1. Windows. . Windows. Windows.

2. Windows. Windows. Windows. Windows.

3. Windows. . . Windows. .

4. Windows. . . . Windows . .

5. . Windows. . . . . .( )

6. . . . . .

7. . . . .

8. Windows. . . . . . .

9. . . . . - - . .

10. Direct2D. . Direct2D. Direct2D.

11. Windows. . . . . .

12. . . . . .

13. Windows. . .

14. - . DLL-. DLL- . DLL-. - DLL-.

15. - . DLL-. DLL- .

16. - . DLL- . DLL-. DLL- DLL-. DLL

17. Windows. . . . .

18. . Windows UNIX/Linux. .

19. SMP NUMA. . . .

20. Windows. . . . .

21. Windows. . . . .

22. . . .

23. Windows. . . . . .

24. Windows. .

25. Windows. . . .

26. Windows. ( ). . .

27. . . . . : , , .

28. . . . . .

29. Windows (Native API). Nt- Zw- Windows.

30. Windows. . .

31. Windows. . . .

32. Windows. Unicode. .

33. Windows. . , . (IDT).

34. . . . . (IRQL). (ISR).

35. (IRQL). x86 x64. (ISR). .

36. . (DPC). . . .

37. (APC). . . .

38. (APC). : APC-. .

39. (Work Item). . . . .

40. Windows. . . . . (, heap). .

41. Windows. (Look-aside Lists) - (Low Fragmentation Heap).

42. Windows. . . . .

43. Windows. . . . .

44. Windows. , , , . . . . . .

45. Windows. Look-aside Lists.

46. . .

47. Windows. (MDL) .

48. Windows. . . .

49. , . , . , . .

50. - (IRP). -. - .

51. - (IRP). -. - - .

52. API- Windows . DLL . DLL . DLL .

53. API- Windows . . (Microsoft Detours).

54. API- Windows . KeServiceDescriptorTable. KeServiceDescriptorTableShadow. UI-. (Kernel Patch Protection) 64- Windows.

55. API- Windows .

56. API- Windows .

57. Windows .

58. Windows . - .

#

1

(DONE)

2

(DONE)

3

(DONE)

4

(DONE)

5

(DONE)

6

(DONE)

7

(DONE)

8

(DONE)

9

(DONE)

10

(DONE)

11

(DONE)

12

(DONE)

13

(DONE)

14

(DONE)

15

(DONE)

16

(DONE)

17

(DONE)

18

(DONE)

19

(DONE)

20

(DONE)

21

(DONE)

22

(DONE)

23

(DONE)

24

(DONE)

25

(DONE)

26

(DONE)

27

(DONE)

28

(DONE)

29

(DONE)

30

(DONE)

31

(DONE)

32

(DONE)

33

(DONE)

34

(DONE)

35

(DONE)

36

(DONE)

37

(DONE)

38

(DONE)

39

(DONE)

40

(DONE)

41

(DONE)

42

(DONE)

43

(DONE)

44

(DONE)

45

(DONE)

46

(DONE)

47

(DONE)

48

(DONE)

49

(DONE)

50

(DONE)

51

(DONE)

52

(DONE)

53

(DONE)

54

(DONE)

55

(DONE)

56

; (PROCESSING)

57

; (DONE)

58

; (PROCESSING)

1. Windows. . Windows. Windows.

Windows. .

Windows API (application programming interface) Windows. Windows API , :

1. (Base Services).

2. (Component Services).

3. (User Interface Services).

4. (Graphics and Multimedia Services).

5. (Messaging and Collaboration).

Windows API (Win32, Win64):

1. : CreateWindow, ReadFile, SendMessage.

2. ( , Charles Simonyi).

API (Application Programming Interface).

API - , , , , (, ) .

API , (, ), API , .

API. API , , , API .

n API. .

n . . () .

n .

, , . , , , , ( ) .

s

string

sClientName

d

delta

int a, b; ... dc = b - a;

Windows.

, : (access token objects), (file objects), (file-mapping objects), - (I/O completion port objects), (job objects), (mailslot objects), (mutex objects), (pipe objects), (process objects), (semaphore objects), (thread objects) (waitable timer objects). Windows-. , . , . ( , .) , . , ,

, , . , . Microsoft , . Microsoft , , - . : , ? , Windows , . . , , , . , . Windows-, , .

:

, . , . , (, CreateFileMapping), ; , , . , 1 . , , , , .

, , , . , , , , .

:

, , CloseHandle:

BOOL CloseHandle(HANDLE hobj);

, , , () , . , ; , .

Windows.

, , , .

:

1. ( ) , Session Manager, Windows ( ).

2. , Windows, (Task Scheduler) (Print Spooler). , , .

3. , : 32- 64- Windows, 16- Windows 3.1, 16- MS-DOS 32- 64- POSIX. , 16- 32- Windows.

4. , , . Windows NT : Windows, POSIX OS/2. POSIX OS/2 Windows 2000. Windows Ultimate Enterprise, POSIX, Unix (Unix-based Applications, SUA).

Windows Windows , (dynamic-link libraries, DLL).

DLL- ( ) . ( ) , .

Windows , :

1. Windows , , , , -, .

2. Windows , , . , .

3. , - - , , .

4. (hardware abstraction layer, HAL), , , Windows ( ).

5. , (graphical user interface, GUI), Windows USER- GDI-, , .

2. Windows. Windows. Windows. Windows.

Windows. Windows.

() , Windows ( , Windows, ): . , (, ) . , . , , , . Windows- , , . , , () . , . , (, , ), . , , , (no-execute memory protection), Windows , , , .

32- Windows -, , . , Windows, . Windows , , , , , . , , , . Windows , (Plug and Play) , (, , ). Driver Verifier (, ), .

. , , Ntoskrnl.exe Win32k.sys. , , .

, , . , - , , , , . , Direct2D (compositing), , , .

Windows , () . , . , . , , , (maps), , . , , .

, , () . . , . , .

. 32- 4 . Windows ( x00000000 x7FFFFFFF) , ( x80000000 xFFFFFFFF)

:

2 2 . 64 . GetSystemInfo().

, , Working Set. SetProcessWorkingSetSize(). 50 4 (200 ), 345 4 (1380 ).

1. n

a. :

b. : VirtualAlloc(), VirtualAllocEx(), VirtualAllocExNuma(), VirtualFree(), VirtualFreeEx(). user mode 64 .

c. : VirtualProtect(), VirtualProtectEx().

d. : VirtualLock(), VirtualUnlock().

e. : VirtualQuery(), VirtualQueryEx().

2. () Heap:

a. : HeapCreate(), HeapDestroy().

b. : HeapAlloc(), HeapReAlloc(), HeapSize(), HeapFree(). 8 x86, 16 x64.

c. : HeapValidate(), HeapWalk(), HeapQueryInformation(), HeapSetInformation().

d. : GetProcessHeap() 1 MB, GetProcessHeaps() .

3. File Mapping:

a. , , (Section Object).

4.

a. Memory Pools

b. Look-aside Lists

c.

d.

e. Memory Descriptor Lists

Windows. Windows.

Windows. DLL- . , , . , API- Windows DLL- Windows, , Kernel32.dll, Advapi32.dll, User32.dll Gdi32.dll.

Ntdll.dll , , , DLL- . :

1. -,