Hallo Leutz,

Wieder was neues von der Beta MC* Front. Uebernaechste Woche mache ich mit Jens Steinigen zusammen die EBS Beta Pruefung (durch die ich bestimmt durchfalle), aber was soll’s, etwas Spass muss sein.

Dann habe ich mich fuer den kommenden Freitag zur 71-660 angemeldet, eine richtige Pruefung fuer Maenner um festzustellen, wieviel Ahnung von Windows Man(n) denn wirklich hat. Hier wird sich die Spreu vom Weizen trennen und ich feststellen, dass ich nur Spreu bin :-). Nein, ich hoffe natuerlich nicht, auch wenn ich mir keine grossen Chancen ausma(h)le.

Zu den Inhalten:

Skills Being Measured

This exam measures your ability to accomplish the technical tasks listed below.  The percentages indicate the relative weight of each major topic area on the exam.

 Identifying Architectural Components (16%)  ·         Identify memory types and mechanisms. o    This objective may include but is not limited to: nonpaged vs. paged; memory descriptor lists; physical memory vs. logical memory; address translation; heap memory.·         Identify I/O mechanisms. o    This objective may include but is not limited to: Plug and play; IRQL levels; I/O request packets (IRPs); I/O manager; device stacks; filter drivers; timers·         Identify subsystems. o    This objective may include but is not limited to: Object manager; cache manager; process manager; memory manager; security reference monitor·         Identify processor functions and architecture. o    This objective may include but is not limited to: Interrupts; processor affinity; system service calls; 64-bit vs. 32-bit·         Identify process and threads. o    This objective may include but is not limited to: Process environment block (PEB), thread environment block (TEB); thread scheduling, states and priorityDesigning Solutions (15%) ·         Optimize a system for its drivers. o    This objective may include but is not limited to: driver signing; identifying filter drivers; timers and deferred procedure calls (DPCs); system worker threads; Driver Verifier·         Design applications. o    This objective may include but is not limited to: Application Verifier; gflags; kernel mode vs. user mode threads; structured exception handling (SEH); memory mapped files; authentication mechanisms; synchronization primitives·         Deploy compatible applications. o    This objective may include but is not limited to: Application Verifier; Application Compatibility Toolkit (ACT); gflags·         Identify optimal I/O models for applications. o    This objective may include but is not limited to: synchronous vs. asynchronous I/O; I/O completion ports; multithreaded applicationsMonitoring Windows (14%) ·         Monitor I/O latency. o    This objective may include but is not limited to: Perfmon; disk I/O; application performance; device I/O·         Monitor I/O throughput. o    This objective may include but is not limited to: filter drivers; cache manager; xperf; kernrate·         Monitor memory usage. o    This objective may include but is not limited to: nonpaged vs paged pool; user memory vs. kernel memory; debugging memory leaks; memory corruption; heap corruption·         Monitor CPU utilization. o    This objective may include but is not limited to: thread time; kernel vs. user time; thread states; Perfmon; WinDbg; Xperf; Kernrate·         Monitor handled and unhandled exceptions. o    This objective may include but is not limited to: Adplus; Dr Watson; Windows Error Reporting (WER); default post-mortem debuggers; exception handlingAnalyzing User Mode (18%) ·         Analyze heap leaks. o    This objective may include but is not limited to: UMDH (User-mode dump heap); user mode stack tracing; WinDbg; Application Verifier; Gflags; Perfmon·          Analyze heap corruption. o    This objective may include but is not limited to: Page heap; WinDbg; Application Verifier; Gflags·         Handle leaks. o    This objective may include but is not limited to: Procmon (Process Monitor); Perfmon; WinDbg; htrace; Process Explorer; Handle.exe·         Resolve image load issues. o    This objective may include but is not limited to: Tlist; loader snaps; dll dependencies; application manifests; 64-bit applications vs. 32-bit applications; tasklist·         Analyze services and host processes. o    This objective may include but is not limited to: sc.exe; services; service dependencies; service isolation; services startup types; service registry entries·         Analyze cross-process application calls. o    This objective may include but is not limited to: RPC; LPC; shared memory; named pipes; process startup; winsock·         Analyze the modification of executables at runtime. o    This objective may include but is not limited to: WinDbg; image corruption; detours; hot patches·         Analyze GUI performance issues. o    This objective may include but is not limited to: spy++; message queues; Application Verifier; TraceTools; ATL Trace; Task ManagerAnalyzing Kernel Mode (19%) ·         Find and identify objects in object manager namespaces and identify the objects’ attributes. o    This objective may include but is not limited to: Winobj.exe; symbolic links; object namespace; security descriptors; global namespace; device objects; file objects; object manager; semaphores·         Analyze Plug and Play (PnP) device failure. o    This objective may include but is not limited to: removal failures; global device list; WinDbg; device adds and removes; power handling·         Analyze pool corruption. o    This objective may include but is not limited to: Driver Verifier; WinDbg; pool tags; Poolmon; guard pages·         Analyze pool leaks. o    This objective may include but is not limited to: WinDbg; poolmon; Driver Verifier; crash dump analysis; paged and nonpaged pool; cache trimming·         Isolate the root cause of S state failure. o    This objective may include but is not limited to: System power states and transitions; power IRP handling·         Analyze kernel mode CPU utilization. o    This objective may include but is not limited to: kernrate.exe; WinDbg; deadlocks; Performance monitoring; event tracingDebugging Windows (18%) ·         Debug memory. o    This objective may include but is not limited to: Heap; pool; virtual memory vs. physical memory; stack; analyzing crash dumps and user dumps·         Identify a pending I/O. o    This objective may include but is not limited to: WinDbg; deadlocks; I/O manager; IRP processing·         Identify a blocking thread. o    This objective may include but is not limited to: thread state; locks; synchronization objects·         Identify a runaway thread. o    This objective may include but is not limited to: thread priorities; processor affinity; Perfmon; kernrate·         Debug kernel crash dumps. o    This objective may include but is not limited to: WinDbg; DPCs; Assembler; forcing kernel crash dumps; trap processing; register usage; call stack composition (prolog/epilog); processes vs. threads·         Debug user crash dumps. o    This objective may include but is not limited to: dump types; forcing user crash dumps; gflags; system resource utilization (CPU, disk, network; memory)·         Set up the debugger.o    This objective may include but is not limited to: WinDbg; physical connection (USB, rs-232, 1394); boot.ini; bcdedit; remoting; NMI; debugging system processesNa dann, Gruss Marc