process

More documents

Recommendations

Info

26 Wow64 Registry Redirection Two registry keys have 32-bit sections: HKEY_LOCAL_MACHINE\Software HKEY_CLASSES_ROOT Everything else is shared 32-bit data lives under \Wow6432Node When a Wow64 process opens/creates a key, it is redirected to be under Wow6432Node
27 Example: Cmd.exe on 64-bit System 32-bit Cmd.exe process: 64-bit Cmd.exe process:
Page 1 and 2: Core System Mechanisms and Windows
Page 3 and 4: 3 Object Manager (I) Executive comp
Page 5 and 6: 5 Executive Objects vs. Kernel Obje
Page 7 and 8: 7 Executive Objects (contd.) Object
Page 9 and 10: 9 Object Header Field Handle count
Page 11 and 12: 11 Object Methods Method Open Close
Page 13 and 14: 13 Handles and Security Process han
Page 15 and 16: 15 Handle and Reference Count handl
Page 17 and 18: 17 Interesting Object Directories i
Page 19 and 20: 19 System Worker Threads Created at
Page 21 and 22: 21 Port Objects ALPC exports port o
Page 23 and 24: 23 Wow64 Allows execution of Win32
Page 25: 25 Wow64 File Locations Location of
Page 29 and 30: 29 Windows API - Overview APIs to W
Page 31 and 32: 31 Windows API Principles System re
Page 33 and 34: 33 Windows API Naming Conventions P
Page 35 and 36: 35 Differences from UNIX HANDLEs ar
Page 37 and 38: 37 Example Application Sequential f
Page 39 and 40: 39 Basic cp file copy program. UNIX
Page 41 and 42: 41 Basic cp file copy program. C li
Page 43 and 44: 43 Basic cp file copy program. Wind
Page 45 and 46: 45 Further Reading Mark E. Russinov
Page 47 and 48: Lab: 2013-9-23 Handles & ALPC
Page 49: ALPC Port Objects Use Winobj.exe to

process

Create successful ePaper yourself

Delete template?

Save as template?