Speaker 1: Ever crack open your laptop and wonder, like, what's really
Speaker 1: going on in there?
Speaker 2: Yeah?
Speaker 1: Most people just click and go right right, But today
Speaker 1: we're going deeper into Windows internals. Our guide this beast of.
Speaker 2: A book, Windows Internals, Part two, seventh edition, Heavy stuff.
Speaker 1: Literally Yeah, by Mark Rosinovinch, David Solomon.
Speaker 2: And Andrea Olivi, the trio.
Speaker 1: Who know Windows inside out, Like this is the bible
Speaker 1: for anyone.
Speaker 2: Who wants to know how the OS really ticks.
Speaker 1: But don't worry, we'll keep it fun. Promise. Get ready
Speaker 1: for some aha moments.
Speaker 2: About your computer's memory, how it handles security, even what.
Speaker 1: Happens when things crash. Stuff most folks never think about, but.
Speaker 2: It's happening every time you hit the power button. Fascinating stuff.
Speaker 1: Okay, before we get too deep, tell us about these authors,
Speaker 1: not your average tech writers.
Speaker 2: Oh no, no, it starts with Mark Rassinovitch legend in the
Speaker 2: Windows world. He envisioned a book that really dug into Windows.
Speaker 1: Empty hardcore from the start.
Speaker 2: But then David Solomon, another expert, publishes a book covering
Speaker 2: similar ground. You'd think rivalry.
Speaker 1: Right, competition time.
Speaker 2: Nope, Mark reaches out to David suggests the ten up
Speaker 2: for the next edition, talk about collaboration and get this.
Speaker 2: He even offered to include his entire c's internal's toolkit.
Speaker 1: Those are like power tools for Cissigmin's exactly super valuable.
Speaker 2: Then later on they bring in Andrea Olivi.
Speaker 1: Who actually worked inside Microsoft.
Speaker 2: Ye, that insider perspective is gold. It's this blend that
Speaker 2: makes the book so insightful, like.
Speaker 1: Having all sides of the story.
Speaker 2: Speaking of insights, let's dive into the core stuff CPUs,
Speaker 2: cash and how it all ties into security.
Speaker 1: CPUs. I know they're important, but honestly a bit fuzzy
Speaker 1: on what they do exactly.
Speaker 2: Think of it like this. Your CPU has different access levels,
Speaker 2: almost like security clearances. There's kernel mode, the VIP area
Speaker 2: where critical stuff.
Speaker 1: Happens pop secret operation.
Speaker 2: And then user mode where your everyday apps run. This
Speaker 2: protected mode segmentation keep those worlds separate so a.
Speaker 1: Rogue program can't just mess with the important stuff.
Speaker 2: Exactly. It's like having a bank vault separate from the lobby.
Speaker 2: And this segmentation also helps the CPU quickly grab important data,
Speaker 2: things like the thread environment block or TAVE.
Speaker 1: Sounds technical, it's basically.
Speaker 2: The CPU's cheat sheet for the running program and the
Speaker 2: kernel process or control region or KPCR. That's the CPU's
Speaker 2: own status report.
Speaker 1: Gotta keep those sandy absolutely.
Speaker 2: Now, cpu cashes. Ever, Notice how some things on your
Speaker 2: computer are just instant.
Speaker 1: Oh yeah, like opening certain files.
Speaker 2: Or exactly, that's the cash working. Think of it like
Speaker 2: your desk versus going to the filing cabinet. Cash holds
Speaker 2: the data your CPU's most likely to need.
Speaker 1: Next, t Oh, it's all about speed.
Speaker 2: Speed is key. But here's where it gets tricky, this
Speaker 2: whole cash system, it can actually be a security risk.
Speaker 1: Wait what how See, modern.
Speaker 2: CPUs are clever. They try to predict what data you'll
Speaker 2: need and prefetch it into the cash. Great for performance,
Speaker 2: but attackers can actually manipulate these predictions, tricking the CPU
Speaker 2: into accessing data it shouldn't. That's how those specter and
Speaker 2: meltdown vulnerabilities work.
Speaker 1: So my CPU trying to be HLPFL is actually a weakness.
Speaker 1: It's a delicate balance. Windows has ways to mitigate the
Speaker 1: risk though. Think of it like security checks, but optimized
Speaker 1: so they're not constantly slowing you down.
Speaker 2: Like a superfficient airport security line.
Speaker 1: Exactly. Now, let's move on to interrupts dpcs outphasis what
Speaker 1: are those?
Speaker 2: Imagine you're focused on work and suddenly fire alarm. You
Speaker 2: got to drop everything.
Speaker 1: And handle that right priority.
Speaker 2: That's an interrupt for your computer, an urgent request that
Speaker 2: can't wait. And just like alarms, there are levels of urgency.
Speaker 2: That's where irqls come in, interrupt request levels.
Speaker 1: So fire alarm versus.
Speaker 2: Doorbell precisely make sure the most critical stuff gets handled first.
Speaker 2: But what happens after the fire's out? You still got
Speaker 2: to deal with the mess, but not right then.
Speaker 1: Clean up time.
Speaker 2: That's where deferred procedure calls come in, or dpcs, like
Speaker 2: leaving yourself a note to deal with the less urgent
Speaker 2: stuff later.
Speaker 1: So you don't get totally sidetracked exactly.
Speaker 2: And the book even shows you how to watch these
Speaker 2: dpcs happening on your own computer real time.
Speaker 1: Pretty neat, like seeing the gears turning. Okay, we've got
Speaker 1: interrupts dpcs. What about APCs.
Speaker 2: Asynchronous procedure calls? Those are more like scheduled deliveries. They
Speaker 2: happen at specific times or when certain conditions are.
Speaker 1: Met, so more organized chaos in a way.
Speaker 2: Yes, some are for system tasks, others deliver messages to applications.
Speaker 2: All about keeping things running smoothly.
Speaker 1: Like a well oiled machine. But so much going on
Speaker 1: we never see.
Speaker 2: That's the beauty of it. And believe me, we're just
Speaker 2: scratching the surface.
Speaker 1: So much happening behind the scenes. And Windows before we
Speaker 1: jumped into this, we were digging into objects, handles, name spaces,
Speaker 1: like the lego bricks of the OS exactly.
Speaker 2: But you need more than bricks to build something complex, right,
Speaker 2: You need a way to make sure everything works together smoothly.
Speaker 1: Like an orchestra, all the instruments in sync.
Speaker 2: Perfect analogy. That's where synchronization comes in. Especially with multi
Speaker 2: core CPUs, things can get chaotic fast without coordination to
Speaker 2: make cooks in the kitchen exactly. Windows has ways to
Speaker 2: make sure different parts of the system aren't fighting over
Speaker 2: the same resources. One basic tool spin locks.
Speaker 1: Spin locks sounds like a workout class kind.
Speaker 2: Of imagine a revolving door, only one person through at
Speaker 2: a time. When a CPU needs to access some shared data,
Speaker 2: it grabs the spin lock, saying mine, now, other's.
Speaker 1: Got to wait, first come, first serve for CPUs. But
Speaker 1: what if the wait is long? Isn't that inefficient?
Speaker 2: It can be. That's why there are acute spin locks,
Speaker 2: like a more organized line. No more CPUs constantly checking
Speaker 2: if the door's.
Speaker 1: Free, so polite waiting in line exactly.
Speaker 2: Then there are reader writer spin locks. They give a library.
Speaker 2: Many people can read a book at once, but only
Speaker 2: one can check it out to write in it.
Speaker 1: Ah, So multiple CPUs can read data but only one
Speaker 1: writes at a time.
Speaker 2: Makes sense, right, optimize for different use cases, and sometimes
Speaker 2: spinlocks aren't the best tool, especially for long waits. That's
Speaker 2: where low irc rol synchronization comes in.
Speaker 1: Lo my arcle will of getting a bit technical.
Speaker 2: Now it is, but think of it like this. Instead
Speaker 2: of constantly checking the door spin lock, you get a
Speaker 2: signal when it's your turn. Dispatch your objects handle that
Speaker 2: like traffic signals for CPUs, So.
Speaker 1: Choosing the right tool depending on the situation.
Speaker 2: Efficiency is key. And speaking of efficient, let's talk ALPC
Speaker 2: Advanced Local Procedure.
Speaker 1: Call another acronym. What's that do?
Speaker 2: It's the super highway for different processes on your computer
Speaker 2: to talk to each other, like internal messaging but fast.
Speaker 1: So departments within Windows sending memos back and forth.
Speaker 2: Good way to put it, and a key feature is
Speaker 2: handle passing sounds official. Imagine you've got a key to
Speaker 2: a safe deposit box. You want to give someone access,
Speaker 2: but not the actual key, so you give them a
Speaker 2: temporary pass, limited time.
Speaker 1: Only, delegating access without giving full control. Clever.
Speaker 2: That's handle passing and ALPC is optimized to the max.
Speaker 2: It uses things like completion lists to avoid unnecessary waiting around,
Speaker 2: like an express lane for data.
Speaker 1: All about speed, so much going on, we never realize
Speaker 1: it's true.
Speaker 2: Now for something a bit different, WNF Windows Notification.
Speaker 1: Facility sounds like a news channel for Windows kind of.
Speaker 2: It's a published subscribe system. You subscribe to what interests
Speaker 2: you and get notified about changes. Different parts of Windows
Speaker 2: use this to stay in sync.
Speaker 1: So no need to constantly check for updates. You just
Speaker 1: get them right.
Speaker 2: And there are different state names like categories for the info,
Speaker 2: permanent ones for core stuff, persistent ones that survive restarts,
Speaker 2: and temporary ones for quick.
Speaker 1: Announcements like breaking news versus scheduled programming.
Speaker 2: Good analogy. One use of WNF is the System Events Broker.
Speaker 2: It tells those modern UWP apps about what's happening in the.
Speaker 1: System, keeping everyone in the loop. Okay, Switching gears a
Speaker 1: bit debugging.
Speaker 2: Ah yes, debucking the art of finding and fixing those
Speaker 2: nasty bugs that sneak into software, like being a detective
Speaker 2: for code.
Speaker 1: Always wondered how that works.
Speaker 2: The basics are simple. You attach a special tool, a debugger,
Speaker 2: to the program and lets you pause the program, look
Speaker 2: at its memory, go line by.
Speaker 1: Line, and putting it under a microscope.
Speaker 2: Exactly. And in Windows user mode debugging is a team effort,
Speaker 2: part of the OS a helper in NTDL specific APIs
Speaker 2: all working.
Speaker 1: Together, coordinated effort. The book mentioned debug events too, What
Speaker 1: are those.
Speaker 2: Like trip wires telling the debugger something happened, process created,
Speaker 2: threads started, DLL loaded. You get notified so you can investigate.
Speaker 1: Staying informed makes sense.
Speaker 2: And there's a special case for Windows air reporting or WHIRR,
Speaker 2: that thing that pops up when an app crashes asking
Speaker 2: to send a report.
Speaker 1: Oh yeah, see that all the time. Always wonder what
Speaker 1: it does.
Speaker 2: Well, we're uses our friend ALPC to talk to the
Speaker 2: crashed process, even if it's badly damaged, gathers info about
Speaker 2: what went wrong.
Speaker 1: ALPC always showing up.
Speaker 2: It's versatile. Now for a topic everyone's heard of, but
Speaker 2: maybe don't fully get the registry Oh yeah.
Speaker 1: The registry bit intimidating, if I'm.
Speaker 2: Honest, understandable. It's got a reputation, but at its core
Speaker 2: it's just a database storing settings for everything in Windows, like.
Speaker 1: A giant settings file for the whole OS exactly.
Speaker 2: Hardware, user preferences, software, it's all in there, the central
Speaker 2: nervous system, you could say.
Speaker 1: And it's organized right with those h KEY things. What
Speaker 1: are they all about?
Speaker 2: Think different branches of government, HKE, local Machine or HKLM.
Speaker 2: That's system wide settings affecting everyone federal level.
Speaker 1: Okay, big picture stuff.
Speaker 2: Then you've got hkey users for each user's specific settings
Speaker 2: like state level control.
Speaker 1: So changing something in HKLM affects everyone on the computer,
Speaker 1: but in HQ users it's just my account precisely.
Speaker 2: In those modern UWP apps, they use application hids to
Speaker 2: store their settings separate from the rest.
Speaker 1: Keeps things tidy, I guess it does.
Speaker 2: And the registry is built to be tough uses transactions,
Speaker 2: so changes are all or nothing. No partial updates that
Speaker 2: could mess things up.
Speaker 1: Take a safety net for your settings exactly.
Speaker 2: The book even shows how to use process monitor to
Speaker 2: watch the age registry changes in real time. Pretty cool
Speaker 2: if you're into that level of detail, I.
Speaker 1: Might have to check that out. Okay, shifting focus a bit,
Speaker 1: Windows services, What are those all about?
Speaker 2: The unsung heroes of the OS background processes doing all
Speaker 2: sorts of work, usually without you noticing.
Speaker 1: Like the stage crew making sure the show goes.
Speaker 2: On precisely, handling network stuff, printing updates, tons of things.
Speaker 2: And the Service Control Manager or SEM is like the conductor.
Speaker 1: Keeping the orchestra in tune.
Speaker 2: You got it, make sure services start stop, don't conflict.
Speaker 2: And it uses the registry as it's cheat sheet.
Speaker 1: So each service has its instructions in.
Speaker 2: The registry YEP path to the program file, how it starts,
Speaker 2: dependencies all in there like a blueprint for the SEM.
Speaker 1: Very organized. And what about service accounts?
Speaker 2: AH that determines the security context to service runs under.
Speaker 2: Could be the local system account, a specific user, or
Speaker 2: special ones like local service or network.
Speaker 1: Service like different levels of access.
Speaker 2: Exactly important for security. Making sure a service only has
Speaker 2: the permissions it needs. And the book gets into how
Speaker 2: services are isolated from your user session for safety. That's
Speaker 2: why they don't usually pop up Windows on your desktop
Speaker 2: for example.
Speaker 1: Makes sense, things could get messy otherwise, Okay, one more
Speaker 1: system to explore, the Windows Task scheduler. I use it
Speaker 1: to automate stuff, but never thought about how it.
Speaker 2: Works past schedulers. Like a personal assistant for your computer,
Speaker 2: tells things when a run based on time or events.
Speaker 1: Handy. The book mentioned different types of tasks, including hosted tasks,
Speaker 1: which are calm objects. What's that all about?
Speaker 2: Hosted tasks are the power users more complex, can do
Speaker 2: a wider range of actions, and being calm objects, they
Speaker 2: can be controlled in specific ways.
Speaker 1: Like a scripting language within the scheduler.
Speaker 2: You got it, more flexibility. The book even shows an
Speaker 2: example the process Memory Diagnostic Events task and how to
Speaker 2: find the calm object behind it.
Speaker 1: Getting into the weeds now, but it is fascinating.
Speaker 2: It is okay. Ready for another powerful tool WMI. Windows
Speaker 2: Management Instrumentation.
Speaker 1: WMI sounds a bit scary.
Speaker 2: It's not once you get it. Think of it as
Speaker 2: a universal language for managing and monitoring almost anything in Windows.
Speaker 1: So different parts of the system and even different systems,
Speaker 1: can talk about management tasks exactly.
Speaker 2: And at the heart of it are providers providers of
Speaker 2: what think of them like translators. They bridge the gap
Speaker 2: between WMI and the actual resources like a provider for
Speaker 2: the registry of the filesystem, network adapters, you name it.
Speaker 1: So if I want info on my network settings through WMI,
Speaker 1: I talk to the network adapter provider and it figures
Speaker 1: out how to get that info from the actual hardware.
Speaker 2: Exactly different types too, once for getting info, ones for
Speaker 2: doing things, ones that notify you about events.
Speaker 1: Super versatile. The book even has a script showing how
Speaker 1: to use WMI to track process creation events.
Speaker 2: It does practical example. Now to go even deeper into
Speaker 2: monitoring ETW event tracing.
Speaker 1: For Windows sounds intense.
Speaker 2: It's powerful. ETW is a high performance tracing system capturing
Speaker 2: detailed logs of events and performance data. Windows itself uses
Speaker 2: it a latti, and so do many apps and.
Speaker 1: Drivers, like a flight recorder for your computer.
Speaker 2: Exactly great for troubleshooting, finding performance bottlenecks, seeing how everything interacts.
Speaker 1: Lots of uses. The book talked about providers, sessions, loggers, consumers.
Speaker 1: What are all those?
Speaker 2: Okay, think of it like a news organization. Providers are
Speaker 2: the reporters creating the news. Events Sessions are like specific
Speaker 2: news programs grouping related events together.
Speaker 1: Okay, I'm following.
Speaker 2: Loggers are the cameras and recording equipment capturing the news,
Speaker 2: and consumers are the viewers analyzing the broadcasts.
Speaker 1: So providers make the events, sessions organize them, loggers capture them,
Speaker 1: consumers analyze them.
Speaker 2: Got it in one and like news. Different types of
Speaker 2: providers kernel mode for OS stuff, user mode for applications,
Speaker 2: specialized ones for things like networking.
Speaker 1: Covers all the The book had an experiment about tracing
Speaker 1: TCPIP traffic using the kernel logger and performance monitor.
Speaker 2: Right yep, hands on way to see how EQW can
Speaker 2: help with network troubleshooting.
Speaker 1: Definitely got to try that. Okay, last, but not least,
Speaker 1: Windows error reporting or WHIRR gets a bad wrap sometimes,
Speaker 1: but it's.
Speaker 2: There to help. Where's the crash investigator handling those unfortunate
Speaker 2: moments when an app goes belly up gathering evidence precisely
Speaker 2: collects info about the crash. Let's you send a report
Speaker 2: to Microsoft?
Speaker 1: And the book explained how where uses our friend ALPC
Speaker 1: to talk to the crash process even if it's barely.
Speaker 2: Functioning, right, robust system making sure at least some information
Speaker 2: is salvaged, like a black box recorder, but for software.
Speaker 1: Pretty amazing stuff. So there we have it a whirlwind
Speaker 1: tour of Windows internals.
Speaker 2: We covered a lot CPUs, registry threads, debugging, error reporting.
Speaker 1: It makes you realize how much is happening every time
Speaker 1: you click something, and how much clever engineering is behind
Speaker 1: it all.
Speaker 2: Absolutely, if you're e I'm a little bit curious about
Speaker 2: how computers really work, Windows internals is worth checking out. Challenging,
Speaker 2: but yes, so rewarding.
Speaker 1: And we'll be right back after a quick break to
Speaker 1: wrap up this deep dive and leave you with some
Speaker 1: final thoughts.
Speaker 2: We're back wrapping up our Windows Internals deep dive. It's
Speaker 2: been a lot.
Speaker 1: It has CPUs to the registry, threads, dancing around, debugging magic.
Speaker 2: It's amazing how it all comes together. This OS we
Speaker 2: use every day.
Speaker 1: Right, powerful and surprisingly resilient when you see what's going
Speaker 1: on under the hood.
Speaker 2: For me, the big takeaway is the sheer optimization of
Speaker 2: it all.
Speaker 1: Oh, Absolutely, every little thing, from caching data to how
Speaker 1: processes talk to each other designed for speed, like a
Speaker 1: finely tuned engine.
Speaker 2: It's true, and that's what makes Windows internals so fascinating,
Speaker 2: not just how it works, but the cleverness behind it right.
Speaker 1: The attention to detail is incredible. If you're at all
Speaker 1: curious about tech, about what really makes computers tick, this
Speaker 1: book is a must read. Challenging, yeah, but worth it.
Speaker 1: Like getting a peek behind the curtain of your own machine.
Speaker 2: It makes you realize how much we take for granted,
Speaker 2: clicking away.
Speaker 1: On the surface, and it leaves you wanting to learn more.
Speaker 1: What's next for you? In terms of Windows knowledge any
Speaker 1: rabbit holes calling your name?
Speaker 2: You know what always gets me is how operating systems
Speaker 2: EVLVE Windows has come a long way and it's not stopping.
Speaker 2: I'm really curious to see how things like cloud computing AI,
Speaker 2: how those shape the future of Windows.
Speaker 1: That's a great point. Exciting times ahead. Who knows what
Speaker 1: we'll see, But that drive to explore, to keep learning,
Speaker 1: that's key, right.
Speaker 2: Absolutely, There's always more to uncover. It never ends.
Speaker 1: So to everyone listening out there, keep that curiosity alive.
Speaker 1: Don't be afraid to dig deeper, ask questions, explore.
Speaker 2: The more you learn, the more you realize how much
Speaker 2: there is to know.
Speaker 1: And that's what makes the world of tech so endlessly fascinating.
Speaker 1: Until next time, happy exploring, everyone,