In my day job I’m a .NET developer who delves into C++ every now and again. As a result I don’t spend much time having to much about with crash dumps and so on, but this week I’ve been on a Windows Internals given by Alex Ionescu (one of the authors of the Windows Internels book.) It wasn’t my intention to blog about this sort of stuff, but the week long course was an eye opener to what goes on “under the hood” of Windows. It wasn’t all new, I’ve been about a long while, but it was a real refresh on my understanding, and a wealth of new, detailed, information as well. The course was provided by the company I work for, and all I can say is that if you are asked if you want to attend one of these courses, say “yes” without any hesitation.
The course we took was aimed at developers and exposed the bowels of the Windows kernel, including memory management, thread scheduling, interrupt processing, time accounting, security, and crash dump analysis. The course included advanced explanations of windbg, Process Exploerer in particular, but a lot of the System Internals were touched upon somewhere during the course.
Just to reiterate: Get on one of these courses if you can.