Memory Thinking for C and C++: Windows Diagnostics

Table of Contents....4

Preface....16

About the Author....17

Introduction....18

Original Training Course Name....18

Prerequisites....19

Training Goals....20

Training Principles....21

Schedule....22

Training Idea....23

General C & C++ Aspects....24

What We Do Not Cover....26

Windows C & C++ Aspects....27

Why C & C++?....28

Which C & C++?....30

My History of C & C++....31

C and C++ Mastery Process....33

Thought Process....34

Philosophy of Pointers....35

Pointer....36

Pointer Dereference....37

Many to One....38

Many to One Dereference....39

Invalid Pointer....40

Invalid Pointer Dereference....41

Wild (Dangling) Pointer....42

Pointer to Pointer....43

Pointer to Pointer Dereference....44

Naming Pointers and Entities....45

Names as Pointer Content....46

Pointers as Entities....47

Memory and Pointers....48

Mental Exercise....49

Debugger Memory Layout....50

Memory Dereference Layout....51

Names as Addresses....52

Addresses and Entities....53

Addresses and Structures....54

Pointers to Structures....55

Arrays....56

Arrays and Pointers to Arrays....57

Strings and Pointers to Strings....58

Basic Types....59

ASCII Characters and Pointers....60

Bytes and Pointers....61

Wide Characters and Pointers....62

Integers....63

Long Integers....64

Little-Endian System....65

Short Integers....66

Long Long Integers....67

Signed and Unsigned Integers....68

Fixed Size Integers....69

Booleans....70

Bytes....71

Size....72

Alignment....73

LLP64....74

Nothing and Anything....75

Automatic Type Inference....76

Entity Conversion....77

Pointer Conversion (C-Style)....78

Numeric Promotion/Conversion....79

Numeric Conversion....80

Incompatible Types....81

Forcing....82

Structures, Classes, and Objects....84

Structures....85

Access Level....86

Classes and Objects....87

Structures and Classes....88

Pointer to Structure....89

Pointer to Structure Dereference....90

Many Pointers to One Structure....91

Many to One Dereference....92

Invalid Pointer to Structure....93

Invalid Pointer Dereference....94

Wild (Dangling) Pointer....95

Pointer to Pointer to Structure....96

Pointer to Pointer Dereference....97

Memory and Structures....98

Addresses and Structures....99

Structure Field Access....100

Pointers to Structures....101

Pointers to Structure Fields....102

Structure Inheritance....103

Structure Slicing....104

Inheritance Access Level....106

Structures and Classes II....107

Internal Structure Alignment....108

Static Structure Fields....109

Uniform Initialization....110

Old Initialization Ways....111

New Way {}....112

Uniform Structure Initialization....113

Static Field Initialization....114

Macros, Types, and Synonyms....115

Macros....116

Old Way....117

New Way....118

Memory Storage....119

Overview....120

Thread Stack Frames....121

Local Variable Value Lifecycle....122

Stack Allocation Pitfalls....124

Explicit Local Allocation....126

Dynamic Allocation (C-style)....127

Dynamic Allocation (C++)....128

Memory Operators....129

Memory Expressions....130

Local Pointers (Manual)....131

In-place Allocation....133

Source Code Organisation....134

Logical Layer (Translation Units)....135

Physical Layer (Source Files)....136

Inter-TU Sharing....137

Classic Static TU Isolation....138

Namespace TU Isolation....139

Declaration and Definition....140

TU Definition Conflicts....141

Fine-grained TU Scope Isolation....142

Conceptual Layer (Design)....143

Incomplete Types....144

References....145

Type& vs. Type*....146

Values....147

Value Categories....148

Constant Values....149

Constant Expressions....150

Functions....151

Pointers to Functions....152

Function Pointer Types....154

Reading Declarations....155

Structure Function Fields....156

Structure Methods....157

Structure Methods (Inlined)....158

Structure Methods (Inheritance)....159

Structure Virtual Methods....161

Structure Pure Virtual Methods....163

Structure as Interface....164

Function Structure....165

Structure Constructors....166

Structure Copy Constructor....167

Structure Copy Assignment....168

Structure Destructor....169

Structure Destructor Hierarchy....170

Structure Virtual Destructor....171

Destructor as a Method....172

Conversion Operators....173

Parameters by Value....175

Parameters by Pointer/Reference....176

Parameters by Ptr/Ref to Const....177

Possible Mistake....178

Function Overloading....179

Immutable Objects....180

Static Structure Functions....181

Lambdas....182

x64 CPU Registers....183

Instructions and Registers....184

Memory and Stack Addressing....185

Memory Cell Sizes....186

Memory Load Instructions....187

Memory Store Instructions....188

Flow Instructions....189

Function Parameters....190

Struct Function Parameters....191

this....192

Function Objects vs. Lambdas....193

Captures and Closures....194

Lambdas as Parameters....196

Lambda Parameter Optimization....198

Lambdas as Unnamed Functions....200

std::function Lambda Parameters....202

auto Lambda Parameters....204

Lambdas as Return Values....206

Virtual Function Call....208

VTBL Memory Layout....209

VPTR and Struct Memory Layout....210

Templates: A Planck-length Introduction....211

Why Templates?....212

Reusability....213

Types of Templates....215

Types of Template Parameters....216

Type Safety....217

Flexibility....219

Metafunctions....220

Iterators as Pointers....221

Containers....222

Iterators....223

Constant Iterators....224

Pointers as Iterators....225

Algorithms....226

Memory Ownership....227

Pointers as Owners....228

Problems with Pointer Owners....229

Smart Pointers....230

Basic Design....231

Unique Pointers....232

Handles as Unique Pointers....233

Shared Pointers....234

RAII....235

RAII Definition....236

RAII Advantages....237

Handle RAII....238

Threads and Synchronization....239

Threads in C/C++....240

Threads in C++ Proper....241

Synchronization Problems....242

Synchronization Solution....243

Resources....244

C and C++....245

Reading Windows-based Code....246

Windows (C and C++)....248

Training (Windows C and C++)....250

Solid C and C++ knowledge is a must to fully understand Windows diagnostic artifacts such as memory dumps and do diagnostic, forensic, and root cause analysis beyond listing stack traces, DLL, and driver information. This full-color reference book is a part of the Accelerated C & C++ for Windows Diagnostics training course organized by Software Diagnostics Services. The text contains slides, brief notes highlighting particular points, and replicated source code fragments that are easy to copy into your favorite IDE. The book's detailed Table of Contents makes the usual Index redundant.

We hope this reference is helpful for the following audiences:

• C and C++ developers who want to deepen their knowledge
• Software engineers developing and maintaining products on Windows platforms
• Technical support, escalation, DevSecOps, cloud and site reliability engineers dealing with complex software issues
• Quality assurance engineers who test software on Windows platforms
• Security and vulnerability researchers, reverse engineers, malware and memory forensics analysts