گواهینامه‌ی دوره

برای دریافت گواهینامه‌ی این دوره، ده روز پس از جلسه‌ی پایانی، آزمونی برگزار خواهد شد که با قبولی در این آزمون، امکان صدور گواهینامه‌ی دوره برای شما را خواهیم داشت. حضور در آزمون پایانی و دریافت گواهینامه‌ی دوره برای شرکت‌کنندگان اختیاری است.

هزینه‌ی چاپ و صدور گواهینامه‌ی دوره: ۵۰ هزارتومان

این دوره به چه افرادی توصیه می‌شود؟

• تحلیل‌گران و محققین امنیت سایبری
• کارشناسان ارزیابی امنیت/تست نفوذ/تیم قرمز
• افراد فعال در زمینه‌ی Bug Bounty سیستمی
• برنامه‌نویسان سیستمی و توسعه‌دهندگان محصولات امنیتی
• مشاورین امنیت سایبری
• علاقه‌مندان به توسعه و تحلیل بدافزار

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

• آشنایی با مفاهیم Windows Internals
• آشنایی با زبان برنامه‌نویسی C یا C++ در سطح متوسط

سرفصل‌های دوره

Chapter 1: Windows System Architecture

1.1 Overview

1.2 Tools

1.3 Processes

1.4 Virtual Memory

1.5 Threads

1.6 User Mode vs. Kernel Mode Architecture Overview

1.7 System Calls

1.8 Introduction to WinDBG

Chapter 2: Windows API Foundation

2.1 Windows APIs

2.2 Using Visual Studio

2.3 Common Types and Conventions

2.4 Working with Strings

2.5 64-Bit vs. 32-Bit Development

Chapter 3: Kernel Objects

3.1 What is Kernel Object?

3.2 A Process Kernel Object Handle Table

3.3 Working with Handles

3.4 Sharing Objects

3.5 Object Names

Chapter 4: Process

4.1 Process Creation

4.2 The Main Function(s)

4.3 Creating Processes

4.4 Process Termination

4.5 Enumerating Processes

4.6 DLLs

Chapter 5: Jobs

5.1 Introduction to Jobs

5.2 Creating Jobs

5.3 Nested Jobs

5.4 Querying Job Information

5.5 Setting Job Limits

5.6 Job Notifications

Chapter 6: Thread

6.1 Thread basics

6.2 Creating threads

6.3 Thread Priorities

6.4 Thread Scheduling

6.5 Thread Stacks

6.6 Hooking

Chapter 7: Windows Thread Pool

7.1 Scenari1: Call a Function Asynchronously

7.2 Scenari2: Call a Function at a Timed Interval

7.3 Scenari3: Call a Function When a Single Kernel Object Becomes Signaled

7.4 Scenari4: Call a Function When Asynchronous I/Requests Complete

7.5 Callback Termination Actions

Chapter 8: Fibers

8.1 Overview

8.2 Working with Fibers

Chapter 9: Memory

9.1 Process address space

9.2 Process memory counters

9.3 Reserving and Committing Memory 

9.4 The Heap Manager

9.5 Memory Mapped Files

9.6 Summary

Chapter 10: Dynamic-Link Libraries

10.1 DLL and Process Address Space

10.2 Building DLL Module

10.3 What exporting Really means?

10.4 Creating DLLs for use with Non-Visual C++ Tools

10.5 Building the Executable Module

Chapter 11: DLL Advanced Techniques

11.1 The DLL’s Entry-Point Function

11.2 Delay-Loading a DLL

11.3 Function Forwarders

11.4 Known DLLs

11.5 DLL Redirection

11.6 Rebasing Modules

11.7 Binding Modules

Chapter 12: Security

12.1 Introduction

12.2 SIDs

12.3 Tokens

12.4 Privileges

12.5 Access Masks

12.6 User Access Control

12.7 Integrity Levels

12.8 Specialized Security Mechanisms

Chapter 13: Registry

13.1 The Hives

13.2 32-bit Specific Hives

13.3 Working with Keys and Values

13.4 Registry Notifications

13.5 Transactional Registry

13.6 Registry and Impersonation

13.7 Remote Registry

13.8 Miscellaneous Registry Functions

Chapter 14: The I/System and Device Drivers

14.1 Device Drivers

14.2 The Windows Driver Model (WDM)

14.3  Driver types

14.4 Software drivers

14.5 Driver and device objects

14.6  I/Processing and Data Flow

14.7 Accessing files and devices

14.8 Asynchronous I/O

Chapter 15: Kernel programming basics

15.1 C++ in a kernel driver

15.2 Creating a driver project Building and deploying The kernel API

15.3 Strings

15.4 Linked Lists

15.5 Kernel Memory Pools

15.6 The DriverEntry function

15.7 The Unload routine

15.8  Installation

Chapter 16: Building a complete driver and Client Creating a device Object

16.1 Exporting a device name

16.2 Building a driver client

16.3 Driver dispatch routines

16.4 Introduction tI/Request Packets (IRPs) Completing IRPs

16.5 Accessing user space buffers

16.6 Handling DeviceIoControl calls

16.7 Testing the driver

16.8 Debugging the driver

16.9 Using WinDbg with a virtual machine

16.10 The driver verifier

Chapter 17: The I/O Request Packet

17.1 Introduction to IRPs

17.2 Device Nodes

17.3 IRP Flow

17.4 IRP and I/O Stack Location

17.5 Viewing IRP Information

17.6 Dispatch Routines

17.7 Completing a Request

17.8 Accessing User Buffers

17.9 Buffered I/O

17.10 Direct I/O

17.11 User Buffers for IRP_MJ_DEVICE_CONTROL

17.12 Putting it All Together: The Zero Driver

17.13 Using a Precompiled Header

17.14 The DriverEntry Routine

17.15 The Create and Close Dispatch Routines

17.16 The Read Dispatch Routine

17.17 The Write Dispatch Routine

17.18 Test Application

17.19 Read/Write Statistics

Chapter 18: Process and Thread Notifications

18.1 Process creation/destruction callback

18.2 Specifying process creation status

18.3 Thread creation/destruction callback

18.4 Notifying user mode

18.5 Writing a user mode client

18.6 User/kernel communication

Chapter 19: Object and Registry Notifications

19.1 Process/thread object notifications

19.2 Pre and post callbacks

19.3 Registry notifications

19.4 Performance considerations

19.5 Reporting results to user mode

19.6 Summary