SWE 5320: Windows Systems Programming

Welcome to the new class website of Windows System Programming. This page links to all the slides for the current class, plus assignment information.

Syllabus

The goal of the class is to introduce you to the practical aspects of low-level Windows programming. As such, we will cover Unicode, DLLs, DLL injection, Advanced Windows Debugging, Semaphores, Processes, Multi-threaded programming and, time permitting, elementary device driver programming.

Prerequisites & Administrivia

The class is rather intensive. To benefit from it fully, you need to be concentrating on the message, not the medium. As such, you need to be very comfortable in C, Assembly, C++ (to a lesser extent) and the CLR (loose working knowledge). The workload for the class is high: my firm belief is that when it comes to programming constructs, practice makes perfect! Thus, there are over 10 programming assignments, ranging from trivial to very difficult.

The book for the class is no longer out of print. It has been reissued as "Windows via C/C++" by Jeffrey Richter and Christophe Nasarre and is available through Microsoft Press.

This course would not have been possible without the cooperation of Jeffrey Richter, whom I thank for his assistance.
The class is rather relatively straightforward: we will take a guided tour of the malware universe and other host/application security issues. Assignments will vary between writing about malware, examining files/executables, looking at low-level system functionality, and simulating malware spread. In order to get an A in the class, all assignment must be turned in and complete. Please note, you must pass the final to obtain a passing grade in the class.

Title XI and Classroom Environment

The federal law prohibiting sex discrimination in educational institutions is Title IX of the Educational Amendments Act of 1972. Title IX prohibits discrimination on the basis of sex under any education program or activity operated by an institution receiving or benefiting from federal financial assistance. Sexual harassment, which includes sexual violence, is a form of sex discrimination. To report a violation please contact the Director of Security at extension 8111. * Please note that as your professor, I am required to report any incidences to the Director of Security or to the Title IX Coordinator (extension 8700). For confidential reporting, please contact CAPS at extension 8050.

My desire for you, as your professor, is for you to have a safe and comfortable classroom environment. If anything makes you feel uncomfortable, please bring it to my attention, and we'll figure out how to address it.

Slides

This deck changes as a function to time. Please check back for additional materials covered in class.

• Introduction
• Tools
• C++ Refresher
• C++ Classes
• Errors
• Unicode
• Kernel Objects
• Processes
• Jobs/Thread Basics
• Thread Scheduling
• Thread Sync, User mode
• Thread Sync, Kernel mode
• Thread Pools
• Memory Introduction
• Practical Memory Exercises
• Virtual Memory
• Memory Mapped Files Introduction
• Memory Mapped Files Continued
• DLLs, Introduction
• DLLs, Continued
• DLL Magic Part I
• DLL Magic Part II
• SEH Introduction
• SEH Continued
• SEH - Unhandled Exceptions

Further lessons will be uploaded as needed.