Solid C and C++ knowledge is a must to fully understand Windows diagnostic artifacts such as memory dumps and do diagnostic, forensic, and root cause analysis beyond listing stack traces, DLL, and driver information. This full-color reference book is a part of the Accelerated C & C++ for Windows Diagnostics training course organized by Software Diagnostics Services. The text contains slides, brief notes highlighting particular points, and replicated source code fragments that are easy to copy into your favorite IDE. The book's detailed Table of Contents makes the usual Index redundant. We hope this reference is helpful for the following audiences:
- C and C++ developers who want to deepen their knowledge
- Software engineers developing and maintaining products on Windows platforms
- Technical support, escalation, DevSecOps, cloud and site reliability engineers dealing with complex software issues
- Quality assurance engineers who test software on Windows platforms
- Security and vulnerability researchers, reverse engineers, malware and memory forensics analysts
Author(s): Dmitry Vostokov
Series: Windows Internals Supplements
Edition: 1
Publisher: OpenTask
Year: 2023
Language: English
Commentary: Revision 1.00 (November 2023)
City: Monkstown, Dublin
Tags: Software Diagnostics; Software Debugging; C Programming Language; C++ Programming Language; MS Windows
Table of Contents
Preface
About the Author
Introduction
Original Training Course Name
Prerequisites
Training Goals
Training Principles
Schedule
Training Idea
General C & C++ Aspects
What We Do Not Cover
Windows C & C++ Aspects
Why C & C++?
Which C & C++?
My History of C & C++
C and C++ Mastery Process
Thought Process
Philosophy of Pointers
Pointer
Pointer Dereference
Many to One
Many to One Dereference
Invalid Pointer
Invalid Pointer Dereference
Wild (Dangling) Pointer
Pointer to Pointer
Pointer to Pointer Dereference
Naming Pointers and Entities
Names as Pointer Content
Pointers as Entities
Memory and Pointers
Mental Exercise
Debugger Memory Layout
Memory Dereference Layout
Names as Addresses
Addresses and Entities
Addresses and Structures
Pointers to Structures
Arrays
Arrays and Pointers to Arrays
Strings and Pointers to Strings
Basic Types
ASCII Characters and Pointers
Bytes and Pointers
Wide Characters and Pointers
Integers
Long Integers
Little-Endian System
Short Integers
Long Long Integers
Signed and Unsigned Integers
Fixed Size Integers
Booleans
Bytes
Size
Alignment
LLP64
Nothing and Anything
Automatic Type Inference
Entity Conversion
Pointer Conversion (C-Style)
Numeric Promotion/Conversion
Numeric Conversion
Incompatible Types
Forcing
Structures, Classes, and Objects
Structures
Access Level
Classes and Objects
Structures and Classes
Pointer to Structure
Pointer to Structure Dereference
Many Pointers to One Structure
Many to One Dereference
Invalid Pointer to Structure
Invalid Pointer Dereference
Wild (Dangling) Pointer
Pointer to Pointer to Structure
Pointer to Pointer Dereference
Memory and Structures
Addresses and Structures
Structure Field Access
Pointers to Structures
Pointers to Structure Fields
Structure Inheritance
Structure Slicing
Inheritance Access Level
Structures and Classes II
Internal Structure Alignment
Static Structure Fields
Uniform Initialization
Old Initialization Ways
New Way {}
Uniform Structure Initialization
Static Field Initialization
Macros, Types, and Synonyms
Macros
Old Way
New Way
Memory Storage
Overview
Thread Stack Frames
Local Variable Value Lifecycle
Stack Allocation Pitfalls
Explicit Local Allocation
Dynamic Allocation (C-style)
Dynamic Allocation (C++)
Memory Operators
Memory Expressions
Local Pointers (Manual)
In-place Allocation
Source Code Organisation
Logical Layer (Translation Units)
Physical Layer (Source Files)
Inter-TU Sharing
Classic Static TU Isolation
Namespace TU Isolation
Declaration and Definition
TU Definition Conflicts
Fine-grained TU Scope Isolation
Conceptual Layer (Design)
Incomplete Types
References
Type& vs. Type*
Values
Value Categories
Constant Values
Constant Expressions
Functions
Pointers to Functions
Function Pointer Types
Reading Declarations
Structure Function Fields
Structure Methods
Structure Methods (Inlined)
Structure Methods (Inheritance)
Structure Virtual Methods
Structure Pure Virtual Methods
Structure as Interface
Function Structure
Structure Constructors
Structure Copy Constructor
Structure Copy Assignment
Structure Destructor
Structure Destructor Hierarchy
Structure Virtual Destructor
Destructor as a Method
Conversion Operators
Parameters by Value
Parameters by Pointer/Reference
Parameters by Ptr/Ref to Const
Possible Mistake
Function Overloading
Immutable Objects
Static Structure Functions
Lambdas
x64 CPU Registers
Instructions and Registers
Memory and Stack Addressing
Memory Cell Sizes
Memory Load Instructions
Memory Store Instructions
Flow Instructions
Function Parameters
Struct Function Parameters
this
Function Objects vs. Lambdas
Captures and Closures
Lambdas as Parameters
Lambda Parameter Optimization
Lambdas as Unnamed Functions
std::function Lambda Parameters
auto Lambda Parameters
Lambdas as Return Values
Virtual Function Call
VTBL Memory Layout
VPTR and Struct Memory Layout
Templates: A Planck-length Introduction
Why Templates?
Reusability
Types of Templates
Types of Template Parameters
Type Safety
Flexibility
Metafunctions
Iterators as Pointers
Containers
Iterators
Constant Iterators
Pointers as Iterators
Algorithms
Memory Ownership
Pointers as Owners
Problems with Pointer Owners
Smart Pointers
Basic Design
Unique Pointers
Handles as Unique Pointers
Shared Pointers
RAII
RAII Definition
RAII Advantages
Handle RAII
Threads and Synchronization
Threads in C/C++
Threads in C++ Proper
Synchronization Problems
Synchronization Solution
Resources
C and C++
Reading Windows-based Code
Windows (C and C++)
Training (Windows C and C++)
