Windows Kernel Programming

This book focuses on the mechanism of the Windows operating system to introduce kernel security programming technology. Except for a few special chapters, most of the content is applicable to the Windows 2000 to Windows 10 operating systems, and the architecture covers 32-bit and 64-bit. At the same time, this book also introduces the basics of assembly and the system kernel mechanism in a simple and easy-to-understand manner. This book is divided into three parts, each introducing kernel programming technology from different perspectives. The first part is for readers with zero foundation, among which "Kernel Programming Environment", "Kernel Driver Operation and Debugging" and "Kernel Programming Basics" focus on the basic knowledge related to kernel programming, development environment construction, and basic programming mechanisms. "Application and Kernel Communication" and "Differences in 64-bit and 32-bit Kernel Development" mainly introduce the data interaction between application layer programming and kernel programming. Finally, the matters needing attention in the programming process and design techniques are introduced. The second part combines the operating system mechanism, starting from the simplest "serial port filtering", and introduces "keyboard filtering", "disk filtering", "file system filtering", "Windows filtering platform", "NDIS protocol driver", "NDIS small port driver", and "NDIS middle layer driver". It covers the mainstream filtering framework of the entire Windows system, and provides an in-depth analysis of the principles of transparent file encryption and decryption. Part 3 focuses on security technology, focusing on the knowledge required for secure programming, such as "IA-32 assembly basics", "Windows kernel hooks", "Windows notifications and callbacks", "Protected processes", and "Code injection and anti-injection". This book is written by practitioners with more than ten years of experience in terminal security development. It is based on simplicity and practicality and combines theory with practical cases. It is suitable for computer software security practitioners and enthusiasts who have a certain C language foundation and are interested in computer security.