Progress Tracker

Track the exact status of every chapter, section, topic, and subtopic.

PART 1 — FOUNDATIONAL HARDWARE (Chapters 1–4)

✅ CHAPTER 1 — The Complete Computer Architecture

Status: COMPLETE ✅

Section 1: The Layers of a Computer

✅ Introduction to layering concept
✅ Diagram of layers (user → OS → firmware → hardware → electricity)
✅ What each layer does
✅ Layer dependencies

Section 2: The Physical Hardware Inside a Computer

Topic 2.1: Power Supply Unit (PSU)

✅ What it is
✅ Why it matters
✅ AC to DC conversion
✅ Multiple voltage levels
✅ Typical wattages
✅ Failure modes

Topic 2.2: The Motherboard

✅ What it is (main circuit board)
✅ All connections explained (CPU, RAM, PCIe, storage, power, USB, audio, network, BIOS, CMOS)
✅ Motherboard as "nervous system"
✅ Power distribution explained
✅ Signal routing
✅ Clock/oscillator
✅ Monitoring (sensors)

Topic 2.3: Central Processing Unit (CPU)

✅ What it is (the brain)
✅ Modern CPU characteristics (cores, threads)
✅ Frequency (GHz)
✅ Example speeds (2010–2024 progression)
✅ CPU limitations (no direct hardware access)

Topic 2.4: Random Access Memory (RAM)

✅ What it is (short-term memory)
✅ Why it exists (speed vs storage)
✅ Typical sizes
✅ RAM speeds
✅ Key concept: temporary, lost on shutdown

Topic 2.5: Storage Devices

✅ Hard Disk Drive (HDD)
- What it is (magnetic platters)
- Components (platter, head, motor, controller, firmware)
- Characteristics (speed, capacity, cost, reliability)
- Issues (mechanical failure, noise)
✅ Solid State Drive (SSD)
- What it is (NAND flash)
- Characteristics (speed, capacity, cost, reliability)
- Connection types (SATA vs NVMe)
- Speed comparisons

Topic 2.6: GPU (Graphics Processing Unit)

✅ What it is (specialized processor)
✅ Integrated vs discrete
✅ What it does (render graphics)
✅ When needed (gaming, 3D design, ML, video)
✅ Importance for UI

Topic 2.7: Network Interface Controller (NIC)

✅ What it is (internet hardware)
✅ Types (Ethernet, Wi-Fi)
✅ What it does (convert data to packets)
✅ Key concept: NIC has own firmware and processor

Topic 2.8: USB Controllers

✅ What they are (special processors)
✅ USB versions (2.0, 3.0, 3.1)
✅ What they do (detect, communicate, transfer)

Topic 2.9: Audio Controller

✅ What it is (sound processor)
✅ Components (DAC, ADC, processor)
✅ DAC/ADC explanation
✅ What it does (digital↔analog conversion)

Topic 2.10: Specialized Chips

✅ Chipset (hub, bridge between CPU and devices)
✅ PMIC (power management)
- Voltage regulation
- Power distribution
- Monitoring
- Sleep/wake control

Topic 2.11: Firmware (BIOS/UEFI Chip)

✅ What it is (boot code storage)
✅ Read-only nature
✅ Contents
✅ When it runs

Topic 2.12: CMOS Battery

✅ What it is (coin-cell battery)
✅ Purpose (maintain settings when off)
✅ When it fails (clock resets, BIOS resets)

Section 3: The Buses — How Components Communicate

Topic 3.1: System Bus / Memory Bus

✅ What it is (fastest connection)
✅ What connects where
✅ Speed characteristics
✅ What travels on it

Topic 3.2: PCIe (PCI Express)

✅ What it is (modern expansion bus)
✅ Common uses (GPU, NIC, sound, storage)
✅ Speed progression (3.0, 4.0, 5.0)
✅ Lanes concept
✅ Bandwidth calculation

Topic 3.3: SATA

✅ What it is (older storage bus)
✅ What uses it
✅ Speed limitations
✅ Characteristics

Topic 3.4: NVMe

✅ What it is (newer, faster bus)
✅ What uses it
✅ Speed advantage
✅ Speed specifications

Topic 3.5: USB Bus

✅ What it is (external device bus)
✅ Controller explanation
✅ USB versions and speeds
✅ Common devices

Topic 3.6: Thunderbolt

✅ What it is (PCIe + DisplayPort)
✅ Speed
✅ Uses

Topic 3.7: I2C and SPI

✅ What they are (low-speed buses)
✅ What uses them

Section 4: Complete Architecture Diagram

✅ Full system diagram showing all connections
✅ Data flow example (opening web browser)
✅ Step-by-step hardware chain

Section 5: Software and Operating System

✅ Where software runs (firmware, RAM, storage)
✅ Privilege levels (Ring 0 vs Ring 3)
✅ Kernel mode components
✅ User mode components
✅ Privilege boundary explanation
✅ Why boundary exists (security, stability, isolation)

Section 6: Key Concepts

✅ Abstraction (layering and hiding complexity)
✅ Layering (dependency structure)
✅ Concurrency (simultaneous operations)
✅ Interrupts (hardware signals)

Section 7: Common Misconceptions

✅ Misconception 1: CPU connects to everything (Reality: through chipset)
✅ Misconception 2: Programs just run (Reality: complex startup process)
✅ Misconception 3: RAM and storage are similar (Reality: speed, permanence differ)
✅ Misconception 4: Drivers installed once (Reality: load/unload/update)
✅ Misconception 5: Kernel does everything (Reality: kernel orchestrates, relies on drivers/services)

Section 8: Terminology Glossary

✅ Fundamental terms table (15 terms)
✅ CPU-related terms (7 terms)
✅ Memory-related terms (6 terms)
✅ Storage-related terms (6 terms)

Practical Lab: Exploring Your Hardware

✅ Objective stated
✅ System Information instructions
✅ Device Manager instructions
✅ What to record (CPU, cores, RAM, system type, BIOS)
✅ Device Manager categories to expand
✅ Interpretation guide
✅ Follow-up questions

Knowledge Check

✅ 10 Quick Review questions
✅ Answer key with detailed explanations
✅ 5 Understanding questions
✅ 5 Scenario questions (troubleshooting)
✅ 5 Interview questions
✅ 1 Practical task (document hardware)

Chapter Summary

✅ Quick reference summary
✅ Key diagram
✅ Chapter navigation links

✅ CHAPTER 2 — CPU Internals

Status: COMPLETE ✅

Section 1: Introduction to CPU Architecture

✅ CPU as the executor of instructions
✅ Why CPU internals matter
✅ The CPU's job (fetch → decode → execute)

Section 2: CPU Cores and Threads

✅ Topic 2.1: What is a core?
✅ Topic 2.2: What is a thread?
✅ Topic 2.3: Cores vs threads (modern architecture)
✅ Topic 2.4: Multi-core benefits
✅ Topic 2.5: Hyperthreading explained

Section 3: CPU Memory Hierarchy

✅ Topic 3.1: Registers (ultra-fast, inside CPU)
✅ Topic 3.2: L1 Cache (32–64 KB, per core)
✅ Topic 3.3: L2 Cache (256 KB–1 MB, per core)
✅ Topic 3.4: L3 Cache (4–16 MB, shared)
✅ Topic 3.5: Main RAM (much larger, slower)
✅ Topic 3.6: Cache hierarchy diagram
✅ Topic 3.7: Why caching matters (speed differential)

Section 4: CPU Instruction Execution

✅ Topic 4.1: Instruction lifecycle
✅ Topic 4.2: Fetch stage (get instruction from memory)
✅ Topic 4.3: Decode stage (interpret instruction)
✅ Topic 4.4: Execute stage (perform operation)
✅ Topic 4.5: Memory stage (read/write data)
✅ Topic 4.6: Writeback stage (store results)

Section 5: Advanced CPU Concepts

✅ Topic 5.1: Pipelining (overlapping stages)
✅ Topic 5.2: Branch prediction (guessing next instruction)
✅ Topic 5.3: Out-of-order execution (reordering instructions)
✅ Topic 5.4: Speculative execution (executing speculatively)
✅ Topic 5.5: Instruction-level parallelism (ILP)

Section 6: CPU Privilege Levels

✅ Topic 6.1: Ring 0 (kernel mode)
✅ Topic 6.2: Ring 3 (user mode)
✅ Topic 6.3: Why privilege levels exist
✅ Topic 6.4: Privilege transitions (system calls)

Section 7: CPU Interrupts and Context Switching

✅ Topic 7.1: What is an interrupt?
✅ Topic 7.2: Hardware interrupts (external signals)
✅ Topic 7.3: Software interrupts (system calls)
✅ Topic 7.4: Exceptions and faults
✅ Topic 7.5: Context switching (process switching)
✅ Topic 7.6: Context switch overhead

Section 8: x86/x64 Architecture

✅ Topic 8.1: What is x86? (32-bit instruction set)
✅ Topic 8.2: What is x64? (64-bit extension)
✅ Topic 8.3: Registers in x86/x64
✅ Topic 8.4: Common instructions
✅ Topic 8.5: Assembly language overview

Section 9: Modern CPU Designs (Intel vs AMD)

✅ Topic 9.1: Intel Core architecture
✅ Topic 9.2: AMD Ryzen architecture
✅ Topic 9.3: Performance differences
✅ Topic 9.4: Power efficiency trade-offs

Section 10: CPU Frequency and Power

✅ Topic 10.1: Clock speed (GHz)
✅ Topic 10.2: Dynamic frequency scaling
✅ Topic 10.3: Thermal throttling
✅ Topic 10.4: Power consumption
✅ Topic 10.5: TDP (Thermal Design Power)

Practical Lab: Monitoring CPU

✅ Using Task Manager (Processes and Details tabs)
✅ CPU percentage interpretation
✅ Context switch observation
✅ Thread count observation
✅ Using Resource Monitor
✅ Reading CPU graphs

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 3 — RAM and Memory Internals

Status: COMPLETE ✅

Section 1: What is RAM?

✅ Random Access Memory definition
✅ Volatile vs non-volatile
✅ Why it's necessary
✅ Historical context (speed improvements)

Section 2: Memory Technologies

✅ Topic 2.1: DRAM (Dynamic RAM)
- How DRAM cells work (capacitor charges)
- Refresh cycles
- Capacity
✅ Topic 2.2: SRAM (Static RAM)
- How SRAM cells work (transistor pairs)
- No refresh needed
- Faster but expensive
- Used for CPU caches
✅ Topic 2.3: DDR (Double Data Rate)
- DDR3, DDR4, DDR5 explained
- Speed progression
- Bandwidth calculation

Section 3: Virtual Memory and Address Spaces

✅ Topic 3.1: Physical memory vs virtual memory
✅ Topic 3.2: Address space (32-bit vs 64-bit)
✅ Topic 3.3: Virtual addresses vs physical addresses
✅ Topic 3.4: Why virtual memory matters (isolation, abstraction)
✅ Topic 3.5: Process address space layout

Section 4: Memory Management Unit (MMU)

✅ Topic 4.1: What the MMU is (hardware component)
✅ Topic 4.2: Address translation
✅ Topic 4.3: Page tables (hierarchical)
✅ Topic 4.4: TLB (Translation Lookaside Buffer)
✅ Topic 4.5: TLB misses and performance
✅ Topic 4.6: Memory protection (per-page permissions)

Section 5: Paging and Swap

✅ Topic 5.1: Pages (fixed-size memory blocks)
✅ Topic 5.2: Page faults (when page isn't in RAM)
✅ Topic 5.3: Paging to storage (swap/pagefile)
✅ Topic 5.4: When paging happens
✅ Topic 5.5: Paging performance (slow!)
✅ Topic 5.6: Windows pagefile

Section 6: Process Memory Layout

✅ Topic 6.1: Stack (function calls, local variables)
✅ Topic 6.2: Heap (dynamic allocation)
✅ Topic 6.3: Data segment (global variables)
✅ Topic 6.4: Code segment (instructions)
✅ Topic 6.5: Memory layout diagram

Section 7: Memory Allocation

✅ Topic 7.1: Static allocation (compile time)
✅ Topic 7.2: Stack allocation (function scope)
✅ Topic 7.3: Heap allocation (malloc, new, etc.)
✅ Topic 7.4: Heap fragmentation
✅ Topic 7.5: Memory leaks (allocated but not freed)

Section 8: Memory Protection and Isolation

✅ Topic 8.1: Per-process isolation
✅ Topic 8.2: User mode vs kernel mode access
✅ Topic 8.3: Access violations
✅ Topic 8.4: Stack overflow
✅ Topic 8.5: Buffer overflow security

Section 9: Copy-on-Write and Shared Memory

✅ Topic 9.1: Copy-on-Write (CoW) mechanism
✅ Topic 9.2: When CoW is used (fork, DLL loading)
✅ Topic 9.3: Shared memory between processes
✅ Topic 9.4: Memory-mapped files

Section 10: Modern RAM Features

✅ Topic 10.1: Memory compression
✅ Topic 10.2: Non-Uniform Memory Access (NUMA)
✅ Topic 10.3: Persistent memory (new technology)

Practical Lab: Monitoring Memory

✅ Task Manager → Performance tab
✅ Reading memory graphs
✅ Committed vs available
✅ Page faults observation
✅ Resource Monitor memory details
✅ RAM speed detection (CPU-Z or similar)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 4 — Motherboard and Hardware Communication

Status: COMPLETE ✅

Section 1: Motherboard Architecture in Detail

✅ Topic 1.1: PCH (Platform Controller Hub) detailed
✅ Topic 1.2: DMI (Direct Media Interface) connection
✅ Topic 1.3: Power delivery subsystem
✅ Topic 1.4: Reset and boot circuits

Section 2: Buses In Depth

✅ Topic 2.1: System/FSB (Front Side Bus)
✅ Topic 2.2: QPI/Infinity Fabric (CPU-to-CPU, CPU-to-PCH)
✅ Topic 2.3: PCIe architecture deep dive
✅ Topic 2.4: USB architecture (hubs, cascading)
✅ Topic 2.5: SATA/SAS controllers
✅ Topic 2.6: I2C/SMBus topology

Section 3: Interrupts (Hardware)

✅ Topic 3.1: Hardware interrupts (IRQ)
✅ Topic 3.2: Interrupt controller (PIC, APIC)
✅ Topic 3.3: Message-Signaled Interrupts (MSI)
✅ Topic 3.4: Interrupt routing
✅ Topic 3.5: ISR (Interrupt Service Routine)

Section 4: DMA (Direct Memory Access)

✅ Topic 4.1: What is DMA (hardware accessing RAM without CPU)
✅ Topic 4.2: Why DMA matters (performance)
✅ Topic 4.3: DMA controller
✅ Topic 4.4: DMA descriptors
✅ Topic 4.5: DMA and cache coherency

Section 5: Power Management

✅ Topic 5.1: Power distribution
✅ Topic 5.2: Multiple voltage rails
✅ Topic 5.3: Vreg (voltage regulators)
✅ Topic 5.4: ACPI (Advanced Configuration Power Interface)
✅ Topic 5.5: Power states (S0, S3, S4, S5)

Section 6: I/O Operations

✅ Topic 6.1: Programmed I/O (PIO)
✅ Topic 6.2: Memory-mapped I/O
✅ Topic 6.3: I/O ports (x86 specific)
✅ Topic 6.4: Device enumeration

Section 7: Clocking and Synchronization

✅ Topic 7.1: Crystal oscillators (clock sources)
✅ Topic 7.2: CPU clock domain
✅ Topic 7.3: PCI clock domain
✅ Topic 7.4: Clock distribution
✅ Topic 7.5: Clock skew and jitter

Section 8: Firmware and ROM

✅ Topic 8.1: BIOS ROM
✅ Topic 8.2: CMOS chip
✅ Topic 8.3: Firmware updates (flashing)

Practical Lab: Exploring Motherboard Info

✅ CPU-Z (motherboard, chipset info)
✅ HWiNFO (voltage, temperatures, bus speeds)
✅ Interpreting motherboard specs
✅ Device Manager → universal serial bus controllers

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 2 — BOOT AND STARTUP (Chapters 5–6)

✅ CHAPTER 5 — BIOS and UEFI

Status: COMPLETE ✅

Section 1: What is BIOS?

✅ Definition
✅ Historical context
✅ 16-bit limitations
✅ Still used today

Section 2: BIOS Architecture

✅ Topic 2.1: Boot ROM
✅ Topic 2.2: Real-mode execution
✅ Topic 2.3: BIOS interrupts
✅ Topic 2.4: BIOS services
✅ Topic 2.5: Option ROMs

Section 3: POST (Power-On Self Test)

✅ Topic 3.1: First steps after power
✅ Topic 3.2: Hardware initialization sequence
✅ Topic 3.3: CPU register initialization
✅ Topic 3.4: Memory testing
✅ Topic 3.5: Device discovery
✅ Topic 3.6: Error detection and beep codes

Section 4: What is UEFI?

✅ Definition (Unified Extensible Firmware Interface)
✅ Advantages over BIOS
✅ 32-bit vs 64-bit
✅ Modular architecture

Section 5: UEFI Internals

✅ Topic 5.1: UEFI firmware volumes
✅ Topic 5.2: UEFI applications
✅ Topic 5.3: UEFI protocols
✅ Topic 5.4: EFI system partition (ESP)
✅ Topic 5.5: UEFI Boot Manager

Section 6: Secure Boot

✅ Topic 6.1: Why Secure Boot exists
✅ Topic 6.2: Public key infrastructure (PKI)
✅ Topic 6.3: Signature verification
✅ Topic 6.4: Microsoft's key role
✅ Topic 6.5: Disabling Secure Boot

Section 7: CMOS and Settings Storage

✅ Topic 7.1: CMOS memory
✅ Topic 7.2: NVRAM
✅ Topic 7.3: Storing boot settings
✅ Topic 7.4: Battery backup

Section 8: BIOS/UEFI Settings

✅ Topic 8.1: Boot order
✅ Topic 8.2: Storage configuration (AHCI, RAID)
✅ Topic 8.3: Memory settings
✅ Topic 8.4: Virtualization (VT-x, AMD-V)
✅ Topic 8.5: TPM
✅ Topic 8.6: Fan curves and thermal management

Practical Lab: Entering BIOS/UEFI

✅ How to enter BIOS (Del, F2, F12 keys)
✅ UEFI interface navigation
✅ Identifying motherboard model in BIOS
✅ Checking boot order
✅ Viewing hardware info in BIOS
✅ Safe settings to check

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 6 — Complete Boot Process

Status: COMPLETE ✅

Section 1: Overview of Boot Sequence

✅ Power button pressed
✅ Complete chain to desktop
✅ Major stages overview

Section 2: Pre-Boot Phase (Power → BIOS)

✅ Topic 2.1: Power supply starts
✅ Topic 2.2: Motherboard power-up
✅ Topic 2.3: CPU initialization
✅ Topic 2.4: Memory initialization
✅ Topic 2.5: Firmware starts (real mode)

Section 3: POST Phase (Hardware Test)

✅ Topic 3.1: CPU and memory test
✅ Topic 3.2: Device discovery
✅ Topic 3.3: BIOS/UEFI loads
✅ Topic 3.4: Option ROMs executed
✅ Topic 3.5: Error handling and beeps

Section 4: Boot Device Selection

✅ Topic 4.1: Boot device order
✅ Topic 4.2: MBR (Master Boot Record)
✅ Topic 4.3: GPT (GUID Partition Table)
✅ Topic 4.4: Boot manager selection
✅ Topic 4.5: Boot timeout

Section 5: Windows Boot Manager

✅ Topic 5.1: UEFI Boot Manager
✅ Topic 5.2: EFI file (bootmgfw.efi)
✅ Topic 5.3: BCD (Boot Configuration Database)
✅ Topic 5.4: Boot menu options
✅ Topic 5.5: UEFI to protected mode transition

Section 6: Windows Bootloader

✅ Topic 6.1: Winload.exe role
✅ Topic 6.2: Driver loading (critical drivers)
✅ Topic 6.3: Registry hive mounting
✅ Topic 6.4: System initialization
✅ Topic 6.5: Kernel loading

Section 7: Windows Kernel Initialization

✅ Topic 7.1: Kernel execution begins
✅ Topic 7.2: Memory manager initialization
✅ Topic 7.3: Process manager initialization
✅ Topic 7.4: Device driver loading (all drivers)
✅ Topic 7.5: I/O subsystem initialization
✅ Topic 7.6: Registry full loading

Section 8: Session Manager and Services

✅ Topic 8.1: Session Manager (smss.exe)
✅ Topic 8.2: Services start (services.exe)
✅ Topic 8.3: Service Control Manager (SCM)
✅ Topic 8.4: Device enumeration and initialization
✅ Topic 8.5: Network stack initialization

✅ Topic 9.1: Winlogon process (winlogon.exe)
✅ Topic 9.2: Login prompt appears
✅ Topic 9.3: LSASS (Local Security Authority)
✅ Topic 9.4: Authentication
✅ Topic 9.5: User profile loading
✅ Topic 9.6: Explorer.exe and desktop
✅ Topic 9.7: Startup applications

Section 10: Complete Boot Chain Diagram

✅ Visual representation of entire sequence
✅ Timing information (rough)
✅ Critical vs non-critical paths

Section 11: Boot Failures

✅ Topic 11.1: Black screen (before POST)
✅ Topic 11.2: POST failures (beep codes)
✅ Topic 11.3: No bootloader found
✅ Topic 11.4: Kernel crash (BSOD during boot)
✅ Topic 11.5: Driver failure
✅ Topic 11.6: Services failure preventing login

Practical Lab: Boot Analysis

✅ Observing boot messages (press Spacebar during boot)
✅ Safe Mode boot
✅ Checking BCD with bcdedit
✅ Viewing system startup logs
✅ Analyzing boot performance (Task Manager Startup tab)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 3 — OPERATING SYSTEM (Chapters 7–8)

✅ CHAPTER 7 — What an Operating System Really Does

Status: COMPLETE ✅

Section 1: Why Operating Systems Exist

✅ Problem: Applications need hardware
✅ Challenge: Multiple applications, one hardware
✅ Solution: OS as abstraction and manager

Section 2: Core OS Responsibilities

✅ Topic 2.1: Resource allocation (sharing hardware)
✅ Topic 2.2: Abstraction (hide complexity)
✅ Topic 2.3: Security (isolation, protection)
✅ Topic 2.4: Coordination (multiple apps at once)

Section 3: Process Management

✅ Topic 3.1: Process creation and termination
✅ Topic 3.2: Process states (running, waiting, etc.)
✅ Topic 3.3: Scheduling (CPU time allocation)
✅ Topic 3.4: Context switching

Section 4: Memory Management

✅ Topic 4.1: Virtual memory abstraction
✅ Topic 4.2: Memory allocation to processes
✅ Topic 4.3: Memory protection
✅ Topic 4.4: Paging and swapping

Section 5: I/O and Device Management

✅ Topic 5.1: Device abstraction
✅ Topic 5.2: Drivers (device communication)
✅ Topic 5.3: Interrupt handling
✅ Topic 5.4: DMA coordination
✅ Topic 5.5: File systems (storage abstraction)

Section 6: Security and Isolation

✅ Topic 6.1: User/kernel separation
✅ Topic 6.2: Process isolation
✅ Topic 6.3: Memory access protection
✅ Topic 6.4: Resource quotas
✅ Topic 6.5: Access control

Section 7: Kernel vs User Mode

✅ Topic 7.1: Privilege levels deep dive
✅ Topic 7.2: Kernel mode capabilities
✅ Topic 7.3: User mode limitations
✅ Topic 7.4: System calls (bridge)
✅ Topic 7.5: Context switching cost

Section 8: The Kernel

✅ Topic 8.1: What the kernel is
✅ Topic 8.2: Kernel vs OS (distinction)
✅ Topic 8.3: Kernel responsibilities
✅ Topic 8.4: Kernel performance critical

Practical Lab: Understanding OS Services

✅ Services running (Services.msc)
✅ System processes (Task Manager)
✅ OS abstraction (what hardware do applications see?)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 8 — Windows Architecture

Status: COMPLETE ✅

Section 1: Windows as Operating System

✅ NT-based architecture
✅ History (Windows NT, 2000, XP, Vista, 7, 8, 10, 11)
✅ Version differences

Section 2: Kernel and Executive

✅ Topic 2.1: Kernel (ntoskrnl.exe)
✅ Topic 2.2: Executive layer (processes, memory, I/O, security)
✅ Topic 2.3: HAL (Hardware Abstraction Layer)
✅ Topic 2.4: Drivers

Section 3: Kernel-Mode Components

✅ Topic 3.1: Process Manager
✅ Topic 3.2: Memory Manager
✅ Topic 3.3: I/O Manager
✅ Topic 3.4: Security Reference Monitor
✅ Topic 3.5: Configuration Manager (registry)
✅ Topic 3.6: Plug and Play Manager
✅ Topic 3.7: Power Manager
✅ Topic 3.8: Device Manager

Section 4: User-Mode Components

✅ Topic 4.1: Win32 Subsystem
✅ Topic 4.2: Client/Server Runtime (csrss.exe)
✅ Topic 4.3: Services processes (svchost.exe)
✅ Topic 4.4: Session 0 (system) vs Session 1+ (users)
✅ Topic 4.5: Applications

Section 5: System Processes

✅ Topic 5.1: System (kernel)
✅ Topic 5.2: Smss.exe (Session Manager)
✅ Topic 5.3: Services.exe (Service Control Manager)
✅ Topic 5.4: Lsass.exe (Local Security Authority)
✅ Topic 5.5: Csrss.exe (Client/Server Runtime)
✅ Topic 5.6: Svchost.exe (Service host)
✅ Topic 5.7: Wininit.exe (Windows initialization)
✅ Topic 5.8: Winlogon.exe (user logon)
✅ Topic 5.9: Explorer.exe (shell)

Section 6: Object Manager

✅ Topic 6.1: Unified object model
✅ Topic 6.2: Handles (references to objects)
✅ Topic 6.3: Object types
✅ Topic 6.4: Object namespace

Section 7: Registry (Configuration Manager)

✅ Topic 7.1: Central configuration database
✅ Topic 7.2: Hives
✅ Topic 7.3: Registry access

Section 8: APIs

✅ Topic 8.1: Win32 API (primary)
✅ Topic 8.2: Native API (lower level)
✅ Topic 8.3: .NET (managed layer)
✅ Topic 8.4: UWP (modern apps)
✅ Topic 8.5: System calls (transition from user to kernel)

Section 9: Architecture Diagram

✅ Complete Windows architecture visualization
✅ Data flow between components
✅ Which parts run in kernel vs user mode

Practical Lab: Windows Components

✅ Observing processes (Task Manager, Process Explorer)
✅ Identifying kernel vs user-mode processes
✅ Registry overview (Regedit, safe viewing)
✅ Event logs (Windows events)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 4 — PROCESSES AND EXECUTION (Chapters 9–11)

✅ CHAPTER 9 — Processes

Status: COMPLETE ✅

Section 1: What is a Process?

✅ Definition
✅ vs programs (exe file)
✅ vs threads
✅ Isolation concept

Section 2: Process Creation

✅ Topic 2.1: Application execution
✅ Topic 2.2: CreateProcess API
✅ Topic 2.3: Executable loading (PE format)
✅ Topic 2.4: Address space allocation
✅ Topic 2.5: Process environment setup
✅ Topic 2.6: Initial thread creation
✅ Topic 2.7: Execution starts

Section 3: Process Termination

✅ Topic 3.1: Normal exit
✅ Topic 3.2: Abnormal termination
✅ Topic 3.3: Crash/exception
✅ Topic 3.4: Cleanup (memory, handles, files)
✅ Topic 3.5: Zombie processes

Section 4: Process Memory

✅ Topic 4.1: Virtual address space (32-bit vs 64-bit)
✅ Topic 4.2: Process layout (code, heap, stack, data)
✅ Topic 4.3: Stack per-thread
✅ Topic 4.4: Heap (application data)
✅ Topic 4.5: Memory isolation

Section 5: Process IDs and Handles

✅ Topic 5.1: PID (Process ID)
✅ Topic 5.2: Handles (not same as memory addresses)
✅ Topic 5.3: Handle table (per-process)
✅ Topic 5.4: Handle inheritance

Section 6: Process Environment

✅ Topic 6.1: Environment variables
✅ Topic 6.2: Working directory
✅ Topic 6.3: Command-line arguments
✅ Topic 6.4: Current user context
✅ Topic 6.5: Parent process

Section 7: Process States

✅ Topic 7.1: New (being created)
✅ Topic 7.2: Ready (waiting for CPU)
✅ Topic 7.3: Running (executing)
✅ Topic 7.4: Waiting (waiting for I/O)
✅ Topic 7.5: Terminated (dead)

Section 8: DLLs and Process Modules

✅ Topic 8.1: Dynamic libraries
✅ Topic 8.2: DLL loading
✅ Topic 8.3: Import table
✅ Topic 8.4: Exported functions
✅ Topic 8.5: Base address and relocation

Section 9: Inter-Process Communication (IPC)

✅ Topic 9.1: Pipes
✅ Topic 9.2: Sockets
✅ Topic 9.3: Shared memory
✅ Topic 9.4: Message passing
✅ Topic 9.5: RPC (Remote Procedure Call)

Section 10: Parent-Child Processes

✅ Topic 10.1: Process hierarchy
✅ Topic 10.2: Child process creation
✅ Topic 10.3: Inheritance
✅ Topic 10.4: Process groups

Practical Lab: Exploring Processes

✅ Task Manager (Processes tab)
✅ Process Explorer (detailed info)
✅ ProcessID observation
✅ Memory usage per process
✅ Parent-child relationships
✅ Handle count

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 10 — Threads

Status: COMPLETE ✅

Section 1: What is a Thread?

✅ Definition (unit of execution within a process)
✅ Thread vs process distinction
✅ Why processes have threads

Section 2: Main Thread and Worker Threads

✅ Topic 2.1: Main thread (created at process start)
✅ Topic 2.2: Worker threads (created during execution)
✅ Topic 2.3: Thread creation API
✅ Topic 2.4: Thread termination

Section 3: Thread Scheduling

✅ Topic 3.1: Scheduler responsibilities
✅ Topic 3.2: Time slices (quantum)
✅ Topic 3.3: Preemptive multitasking
✅ Topic 3.4: Multi-core scheduling
✅ Topic 3.5: CPU affinity

Section 4: Thread States

✅ Topic 4.1: Ready
✅ Topic 4.2: Running
✅ Topic 4.3: Waiting/Blocked
✅ Topic 4.4: Terminated
✅ Topic 4.5: State transition diagram

Section 5: Thread Priority

✅ Topic 5.1: Priority levels (Windows priority classes)
✅ Topic 5.2: Priority boosting
✅ Topic 5.3: Real-time priority
✅ Topic 5.4: Priority inversion problem

Section 6: Context Switching (Thread-Level)

✅ Topic 6.1: What gets saved/restored
✅ Topic 6.2: Register state
✅ Topic 6.3: Stack pointer
✅ Topic 6.4: Context switch cost/overhead

Section 7: Thread Synchronization

✅ Topic 7.1: Why synchronization is needed (shared data)
✅ Topic 7.2: Mutex (mutual exclusion)
✅ Topic 7.3: Semaphore (counting resource access)
✅ Topic 7.4: Event (signaling between threads)
✅ Topic 7.5: Critical Section (lightweight lock)
✅ Topic 7.6: Condition variables

Section 8: Concurrency Problems

✅ Topic 8.1: Race condition (unsynchronized access)
✅ Topic 8.2: Deadlock (circular waiting)
✅ Topic 8.3: Livelock
✅ Topic 8.4: Starvation
✅ Topic 8.5: How to detect and avoid each

Section 9: Thread Pools

✅ Topic 9.1: What a thread pool is
✅ Topic 9.2: Why thread pools exist (reuse overhead)
✅ Topic 9.3: Windows Thread Pool API

Practical Lab: Observing Threads

✅ Task Manager → Details → Add "Threads" column
✅ Process Explorer thread view
✅ Observing thread count per process
✅ Viewing thread stacks (Process Explorer)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 11 — Windows Task Manager

Status: COMPLETE ✅

Section 1: Processes Tab

✅ Topic 1.1: App vs background process grouping
✅ Topic 1.2: CPU, Memory, Disk, Network, GPU columns explained
✅ Topic 1.3: What each percentage actually measures internally

Section 2: Performance Tab

✅ Topic 2.1: CPU graph (utilization, speed, processes, threads, handles)
✅ Topic 2.2: Memory graph (in use, available, committed, cached, paged/non-paged pool)
✅ Topic 2.3: Disk graph (active time, read/write speed, response time)
✅ Topic 2.4: Network graph (throughput, adapter info)
✅ Topic 2.5: GPU graph (engines, dedicated/shared memory)

Section 3: App History Tab

✅ Topic 3.1: CPU time and network usage per app over time

Section 4: Startup Tab

✅ Topic 4.1: Startup impact measurement
✅ Topic 4.2: Where startup entries come from (Registry Run keys, Startup folder)

Section 5: Users Tab

✅ Topic 5.1: Per-user resource usage
✅ Topic 5.2: Session isolation

Section 6: Details Tab

✅ Topic 6.1: PID, status, user name
✅ Topic 6.2: Priority column
✅ Topic 6.3: Architecture (32-bit vs 64-bit)
✅ Topic 6.4: Command line column
✅ Topic 6.5: Set priority / affinity (right-click options)

Section 7: Services Tab

✅ Topic 7.1: Service name vs display name
✅ Topic 7.2: Linking back to Services.msc

Practical Lab: Task Manager Deep Dive

✅ Enabling all optional columns
✅ Identifying a runaway process
✅ Correlating CPU spike with a specific process
✅ Checking startup impact ratings

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 5 — WINDOWS SERVICES (Chapter 12)

✅ CHAPTER 12 — Windows Services

Status: COMPLETE ✅

Section 1: What is a Service?

✅ Definition (background process without UI)
✅ Services vs regular processes
✅ Why Windows needs services

Section 2: Service Control Manager (SCM)

✅ Topic 2.1: SCM role (services.exe)
✅ Topic 2.2: Service database
✅ Topic 2.3: SCM API (start/stop/query)

Section 3: Service Startup Types

✅ Topic 3.1: Automatic
✅ Topic 3.2: Automatic (Delayed Start)
✅ Topic 3.3: Manual
✅ Topic 3.4: Disabled
✅ Topic 3.5: Trigger Start

Section 4: Service Dependencies

✅ Topic 4.1: Dependency chains
✅ Topic 4.2: Start order resolution
✅ Topic 4.3: Failure propagation

Section 5: Service Accounts

✅ Topic 5.1: Local System (full privileges)
✅ Topic 5.2: Network Service (limited, network access)
✅ Topic 5.3: Local Service (limited, no network)
✅ Topic 5.4: Custom user accounts for services

Section 6: Service Permissions

✅ Topic 6.1: Who can start/stop/configure a service
✅ Topic 6.2: Service SIDs
✅ Topic 6.3: Service hardening (Windows 10+ restrictions)

Section 7: Service Recovery

✅ Topic 7.1: First/second/subsequent failure actions
✅ Topic 7.2: Restart service option
✅ Topic 7.3: Run a program on failure
✅ Topic 7.4: Reboot computer on failure

Section 8: Service Failures

✅ Topic 8.1: Common failure causes
✅ Topic 8.2: Event log entries for service failures
✅ Topic 8.3: Diagnosing a service that won't start

Section 9: How a Service Actually Starts (Internal Chain)

✅ Topic 9.1: SCM reads registry service entry
✅ Topic 9.2: Executable/DLL loaded (svchost.exe hosting)
✅ Topic 9.3: Service main function registered
✅ Topic 9.4: Status reported back to SCM

Practical Lab: Exploring Services

✅ services.msc walkthrough
✅ Viewing a service's dependencies tab
✅ Viewing a service's recovery tab
✅ sc query and sc qc from command line
✅ Safely starting/stopping a non-critical service

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 6 — DEVICE DRIVERS (Chapters 13–14)

✅ CHAPTER 13 — Device Drivers

Status: COMPLETE ✅

Section 1: What a Driver Really Is

✅ Definition (software translating OS commands to hardware commands)
✅ Why hardware can't be controlled directly by applications
✅ Driver as a "translator"

Section 2: Why Drivers Are Required

✅ Topic 2.1: Hardware diversity problem
✅ Topic 2.2: Abstraction for applications
✅ Topic 2.3: Security enforcement point

Section 3: User-Mode vs Kernel-Mode Drivers

✅ Topic 3.1: Kernel-mode drivers (direct hardware access, Ring 0)
✅ Topic 3.2: User-mode drivers (UMDF, safer, restricted)
✅ Topic 3.3: Trade-offs (performance vs stability/security)

Section 4: Driver Architecture

✅ Topic 4.1: Windows Driver Model (WDM)
✅ Topic 4.2: Windows Driver Frameworks (WDF): KMDF and UMDF
✅ Topic 4.3: Driver object
✅ Topic 4.4: Device object
✅ Topic 4.5: Device stacks (layered drivers)
✅ Topic 4.6: Filter drivers (upper/lower filters)

Section 5: Driver Installation

✅ Topic 5.1: INF files (installation instructions)
✅ Topic 5.2: Driver packages (catalog + INF + binaries)
✅ Topic 5.3: Driver Store (C:\Windows\System32\DriverStore)
✅ Topic 5.4: Staging vs installing a driver

Section 6: Driver Loading and Initialization

✅ Topic 6.1: DriverEntry function
✅ Topic 6.2: Load order groups
✅ Topic 6.3: Boot-start, system-start, auto-start, demand-start drivers
✅ Topic 6.4: AddDevice routine
✅ Topic 6.5: Device initialization sequence

Section 7: Plug and Play (PnP)

✅ Topic 7.1: PnP Manager role
✅ Topic 7.2: Device enumeration (bus drivers report new devices)
✅ Topic 7.3: Hardware ID / Compatible ID matching
✅ Topic 7.4: Driver ranking and selection
✅ Topic 7.5: Dynamic device arrival/removal

Section 8: Driver Signing

✅ Topic 8.1: Why signing exists (integrity, malware prevention)
✅ Topic 8.2: WHQL certification
✅ Topic 8.3: Test signing mode
✅ Topic 8.4: Signature enforcement (kernel-mode code signing)

Section 9: I/O Request Packets (IRPs)

✅ Topic 9.1: What an IRP is
✅ Topic 9.2: IRP creation by I/O Manager
✅ Topic 9.3: IRP travels down the device stack
✅ Topic 9.4: IRP completion routines
✅ Topic 9.5: Synchronous vs asynchronous I/O

Section 10: Interrupts and Driver Handling

✅ Topic 10.1: Interrupt Service Routine (ISR)
✅ Topic 10.2: Deferred Procedure Call (DPC)
✅ Topic 10.3: ISR vs DPC division of labor

Section 11: DMA in Drivers

✅ Topic 11.1: DMA setup by driver
✅ Topic 11.2: Scatter/gather DMA
✅ Topic 11.3: DMA completion notification

Section 12: Symbolic Links and Device Namespace

✅ Topic 12.1: Device object names (\Device...)
✅ Topic 12.2: Symbolic links (\DosDevices, drive letters)
✅ Topic 12.3: How applications open a device via CreateFile

Section 13: Driver Dependencies

✅ Topic 13.1: Driver-to-driver dependencies
✅ Topic 13.2: Filter driver chains

Section 14: Driver Failures and BSODs

✅ Topic 14.1: Common driver bug patterns
✅ Topic 14.2: How a driver bug causes a system crash
✅ Topic 14.3: Driver Verifier tool

Section 15: Debugging Drivers

✅ Topic 15.1: WinDbg overview
✅ Topic 15.2: Minidump analysis basics
✅ Topic 15.3: Driver Verifier stress testing

Section 16: Complete Chain — Connecting a USB Keyboard

✅ Topic 16.1: Physical connection detected by USB controller
✅ Topic 16.2: Bus driver reports new device to PnP Manager
✅ Topic 16.3: Hardware ID read from device descriptor
✅ Topic 16.4: Driver Store searched for matching driver
✅ Topic 16.5: Driver loaded, DriverEntry runs
✅ Topic 16.6: Device stack created (HID class driver + function driver)
✅ Topic 16.7: Device object created, symbolic link established
✅ Topic 16.8: Keyboard input begins generating interrupts

Practical Lab: Driver Exploration

✅ Device Manager → driver details/properties
✅ driverquery command
✅ Viewing Driver Store contents
✅ Checking driver signing status
✅ Safely disabling/re-enabling a non-critical device driver

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 14 — Device Manager

Status: COMPLETE ✅

Section 1: What Device Manager Really Represents

✅ A view into the PnP device tree, not just a list

Section 2: Device Enumeration

✅ Topic 2.1: Bus enumeration (PCI, USB, ACPI buses reporting devices)
✅ Topic 2.2: Device tree hierarchy (bus → device → function)

Section 3: Hardware IDs and Compatible IDs

✅ Topic 3.1: Hardware ID format (VID/PID for USB, PCI\VEN_&DEV_)
✅ Topic 3.2: Compatible IDs (fallback generic driver matching)
✅ Topic 3.3: ID ranking/priority order

Section 4: Driver Selection Process

✅ Topic 4.1: Searching Driver Store
✅ Topic 4.2: Searching Windows Update
✅ Topic 4.3: Best match ranking algorithm

Section 5: Driver Installation/Update/Removal (via Device Manager)

✅ Topic 5.1: Update driver flow
✅ Topic 5.2: Roll back driver
✅ Topic 5.3: Uninstall device (and delete driver option)

Section 6: Hidden and Disabled Devices

✅ Topic 6.1: Show hidden devices option
✅ Topic 6.2: Ghost devices (previously connected, not present)
✅ Topic 6.3: Disabling vs uninstalling a device

Section 7: Device Status and Error Codes

✅ Topic 7.1: Code 1 – driver not installed
✅ Topic 7.2: Code 10 – device cannot start
✅ Topic 7.3: Code 28 – drivers not installed
✅ Topic 7.4: Code 43 – device reported a problem
✅ Topic 7.5: Yellow triangle vs red X meaning

Section 8: Device Resources

✅ Topic 8.1: IRQ (Interrupt Request line) assignment
✅ Topic 8.2: DMA channel assignment
✅ Topic 8.3: I/O address ranges
✅ Topic 8.4: Memory address ranges
✅ Topic 8.5: Resource conflicts (legacy vs modern PnP allocation)

Section 9: Device Properties Deep Dive

✅ Topic 9.1: General tab (status)
✅ Topic 9.2: Driver tab (version, provider, date, digital signer)
✅ Topic 9.3: Details tab (property browser: class GUID, device instance path)
✅ Topic 9.4: Events tab (device install/config events)
✅ Topic 9.5: Resources tab

Practical Lab: Device Manager Deep Dive

✅ Viewing devices "by connection" vs "by type"
✅ Reading a hardware ID from Details tab
✅ Finding a device with an error code and researching it
✅ Viewing resource allocations for a device

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 7 — WINDOWS CONTROL PANEL AND SETTINGS (Chapters 15–17)

✅ CHAPTER 15 — Windows Control Panel

Status: COMPLETE ✅

Section 1: Why Control Panel Exists

✅ Historical role as central configuration hub

Section 2: Control Panel Architecture

✅ Topic 2.1: .cpl files (Control Panel applets, DLLs with special export)
✅ Topic 2.2: Control Panel host process
✅ Topic 2.3: Applet registration

Section 3: The Applet Chain (UI → Hardware)

For each applet category, trace: UI → Windows API → Registry/config → service/component → kernel/driver (if applicable) → hardware (if applicable)

✅ Topic 3.1: System settings (System Properties)
✅ Topic 3.2: Network settings (ncpa.cpl)
✅ Topic 3.3: Programs and Features (appwiz.cpl)
✅ Topic 3.4: Devices and Printers
✅ Topic 3.5: Power Options (powercfg.cpl)
✅ Topic 3.6: User Accounts
✅ Topic 3.7: Windows Defender Firewall
✅ Topic 3.8: Administrative Tools
✅ Topic 3.9: Environment Variables (via System Properties)
✅ Topic 3.10: Date and Time
✅ Topic 3.11: Region and Language

Practical Lab: Control Panel Tracing

✅ Change one setting and locate its Registry key with Process Monitor
✅ Identify which .cpl file hosts a given applet

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 16 — Windows Settings Application

Status: COMPLETE ✅

Section 1: Modern Windows Settings Architecture

✅ UWP/XAML-based app vs legacy Control Panel applets
✅ SettingsHandlers and backend brokers

Section 2: Settings Pages

✅ Topic 2.1: System
✅ Topic 2.2: Accounts
✅ Topic 2.3: Network & Internet
✅ Topic 2.4: Privacy & Security
✅ Topic 2.5: Apps
✅ Topic 2.6: Windows Update
✅ Topic 2.7: Personalization
✅ Topic 2.8: Accessibility
✅ Topic 2.9: Bluetooth & Devices

Section 3: Settings vs Control Panel — Internal Differences

✅ Topic 3.1: Different storage backends (Registry vs Settings database/policy)
✅ Topic 3.2: Deep links (ms-settings: URI scheme)
✅ Topic 3.3: Why some settings still redirect to Control Panel

Practical Lab: Settings vs Control Panel

✅ Compare same setting exposed in both places (if any remain)
✅ Use ms-settings: URIs from Run dialog

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 17 — Windows Registry

Status: COMPLETE ✅

Section 1: What the Registry Is and Why It Exists

✅ Centralized hierarchical configuration database
✅ Replacing old .ini files

Section 2: Registry Hives

✅ Topic 2.1: HKEY_LOCAL_MACHINE (HKLM)
✅ Topic 2.2: HKEY_CURRENT_USER (HKCU)
✅ Topic 2.3: HKEY_CLASSES_ROOT (HKCR)
✅ Topic 2.4: HKEY_USERS (HKU)
✅ Topic 2.5: HKEY_CURRENT_CONFIG (HKCC)
✅ Topic 2.6: How hives map to physical hive files on disk

Section 3: Keys and Values

✅ Topic 3.1: Key structure (folder-like hierarchy)
✅ Topic 3.2: Value names and default values

Section 4: Registry Data Types

✅ Topic 4.1: REG_SZ (string)
✅ Topic 4.2: REG_DWORD (32-bit number)
✅ Topic 4.3: REG_QWORD (64-bit number)
✅ Topic 4.4: REG_BINARY (raw bytes)
✅ Topic 4.5: REG_MULTI_SZ (multiple strings)
✅ Topic 4.6: REG_EXPAND_SZ (expandable string with env vars)

Section 5: Registry Files on Disk

✅ Topic 5.1: Hive files location (C:\Windows\System32\config)
✅ Topic 5.2: SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT hives
✅ Topic 5.3: NTUSER.DAT (per-user hive)
✅ Topic 5.4: Hive loading at boot

Section 6: Registry Permissions

✅ Topic 6.1: ACLs on registry keys
✅ Topic 6.2: Why some keys require admin/SYSTEM access

Section 7: Registry Virtualization

✅ Topic 7.1: UAC Registry redirection for legacy apps
✅ Topic 7.2: VirtualStore mechanism

Section 8: Group Policy Interaction

✅ Topic 8.1: Policy keys vs regular keys
✅ Topic 8.2: Policy precedence over user settings

Section 9: How Applications Use the Registry

✅ Topic 9.1: Reading configuration at startup
✅ Topic 9.2: Storing user preferences
✅ Topic 9.3: File associations (HKCR)

Section 10: Registry Corruption and Backup

✅ Topic 10.1: Causes of corruption
✅ Topic 10.2: System Restore and registry snapshots
✅ Topic 10.3: Manual export/import (.reg files)

Section 11: What Happens When You Change a Registry Value (Complete Chain)

✅ Topic 11.1: RegEdit → Configuration Manager (kernel) → hive update in memory
✅ Topic 11.2: Lazy flush to disk
✅ Topic 11.3: Notification to listening components (RegNotifyChangeKey)
✅ Topic 11.4: When a restart/logoff is required vs immediate effect

Practical Lab: Safe Registry Exploration

✅ Opening regedit safely (view-only exploration)
✅ Navigating to a known key (Run keys for startup programs)
✅ Exporting a key as backup before any hypothetical change
✅ Using Process Monitor to watch registry activity live

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 8 — FILE SYSTEMS AND STORAGE (Chapters 18–21)

✅ CHAPTER 18 — Hard Disk and SSD Internals

Status: COMPLETE ✅

Section 1: HDD Mechanical Architecture

✅ Topic 1.1: Platters (magnetic storage surface)
✅ Topic 1.2: Tracks (concentric circles on platter)
✅ Topic 1.3: Sectors (subdivisions of tracks)
✅ Topic 1.4: Heads (read/write per platter surface)
✅ Topic 1.5: Seek time and rotational latency

Section 2: SSD Architecture

✅ Topic 2.1: NAND flash memory cells
✅ Topic 2.2: Controller (manages all SSD operations)
✅ Topic 2.3: Pages (smallest write unit)
✅ Topic 2.4: Blocks (smallest erase unit, made of pages)

Section 3: SSD Endurance and Management

✅ Topic 3.1: Wear leveling (spreading writes evenly)
✅ Topic 3.2: TRIM command (telling SSD which blocks are free)
✅ Topic 3.3: Garbage collection (reclaiming stale blocks)
✅ Topic 3.4: Over-provisioning (reserved spare capacity)

Section 4: Connection Interfaces

✅ Topic 4.1: SATA (AHCI protocol)
✅ Topic 4.2: NVMe (PCIe-based protocol, parallel queues)
✅ Topic 4.3: Why NVMe is dramatically faster (queue depth, protocol overhead)

Practical Lab: Storage Inspection

✅ Optimize-Drives / defrag tool showing HDD vs SSD (TRIM) optimization
✅ Checking drive type in Disk Management
✅ CrystalDiskInfo-style health check (if available)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 19 — File Systems

Status: COMPLETE ✅

Section 1: What a File System Does

✅ Mapping human-readable files/folders to physical storage blocks

Section 2: File System Types

✅ Topic 2.1: NTFS (modern Windows default)
✅ Topic 2.2: FAT32 (legacy, simple, used for compatibility)
✅ Topic 2.3: exFAT (modern, cross-platform, for flash drives)
✅ Topic 2.4: ReFS (Resilient File System, server/enterprise)

Section 3: Files, Directories, and Metadata

✅ Topic 3.1: File metadata (size, timestamps, attributes)
✅ Topic 3.2: Directory as a special file (list of entries)

Section 4: NTFS Internals

✅ Topic 4.1: Master File Table (MFT)
✅ Topic 4.2: File IDs / File Reference Numbers
✅ Topic 4.3: File allocation (clusters)
✅ Topic 4.4: Journaling ($LogFile — crash consistency)

Section 5: Permissions and Security

✅ Topic 5.1: NTFS permissions (read/write/execute/modify/full control)
✅ Topic 5.2: ACL (Access Control List) structure
✅ Topic 5.3: ACE (Access Control Entry)
✅ Topic 5.4: Inheritance from parent folders

Section 6: Links

✅ Topic 6.1: Hard links (multiple names, same MFT record)
✅ Topic 6.2: Symbolic links (pointer/reference to another path)
✅ Topic 6.3: Junction points

Section 7: File Attributes

✅ Topic 7.1: Read-only, Hidden, System, Archive
✅ Topic 7.2: Compression and encryption attributes (EFS)

Section 8: What Happens When You Create a New Text File (Complete Chain)

✅ Topic 8.1: Explorer → CreateFile Win32 API call
✅ Topic 8.2: I/O Manager creates IRP
✅ Topic 8.3: NTFS driver allocates MFT entry
✅ Topic 8.4: Free clusters located via bitmap ($Bitmap)
✅ Topic 8.5: Journal entry written ($LogFile)
✅ Topic 8.6: Storage driver sends write command
✅ Topic 8.7: Physical write to SSD/HDD

Practical Lab: File System Exploration

✅ Checking file system type via Disk Management / fsutil fsinfo volumeinfo
✅ Viewing NTFS permissions via file Properties → Security
✅ Creating a hard link/symlink with mklink
✅ Viewing file attributes with attrib

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 20 — Windows Storage Architecture

Status: COMPLETE ✅

Section 1: The Storage Stack

✅ Application → file system → volume manager → disk driver → controller → device

Section 2: Disk Management Concepts

✅ Topic 2.1: Physical disks vs logical disks
✅ Topic 2.2: Partitions
✅ Topic 2.3: Volumes

Section 3: Partitioning Schemes

✅ Topic 3.1: MBR (Master Boot Record) — legacy, 4 primary partition limit
✅ Topic 3.2: GPT (GUID Partition Table) — modern, many partitions, UEFI-required

Section 4: Volumes, Mount Points, and Drive Letters

✅ Topic 4.1: Drive letter assignment
✅ Topic 4.2: Mount points (folder-mounted volumes)
✅ Topic 4.3: Volume GUIDs

Section 5: Storage Spaces

✅ Topic 5.1: Software-defined storage pooling
✅ Topic 5.2: Resiliency options (mirror, parity)

Section 6: Disk Drivers

✅ Topic 6.1: Disk class driver
✅ Topic 6.2: Port/miniport drivers (storport)

Practical Lab: Disk Management

✅ Opening Disk Management (diskmgmt.msc)
✅ Identifying MBR vs GPT (diskpart → list disk → detail)
✅ Viewing volume GUIDs with mountvol

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 21 — Windows System Files and Directories

Status: COMPLETE ✅

Section 1: Important Directories

✅ Topic 1.1: C:\Windows (OS root)
✅ Topic 1.2: System32 (64-bit system binaries)
✅ Topic 1.3: SysWOW64 (32-bit compatibility binaries on 64-bit Windows)
✅ Topic 1.4: WinSxS (Side-by-Side component store)
✅ Topic 1.5: Program Files (64-bit apps)
✅ Topic 1.6: Program Files (x86) (32-bit apps)
✅ Topic 1.7: ProgramData (shared app data, all users)
✅ Topic 1.8: Users (per-user profiles)
✅ Topic 1.9: AppData (Roaming, Local, LocalLow)
✅ Topic 1.10: Temp directories
✅ Topic 1.11: System Volume Information (restore points, shadow copies)
✅ Topic 1.12: $Recycle.Bin

Section 2: Critical System Files

✅ Topic 2.1: ntoskrnl.exe (kernel executive)
✅ Topic 2.2: hal.dll (Hardware Abstraction Layer)
✅ Topic 2.3: ntdll.dll (Native API bridge)
✅ Topic 2.4: kernel32.dll (Win32 core APIs)
✅ Topic 2.5: user32.dll (UI/windowing APIs)
✅ Topic 2.6: advapi32.dll (registry/security APIs)
✅ Topic 2.7: services.exe (Service Control Manager)
✅ Topic 2.8: svchost.exe (generic service host)
✅ Topic 2.9: lsass.exe (Local Security Authority)
✅ Topic 2.10: winlogon.exe (logon UI coordination)
✅ Topic 2.11: explorer.exe (shell)
✅ Topic 2.12: csrss.exe (Client/Server Runtime Subsystem)
✅ Topic 2.13: dwm.exe (Desktop Window Manager)

Section 3: What Would Happen If These Files Were Missing/Corrupted

✅ Topic 3.1: Per-file failure symptoms
✅ Topic 3.2: Why Windows protects these files (WFP/WRP)

Practical Lab: System File Exploration

✅ Browsing System32 safely (view only, no deletion)
✅ Running sfc /verifyonly to check system file integrity
✅ Viewing WinSxS size and purpose via dism /online /cleanup-image /analyzecomponentstore

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 9 — DLLs AND WINDOWS APIs (Chapters 22–23)

✅ CHAPTER 22 — DLL Architecture

Status: COMPLETE ✅

Section 1: What a DLL Is

✅ Dynamic Link Library — shared code loaded at runtime

Section 2: Dynamic vs Static Linking

✅ Topic 2.1: Static linking (code copied into executable at compile time)
✅ Topic 2.2: Dynamic linking (code loaded separately at runtime)
✅ Topic 2.3: Trade-offs (size, updateability, sharing)

Section 3: DLL Loading

✅ Topic 3.1: Load-time linking (referenced in import table)
✅ Topic 3.2: Run-time linking (LoadLibrary/GetProcAddress)

Section 4: DLL Search Order

✅ Topic 4.1: Application directory
✅ Topic 4.2: System directories (System32, SysWOW64)
✅ Topic 4.3: Windows directory
✅ Topic 4.4: Current directory
✅ Topic 4.5: PATH directories
✅ Topic 4.6: DLL search order hijacking risk (security awareness)

Section 5: Exports and Imports

✅ Topic 5.1: Export table (functions a DLL provides)
✅ Topic 5.2: Import table (functions an executable needs)
✅ Topic 5.3: Ordinal vs name-based exports

Section 6: DLL Dependencies

✅ Topic 6.1: Dependency chains (DLLs depending on other DLLs)
✅ Topic 6.2: Missing dependency errors

Section 7: Side-by-Side Assemblies (WinSxS)

✅ Topic 7.1: DLL versioning problem ("DLL hell")
✅ Topic 7.2: How WinSxS solves multiple versions coexisting

Section 8: DLL Injection (Concept Only)

✅ Topic 8.1: What DLL injection is technically
✅ Topic 8.2: Legitimate uses (debugging, hooking) vs malicious uses
✅ Topic 8.3: Why this is a security-monitored technique (conceptual awareness only)

Practical Lab: DLL Exploration

✅ Process Explorer → DLL view for a running process
✅ dumpbin /exports or equivalent on a system DLL
✅ Observing DLL search order with Process Monitor

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 23 — Windows APIs

Status: COMPLETE ✅

Section 1: API Layers Overview

✅ Application → Win32 API → Native API → System Call → Kernel → Driver → Hardware

Section 2: Win32 API

✅ Topic 2.1: What Win32 covers (windows, files, processes, graphics)
✅ Topic 2.2: kernel32/user32/gdi32 role split

Section 3: Native API (NTAPI)

✅ Topic 3.1: Nt*/Zw* functions in ntdll.dll
✅ Topic 3.2: Undocumented/internal nature
✅ Topic 3.3: Why Win32 wraps Native API instead of exposing it directly

Section 4: System Calls

✅ Topic 4.1: User-mode to kernel-mode transition mechanism
✅ Topic 4.2: System Service Dispatch Table (SSDT)
✅ Topic 4.3: syscall/sysenter CPU instructions

Section 5: The Complete API Chain

✅ Topic 5.1: Application calls Win32 function
✅ Topic 5.2: Win32 calls corresponding Native API function
✅ Topic 5.3: Native API executes system call instruction
✅ Topic 5.4: Kernel handles the request
✅ Topic 5.5: Kernel calls into driver if hardware involved
✅ Topic 5.6: Driver communicates with hardware
✅ Topic 5.7: Result returned back up the chain

Practical Lab: API Tracing

✅ Process Monitor showing Win32 file/registry API calls in real time
✅ API Monitor (if available) showing a function call chain

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 10 — WINDOWS SECURITY (Chapters 24–26)

✅ CHAPTER 24 — Windows Authentication

Status: COMPLETE ✅

✅ Topic 1.1: Local accounts vs Microsoft accounts vs domain accounts
✅ Topic 1.2: Password storage (never plaintext — hashed)

Section 2: Authentication vs Authorization

✅ Topic 2.1: Authentication (who you are)
✅ Topic 2.2: Authorization (what you can do)

Section 3: Access Tokens

✅ Topic 3.1: What an access token contains
✅ Topic 3.2: Token creation at logon
✅ Topic 3.3: Token attached to every process/thread the user starts

Section 4: Security Identifiers (SIDs)

✅ Topic 4.1: SID structure
✅ Topic 4.2: Well-known SIDs (Everyone, SYSTEM, Administrators)
✅ Topic 4.3: SID vs username (SIDs are permanent identity)

Section 5: ACL and ACE (Authorization Mechanics)

✅ Topic 5.1: ACL attached to securable objects
✅ Topic 5.2: ACE entries (allow/deny + SID + permission)
✅ Topic 5.3: Access check algorithm

Section 6: Authentication Protocols

✅ Topic 6.1: NTLM (legacy challenge-response)
✅ Topic 6.2: Kerberos (modern ticket-based, domain environments)
✅ Topic 6.3: Windows Hello (biometric/PIN, hardware-backed)

Section 7: Credential Manager

✅ Topic 7.1: Stored credentials for websites/network resources
✅ Topic 7.2: Credential vaults

Section 8: What Happens When You Enter Your Windows Password (Complete Chain)

✅ Topic 8.1: Winlogon captures input (Secure Attention Sequence)
✅ Topic 8.2: LSASS receives credentials
✅ Topic 8.3: Authentication package validates (local SAM or domain controller)
✅ Topic 8.4: Access token generated
✅ Topic 8.5: Explorer.exe launched with that token
✅ Topic 8.6: Every subsequent process inherits/derives from that token

Practical Lab: Authentication Exploration

✅ whoami /all — viewing your own SID and group memberships
✅ Credential Manager control panel exploration
✅ Viewing Windows Hello enrollment status

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 25 — Windows Permissions

Status: COMPLETE ✅

Section 1: NTFS Permissions

✅ Topic 1.1: Read, Write, Execute, Modify, Full Control
✅ Topic 1.2: Special permissions (granular)

✅ Topic 2.1: Network share-level permissions
✅ Topic 2.2: Interaction with NTFS permissions (most restrictive wins)

Section 3: ACL Inheritance

✅ Topic 3.1: Inherited vs explicit permissions
✅ Topic 3.2: Breaking inheritance

Section 4: Effective Permissions

✅ Topic 4.1: How Windows computes effective permission from multiple group memberships
✅ Topic 4.2: Deny always overrides Allow

Section 5: Ownership

✅ Topic 5.1: File/folder owner concept
✅ Topic 5.2: Taking ownership

Section 6: Special Accounts

✅ Topic 6.1: Administrator account
✅ Topic 6.2: SYSTEM account (higher privilege than Administrator in some respects)
✅ Topic 6.3: TrustedInstaller (owns core OS files)

Section 7: User Account Control (UAC)

✅ Topic 7.1: Why UAC exists (limiting standing admin privilege)
✅ Topic 7.2: Elevation prompts
✅ Topic 7.3: Split token for administrators

Section 8: Why Administrators Sometimes Can't Modify System Files

✅ Topic 8.1: TrustedInstaller ownership blocking even admin access
✅ Topic 8.2: How to (carefully, if ever necessary) take ownership

Practical Lab: Permissions Exploration

✅ File Properties → Security → Advanced → viewing effective access
✅ icacls command to view permissions
✅ Identifying TrustedInstaller-owned files

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 26 — Windows Security Architecture

Status: COMPLETE ✅

Section 1: Security Boundaries and Isolation

✅ Topic 1.1: Process isolation
✅ Topic 1.2: User/kernel isolation
✅ Topic 1.3: Virtualization-based security (VBS)

Section 2: Sandboxing

✅ Topic 2.1: Windows Sandbox concept
✅ Topic 2.2: AppContainer isolation (UWP apps)

Section 3: Secure Boot

✅ Topic 3.1: Recap from Chapter 5, security-focused view
✅ Topic 3.2: Chain of trust from firmware to OS

Section 4: TPM (Trusted Platform Module)

✅ Topic 4.1: What TPM is (secure crypto hardware)
✅ Topic 4.2: Key storage and sealing
✅ Topic 4.3: TPM's role in BitLocker and Windows Hello

Section 5: BitLocker

✅ Topic 5.1: Full disk encryption concept
✅ Topic 5.2: Key protectors (TPM, PIN, recovery key)
✅ Topic 5.3: Encryption/decryption flow during boot

Section 6: Windows Defender

✅ Topic 6.1: Real-time protection
✅ Topic 6.2: Signature-based vs behavior-based detection
✅ Topic 6.3: Cloud-delivered protection

Section 7: Windows Firewall

✅ Topic 7.1: Inbound/outbound rule model
✅ Topic 7.2: Profiles (Domain, Private, Public)

Section 8: Credential Protection

✅ Topic 8.1: Credential Guard (VBS-isolated LSASS secrets)
✅ Topic 8.2: Protection against credential theft techniques

Section 9: Code Signing

✅ Topic 9.1: Digital signatures on executables/drivers
✅ Topic 9.2: Certificate chain validation

Section 10: Application Control and Exploit Protection

✅ Topic 10.1: WDAC / AppLocker concept
✅ Topic 10.2: Exploit Protection mitigations (DEP, ASLR, CFG)

Practical Lab: Security Feature Exploration

✅ Checking TPM status (tpm.msc)
✅ Checking BitLocker status (manage-bde -status)
✅ Windows Security app walkthrough
✅ Checking Secure Boot status (msinfo32)

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 11 — NETWORKING INTERNALS (Chapters 27–29)

✅ CHAPTER 27 — How Networking Actually Works

Status: COMPLETE ✅

Section 1: The NIC and Physical Addressing

✅ Topic 1.1: MAC address (hardware address, burned into NIC)
✅ Topic 1.2: Ethernet frames

Section 2: IP Addressing

✅ Topic 2.1: IPv4 structure and address classes
✅ Topic 2.2: IPv6 structure and why it exists
✅ Topic 2.3: Subnetting basics

Section 3: ARP (Address Resolution Protocol)

✅ Topic 3.1: Mapping IP address to MAC address
✅ Topic 3.2: ARP cache

Section 4: DNS (Domain Name System)

✅ Topic 4.1: Why DNS exists (names vs IPs)
✅ Topic 4.2: Resolution process (recursive/iterative queries)
✅ Topic 4.3: DNS caching

Section 5: DHCP (Dynamic Host Configuration Protocol)

✅ Topic 5.1: Automatic IP assignment
✅ Topic 5.2: DORA process (Discover, Offer, Request, Acknowledge)
✅ Topic 5.3: Lease renewal

Section 6: Transport Protocols

✅ Topic 6.1: TCP (reliable, connection-oriented)
✅ Topic 6.2: UDP (unreliable, connectionless, fast)
✅ Topic 6.3: TCP three-way handshake

Section 7: Ports and Sockets

✅ Topic 7.1: Port numbers (identifying services/applications)
✅ Topic 7.2: Socket concept (IP + port + protocol)

Section 8: Routing

✅ Topic 8.1: How routers forward packets
✅ Topic 8.2: Routing tables
✅ Topic 8.3: Default gateway

Section 9: NAT (Network Address Translation)

✅ Topic 9.1: Why NAT exists (private/public IP conservation)
✅ Topic 9.2: How home routers use NAT

Section 10: Firewalls

✅ Topic 10.1: Packet filtering concept
✅ Topic 10.2: Stateful vs stateless filtering

Practical Lab: Networking Fundamentals

✅ arp -a — view ARP cache
✅ ipconfig /displaydns — view DNS cache
✅ tracert — visualize routing hops

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 28 — Windows Networking Internals

Status: COMPLETE ✅

Section 1: Network Adapters and Drivers

✅ Topic 1.1: NDIS (Network Driver Interface Specification)
✅ Topic 1.2: Miniport drivers

Section 2: Windows Networking Stack

✅ Topic 2.1: Layered architecture (NDIS → TCP/IP driver → Winsock → application)

Section 3: Winsock

✅ Topic 3.1: Socket API for Windows applications
✅ Topic 3.2: Winsock service providers (LSPs)

Section 4: TCP/IP Stack Implementation

✅ Topic 4.1: tcpip.sys driver
✅ Topic 4.2: Network stack processing of inbound/outbound packets

Section 5: DNS Client Service

✅ Topic 5.1: Local caching resolver
✅ Topic 5.2: Dnscache service

Section 6: DHCP Client Service

✅ Topic 6.1: Automatic configuration
✅ Topic 6.2: APIPA (Automatic Private IP Addressing) fallback

Section 7: Windows Firewall Implementation

✅ Topic 7.1: WFP (Windows Filtering Platform)
✅ Topic 7.2: Rule processing order

Section 8: Network Profiles

✅ Topic 8.1: Domain, Private, Public profile differences
✅ Topic 8.2: Profile detection logic

Section 9: Hosts File and Routing Table

✅ Topic 9.1: hosts file (manual name resolution override)
✅ Topic 9.2: route print routing table

Section 10: Complete Chain — Typing google.com and Pressing Enter

✅ Topic 10.1: Browser checks its own cache
✅ Topic 10.2: OS DNS cache checked
✅ Topic 10.3: hosts file checked
✅ Topic 10.4: DNS query sent to configured DNS server
✅ Topic 10.5: TCP connection established (3-way handshake) to resolved IP
✅ Topic 10.6: TLS handshake (if HTTPS)
✅ Topic 10.7: HTTP request sent
✅ Topic 10.8: Server responds
✅ Topic 10.9: Browser renders response, pixels sent to GPU/monitor

Practical Lab: Windows Networking Tools

✅ ipconfig /all
✅ nslookup
✅ netstat -ano
✅ Viewing network profile in Settings

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 29 — Browser Internals

Status: COMPLETE ✅

Section 1: Browser Process Architecture

✅ Topic 1.1: Multi-process model (browser process, renderer processes, GPU process)
✅ Topic 1.2: Why tabs are separate processes (isolation, crash containment)

Section 2: Rendering Engine

✅ Topic 2.1: HTML parsing → DOM tree
✅ Topic 2.2: CSS parsing → style rules
✅ Topic 2.3: Render tree construction
✅ Topic 2.4: Layout and paint

Section 3: JavaScript Engine

✅ Topic 3.1: Parsing and compiling JS (JIT compilation)
✅ Topic 3.2: Event loop

Section 4: Network Protocols in the Browser

✅ Topic 4.1: HTTP vs HTTPS
✅ Topic 4.2: TLS handshake details
✅ Topic 4.3: TCP vs QUIC (HTTP/3)

Section 5: Browser Storage

✅ Topic 5.1: Cookies
✅ Topic 5.2: Cache
✅ Topic 5.3: Local Storage
✅ Topic 5.4: Session Storage
✅ Topic 5.5: IndexedDB

Section 6: Same-Origin Policy

✅ Topic 6.1: Why it exists (security isolation between sites)
✅ Topic 6.2: What it restricts

Section 7: What Happens When a Webpage Loads (Complete Chain)

✅ Topic 7.1: URL parsing
✅ Topic 7.2: DNS resolution
✅ Topic 7.3: TCP/TLS connection
✅ Topic 7.4: HTTP request/response
✅ Topic 7.5: HTML parsing and DOM construction
✅ Topic 7.6: Resource fetching (CSS, JS, images)
✅ Topic 7.7: Render tree, layout, paint
✅ Topic 7.8: GPU compositing
✅ Topic 7.9: Pixels on screen

Practical Lab: Browser Internals Exploration

✅ Browser Task Manager (Shift+Esc in Chrome-based browsers)
✅ DevTools Network tab — observing DNS/TLS/request timing
✅ DevTools Application tab — inspecting cookies/storage

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 12 — WINDOWS USER INTERFACE (Chapter 30)

✅ CHAPTER 30 — Windows Desktop Internals

Status: COMPLETE ✅

Section 1: Explorer as Shell

✅ Topic 1.1: explorer.exe role (desktop, taskbar, file browsing)
✅ Topic 1.2: Shell extensions

✅ Topic 2.1: Desktop as a special Explorer window
✅ Topic 2.2: Taskbar process and notification area
✅ Topic 2.3: Start Menu (search indexing integration)

Section 3: Windows and Window Handles

✅ Topic 3.1: HWND (window handle) concept
✅ Topic 3.2: Window classes and window procedures
✅ Topic 3.3: Message queue per thread

Section 4: Window Manager and DWM

✅ Topic 4.1: Desktop Window Manager (dwm.exe) role
✅ Topic 4.2: Composition (each window rendered to its own buffer, then composited)
✅ Topic 4.3: GPU acceleration of composition

Section 5: Notifications and Clipboard

✅ Topic 5.1: Notification/toast system
✅ Topic 5.2: Clipboard as shared OS object

Section 6: Input System Integration

✅ Topic 6.1: How input reaches the focused window
✅ Topic 6.2: Focus and activation

Section 7: What Happens When You Move the Mouse and Click an Icon (Complete Chain)

✅ Topic 7.1: Mouse hardware movement → USB/PS2 driver
✅ Topic 7.2: Raw input processed by Windows input subsystem
✅ Topic 7.3: Cursor position updated, hit-testing against window Z-order
✅ Topic 7.4: Click message routed to Explorer's window procedure
✅ Topic 7.5: Explorer triggers process creation for the icon's target
✅ Topic 7.6: DWM composites the new window onto the desktop

Practical Lab: Desktop Internals Exploration

✅ Spy++ or similar tool to view window handles (if available)
✅ Task Manager showing dwm.exe and explorer.exe resource usage
✅ Observing GPU engine usage tied to composition

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 13 — INPUT AND OUTPUT (Chapters 31–32) AND AUDIO (Chapter 33)

✅ CHAPTER 31 — Keyboard and Mouse Internals

Status: COMPLETE ✅

Section 1: Keyboard Hardware

✅ Topic 1.1: Key matrix scanning
✅ Topic 1.2: Scan codes

Section 2: Connection Path

✅ Topic 2.1: USB HID (Human Interface Device) class
✅ Topic 2.2: Bluetooth HID

Section 3: The Complete Keyboard Chain

✅ Topic 3.1: Keyboard → USB/Bluetooth transport
✅ Topic 3.2: HID class driver receives report
✅ Topic 3.3: Driver generates interrupt/event
✅ Topic 3.4: Windows input subsystem (raw input) processes it
✅ Topic 3.5: Keyboard layout translation (scan code → virtual key → character)
✅ Topic 3.6: Message routed to focused application's window procedure
✅ Topic 3.7: Application updates UI

Section 4: Mouse Movement and Clicks

✅ Topic 4.1: Optical/laser sensor movement detection
✅ Topic 4.2: Movement deltas reported via HID
✅ Topic 4.3: Cursor position update and acceleration curves
✅ Topic 4.4: Click event hit-testing against window Z-order

Practical Lab: Input Exploration

✅ Device Manager → Keyboards/Mice properties
✅ Keyboard layout settings
✅ Mouse pointer speed/acceleration settings

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 32 — Display and GPU

Status: COMPLETE ✅

Section 1: GPU Fundamentals

✅ Topic 1.1: GPU as massively parallel processor
✅ Topic 1.2: VRAM (dedicated video memory)

Section 2: Display Drivers

✅ Topic 2.1: WDDM (Windows Display Driver Model)
✅ Topic 2.2: Kernel-mode vs user-mode driver split for graphics

Section 3: Graphics APIs

✅ Topic 3.1: DirectX
✅ Topic 3.2: OpenGL
✅ Topic 3.3: Vulkan
✅ Topic 3.4: How an app chooses/uses these APIs

Section 4: The Rendering Pipeline

✅ Topic 4.1: Vertex processing
✅ Topic 4.2: Rasterization
✅ Topic 4.3: Pixel/fragment shading
✅ Topic 4.4: Output merging into frame buffer

Section 5: Display Connection

✅ Topic 5.1: HDMI
✅ Topic 5.2: DisplayPort
✅ Topic 5.3: Signal transmission (digital video signal)

Section 6: Display Characteristics

✅ Topic 6.1: Refresh rate
✅ Topic 6.2: Resolution
✅ Topic 6.3: VSync (synchronizing frame delivery to refresh rate)

Section 7: Frame Buffer and Final Output

✅ Topic 7.1: Frame buffer as the "final image" in VRAM
✅ Topic 7.2: Scanout to the monitor

Section 8: How a Pixel Eventually Appears on Your Monitor (Complete Chain)

✅ Topic 8.1: Application draws via graphics API
✅ Topic 8.2: GPU driver translates commands to GPU instructions
✅ Topic 8.3: GPU executes rendering pipeline
✅ Topic 8.4: Completed frame written to frame buffer
✅ Topic 8.5: DWM composites with other windows
✅ Topic 8.6: Frame sent over HDMI/DisplayPort
✅ Topic 8.7: Monitor scans and displays the frame

Practical Lab: Display and GPU Exploration

✅ Task Manager → Performance → GPU tab
✅ Display settings (resolution, refresh rate)
✅ dxdiag for DirectX/GPU diagnostic info

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

✅ CHAPTER 33 — Computer Audio Architecture

Status: COMPLETE ✅

Section 1: Audio Hardware

✅ Topic 1.1: Audio codec chip
✅ Topic 1.2: Speakers and microphone as endpoints

Section 2: Audio Drivers

✅ Topic 2.1: Windows audio driver model
✅ Topic 2.2: Kernel Streaming (KS)

Section 3: Windows Audio Architecture

✅ Topic 3.1: Windows Audio service (audiosrv)
✅ Topic 3.2: Audio Session API (WASAPI)

Section 4: Audio Endpoints

✅ Topic 4.1: Playback devices
✅ Topic 4.2: Recording devices
✅ Topic 4.3: Default device selection

Section 5: Digital Audio Fundamentals

✅ Topic 5.1: Sampling rate
✅ Topic 5.2: Bit depth
✅ Topic 5.3: Digital-to-analog conversion (DAC)

Section 6: Buffering and Latency

✅ Topic 6.1: Audio buffer role (smoothing playback)
✅ Topic 6.2: Latency trade-offs (buffer size vs glitching)

Section 7: What Happens When You Play an Audio File (Complete Chain)

✅ Topic 7.1: Application decodes audio file format
✅ Topic 7.2: PCM data sent via WASAPI
✅ Topic 7.3: Windows Audio Engine mixes streams
✅ Topic 7.4: Audio driver receives mixed stream
✅ Topic 7.5: DAC converts digital to analog signal
✅ Topic 7.6: Speaker converts electrical signal to sound waves

Practical Lab: Audio Exploration

✅ Sound Control Panel → playback/recording devices
✅ Volume mixer per-application
✅ Checking sample rate/bit depth settings

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 14 — POWER MANAGEMENT (Chapter 34)

✅ CHAPTER 34 — Power Management

Status: COMPLETE ✅

Section 1: ACPI (Advanced Configuration and Power Interface)

✅ Topic 1.1: What ACPI is (OS-hardware power negotiation standard)
✅ Topic 1.2: ACPI tables provided by firmware

Section 2: System Power States

✅ Topic 2.1: S0 (fully on)
✅ Topic 2.2: S3 (sleep/suspend to RAM)
✅ Topic 2.3: S4 (hibernate/suspend to disk)
✅ Topic 2.4: S5 (soft off/shutdown)

Section 3: Sleep

✅ Topic 3.1: What gets preserved (RAM stays powered)
✅ Topic 3.2: Wake latency (fast resume)

Section 4: Hibernate

✅ Topic 4.1: RAM contents written to hiberfil.sys
✅ Topic 4.2: Full power-off, restore on wake

Section 5: Modern Standby

✅ Topic 5.1: Instant On / Connected Standby concept
✅ Topic 5.2: How it differs from classic S3 sleep

Section 6: Shutdown and Restart

✅ Topic 6.1: Graceful shutdown sequence (services stop, processes terminate)
✅ Topic 6.2: Fast Startup (hybrid shutdown using hibernation of kernel session)

Section 7: Power Plans

✅ Topic 7.1: Balanced, Power Saver, High Performance
✅ Topic 7.2: Custom plan settings

Section 8: CPU and Device Power States

✅ Topic 8.1: CPU C-states (idle power states)
✅ Topic 8.2: CPU P-states (performance/frequency states)
✅ Topic 8.3: Device power states (D0–D3)

Section 9: Battery Management

✅ Topic 9.1: Battery reporting to OS
✅ Topic 9.2: Battery health/wear leveling awareness

Section 10: Wake Events

✅ Topic 10.1: Wake-on-LAN
✅ Topic 10.2: Wake timers
✅ Topic 10.3: Device-initiated wake (USB, keyboard)

Section 11: What Happens During Shutdown and Startup (Complete Chain)

✅ Topic 11.1: Shutdown request → session manager notifies apps
✅ Topic 11.2: Services stopped in dependency order
✅ Topic 11.3: Kernel session terminated (or hibernated if Fast Startup)
✅ Topic 11.4: Power-off signal sent to PSU via ACPI
✅ Topic 11.5: Startup: reverse of Chapter 6's boot chain

Practical Lab: Power Management Exploration

✅ powercfg /a — available sleep states
✅ powercfg /lastwake — what woke the PC last
✅ Power plan settings exploration

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

PART 15 — WINDOWS UPDATE AND SOFTWARE INSTALLATION (Chapters 35–36)

✅ CHAPTER 35 — Windows Update

Status: COMPLETE ✅

Section 1: Update Architecture Overview

✅ Topic 1.1: Windows Update service role
✅ Topic 1.2: Update sources (Microsoft servers, WSUS, Windows Update for Business)

Section 2: Update Packages

✅ Topic 2.1: Cumulative updates
✅ Topic 2.2: Feature updates vs quality updates
✅ Topic 2.3: .msu/.cab package formats

Section 3: Update Process

✅ Topic 3.1: Download phase
✅ Topic 3.2: Verification (signature check)
✅ Topic 3.3: Installation staging
✅ Topic 3.4: Reboot to finalize

Section 4: Servicing Stack

✅ Topic 4.1: Servicing Stack Updates (SSU) — updates the updater itself
✅ Topic 4.2: Why SSUs must install before feature updates

Section 5: Component Store (WinSxS revisited)

✅ Topic 5.1: How updates add new component versions
✅ Topic 5.2: Component store cleanup

Section 6: Rollback and Recovery

✅ Topic 6.1: Automatic rollback on failed update
✅ Topic 6.2: Uninstalling a problematic update

Practical Lab: Windows Update Exploration

✅ Update history review
✅ wuauclt/Windows Update troubleshooter concepts
✅ Viewing installed updates via Get-HotFix or Control Panel

Knowledge Check

✅ 10 Quick Review questions
✅ 5 Understanding questions
✅ 5 Scenario questions
✅ 5 Interview questions
✅ 1 Practical task

🟡 CHAPTER 36 — Software Installation

Status: NOT STARTED

Section 1: Installer Types

⏳ Topic 1.1: EXE installers (custom install logic)
⏳ Topic 1.2: MSI (Windows Installer database format)
⏳ Topic 1.3: MSIX (modern, sandboxed packaging)

Section 2: What an Installer Actually Does

⏳ Topic 2.1: Copying files to installation directories
⏳ Topic 2.2: Writing Registry entries (uninstall info, app settings)
⏳ Topic 2.3: Installing services (if applicable)
⏳ Topic 2.4: Installing drivers (if applicable)
⏳ Topic 2.5: Setting environment variables
⏳ Topic 2.6: Creating Start Menu entries
⏳ Topic 2.7: Registering file associations

Section 3: MSI Deep Dive

⏳ Topic 3.1: MSI database structure (tables)
⏳ Topic 3.2: Windows Installer service (msiexec)
⏳ Topic 3.3: Rollback capability

Section 4: MSIX Deep Dive

⏳ Topic 4.1: Package signing requirement
⏳ Topic 4.2: Containerized file/registry virtualization
⏳ Topic 4.3: Clean uninstall guarantee

Section 5: Uninstallation

⏳ Topic 5.1: Uninstall entry in Programs and Features
⏳ Topic 5.2: What a clean uninstall removes
⏳ Topic 5.3: Leftover files/registry keys (common with EXE installers)

Section 6: What Happens When You Install an Application (Complete Chain)

⏳ Topic 6.1: Installer executable runs (elevation prompt if needed)
⏳ Topic 6.2: Files extracted/copied to Program Files
⏳ Topic 6.3: Registry entries written (HKLM\Software, Uninstall key)
⏳ Topic 6.4: Services/drivers installed if applicable
⏳ Topic 6.5: Start Menu shortcut created
⏳ Topic 6.6: File associations registered

Practical Lab: Installation Exploration

⏳ Observing Registry changes during an install via Process Monitor
⏳ Viewing Programs and Features uninstall registry keys
⏳ Comparing an EXE-installed app vs an MSIX-installed app's footprint

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 16 — ENVIRONMENT VARIABLES AND PATH (Chapter 37)

🟡 CHAPTER 37 — Environment Variables

Status: NOT STARTED

Section 1: What Environment Variables Are

⏳ Key-value pairs available to processes

Section 2: The PATH Variable

⏳ Topic 2.1: How PATH is used to locate executables
⏳ Topic 2.2: PATH search order

Section 3: Common System Variables

⏳ Topic 3.1: USERPROFILE
⏳ Topic 3.2: TEMP/TMP
⏳ Topic 3.3: APPDATA
⏳ Topic 3.4: LOCALAPPDATA
⏳ Topic 3.5: PROGRAMDATA
⏳ Topic 3.6: WINDIR/SystemRoot

Section 4: System vs User Variables

⏳ Topic 4.1: System variables (all users, stored in HKLM)
⏳ Topic 4.2: User variables (per-user, stored in HKCU)
⏳ Topic 4.3: Precedence when both exist

Section 5: Process Environment Inheritance

⏳ Topic 5.1: Child process inherits parent's environment block
⏳ Topic 5.2: Why a new terminal is needed after changing variables

Section 6: Why a Command Works in One Terminal But Not Another (Complete Explanation)

⏳ Topic 6.1: Environment snapshot taken at process launch
⏳ Topic 6.2: Terminal opened before a PATH change won't see it
⏳ Topic 6.3: Per-session vs system-wide variable changes

Practical Lab: Environment Variable Exploration

⏳ set / Get-ChildItem Env: to list all variables
⏳ Viewing System Properties → Environment Variables dialog
⏳ Adding a folder to PATH and verifying in a new terminal

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 17 — COMMAND LINE (Chapter 38)

🟡 CHAPTER 38 — Windows Command Line

Status: NOT STARTED

Section 1: CMD, PowerShell, and Terminal

⏳ Topic 1.1: CMD (legacy command interpreter)
⏳ Topic 1.2: PowerShell (object-based shell)
⏳ Topic 1.3: Windows Terminal (modern host application for both)

Section 2: Processes and Commands

⏳ Topic 2.1: Built-in commands vs external executables
⏳ Topic 2.2: How the shell launches a process for a command

Section 3: Pipes and Redirection

⏳ Topic 3.1: Pipe (|) — passing output of one command to another
⏳ Topic 3.2: Redirection (>, >>, <)

Section 4: Scripting

⏳ Topic 4.1: Batch files (.bat/.cmd)
⏳ Topic 4.2: PowerShell scripts (.ps1)
⏳ Topic 4.3: Execution policy in PowerShell

Section 5: Important Commands Explained Internally

⏳ Topic 5.1: ipconfig — queries adapter configuration from TCP/IP stack
⏳ Topic 5.2: ping — sends ICMP echo requests
⏳ Topic 5.3: tracert — ICMP with increasing TTL to map route
⏳ Topic 5.4: nslookup — direct DNS query tool
⏳ Topic 5.5: netstat — lists active sockets from TCP/IP stack
⏳ Topic 5.6: tasklist — queries process list from OS
⏳ Topic 5.7: taskkill — sends termination request to a process
⏳ Topic 5.8: systeminfo — queries WMI/registry for system details
⏳ Topic 5.9: sfc — System File Checker, verifies protected files against manifest
⏳ Topic 5.10: DISM — services the Windows image/component store
⏳ Topic 5.11: chkdsk — scans file system and disk for errors
⏳ Topic 5.12: whoami — reads current process token
⏳ Topic 5.13: net — legacy network/user/service management commands
⏳ Topic 5.14: sc — talks directly to Service Control Manager
⏳ Topic 5.15: shutdown — invokes graceful system power-off/restart
⏳ Topic 5.16: diskpart — low-level disk/partition management tool

Practical Lab: Command Line Practice

⏳ Running each command above and interpreting output
⏳ Chaining commands with pipes
⏳ Writing a simple batch file

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 18 — WINDOWS ADMINISTRATION (Chapter 39)

🟡 CHAPTER 39 — Administrative Tools

Status: NOT STARTED

Section 1: Computer Management

⏳ Topic 1.1: Unified console (Device Manager, Disk Management, Services, etc.)

Section 2: Event Viewer

⏳ Topic 2.1: Role as central log viewer (detailed in Chapter 40)

Section 3: Services (services.msc)

⏳ Topic 3.1: Direct SCM interface (recap from Chapter 12)

Section 4: Task Scheduler

⏳ Topic 4.1: Role as automation engine (detailed in Chapter 41)

Section 5: Device Manager

⏳ Topic 5.1: Recap and role in administration

Section 6: Disk Management

⏳ Topic 6.1: Recap and role in administration

Section 7: Performance Monitor

⏳ Topic 7.1: Counter-based deep performance tracking
⏳ Topic 7.2: Data collector sets

Section 8: Resource Monitor

⏳ Topic 8.1: Real-time CPU/memory/disk/network detail view
⏳ Topic 8.2: Relationship to Task Manager

Section 9: Local Security Policy

⏳ Topic 9.1: Local Group Policy subset for security settings
⏳ Topic 9.2: Account/audit/user rights policies

Section 10: Registry Editor

⏳ Topic 10.1: Direct registry access (recap from Chapter 17)

Section 11: System Configuration (msconfig)

⏳ Topic 11.1: Boot options
⏳ Topic 11.2: Services/startup management (legacy)

Section 12: Group Policy Editor

⏳ Topic 12.1: Role recap (detailed in Chapter 42)

Practical Lab: Administrative Tools Tour

⏳ Opening Computer Management and navigating each subtool
⏳ Creating a simple Performance Monitor data collector set
⏳ Comparing Resource Monitor to Task Manager side by side

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 19 — EVENT LOGGING (Chapter 40)

🟡 CHAPTER 40 — Windows Event Viewer

Status: NOT STARTED

Section 1: Event Log Architecture

⏳ Topic 1.1: Event Log service
⏳ Topic 1.2: .evtx log file format

Section 2: Event Providers

⏳ Topic 2.1: Components that generate events
⏳ Topic 2.2: Provider manifests

Section 3: Event IDs and Levels

⏳ Topic 3.1: Event ID meaning and lookup
⏳ Topic 3.2: Information
⏳ Topic 3.3: Warning
⏳ Topic 3.4: Error
⏳ Topic 3.5: Critical

Section 4: Log Channels

⏳ Topic 4.1: Application log
⏳ Topic 4.2: System log
⏳ Topic 4.3: Security log
⏳ Topic 4.4: Setup log
⏳ Topic 4.5: Forwarded Events
⏳ Topic 4.6: Applications and Services Logs (per-component logs)

Section 5: Kernel-Level Logging

⏳ Topic 5.1: ETW (Event Tracing for Windows) as the underlying mechanism

Section 6: Event Correlation

⏳ Topic 6.1: Correlating timestamps across logs
⏳ Topic 6.2: Task Category and Correlation ID fields

Section 7: How Engineers Investigate a Problem Using Event Viewer

⏳ Topic 7.1: Narrowing the time window around the incident
⏳ Topic 7.2: Filtering by Error/Critical level
⏳ Topic 7.3: Reading the event's Details/XML view
⏳ Topic 7.4: Cross-referencing Event ID against known documentation
⏳ Topic 7.5: Building a timeline from multiple logs

Practical Lab: Event Viewer Investigation

⏳ Opening Event Viewer and filtering the System log by Error
⏳ Finding the most recent shutdown/restart event
⏳ Creating a custom view filtered by Event ID

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 20 — TASK SCHEDULER (Chapter 41)

🟡 CHAPTER 41 — Windows Task Scheduler

Status: NOT STARTED

Section 1: Tasks

⏳ Topic 1.1: What a scheduled task is
⏳ Topic 1.2: Task definitions stored as XML

Section 2: Triggers

⏳ Topic 2.1: Time-based triggers
⏳ Topic 2.2: Event-based triggers
⏳ Topic 2.3: Logon/startup triggers
⏳ Topic 2.4: Idle triggers

Section 3: Actions

⏳ Topic 3.1: Start a program
⏳ Topic 3.2: Send an email/display a message (legacy)

Section 4: Conditions

⏳ Topic 4.1: Power conditions (AC only)
⏳ Topic 4.2: Network availability conditions
⏳ Topic 4.3: Idle conditions

Section 5: Accounts and Security Context

⏳ Topic 5.1: Running as SYSTEM vs current user
⏳ Topic 5.2: "Run whether user is logged on or not"

Section 6: Background Tasks

⏳ Topic 6.1: How Windows itself uses scheduled tasks internally (maintenance, telemetry, updates)

Section 7: How Windows Automatically Performs Tasks (Complete Chain)

⏳ Topic 7.1: Task Scheduler service monitors trigger conditions
⏳ Topic 7.2: Trigger fires → conditions checked
⏳ Topic 7.3: Action executed under specified account
⏳ Topic 7.4: Result/history logged

Practical Lab: Task Scheduler Exploration

⏳ Browsing the built-in Microsoft task library (view-only)
⏳ Viewing a task's Triggers/Actions/Conditions tabs
⏳ Creating a simple, safe test task (e.g., open Notepad at a set time)

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 21 — WINDOWS GROUP POLICY (Chapter 42)

🟡 CHAPTER 42 — Group Policy

Status: NOT STARTED

Section 1: Local vs Domain Group Policy

⏳ Topic 1.1: Local Group Policy (single machine)
⏳ Topic 1.2: Domain Group Policy (Active Directory-distributed)

Section 2: Administrative Templates

⏳ Topic 2.1: ADMX/ADML template files
⏳ Topic 2.2: Policy categories

Section 3: Policies vs Preferences

⏳ Topic 3.1: Policies (enforced, reverted if unmanaged)
⏳ Topic 3.2: Preferences (one-time configuration, user can change after)

Section 4: Registry-Based Policy Implementation

⏳ Topic 4.1: Policy settings ultimately write to Registry policy keys
⏳ Topic 4.2: Policy key precedence over regular settings

Section 5: Computer Configuration vs User Configuration

⏳ Topic 5.1: Machine-wide policies
⏳ Topic 5.2: Per-user policies

Section 6: Policy Processing

⏳ Topic 6.1: Processing order (Local → Site → Domain → OU — "LSDOU")
⏳ Topic 6.2: Background refresh interval
⏳ Topic 6.3: Policy application at logon/boot

Section 7: Group Policy Tools

⏳ Topic 7.1: gpupdate — force policy refresh
⏳ Topic 7.2: gpresult — show resultant set of policy

Practical Lab: Group Policy Exploration

⏳ Opening Local Group Policy Editor (gpedit.msc, if available)
⏳ Running gpresult /r to see applied policies
⏳ Running gpupdate /force

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 22 — BOOT, RECOVERY AND FAILURE (Chapters 43–44)

🟡 CHAPTER 43 — Windows Recovery

Status: NOT STARTED

Section 1: Windows Recovery Environment (WinRE)

⏳ Topic 1.1: What WinRE is (minimal boot environment for repair)
⏳ Topic 1.2: How Windows detects it needs to boot into WinRE

Section 2: Safe Mode

⏳ Topic 2.1: Minimal driver/service set loaded
⏳ Topic 2.2: Safe Mode with Networking / Command Prompt variants

Section 3: Startup Repair

⏳ Topic 3.1: Automatic diagnosis of boot failures
⏳ Topic 3.2: What it checks and fixes (BCD, boot sector, drivers)

Section 4: System Restore

⏳ Topic 4.1: Restore points (registry/system file snapshots)
⏳ Topic 4.2: What is and isn't restored (personal files untouched)

Section 5: Recovery Partition

⏳ Topic 5.1: Hidden partition containing WinRE image
⏳ Topic 5.2: Factory reset image (OEM recovery partition)

Section 6: Boot Configuration Data (BCD)

⏳ Topic 6.1: BCD store structure
⏳ Topic 6.2: bcdedit for viewing/editing boot entries

Section 7: Common Startup Problems

⏳ Topic 7.1: Missing/corrupt BCD
⏳ Topic 7.2: Corrupt system files
⏳ Topic 7.3: Driver-caused boot loops

Practical Lab: Recovery Environment Exploration

⏳ Viewing BCD entries with bcdedit /enum
⏳ Locating the recovery partition in Disk Management
⏳ Reviewing System Restore point history

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

🟡 CHAPTER 44 — Blue Screen of Death

Status: NOT STARTED

Section 1: What a Kernel Crash Is

⏳ Topic 1.1: Bugcheck concept (fatal, unrecoverable kernel error)
⏳ Topic 1.2: Why the OS halts instead of continuing

Section 2: Stop Codes

⏳ Topic 2.1: Stop code format and meaning
⏳ Topic 2.2: Common stop codes and their typical causes

Section 3: Crash Dumps

⏳ Topic 3.1: Minidump (small, summary info)
⏳ Topic 3.2: Kernel memory dump
⏳ Topic 3.3: Complete memory dump
⏳ Topic 3.4: Dump file location and configuration

Section 4: Common Causes

⏳ Topic 4.1: Driver bugs (most common cause)
⏳ Topic 4.2: Memory corruption/failing RAM
⏳ Topic 4.3: Hardware failures
⏳ Topic 4.4: Overclocking instability

Section 5: How Engineers Determine the Cause (Complete Process)

⏳ Topic 5.1: Reading the stop code and parameters on the blue screen
⏳ Topic 5.2: Loading the minidump in WinDbg
⏳ Topic 5.3: Running !analyze -v to identify the faulting module
⏳ Topic 5.4: Identifying whether the faulting module is a driver, and which one
⏳ Topic 5.5: Cross-referencing with Driver Verifier results
⏳ Topic 5.6: Correlating with Event Viewer entries around the crash time

Practical Lab: Crash Dump Basics

⏳ Locating dump file settings (System Properties → Startup and Recovery)
⏳ Checking Reliability Monitor for past crash history
⏳ Reviewing Event Viewer for BugCheck events (Event ID 1001)

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 23 — PERFORMANCE (Chapter 45)

🟡 CHAPTER 45 — Computer Performance Internals

Status: NOT STARTED

Section 1: CPU Utilization

⏳ Topic 1.1: What "% CPU" actually measures (busy vs idle thread time)
⏳ Topic 1.2: Per-core vs aggregate utilization

Section 2: RAM Utilization

⏳ Topic 2.1: Committed vs in-use vs cached memory
⏳ Topic 2.2: Why "available" isn't the same as "free"

Section 3: Disk Performance

⏳ Topic 3.1: Disk latency
⏳ Topic 3.2: IOPS (I/O operations per second)
⏳ Topic 3.3: Queue depth

Section 4: Network Utilization

⏳ Topic 4.1: Throughput vs latency
⏳ Topic 4.2: Bandwidth saturation symptoms

Section 5: GPU Utilization

⏳ Topic 5.1: Engine-level utilization (3D, copy, video decode)

Section 6: CPU Frequency and Thermal Behavior

⏳ Topic 6.1: Dynamic frequency scaling under load
⏳ Topic 6.2: Thermal throttling (reducing speed to manage heat)

Section 7: Bottleneck Analysis

⏳ Topic 7.1: Identifying which resource is the limiting factor
⏳ Topic 7.2: Symptoms of CPU-bound vs I/O-bound vs memory-bound workloads

Section 8: Context Switching Overhead

⏳ Topic 8.1: Excessive context switching as a performance drain

Section 9: Page Faults and Cache Behavior

⏳ Topic 9.1: Soft vs hard page faults
⏳ Topic 9.2: Cache hit/miss impact on perceived speed

Section 10: Why "Low CPU Usage But Still Feels Slow" Happens

⏳ Topic 10.1: Disk latency bottleneck with idle CPU
⏳ Topic 10.2: Single-threaded workload not using multi-core capacity
⏳ Topic 10.3: I/O wait states not reflected in CPU%
⏳ Topic 10.4: Excessive paging to a slow disk

Practical Lab: Performance Investigation

⏳ Resource Monitor → Disk tab, sorting by highest response time
⏳ Performance Monitor counters: % Processor Time, Pages/sec, Avg. Disk sec/Transfer
⏳ Identifying a bottleneck on your own machine

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 24 — VIRTUALIZATION (Chapter 46)

🟡 CHAPTER 46 — Virtual Machines

Status: NOT STARTED

Section 1: What Virtualization Is

⏳ Topic 1.1: Running one or more OS instances on shared physical hardware

Section 2: The Hypervisor

⏳ Topic 2.1: Type 1 (bare-metal, e.g. Hyper-V)
⏳ Topic 2.2: Type 2 (hosted, e.g. VirtualBox, VMware Workstation)

Section 3: Virtual Hardware

⏳ Topic 3.1: Virtual CPU (vCPU) scheduling onto physical cores
⏳ Topic 3.2: Virtual RAM allocation
⏳ Topic 3.3: Virtual disk (VHD/VHDX/VMDK files)
⏳ Topic 3.4: Virtual network adapters and virtual switches

Section 4: Hardware-Assisted Virtualization

⏳ Topic 4.1: Intel VT-x / AMD-V
⏳ Topic 4.2: Why hardware support matters (performance vs software emulation)

Section 5: Common Hypervisors

⏳ Topic 5.1: Hyper-V (built into Windows)
⏳ Topic 5.2: VirtualBox
⏳ Topic 5.3: VMware

Section 6: How One Physical Computer Runs Multiple OSes (Complete Explanation)

⏳ Topic 6.1: Hypervisor intercepts privileged CPU instructions
⏳ Topic 6.2: Each VM believes it has exclusive hardware access
⏳ Topic 6.3: Hypervisor schedules vCPU time slices across physical cores
⏳ Topic 6.4: I/O requests trapped and translated to real hardware calls

Practical Lab: Virtualization Exploration

⏳ Checking virtualization support (systeminfo → Hyper-V Requirements)
⏳ Enabling/viewing Hyper-V feature (if applicable)
⏳ Viewing a VM's virtual hardware configuration

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 25 — CONTAINERS (Chapter 47)

🟡 CHAPTER 47 — Containers

Status: NOT STARTED

Section 1: What a Container Is

⏳ Topic 1.1: Isolated process, not a full OS

Section 2: Isolation Mechanisms

⏳ Topic 2.1: Namespaces (process, network, filesystem isolation)
⏳ Topic 2.2: Resource limits (cgroups equivalent on Windows containers)

Section 3: Container Images and Layers

⏳ Topic 3.1: Image as a stack of read-only layers
⏳ Topic 3.2: Layer caching/reuse

Section 4: Docker

⏳ Topic 4.1: Docker Engine role
⏳ Topic 4.2: Docker Desktop on Windows (uses a lightweight VM/WSL2 backend)

Section 5: Container Networking

⏳ Topic 5.1: Virtual networks between containers
⏳ Topic 5.2: Port mapping to host

Section 6: Container Storage

⏳ Topic 6.1: Writable layer on top of read-only image layers
⏳ Topic 6.2: Volumes for persistent data

Section 7: VM vs Container — The Complete Internal Difference

⏳ Topic 7.1: VM virtualizes hardware; container virtualizes the OS's process view
⏳ Topic 7.2: VM has its own kernel; container shares the host kernel
⏳ Topic 7.3: Startup time, resource overhead, and isolation strength compared

Practical Lab: Container Exploration

⏳ If Docker is installed: docker ps, docker images
⏳ Comparing container startup time vs a VM's boot time

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 26 — PROGRAMMING TO MACHINE LEVEL (Chapter 48)

🟡 CHAPTER 48 — From Source Code to CPU

Status: NOT STARTED

Section 1: Source Code

⏳ Topic 1.1: Human-readable program text (C/C++ example)

Section 2: Compilation

⏳ Topic 2.1: Preprocessing
⏳ Topic 2.2: Compiler front-end (parsing → AST)
⏳ Topic 2.3: Intermediate representation (IR)
⏳ Topic 2.4: Optimization passes

Section 3: Assembly Generation

⏳ Topic 3.1: IR → target-specific assembly

Section 4: Assembling

⏳ Topic 4.1: Assembly → object file (machine code + metadata)

Section 5: Linking

⏳ Topic 5.1: Combining object files
⏳ Topic 5.2: Resolving external symbols
⏳ Topic 5.3: Static vs dynamic linking (recap)

Section 6: Executable Creation

⏳ Topic 6.1: Final PE executable produced

Section 7: Loading

⏳ Topic 7.1: OS loader reads the executable
⏳ Topic 7.2: Process and address space created

Section 8: Execution

⏳ Topic 8.1: Memory populated (stack, heap, code, data)
⏳ Topic 8.2: CPU begins fetching instructions at entry point

Section 9: Complete Worked Example (Simple C Program)

⏳ Topic 9.1: A small C snippet traced through every stage above

Practical Lab: Source-to-Execution Tracing

⏳ Compiling a trivial C program (if a compiler is available) and inspecting the object/executable file
⏳ Viewing generated assembly (-S compiler flag) for a simple function

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 27 — APPLICATION MEMORY (Chapter 49)

🟡 CHAPTER 49 — What Happens When a Program Runs

Status: NOT STARTED

Section 1: EXE Loading

⏳ Topic 1.1: Loader reads PE headers to determine layout

Section 2: PE Format Recap in Context

⏳ Topic 2.1: Sections mapped into memory per their headers

Section 3: Process Creation

⏳ Topic 3.1: Kernel object created for the new process

Section 4: Virtual Address Space Setup

⏳ Topic 4.1: Address space reserved and structured (code, data, heap, stack regions)

Section 5: DLL Loading

⏳ Topic 5.1: Import table resolved, dependent DLLs mapped in

Section 6: Stack and Heap Initialization

⏳ Topic 6.1: Initial stack allocated per thread
⏳ Topic 6.2: Heap manager initialized

Section 7: Thread Creation

⏳ Topic 7.1: Primary thread created, begins at entry point

Section 8: CPU Execution Begins

⏳ Topic 8.1: Fetch-decode-execute cycle starts running the program's instructions

Section 9: System Calls During Execution

⏳ Topic 9.1: File access, memory allocation, and other requests crossing into the kernel

Section 10: File Access Example

⏳ Topic 10.1: A concrete trace of the program opening a file

Section 11: Process Termination

⏳ Topic 11.1: Resources released, exit code returned

Practical Lab: Program Execution Observation

⏳ Process Explorer showing a process's memory map from launch to exit
⏳ Observing DLLs loaded by a simple application

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 28 — WINDOWS PE FORMAT (Chapter 50)

🟡 CHAPTER 50 — PE Executable Format

Status: NOT STARTED

Section 1: What a PE File Is

⏳ Topic 1.1: Portable Executable — the format for .exe and .dll files

Section 2: PE Headers

⏳ Topic 2.1: DOS header (legacy compatibility stub)
⏳ Topic 2.2: NT headers (real PE metadata)
⏳ Topic 2.3: Optional header (entry point, image base, subsystem)

Section 3: Sections

⏳ Topic 3.1: .text (executable code)
⏳ Topic 3.2: .data (initialized global/static data)
⏳ Topic 3.3: .rdata (read-only data, import/export tables)
⏳ Topic 3.4: .rsrc (resources: icons, strings, version info)

Section 4: Import Table

⏳ Topic 4.1: List of external functions the executable needs
⏳ Topic 4.2: How the loader resolves these at load time

Section 5: Export Table

⏳ Topic 5.1: Functions a DLL makes available to others

Section 6: Entry Point

⏳ Topic 6.1: Where execution begins after loading

Section 7: DLLs vs EXEs in PE Format

⏳ Topic 7.1: Structural similarities and key differences (subsystem flag, exports)

Practical Lab: PE Format Exploration

⏳ Viewing a PE file's headers/sections with a PE viewer tool (if available)
⏳ Identifying the entry point address of a known executable

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 29 — DEEP SYSTEM TOOLS (Chapter 51)

🟡 CHAPTER 51 — Sysinternals

Status: NOT STARTED

For each tool below: what it does, why engineers use it, what information it reveals, how to interpret the information, safe practical exercises.

Section 1: Process Explorer

⏳ Topic 1.1: What it does (advanced Task Manager replacement)
⏳ Topic 1.2: Why engineers use it (DLL view, handle view, tree view)
⏳ Topic 1.3: Interpreting color coding
⏳ Topic 1.4: Safe exercise: finding what DLLs a process has loaded

Section 2: Process Monitor

⏳ Topic 2.1: What it does (real-time file/registry/process/network activity log)
⏳ Topic 2.2: Why engineers use it (root-cause troubleshooting)
⏳ Topic 2.3: Filtering techniques
⏳ Topic 2.4: Safe exercise: watching registry activity during an app launch

Section 3: Autoruns

⏳ Topic 3.1: What it does (shows every autostart location)
⏳ Topic 3.2: Why engineers use it (malware/bloatware discovery)
⏳ Topic 3.3: Interpreting unsigned entries
⏳ Topic 3.4: Safe exercise: reviewing (not disabling) startup entries

Section 4: TCPView

⏳ Topic 4.1: What it does (live view of TCP/UDP endpoints)
⏳ Topic 4.2: Why engineers use it (identifying what's making network connections)
⏳ Topic 4.3: Safe exercise: identifying which process owns a given connection

Section 5: RAMMap

⏳ Topic 5.1: What it does (detailed physical memory usage breakdown)
⏳ Topic 5.2: Why engineers use it (understanding cache/standby memory)

Section 6: VMMap

⏳ Topic 6.1: What it does (per-process virtual memory breakdown)
⏳ Topic 6.2: Why engineers use it (memory leak investigation)

Section 7: DiskView

⏳ Topic 7.1: What it does (graphical map of disk block usage)

Section 8: Handle

⏳ Topic 8.1: What it does (lists open handles, finds file-lock conflicts)

Section 9: PsExec

⏳ Topic 9.1: What it does (remote/elevated process execution)
⏳ Topic 9.2: Security awareness (legitimate admin use only)

Section 10: ProcDump

⏳ Topic 10.1: What it does (creates crash dumps on demand or on trigger conditions)

Practical Lab: Sysinternals Toolkit

⏳ Downloading the Sysinternals Suite (from Microsoft directly)
⏳ Running Process Explorer alongside Task Manager and comparing views
⏳ Running Autoruns in view-only mode

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 30 — TROUBLESHOOTING (Chapter 52)

🟡 CHAPTER 52 — How Professional Engineers Troubleshoot Computers

Status: NOT STARTED

Section 1: Systematic Methodology

⏳ Topic 1.1: Symptom identification
⏳ Topic 1.2: Reproduction
⏳ Topic 1.3: Log review
⏳ Topic 1.4: Isolation (narrowing down the cause)
⏳ Topic 1.5: Root-cause analysis
⏳ Topic 1.6: Fix and verify

Section 2: Where to Look

⏳ Topic 2.1: Event Viewer
⏳ Topic 2.2: Processes (Task Manager/Process Explorer)
⏳ Topic 2.3: Services
⏳ Topic 2.4: Drivers/Device Manager
⏳ Topic 2.5: Network tools
⏳ Topic 2.6: Storage health
⏳ Topic 2.7: Memory diagnostics
⏳ Topic 2.8: CPU/thermal
⏳ Topic 2.9: Hardware vs software vs configuration triage

Section 3: Realistic Troubleshooting Scenarios (Full Walkthroughs)

⏳ Scenario 3.1: Computer is slow
⏳ Scenario 3.2: Internet connected but websites don't open
⏳ Scenario 3.3: USB device isn't detected
⏳ Scenario 3.4: Bluetooth isn't working
⏳ Scenario 3.5: Application crashes
⏳ Scenario 3.6: Windows takes too long to start
⏳ Scenario 3.7: Disk usage is 100%
⏳ Scenario 3.8: RAM usage is high
⏳ Scenario 3.9: Blue screen occurs
⏳ Scenario 3.10: Printer isn't working
⏳ Scenario 3.11: Sound isn't working
⏳ Scenario 3.12: Wi-Fi disappears
⏳ Scenario 3.13: Windows Update fails
⏳ Scenario 3.14: Application cannot access a file
⏳ Scenario 3.15: Administrator cannot delete a file

Practical Lab: Apply the Methodology

⏳ Picking one real (or simulated) issue on your own PC and working it through the full methodology

Knowledge Check

⏳ 10 Quick Review questions
⏳ 5 Understanding questions
⏳ 5 Scenario questions
⏳ 5 Interview questions
⏳ 1 Practical task

PART 31 — ADVANCED WINDOWS INTERNALS (Chapters 53–68)

🟡 CHAPTER 53 — Windows Object Manager

Status: NOT STARTED

⏳ Unified namespace for kernel objects
⏳ Object headers and object bodies
⏳ Object types (process, thread, file, event, mutex, etc.)
⏳ Object namespace (\Device, \DosDevices, \Sessions)
⏳ Reference counting and object lifetime
⏳ Security descriptors on objects
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 54 — Windows Handles

Status: NOT STARTED

⏳ What a handle is (opaque reference, not a pointer)
⏳ Per-process handle table
⏳ Handle creation (e.g., CreateFile returns a handle)
⏳ Handle duplication and inheritance
⏳ Handle leaks and their symptoms
⏳ Viewing handles with Process Explorer/Handle tool
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 55 — I/O Manager

Status: NOT STARTED

⏳ Central coordinator for all I/O operations
⏳ IRP creation and dispatch (recap/deepen from Ch13)
⏳ Synchronous vs asynchronous I/O completion
⏳ I/O completion ports
⏳ Fast I/O path (bypassing full IRP overhead)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 56 — Windows Memory Manager

Status: NOT STARTED

⏳ Working set management per process
⏳ Page replacement algorithms
⏳ Standby/modified/free page lists
⏳ Memory pools (paged vs non-paged)
⏳ Section objects (memory-mapped files)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 57 — Windows Scheduler

Status: NOT STARTED

⏳ Priority-driven, preemptive scheduling
⏳ 32 priority levels (real-time vs dynamic classes)
⏳ Quantum and quantum stretching
⏳ Multiprocessor scheduling and processor affinity
⏳ Priority boosts (I/O completion, foreground window)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 58 — Windows Security Reference Monitor

Status: NOT STARTED

⏳ Central authority for all access checks
⏳ How it cooperates with the Object Manager
⏳ Access token evaluation against object ACLs (deepened from Ch24/25)
⏳ Audit log generation
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 59 — Windows Executive

Status: NOT STARTED

⏳ The Executive as the layer above the microkernel
⏳ Executive components recap (Process/Memory/IO/Security/PnP/Power Managers) unified view
⏳ Executive vs kernel proper distinction
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 60 — Hardware Abstraction Layer

Status: NOT STARTED

⏳ Why HAL exists (isolating kernel from hardware differences)
⏳ What HAL abstracts (interrupt controllers, timers, DMA, buses)
⏳ HAL.dll's role at boot
⏳ Modern HAL consolidation in recent Windows versions
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 61 — Windows Kernel

Status: NOT STARTED

⏳ The kernel proper (ntoskrnl.exe's KERNEL portion) vs the Executive
⏳ Thread scheduling primitives at the lowest level
⏳ Interrupt/exception dispatching
⏳ Synchronization primitives (spinlocks, dispatcher objects)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 62 — NT Native API

Status: NOT STARTED

⏳ Nt*/Zw* function pairs and the difference between them
⏳ Why most developers never call these directly
⏳ Native API's role as the real OS interface beneath Win32
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 63 — Windows System Calls

Status: NOT STARTED

⏳ The syscall/sysenter transition mechanism in detail
⏳ System Service Dispatch Table (SSDT) lookup
⏳ Parameter validation on kernel entry
⏳ Return path back to user mode
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 64 — Windows Process Environment Block (PEB)

Status: NOT STARTED

⏳ What the PEB stores (loaded module list, process parameters, heap list)
⏳ Where the PEB lives (user-mode, per-process)
⏳ Why the PEB matters for debugging and (legitimately) for anti-debugging awareness
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 65 — Thread Environment Block (TEB)

Status: NOT STARTED

⏳ What the TEB stores (thread-local storage, last error code, stack info)
⏳ Per-thread, user-mode structure
⏳ Relationship to the PEB
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 66 — Windows Loader

Status: NOT STARTED

⏳ Process-level loader responsibilities (recap/deepen from Ch49)
⏳ Relocation processing
⏳ TLS (Thread Local Storage) initialization
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 67 — DLL Loader

Status: NOT STARTED

⏳ DLL-specific loader mechanics (deepened from Ch22)
⏳ Loader lock and why DLL_PROCESS_ATTACH must be careful
⏳ Circular dependency handling
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 68 — Windows IPC

Status: NOT STARTED

⏳ Named pipes (cross-process, named endpoint)
⏳ Anonymous pipes (parent-child only)
⏳ Shared memory (section objects revisited)
⏳ RPC (Remote Procedure Call)
⏳ COM (Component Object Model as IPC + object model)
⏳ ALPC (Advanced Local Procedure Call — internal Windows IPC)
⏳ Sockets (local and network IPC)
⏳ Knowledge check (10/5/5/5/1 question set)

PART 32 — ADVANCED HARDWARE (Chapters 69–77)

🟡 CHAPTER 69 — Interrupts

Status: NOT STARTED

⏳ Deep dive beyond Chapter 4's introduction
⏳ Interrupt vectors and the IDT (Interrupt Descriptor Table)
⏳ IRQL (Interrupt Request Level) in Windows
⏳ Nested/masked interrupts
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 70 — DMA

Status: NOT STARTED

⏳ Deep dive beyond Chapter 4/13's introduction
⏳ Bus mastering DMA
⏳ IOMMU (I/O memory management unit) and DMA protection
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 71 — PCIe Internals

Status: NOT STARTED

⏳ Packet-based, point-to-point serial architecture
⏳ Lanes, links, and switches
⏳ Configuration space and BARs (Base Address Registers)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 72 — USB Internals

Status: NOT STARTED

⏳ Host controller, hub, and device roles
⏳ Enumeration process in protocol detail
⏳ Descriptors (device, configuration, interface, endpoint)
⏳ Transfer types (control, bulk, interrupt, isochronous)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 73 — SATA and NVMe Internals

Status: NOT STARTED

⏳ AHCI protocol details for SATA
⏳ NVMe queue architecture (submission/completion queues)
⏳ Why NVMe scales better with parallel workloads
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 74 — TPM

Status: NOT STARTED

⏳ Deep dive beyond Chapter 26's introduction
⏳ PCR (Platform Configuration Registers) and measured boot
⏳ TPM 1.2 vs 2.0 differences
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 75 — Secure Boot

Status: NOT STARTED

⏳ Deep dive beyond Chapter 5/26's introduction
⏳ Key hierarchy (PK, KEK, db, dbx)
⏳ Signature validation chain in detail
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 76 — ACPI

Status: NOT STARTED

⏳ Deep dive beyond Chapter 34's introduction
⏳ ACPI tables (DSDT, SSDT, FADT, MADT)
⏳ ACPI's role beyond power (device configuration, thermal zones)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 77 — Firmware Updates

Status: NOT STARTED

⏳ How firmware update packages are structured
⏳ Update mechanisms (Windows Update-delivered firmware, OEM tools, Capsule updates via UEFI)
⏳ Risks of interrupted firmware updates
⏳ Knowledge check (10/5/5/5/1 question set)

PART 33 — SECURITY DEEP DIVE (Chapters 78–79)

🟡 CHAPTER 78 — Malware Basics

Status: NOT STARTED

(Technical mechanisms only — no exploitation techniques)

⏳ Virus (attaches to host files, requires execution)
⏳ Worm (self-propagating, no host file needed)
⏳ Trojan (disguised as legitimate software)
⏳ Ransomware (encrypts files, demands payment)
⏳ Rootkit (hides presence by hooking OS structures)
⏳ Bootkit (infects boot process before OS loads)
⏳ Spyware (covertly collects information)
⏳ How each interacts with OS components covered earlier (processes, drivers, registry, boot)
⏳ Knowledge check (10/5/5/5/1 question set)

🟡 CHAPTER 79 — Endpoint Security

Status: NOT STARTED

⏳ Antivirus (signature and heuristic scanning)
⏳ EDR (Endpoint Detection and Response — behavioral monitoring, telemetry)
⏳ Windows Defender architecture recap and deepening
⏳ Firewall as endpoint control point
⏳ Application control (allow-listing)
⏳ Sandboxing as containment strategy
⏳ Security logs as the evidence trail
⏳ Knowledge check (10/5/5/5/1 question set)

PART 34 — COMPLETE END-TO-END SCENARIOS (Chapter 80)

🟡 CHAPTER 80 — Complete End-to-End Scenarios

Status: NOT STARTED

Scenario 1: What Happens When I Press the Power Button?

⏳ Full trace: electricity → PSU → motherboard → firmware → POST → UEFI → Boot Manager → Windows loader → kernel → drivers → services → login → desktop
⏳ Cross-references Chapters 5, 6, 8, 12, 13, 24

Scenario 2: What Happens When I Open Chrome?

⏳ Full trace: mouse click → USB → driver → Windows input → Explorer → process creation → executable loader → memory → threads → CPU → GPU → network
⏳ Cross-references Chapters 9, 10, 22, 23, 30, 31, 32, 49

Scenario 3: What Happens When I Open a Website?

⏳ Full trace: keyboard → application → DNS → network adapter → driver → TCP/IP → router → internet → server → TLS → HTTP → browser → renderer → GPU → monitor
⏳ Cross-references Chapters 27, 28, 29, 31, 32

Scenario 4: What Happens When I Save a File?

⏳ Full trace: application → API → system call → I/O Manager → file system → NTFS → storage driver → NVMe/SATA → SSD → NAND
⏳ Cross-references Chapters 18, 19, 23, 55

Scenario 5: What Happens When I Connect a USB Device?

⏳ Full trace: USB hardware → controller → detection → Plug and Play → device identification → driver matching → driver loading → device initialization → application access
⏳ Cross-references Chapters 13, 14, 72

Knowledge Check (Capstone)

⏳ 5 comprehensive tracing exercises (pick any everyday action and trace the full chain unaided)
⏳ Final self-assessment against the "Ultimate Goal" statement from the course brief

SUMMARY OF COMPLETION STATUS

Category	Chapters	Complete	Not Started
Part 1 — Foundational Hardware	1–4	1	3
Part 2 — Boot and Startup	5–6	0	2
Part 3 — Operating System	7–8	0	2
Part 4 — Processes and Execution	9–11	0	3
Part 5 — Windows Services	12	0	1
Part 6 — Device Drivers	13–14	0	2
Part 7 — Control Panel and Settings	15–17	0	3
Part 8 — File Systems and Storage	18–21	0	4
Part 9 — DLLs and Windows APIs	22–23	0	2
Part 10 — Windows Security	24–26	0	3
Part 11 — Networking Internals	27–29	0	3
Part 12 — Windows User Interface	30	0	1
Part 13 — Input, Output, Audio	31–33	0	3
Part 14 — Power Management	34	0	1
Part 15 — Update and Installation	35–36	0	2
Part 16 — Environment Variables	37	0	1
Part 17 — Command Line	38	0	1
Part 18 — Administration	39	0	1
Part 19 — Event Logging	40	0	1
Part 20 — Task Scheduler	41	0	1
Part 21 — Group Policy	42	0	1
Part 22 — Recovery and Failure	43–44	0	2
Part 23 — Performance	45	0	1
Part 24 — Virtualization	46	0	1
Part 25 — Containers	47	0	1
Part 26 — Programming to Machine Level	48	0	1
Part 27 — Application Memory	49	0	1
Part 28 — Windows PE Format	50	0	1
Part 29 — Deep System Tools	51	0	1
Part 30 — Troubleshooting	52	0	1
Part 31 — Advanced Windows Internals	53–68	0	16
Part 32 — Advanced Hardware	69–77	0	9
Part 33 — Security Deep Dive	78–79	0	2
Part 34 — End-to-End Scenarios	80	0	1
TOTAL	1–80	1	79

NEXT STEPS

Finish Chapter 1 knowledge checks — Answer all questions
Do Chapter 1 practical lab — Explore your actual hardware
Chapter 2 is being written — CPU Internals coming next

Last Updated: 2026-09-16
Status: Chapter 1 Complete, Tracking Granular Progress

PART 1 — FOUNDATIONAL HARDWARE (Chapters 1–4)

✅ CHAPTER 1 — The Complete Computer Architecture

Section 1: The Layers of a Computer

Section 2: The Physical Hardware Inside a Computer

Section 3: The Buses — How Components Communicate

Section 4: Complete Architecture Diagram

Section 5: Software and Operating System

Section 6: Key Concepts

Section 7: Common Misconceptions

Section 8: Terminology Glossary

Practical Lab: Exploring Your Hardware

Knowledge Check

Chapter Summary

✅ CHAPTER 2 — CPU Internals

Section 1: Introduction to CPU Architecture

Section 2: CPU Cores and Threads

Section 3: CPU Memory Hierarchy

Section 4: CPU Instruction Execution

Section 5: Advanced CPU Concepts

Section 6: CPU Privilege Levels

Section 7: CPU Interrupts and Context Switching

Section 8: x86/x64 Architecture

Section 9: Modern CPU Designs (Intel vs AMD)

Section 10: CPU Frequency and Power

Practical Lab: Monitoring CPU

Knowledge Check

✅ CHAPTER 3 — RAM and Memory Internals

Section 1: What is RAM?

Section 2: Memory Technologies

Section 3: Virtual Memory and Address Spaces

Section 4: Memory Management Unit (MMU)

Section 5: Paging and Swap

Section 6: Process Memory Layout

Section 7: Memory Allocation

Section 8: Memory Protection and Isolation

Section 9: Copy-on-Write and Shared Memory

Section 10: Modern RAM Features

Practical Lab: Monitoring Memory

Knowledge Check

✅ CHAPTER 4 — Motherboard and Hardware Communication

Section 1: Motherboard Architecture in Detail

Section 2: Buses In Depth

Section 3: Interrupts (Hardware)

Section 4: DMA (Direct Memory Access)

Section 5: Power Management

Section 6: I/O Operations

Section 7: Clocking and Synchronization

Section 8: Firmware and ROM

Practical Lab: Exploring Motherboard Info

Knowledge Check

PART 2 — BOOT AND STARTUP (Chapters 5–6)

✅ CHAPTER 5 — BIOS and UEFI

Section 1: What is BIOS?

Section 2: BIOS Architecture

Section 3: POST (Power-On Self Test)

Section 4: What is UEFI?

Section 5: UEFI Internals

Section 6: Secure Boot

Section 7: CMOS and Settings Storage

Section 8: BIOS/UEFI Settings

Practical Lab: Entering BIOS/UEFI

Knowledge Check

✅ CHAPTER 6 — Complete Boot Process

Section 1: Overview of Boot Sequence

Section 2: Pre-Boot Phase (Power → BIOS)

Section 3: POST Phase (Hardware Test)

Section 4: Boot Device Selection

Section 5: Windows Boot Manager

Section 6: Windows Bootloader

Section 7: Windows Kernel Initialization

Section 8: Session Manager and Services

Section 9: User Login and Desktop

Section 10: Complete Boot Chain Diagram

Section 11: Boot Failures

Practical Lab: Boot Analysis

Knowledge Check

PART 3 — OPERATING SYSTEM (Chapters 7–8)

✅ CHAPTER 7 — What an Operating System Really Does

Section 1: Why Operating Systems Exist