Unless my search skills have gone to hell, the Linux equivalents seem to be significantly out of date. You might consider trying The Design and Implementation of the FreeBSD Operating System by Kirk McKusick et. al..
If Alex happens to drop by: what happened to DriverMon? Clearly Alex has been very busy but he mentioned the GUI-fication of the tool was being handled by his co-worker Robin Keir.
"Abusing the NT Kernel Shim Engine" by Alex Ionescu at REcon 2016 (October)
Waiting for this has reinforced my belief that vaporware (or whatever is preventing the release of this tool) has served as the best deterrent preventing anyone else from running with this undocumented tech!
Maybe it's just me but when I glance at the cover it looks like the book is about Windows 7 Internals only. I'm wondering how many others would think the same when seeing it on a bookshelf. It looks like the same layout was used for the 6th edition, I want to suggest the use of a different layout for the next editions.
It does look as if the title is Windows 7 Internals. Note that it was the preceding edition that covered Windows 7 (Windows NT 6.1). This edition has been updated to cover Windows NT 10.
Not the way I read it - it is "Windows Internals - 7 (seventh edition)". It is not even ambiguous IMHO because "7" is not vertically aligned with "Windows". But at a glance, yeah, someone could misunderstand it...
This problem gets a lot worse when all you see is a thumbnail of the cover. At least the image on his blog post is large enough that you can figure out what it means if you take a second. But in search results, the text "Seventh Edition" is nearly invisible.
Wow, awesome. I've been checking Amazon every few months waiting on this. I was starting to think it'd never come. Also, just to echo xurukefi, what about part 2?
25 comments
[ 4.1 ms ] story [ 132 ms ] threadhttps://web.archive.org/web/20170512030315/http://www.alex-i...
https://amzn.com/dp/B0711FDMRR
Was ~$19 AUD ($14 USD)
https://www.microsoftpressstore.com
"Abusing the NT Kernel Shim Engine" by Alex Ionescu at REcon 2016 (October)
https://www.youtube.com/watch?v=qCa9icMqBNM?t=48m55s
a tool called DriverMon is planned for release at the conference, which uses the KSE to provide ProcMon for Drivers
Will be available from https://www.crowdstrike.com/resources/community-tools/
Will announce release on Twitter in a few weeks
--
Waiting for this has reinforced my belief that vaporware (or whatever is preventing the release of this tool) has served as the best deterrent preventing anyone else from running with this undocumented tech!
Nobody on the Internet seems to know what it is (based on my 5 minutes of looking). Does anyone on HN know?
[1] https://twitter.com/aionescu/status/815878947200077824?lang=...
[2] https://en.wikipedia.org/wiki/System_Management_Controller
> System Management Controller
It's like the worst Java naming patterns (FactoryControlerBridgeAdapterManagerAdapter), but in hardware.