369

stacks, 369

viewing support, 370–371

ratings (security)

CC, 607

TCSEC, 605–607

ready threads, 230–231

ReadyBoost, 479–480

ReadyBoot, 413–416

ReadyDrive, 480

real-time priorities (threads), 218–219

reflection (process reflection), 480–482

registry

overview, 32–33

threads (quantum), 236–237

viewing (security keys), 610

virtualization (UAC), 722–724, 727–728

releasing combined pages, 464–465

removing priority boosts, 250

requests. See IRPs

reservations (PFNs), 443–446

reserved pages (memory manager), 310–313

reserving bandwidth, 551–552

Resource Monitor, 36–38

resources

Driver Verifier, 557–558

low resources simulation, 557–558

Resource Monitor, 36–38

restricted tokens (SIDs), 644–645

rights (accounts), 668–670

robust performance, 478–479

rotate VADs, 403

routines

device drivers, 498–500

dispatch routines. See dispatch routines

overview, 7–8

S

SACLs. See ACLs

safe DLL search mode, 160

sandboxes (lowboxes), 134

SAS implementation, 712

saturation values, 216

scalability

operating system, 53

scheulers, 274

scatter/gather I/O, 513

scenarios (SuperFetch), 475–476

schedulers (scalability), 274

scheduling

groups

CPU rate limits, 292–295

DFSS, 289–292

dynamic processors, 295–296

overview, 287–289

priority boosts

deadline scheduling, 254

scheduling category, 251

schedulers (scalability), 274

threads

context switches, 215

dispatchers, 215

exiting, 260

heterogenous, 286–287

preemption, 257–258

quantums, 258–260

terminating, 260

voluntary switching, 256–257

scheduling category, 251

SDK (software development kit), 43

searching

image loader, 160

memory combining, 460

safe DLL search mode, 160

section objects, 405–412

secure communication (Credential Guard), 614–615

secure kernel, 59–61

secure processes (trustlets)

attributes, 125

built-in, 125

identifying, 129

identities, 125–126

overview, 61, 123–124

policies, 124–125

services, 127–128

system calls, 128

Secure System process, 91

security

access tokens. See access tokens

accounts

privileges, 668–675

privileges, Bypass Traverse Checking privilege, 675

privileges, super privileges, 675–676

rights, 668–670

AppContainers. See AppContainers

AppIDs, 756–757

AppLocker, 757–762

auditing. See auditing (security)

AuthZ API, 666–667

CBAC, 667

components, 608–611

Credential Guard. See Credential Guard

Device Guard, 617–619

exploit mitigation. See exploit mitigation

GUI security editors, 664–665

heaps, 341–342

IBAC, 667

kernel patches. See kernel patches

logon. See logon

mitigations (user address spaces), 370

objects

access checks, 621–624

ACEs. See ACEs

ACLs. See ACLs

DAC, 666

overview, 619–621

security descriptors. See security descriptors, 650

SIDs. See SIDs, 625

virtual service accounts, 646–650

overview, 31–32, 605

ratings. See ratings (security)

secure communication (Credential Guard), 614–615

secure kernel, 59–61

secure processes. See secure processes (trustlets)

secure system calls (functions), 71

Secure System process, 91

security descriptors. See security descriptors

SIDs (security identifiers). See SIDs

SRPs, 757, 762–764

trustlets. See trustlets

UAC (User Account Control). See UAC (User Account Control)

UIPI, 660–661

VBS (virtualization-based security). See VBS (virtualization-based security)

architecture, 59–61

hypervisor, 28

viewing (registry keys), 610

virtualization

files, 722–727

overview, 611–612, 722

registry, 722–724, 727–728

VSM. See VSB

security descriptors

overview, 650–653

viewing, 654–656

security identifiers. See SIDs

segment heaps, 336–337

selecting

processors, 284–286

threads, 266–267, 283–284

server silos. See silos

Service Control Manager, 96

service processes, 97–98

services

memory manager, 309–310

overview, 7–8

Service Control Manager, 96

service processes, 97–98

system service dispatcher, 70–71

trustlets, 127–128

viewing, 97

Session Manager process, 92–95

sessions

multiple, 29–30

viewing, 353–355

Session Manager process, 92–95

x86 session space, 353–355

setting

address limits, 363–364

EPROCESS object, 138–140

PEB, 143

UAC, 733–734

shareable pages, 310–313

shared memory, 315

sharing PTEs, 462–464

showing. See viewing

SIDs (security identifiers)

filtered admin tokens, 645–646

impersonation, 642–644

integrity levels, 628–631, 641–642

mandatory labels, 630

overview, 625–626

Owner Rights SIDs, 662

restricted tokens, 644–645

tokens, 632–640

trust SIDs, 657–658

viewing, 626–627

silos (jobs)

ancillary functionality, 189–190

containers, 190–191

contexts, 186–188

creating, 188–189

isolation, 184–186

monitors, 187–188

objects, 183–184

overview, 183

simulating low resources, 557–558

size

large address spaces, checking support, 351

page files

commit charge, 397–398

memory manager, 303–304

pools, 325–327

small pages (memory manager), 303–304

SMT systems, 268–269

soft page faults, 384

software development kit (SDK), 43

software PTEs, 384–385

software restriction policies (SRPs), 757, 762–764

special pools, 325, 555–556

SRPs (software restriction policies), 757, 762–764

stacks

device stacks, 563–569

DPC stacks, 401

IRPs, 515–519, 521

kernel stacks, 400–401

overview, 398

Plug and Play, 563–569

randomizing, 369

user address spaces, 369

user stacks, 399

standby

SuperFetch, 475

page lists, 430–435

startup (subsystems), 63–64

states

pages (PFN), 425–428

processors, 274

threads, 223–228

storage (TLS), 18

strategies (I/O priorities), 547–548

strengthening CFG, 747–749

structures

data structures. See data structures

kernel process structure, 141

subsystems

console host, 67

DLLs, 62–63

initializing, 146–147

Linux, 68–70

native images, 72

Ntdll.dll, 70–72

overview, 62–63

Pico providers, 68–70

startup, 63–64

subsystem DLLs, 48

viewing types, 62–63

Windows subsystem, 64–67

super privileges, 675–676

SuperFetch

components, 473–474

fast user switching, 475

hibernation, 475

logging, 474–475

overview, 472–474

page priorities, 476–478

process reflection, 480–482

ReadyBoost, 479–480

ReadyDrive, 480

robust performance, 478–479

scenarios, 475–476

standby, 475

tracing, 474–475

support (Plug and Play), 560–561, 569–571

suppression (CFG), 741, 748

suspending threads, 264

swap files, 392–393

swapper (working sets), 421–422

switches/switching

context switches/switching, 215, 255–256

Direct Switch, 255–256

directed context switch, 19

voluntary switching, 256–257

symbols

kernel debugging, 38

viewing kernel type information, 41–42

symmetric multiprocessing, 51–53

synchronization

heaps, 334–335

internal synchronization, 308

IRPs, 531–533

memory, 308

synchronous I/O, 511

Sysinternals, 44

system address space layouts (x86), 352–353

System and Compressed Memory process, 90

system calls (trustlets), 128

system capabilities (power manager), 597–599

System process, 90–91

system processes

Idle process, 89–90

Memory Compression process, 91

overview, 88–89

Secure System process, 91

Service Control Manager, 96

service processes, 97–98

Session Manager process, 92–95

System and Compressed Memory process, 90

System process, 90–91

system thread, 90–91

Windows Initialization process, 95–96

Windows logon process, 98–99

system PTEs (page table entries)

address spaces, 355–356

address translation, 375–376

creating shared PTEs, 462–464

defined, 372

invalid PTEs, 384–385

prototype PTEs, 385–386

system services (functions), 72

system thread, 90–91

system working sets, 422–423

systems

PTEs (page table entries). See PTEs (page table entries)

subsystems. See subsystems

Sysinternals, 44

system address space layouts (x86), 352–353

System and Compressed Memory process, 90

system calls (trustlets), 128

system capabilities (power manager), 597–599

System process, 90–91

system processes. See system processes

system services (functions), 72

system thread, 90–91

system working sets, 422–423

SystemParametersInfo function, 178

viewing (system service dispatcher), 70–71

T

tables (PTEs, page table entries)

address spaces, 355–356

address translation, 375–376

creating shared PTEs, 462–464

defined, 372

invalid PTEs, 384–385

prototype PTEs, 385–386

Task Manager, 9–11

TCB (thread control block)

minimum TCB list, 117

overview, 196

TCSEC (Trusted Computer System Evaluation Criteria), 605–607

TEB (thread environment block)

overview, 194, 198

viewing, 201–205

Terminal Services, 29–30

terminating

I/O, 539

processes, 154–155

TerminateJobObject function, 179

threads, 260, 539

thread-agnostic I/O, 536–537

thread control block (TCB)

minimum TCB list, 117

overview, 196

thread environment block (TEB)

overview, 194, 198

viewing, 201–205

Thread Information Block (TIB), 201

thread local storage (TLS), 18

thread pools, 297–300

threads

access tokens, 20, 677

cancelling I/O, 539

concurrency, 542

context, 18

context switching, 255–256

contexts, 18

cores, 52

creating, 193–194, 206–207, 399

data structures

CSR_THREAD, 195, 205–206

ETHREAD, 194–201

KTHREAD, 194–201

Direct Switch, 255–256

directed context switch, 19

dispatcher database, 228–230

fibers, 19

file mapping objects, 20

freezing, 264–266

group scheduling

CPU rate limits, 292–295

DFSS, 289–292

dynamic processors, 295–296

overview, 287–289

idle threads, 260–263, 267

initial thread, 144, 145–146, 148

maximum number, 399

multiprocessor systems. See multiprocessor systems

overview, 18–19

PCR, 260

priorities

levels, 215–219

real-time, 218–219

viewing, 219–222

priority boosts

applying, 249

Autoboost, 254

balance set manager, 247

CPU starvation, 246–248

deadline scheduling, 254

dispatch events, 239–240

executive resources, 242–243

foreground threads, 243–245

games, 251–254

GUI threads, 245–246

I/O, 241–242

locks, 241

MMCSS, 239, 251–254

multimedia, 251–254

overview, 238–239

priority inversion, 246

removing, 250

scheduling category, 251

unwait boosts, 240–241

quantums. See quantums (threads)

ready, 230–231

saturation values, 216

scheduling

context switches, 215

dispatchers, 215

exiting, 260

heterogenous, 286–287

preemption, 257–258

quantums, 258–260

terminating, 260

voluntary switching, 256–257

scheduling overview, 214–215

selecting, 266–267, 283–284

states, 223–228

suspending, 264

system thread, 90–91

TCB (thread control block). See TCB (thread control block)

TEB (thread environment block). See TEB (thread environment block)

terminating, 539

thread-agnostic I/O, 536–537

thread pools, 297–300

TIB (Thread Information Block), 201

TLS (thread local storage), 18

UMS threads, 19–20

VADs (virtual address descriptors), 20

viewing

kernel-mode debugger, 210–212

overview, 207–209

protected processes, 212–213

ready, 230–231

TEB, 201–205

user-mode debugger, 209–210

worker factories, 297–300

throughput (I/O priorities), 549–551

TIB (Thread Information Block), 201

TLB (translation look-aside buffer), 377–378

TLS (thread local storage), 18

tokens

access tokens, 677

AppContainters, 690–692

BNO isolation, 708

SIDs, 632–640

stored handles, 706–708

tools

Debugging Tools for Windows (kernel debugging), 38–42

Windows, viewing internals, 35–36

tracing

process startup, 149–154

SuperFetch, 474–475

tracking pools (Device Driver), 556–557

translating addresses

ARM virtual address translation, 381–382

overview, 371

page tables, 375–376

PTEs, 375–376

TLB, 377–378

viewing, 378–380

write bits, 376–377

x64 virtual address translation, 380–381

x86 virtual address translation, 371–375

translation look-aside buffer (TLB), 377–378

trees (Plug and Play), 561–563

troubleshooting pools, 329–330

trust SIDs, 657–658

Trusted Computer System Evaluation Criteria (TCSEC), 605–607

trustlets

attributes, 125

built-in, 125

identifying, 129

identities, 125–126

overview, 61, 123–124

policies, 124–125

services, 127–128

system calls, 128

types

device drivers, 492–496

heaps, 334

kernels, 41–42

subsystems, 62–63

U

UAC (User Account Control)

elevation

Admin Approval Mode (AAM), 729

administrative rights, 729–732

auto-elevation, 732–733

consent, 729

over-the-shoulder (OTS), 729

overview, 729

settings, 733–734

overview, 722

virtualization

files, 722–727

registry, 722–724, 727–728

UEFI (Credential Guard), 616

UIPI (User Interface Privilege Isolation), 660–661

UMDF (WDF), 578, 580–581, 587–590

UMS threads (user mode scheduling threads), 19–20

Unicode, 33–35

Universal Windows Drivers, 85

unkillable processes, debugging, 539–541

unwait boosts, 240–241

updating Windows, 3

usage (pools), 327–329

User Account Control. See UAC

user address spaces

calculating load address, 368–369

EMET, 370

heap randomization, 369

image randomization, 367–369

IRPs, 528–531

kernel, 369

layouts, 365–367

overview, 365–367

security mitigations, 370

stack randomization, 369

viewing, 366–367

viewing randomization support, 370–371

User Interface Privilege Isolation (UIPI), 660–661

user mode

architecture, 47–49

kernel mode comparison, 23–27, 46

user-mode debugging

Debugging Tools for Windows, 39

viewing threads, 209–210

user mode scheduling threads (UMS threads), 19–20

user stacks, 399

users

authentication, 713–718

Kerberos, 714–715

MSV1_0, 713–714

viewing active logon sessions, 715–717

cancelling I/O, 537–538

fast user switching, 30, 475

multiple sessions, 29–30

SuperFetch, 475

UAC. See UAC

user address spaces. See user address spaces

using virtual service accounts, 647–650

UWP apps, 685–687

UWP processes, 687–692

V

VADs (virtual address descriptors)

overview, 20, 401

process VADs, 402–403

rotate VADs, 403

validating parameters (processes), 131–135

values (saturation values), 216

variable quantums, 235–236

VBS (virtualization-based security)

architecture, 59–61

hypervisor, 28

versions (Windows)

OneCore, 3–4

overview, 1–3

updating, 3

viewing

access masks, 624

active logon sessions, 715–717

addresses

randomization support, 370–371

translation, 378–380

usage, 361–363

user address spaces, 366–367, 370–371

VADs (virtual address descriptors), 402–403

AppContainer

atom table, 697–698

capabilities, 701–703

security attributes, 695–697

tokens, 690–692

brokers, 709

CFG, 742–744

CFG bitmaps, 746–747

control areas, 408–412

CPU. See CPU

CSR_PROCESS data structure, 112

CSR_THREAD structure, 206

DEP, 321

device drivers, 85–88

device objects, 502–506

devnodes, 568–569

DFSS (dynamic fair share scheduling), 290–292

drivers, 496–498

catalog files, 574

device drivers, 85–88

dispatch routines, 517–518

INF files, 573

KMDF drivers, 580–581

objects, 504–506

power mappings, 596

UMDF drivers, 580–581

dumping. See dumping

enabling privileges, 673–675

EPROCESS data structure, 107–108

ETHREAD structure, 196–201

files

catalog files, 574

file objects, 508–509

INF files, 573

memory-mapped files, 316–317

page files, 390–392, 397–398

prefetch file reads and writes, 415–416

swap files, 393

virtual page files, 393

virtualization, 726–727

free page lists, 429–430

functions, exported, 34–35

global audit policy, 682

HAL image dependencies, 80–82

heaps, 338–341

image loader, 156–157

DLL load search order, 163–164

loaded modules database, 166–167

integrity levels, 628–631

I/O

fast I/O, 512–513

IRPs, 518–519, 521–524

priority boosting/bumping, 551

priority throughput, 549–551

IRPs, 518–519, 521–524

jobs, 180–183

kernel

kernel-mode debugger, 210–212

KPRCB (kernel processor control block), 77–78

KPCR (kernel processor control region), 77–78

stacks, 400–401

type information, 41–42

KTHREAD structure, 196–201

look-aside lists, 331–332

memory, 305–308

combining, 465–467

compression, 455–456

memory-mapped files, 316–317

partitions, 458

modified page lists, 430–435

notification events, 424–425

NUMA processors, 270–271

object access auditing, 679–681

pages

files, 390–392, 397–398

free page lists, 429–430

modified page lists, 430–435

pageheap, 344–346

PFN (Page Frame Number), 427–428, 443

priorities, 437

PTEs (page table entries), 355–356

standby page lists, 430–435

virtual page files, 393

zero page lists, 429–430

PEB (Process Environmental Block), 110–111

PFN (Page Frame Number), 427–428, 443

pools. See pools

power

availability requests, 603

driver power mappings, 596

states, 592–593

system capabilities, 597–599

prefetch file reads and writes, 415–416

priority boosts

bumping (I/O), 551

CPU starvation, 247–248

foreground threads, 243–245

GUI threads, 245–246

MMCSS (Multimedia Class Scheduler Service), 252–253

processes

affinity, 275–276

data structures, 109

PEB (Process Environmental Block), 110–111

Process Explorer, 14–18, 118–119

process tree, 12–14

protected processes, 118–119, 212–213

service processes, 97–98

Task Manager, 9–11

UWP processes, 689–690

PTEs (page table entries), 355–356

section objects, 406–407

security

AppContainer, 695–697

descriptors, 654–656

registry keys, 610

SIDs (security identifiers), 626–627

trust SIDs, 658

services, 97

MMCSS (Multimedia Class Scheduler Service), 252–253

service processes, 97–98

system service dispatcher, 70–71

sessions, 353–355, 715–717

SMT processors, 268–269

SRPs (software restriction policies), 764

stacks, 400–401, 521

standby page lists, 430–435

swap files, 393

systems

power capabilities, 597–599

subsystems, 62–63

system service dispatcher, 70–71

threads

clock cycles per quantum, 233–234

clock interval, 232

foreground threads, 243–245

freezing, 265–266

GUI threads, 245–246

idle threads, 260–262

kernel-mode debugger, 210–212

KTHREAD structure, 196–201

overview, 207–209

pools, 299–300

priorities, 219–222

protected processes, 118–119, 212–213

ready, 230–231

states, 224–228

user-mode debugger, 209–210

tokens, 635–640

AppContainers, 690–692

filtered admin tokens, 645–646

token stored handles, 706–708

virtual page files, 393

Windows

enabled features, 56–57

tools, 35–36

working sets, 418–421

zero page lists, 429–430

virtual address descriptors (VADs). See VADs (virtual address descriptors)

virtual address spaces. See address spaces

virtual memory, 21–23

virtual page files, 393

Virtual Secure Mode. See VBS

virtual service accounts, 646–650

Virtual Trust Levels (VTLs), 59–61

virtualization

security

authentication policies, 616–617

Device Guard, 617–619

files, 722–727

Kerberos armoring, 616–617

NTOWF/TGT key, 613–614

overview, 611–613, 722

passwords, 613

registry, 722–724, 727–728

secure communication, 614–615

UEFI, 616

VBS (virtualization-based security). See VBS (virtualization-based security)

virtualization-based security (VBS): See VBS (virtualization-based security)

voluntary switching, 256–257

VSM. See VBS

VTLs (Virtual Trust Levels), 59–61

W

W32PROCESS data structure, 105, 113

WBF (Windows Biometric Framework), 719–721

WDF (Windows Driver Foundation)

KMDF, 578–587

overview, 84, 578–579

UMDF, 578, 580–581, 587–590

WDK (Windows Driver Kit), 43–44

WDM (Windows Driver Model), 83–84, 493–494

windows, opening command prompts, 13

Windows

client memory limits, 447–449

design goals, 45–46

editions

comparison, 54–56

viewing enabled features, 56–57

operating system model, 46–47

portability, 50–51

SDK (software development kit), 43

versions

OneCore, 3–4

overview, 1–3

updating, 3

viewing internals, 35–36

W32PROCESS data structure, 105, 113

WBF (Windows Biometric Framework), 719–721

WDF (Windows Driver Foundation). See WDF Windows Driver Foundation)

WDK (Windows Driver Kit), 43–44

WDM (Windows Driver Model), 83–84, 493–494

Windows API. See APIs

Windows Hello, 721

Windows Initialization process, 95–96

Windows logon process, 98–99

Windows Runtime, 5–6

Windows subsystem, 64–67

Winlogon initialization, 711–712

winver command, 3

WSRM (Windows System Resource Manager ), 222–223

Windows Biometric Framework (WBF), 719–721

Windows Driver Foundation (WDF)

KMDF, 578–587

overview, 84, 578–579

UMDF, 578, 580–581, 587–590

Windows Driver Kit (WDK), 43–44

Windows Driver Model (WDM), 83–84, 493–494

Windows Hello, 721

Windows Initialization process, 95–96

Windows logon process, 98–99

Windows Runtime, 5–6

Windows System Resource Manager (WSRM), 222–223

Winlogon initialization, 711–712

worker factories, 297–300

working sets

balance set manager, 421–422

demand paging, 413

managing, 417–421

memory, 412

notification events, 423–425

overview, 413

placement policies, 416–417

prefetcher, 413–416

ReadyBoot, 413–416

swapper, 421–422

system working sets, 422–423

viewing, 418–421

write bits, 376–377

WSRM (Windows System Resource Manager), 222–223

X–Z

x64 systems, 50

x64 virtual address limitations, 359

x64 virtual address translation, 380–381

x86 address space layouts, 349–352

x86 session space, 353–355

x86 system address space layouts, 352–353

x86 virtual address translation, 371–375

zero page lists, 429–430