Introduction |
|
xlvii | |
Part I: Introduction To Professional C++ |
|
|
Chapter 1 A Crash Course In C++ And The Standard Library |
|
|
3 | (54) |
|
|
4 | (24) |
|
The Obligatory Hello, World |
|
|
4 | (4) |
|
|
4 | (1) |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
8 | (2) |
|
|
10 | (1) |
|
|
10 | (3) |
|
|
13 | (2) |
|
|
15 | (2) |
|
|
15 | (1) |
|
|
16 | (1) |
|
|
17 | (3) |
|
|
17 | (1) |
|
|
18 | (2) |
|
|
20 | (1) |
|
Logical Evaluation Operators |
|
|
20 | (1) |
|
|
21 | (2) |
|
Function Return Type Deduction |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
23 | (2) |
|
|
25 | (1) |
|
|
25 | (1) |
|
|
26 | (1) |
|
|
26 | (2) |
|
|
26 | (1) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
27 | (1) |
|
|
28 | (1) |
|
|
28 | (1) |
|
|
28 | (12) |
|
|
29 | (1) |
|
Pointers and Dynamic Memory |
|
|
29 | (6) |
|
|
29 | (1) |
|
|
30 | (1) |
|
Dynamically Allocated Arrays |
|
|
31 | (1) |
|
|
32 | (1) |
|
|
33 | (2) |
|
|
35 | (1) |
|
|
35 | (1) |
|
const to Protect Parameters |
|
|
35 | (1) |
|
|
35 | (2) |
|
|
36 | (1) |
|
|
37 | (1) |
|
|
37 | (1) |
|
|
38 | (2) |
|
|
39 | (1) |
|
|
40 | (1) |
|
C++ as an Object-Oriented Language |
|
|
40 | (3) |
|
|
40 | (3) |
|
|
43 | (1) |
|
|
43 | (3) |
|
Direct List Initialization versus Copy List Initialization |
|
|
45 | (1) |
|
|
46 | (1) |
|
Your First Useful C++ Program |
|
|
46 | (10) |
|
An Employee Records System |
|
|
46 | (1) |
|
|
47 | (3) |
|
|
47 | (1) |
|
|
48 | (2) |
|
|
50 | (1) |
|
|
50 | (3) |
|
|
50 | (1) |
|
|
51 | (1) |
|
|
52 | (1) |
|
|
53 | (2) |
|
|
55 | (1) |
|
|
56 | (1) |
|
Chapter 2 Working With Strings And String Views |
|
|
57 | (14) |
|
|
58 | (11) |
|
|
58 | (2) |
|
|
60 | (2) |
|
|
60 | (2) |
|
The C++ std::string Class |
|
|
62 | (5) |
|
What Is Wrong with C-Style Strings? |
|
|
62 | (1) |
|
|
62 | (2) |
|
|
64 | (1) |
|
High-Level Numeric Conversions |
|
|
64 | (1) |
|
Low-Level Numeric Conversions |
|
|
65 | (2) |
|
The std::string_view Class |
|
|
67 | (2) |
|
std::string_view Literals |
|
|
69 | (1) |
|
|
69 | (1) |
|
|
69 | (2) |
|
Chapter 3 Coding With Style |
|
|
71 | (24) |
|
The Importance of Looking Good |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
|
72 | (9) |
|
Reasons to Write Comments |
|
|
72 | (5) |
|
Commenting to Explain Usage |
|
|
72 | (2) |
|
Commenting to Explain Complicated Code |
|
|
74 | (1) |
|
Commenting to Convey Meta-information |
|
|
75 | (2) |
|
|
77 | (4) |
|
|
77 | (1) |
|
|
78 | (1) |
|
|
79 | (1) |
|
|
80 | (1) |
|
|
81 | (1) |
|
|
81 | (2) |
|
Decomposition through Refactoring |
|
|
82 | (1) |
|
|
83 | (1) |
|
Decomposition in This Book |
|
|
83 | (1) |
|
|
83 | (3) |
|
|
83 | (1) |
|
|
84 | (2) |
|
|
84 | (1) |
|
|
84 | (1) |
|
|
85 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
|
86 | (1) |
|
Using Language Features with Style |
|
|
86 | (2) |
|
|
87 | (1) |
|
Use References Instead of Pointers |
|
|
87 | (1) |
|
|
88 | (1) |
|
|
88 | (2) |
|
The Curly Brace Alignment Debate |
|
|
88 | (1) |
|
Coming to Blows over Spaces and Parentheses |
|
|
89 | (1) |
|
|
90 | (1) |
|
|
90 | (1) |
|
|
91 | (4) |
Part II: Professional C++ Software Design |
|
|
Chapter 4 Designing Professional C++ Programs |
|
|
95 | (28) |
|
What Is Programming Design? |
|
|
96 | (1) |
|
The Importance of Programming Design |
|
|
97 | (2) |
|
|
99 | (1) |
|
|
100 | (3) |
|
|
100 | (1) |
|
Benefiting from Abstraction |
|
|
100 | (1) |
|
Incorporating Abstraction in Your Design |
|
|
101 | (1) |
|
|
101 | (2) |
|
|
102 | (1) |
|
|
103 | (1) |
|
|
103 | (11) |
|
|
104 | (1) |
|
Deciding Whether or Not to Reuse Code |
|
|
105 | (2) |
|
Advantages to Reusing Code |
|
|
105 | (1) |
|
Disadvantages to Reusing Code |
|
|
105 | (1) |
|
Putting It Together to Make a Decision |
|
|
106 | (1) |
|
Strategies for Reusing Code |
|
|
107 | (5) |
|
Understand the Capabilities and Limitations |
|
|
107 | (1) |
|
Understand the Performance |
|
|
108 | (2) |
|
Understand Platform Limitations |
|
|
110 | (1) |
|
Understand Licensing and Support |
|
|
110 | (1) |
|
|
111 | (1) |
|
|
111 | (1) |
|
Bundling Third-Party Applications |
|
|
112 | (1) |
|
|
112 | (2) |
|
The Open-Source Movements |
|
|
112 | (1) |
|
Finding and Using Open-Source Libraries |
|
|
113 | (1) |
|
Guidelines for Using Open-Source Code |
|
|
113 | (1) |
|
|
114 | (1) |
|
|
114 | (1) |
|
Deciding Whether or Not to Use the Standard Library |
|
|
114 | (1) |
|
Designing a Chess Program |
|
|
114 | (7) |
|
|
115 | (1) |
|
|
115 | (9) |
|
Divide the Program into Subsystems |
|
|
115 | (2) |
|
|
117 | (1) |
|
Specify Class Hierarchies for Each Subsystem |
|
|
118 | (1) |
|
Specify Classes, Data Structures, Algorithms, and Patterns for Each Subsystem |
|
|
118 | (2) |
|
Specify Error Handling for Each Subsystem |
|
|
120 | (1) |
|
|
121 | (2) |
|
Chapter 5 Designing With Objects |
|
|
123 | (20) |
|
Am I Thinking Procedurally? |
|
|
124 | (1) |
|
The Object-Oriented Philosophy |
|
|
124 | (3) |
|
|
124 | (1) |
|
|
125 | (1) |
|
|
125 | (1) |
|
|
126 | (1) |
|
|
126 | (1) |
|
Living in a World of Objects |
|
|
127 | (2) |
|
|
127 | (1) |
|
|
128 | (1) |
|
|
129 | (9) |
|
|
129 | (1) |
|
The Is-A Relationship (Inheritance) |
|
|
130 | (2) |
|
|
130 | (1) |
|
Polymorphism versus Code Reuse |
|
|
131 | (1) |
|
The Fine Line between Has-A and Is-A |
|
|
132 | (3) |
|
|
135 | (1) |
|
|
136 | (1) |
|
|
137 | (1) |
|
|
138 | (1) |
|
|
138 | (4) |
|
Interface versus Implementation |
|
|
138 | (1) |
|
Deciding on an Exposed Interface |
|
|
139 | (2) |
|
|
139 | (1) |
|
|
139 | (2) |
|
|
141 | (1) |
|
Designing a Successful Abstraction |
|
|
141 | (1) |
|
|
142 | (1) |
|
Chapter 6 Designing For Reuse |
|
|
143 | (20) |
|
|
144 | (1) |
|
How to Design Reusable Code |
|
|
144 | (15) |
|
|
145 | (1) |
|
Structure Your Code for Optimal Reuse |
|
|
146 | (7) |
|
Avoid Combining Unrelated or Logically Separate Concepts |
|
|
146 | (2) |
|
Use Templates for Generic Data Structures and Algorithms |
|
|
148 | (2) |
|
Provide Appropriate Checks and Safeguards |
|
|
150 | (1) |
|
|
151 | (2) |
|
|
153 | (5) |
|
Design Interfaces That Are Easy to Use |
|
|
153 | (4) |
|
Design General-Purpose Interfaces |
|
|
157 | (1) |
|
Reconciling Generality and Ease of Use |
|
|
157 | (1) |
|
|
158 | (1) |
|
|
159 | (4) |
Part III: C++ Coding The Professional Way |
|
|
Chapter 7 Memory Management |
|
|
163 | (36) |
|
Working with Dynamic Memory |
|
|
164 | (13) |
|
|
164 | (2) |
|
Allocation and Deallocation |
|
|
166 | (2) |
|
|
166 | (1) |
|
What about My Good Friend malloc? |
|
|
167 | (1) |
|
When Memory Allocation Fails |
|
|
167 | (1) |
|
|
168 | (7) |
|
|
168 | (2) |
|
|
170 | (1) |
|
|
171 | (1) |
|
|
172 | (3) |
|
|
175 | (2) |
|
A Mental Model for Pointers |
|
|
175 | (1) |
|
|
176 | (1) |
|
|
177 | (2) |
|
|
177 | (2) |
|
Not All Pointers Are Arrays! |
|
|
179 | (1) |
|
Low-Level Memory Operations |
|
|
179 | (3) |
|
|
179 | (1) |
|
|
180 | (1) |
|
|
181 | (1) |
|
|
182 | (1) |
|
|
182 | (10) |
|
|
183 | (3) |
|
|
183 | (2) |
|
|
185 | (1) |
|
unique_ptr and C-Style Arrays |
|
|
186 | (1) |
|
|
186 | (1) |
|
|
186 | (3) |
|
|
187 | (1) |
|
The Need for Reference Counting |
|
|
188 | (1) |
|
|
189 | (1) |
|
|
189 | (1) |
|
|
190 | (1) |
|
|
191 | (1) |
|
The Old Deprecated/Removed auto_ptr |
|
|
192 | (1) |
|
|
192 | (5) |
|
|
192 | (1) |
|
Accessing Out-of-Bounds Memory |
|
|
193 | (1) |
|
|
194 | (3) |
|
Finding and Fixing Memory Leaks in Windows with Visual C++ |
|
|
195 | (1) |
|
Finding and Fixing Memory Leaks in Linux with Valgrind |
|
|
196 | (1) |
|
Double-Deleting and Invalid Pointers |
|
|
197 | (1) |
|
|
197 | (2) |
|
Chapter 8 Gaining Proficiency With Classes And Objects |
|
|
199 | (32) |
|
Introducing the Spreadsheet Example |
|
|
200 | (1) |
|
|
200 | (8) |
|
|
200 | (3) |
|
|
201 | (1) |
|
|
201 | (2) |
|
|
203 | (1) |
|
In-Class Member Initializers |
|
|
203 | (1) |
|
|
203 | (4) |
|
|
204 | (1) |
|
|
204 | (2) |
|
|
206 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
208 | (22) |
|
|
208 | (16) |
|
|
209 | (1) |
|
|
210 | (1) |
|
Providing Multiple Constructors |
|
|
211 | (1) |
|
|
212 | (3) |
|
|
215 | (3) |
|
|
218 | (2) |
|
Initializer-List Constructors |
|
|
220 | (2) |
|
|
222 | (1) |
|
Summary of Compiler-Generated Constructors |
|
|
222 | (2) |
|
|
224 | (1) |
|
|
225 | (3) |
|
Declaring an Assignment Operator |
|
|
225 | (1) |
|
Defining an Assignment Operator |
|
|
226 | (1) |
|
Explicitly Defaulted and Deleted Assignment Operator |
|
|
227 | (1) |
|
Compiler-Generated Copy Constructor and Copy Assignment Operator |
|
|
228 | (1) |
|
Distinguishing Copying from Assignment |
|
|
228 | (5) |
|
|
228 | (1) |
|
Copy Constructors and Object Members |
|
|
229 | (1) |
|
|
230 | (1) |
|
Chapter 9 Mastering Classes And Objects |
|
|
231 | (46) |
|
|
232 | (1) |
|
Dynamic Memory Allocation in Objects |
|
|
233 | (18) |
|
|
233 | (2) |
|
Freeing Memory with Destructors |
|
|
235 | (1) |
|
Handling Copying and Assignment |
|
|
236 | (7) |
|
The Spreadsheet Copy Constructor |
|
|
239 | (1) |
|
The Spreadsheet Assignment Operator |
|
|
240 | (2) |
|
Disallowing Assignment and Pass-By-Value |
|
|
242 | (1) |
|
Handling Moving with Move Semantics |
|
|
243 | (7) |
|
|
243 | (2) |
|
Implementing Move Semantics |
|
|
245 | (3) |
|
Testing the Spreadsheet Move Operations |
|
|
248 | (2) |
|
Implementing a Swap Function with Move Semantics |
|
|
250 | (1) |
|
|
250 | (1) |
|
|
251 | (7) |
|
|
251 | (1) |
|
|
251 | (2) |
|
|
253 | (1) |
|
|
253 | (2) |
|
Overloading Based on const |
|
|
254 | (1) |
|
Explicitly Deleting Overloads |
|
|
255 | (1) |
|
|
255 | (2) |
|
|
257 | (1) |
|
Different Kinds of Data Members |
|
|
258 | (5) |
|
|
258 | (2) |
|
|
259 | (1) |
|
Accessing static Data Members within Class Methods |
|
|
259 | (1) |
|
Accessing static Data Members Outside Methods |
|
|
260 | (1) |
|
const static Data Members |
|
|
260 | (1) |
|
|
261 | (1) |
|
const Reference Data Members |
|
|
262 | (1) |
|
|
263 | (1) |
|
Enumerated Types inside Classes |
|
|
264 | (1) |
|
|
265 | (7) |
|
Example: Implementing Addition for SpreadsheetCells |
|
|
265 | (4) |
|
First Attempt: The add Method |
|
|
265 | (1) |
|
Second Attempt: Overloaded operator+ as a Method |
|
|
266 | (2) |
|
Third Attempt: Global operator+ |
|
|
268 | (1) |
|
Overloading Arithmetic Operators |
|
|
269 | (1) |
|
Overloading the Arithmetic Shorthand Operators |
|
|
269 | (1) |
|
Overloading Comparison Operators |
|
|
270 | (1) |
|
Building Types with Operator Overloading |
|
|
271 | (1) |
|
Building Stable Interfaces |
|
|
272 | (3) |
|
Using Interface and Implementation Classes |
|
|
272 | (3) |
|
|
275 | (2) |
|
Chapter 10 Discovering Inheritance Techniques |
|
|
277 | (56) |
|
Building Classes with Inheritance |
|
|
278 | (13) |
|
|
278 | (3) |
|
A Client's View of Inheritance |
|
|
279 | (1) |
|
A Derived Class' View of Inheritance |
|
|
280 | (1) |
|
|
281 | (1) |
|
|
281 | (10) |
|
How I Learned to Stop Worrying and Make Everything virtual |
|
|
281 | (1) |
|
Syntax for Overriding a Method |
|
|
282 | (1) |
|
A Client's View of Overridden Methods |
|
|
283 | (1) |
|
|
284 | (2) |
|
|
286 | (4) |
|
|
290 | (1) |
|
|
291 | (3) |
|
The WeatherPrediction Class |
|
|
291 | (1) |
|
Adding Functionality in a Derived Class |
|
|
292 | (1) |
|
Replacing Functionality in a Derived Class |
|
|
293 | (1) |
|
|
294 | (7) |
|
|
294 | (2) |
|
|
296 | (1) |
|
Referring to Parent Names |
|
|
297 | (2) |
|
|
299 | (2) |
|
Inheritance for Polymorphism |
|
|
301 | (7) |
|
Return of the Spreadsheet |
|
|
301 | (1) |
|
Designing the Polymorphic Spreadsheet Cell |
|
|
301 | (1) |
|
The SpreadsheetCell Base Class |
|
|
302 | (2) |
|
|
302 | (1) |
|
Pure Virtual Methods and Abstract Base Classes |
|
|
303 | (1) |
|
The Individual Derived Classes |
|
|
304 | (2) |
|
StringSpreadsheetCell Class Definition |
|
|
304 | (1) |
|
StringSpreadsheetCell Implementation |
|
|
304 | (1) |
|
DoubleSpreadsheetCell Class Definition and Implementation |
|
|
305 | (1) |
|
|
306 | (1) |
|
|
306 | (2) |
|
|
308 | (4) |
|
Inheriting from Multiple Classes |
|
|
308 | (1) |
|
Naming Collisions and Ambiguous Base Classes |
|
|
309 | (3) |
|
|
309 | (2) |
|
|
311 | (1) |
|
Uses for Multiple Inheritance |
|
|
312 | (1) |
|
Interesting and Obscure Inheritance Issues |
|
|
312 | (20) |
|
Changing the Overridden Method's Characteristics |
|
|
313 | (3) |
|
Changing the Method Return Type |
|
|
313 | (2) |
|
Changing the Method Parameters |
|
|
315 | (1) |
|
|
316 | (4) |
|
Special Cases in Overriding Methods |
|
|
320 | (7) |
|
The Base Class Method Is static |
|
|
320 | (1) |
|
The Base Class Method Is Overloaded |
|
|
321 | (1) |
|
The Base Class Method Is private or protected |
|
|
322 | (2) |
|
The Base Class Method Has Default Arguments |
|
|
324 | (1) |
|
The Base Class Method Has a Different Access Level |
|
|
325 | (2) |
|
Copy Constructors and Assignment Operators in Derived Classes |
|
|
327 | (2) |
|
|
329 | (2) |
|
|
331 | (1) |
|
|
331 | (1) |
|
|
332 | (1) |
|
Chapter 11 C++ Quirks, Oddities, And Incidentals |
|
|
333 | (40) |
|
|
334 | (9) |
|
|
334 | (2) |
|
|
335 | (1) |
|
References to Pointers and Pointers to References |
|
|
336 | (1) |
|
|
336 | (1) |
|
|
336 | (2) |
|
|
337 | (1) |
|
Pass-by-Reference versus Pass-by-Value |
|
|
337 | (1) |
|
|
338 | (1) |
|
|
338 | (1) |
|
Deciding between References and Pointers |
|
|
339 | (4) |
|
|
343 | (8) |
|
|
343 | (4) |
|
const Variables and Parameters |
|
|
343 | (2) |
|
|
345 | (1) |
|
|
346 | (1) |
|
|
347 | (4) |
|
static Data Members and Methods |
|
|
347 | (1) |
|
|
347 | (3) |
|
static Variables in Functions |
|
|
350 | (1) |
|
Order of Initialization of Nonlocal Variables |
|
|
351 | (1) |
|
Order of Destruction of Nonlocal Variables |
|
|
351 | (1) |
|
|
351 | (11) |
|
|
352 | (1) |
|
Type Aliases for Function Pointers |
|
|
353 | (2) |
|
Type Aliases for Pointers to Methods and Data Members |
|
|
355 | (1) |
|
|
356 | (1) |
|
|
357 | (6) |
|
|
357 | (1) |
|
|
358 | (1) |
|
|
359 | (1) |
|
|
360 | (1) |
|
|
361 | (1) |
|
|
362 | (1) |
|
|
363 | (2) |
|
|
363 | (1) |
|
|
364 | (1) |
|
|
364 | (1) |
|
|
364 | (1) |
|
|
365 | (1) |
|
Vendor-Specific Attributes |
|
|
365 | (1) |
|
|
365 | (2) |
|
Standard User-Defined Literals |
|
|
367 | (1) |
|
|
367 | (2) |
|
|
369 | (3) |
|
Variable-Length Argument Lists |
|
|
369 | (2) |
|
|
370 | (1) |
|
Why You Shouldn't Use C-Style Variable-Length Argument Lists |
|
|
371 | (1) |
|
|
371 | (1) |
|
|
372 | (1) |
|
Chapter 12 Writing Generic Code With Templates |
|
|
373 | (36) |
|
|
374 | (1) |
|
|
375 | (25) |
|
|
375 | (8) |
|
|
375 | (3) |
|
|
378 | (4) |
|
|
382 | (1) |
|
|
383 | (1) |
|
How the Compiler Processes Templates |
|
|
383 | (1) |
|
|
384 | (1) |
|
Template Requirements on Types |
|
|
384 | (1) |
|
Distributing Template Code between Files |
|
|
384 | (2) |
|
Template Definitions in Header Files |
|
|
384 | (1) |
|
Template Definitions in Source Files |
|
|
385 | (1) |
|
|
386 | (5) |
|
Non-type Template Parameters |
|
|
387 | (2) |
|
Default Values for Type Parameters |
|
|
389 | (1) |
|
Template Parameter Deduction for Constructors |
|
|
389 | (2) |
|
|
391 | (4) |
|
Method Templates with Non-type Parameters |
|
|
393 | (2) |
|
Class Template Specialization |
|
|
395 | (2) |
|
Deriving from Class Templates |
|
|
397 | (2) |
|
Inheritance versus Specialization |
|
|
399 | (1) |
|
|
399 | (1) |
|
|
400 | (7) |
|
Function Template Specialization |
|
|
401 | (1) |
|
Function Template Overloading |
|
|
402 | (1) |
|
Function Template Overloading and Specialization Together |
|
|
403 | (1) |
|
Friend Function Templates of Class Templates |
|
|
403 | (1) |
|
More on Template Parameter Deduction |
|
|
404 | (1) |
|
Return Type of Function Templates |
|
|
405 | (2) |
|
|
407 | (1) |
|
|
407 | (2) |
|
Chapter 13 Demystifying C++ I/O |
|
|
409 | (24) |
|
|
410 | (15) |
|
What Is a Stream, Anyway? |
|
|
410 | (1) |
|
Stream Sources and Destinations |
|
|
411 | (1) |
|
|
411 | (6) |
|
|
412 | (1) |
|
Methods of Output Streams |
|
|
412 | (2) |
|
|
414 | (1) |
|
|
415 | (2) |
|
|
417 | (6) |
|
|
417 | (1) |
|
|
418 | (1) |
|
|
419 | (4) |
|
|
423 | (1) |
|
Input and Output with Objects |
|
|
423 | (2) |
|
|
425 | (1) |
|
|
426 | (5) |
|
Text Mode versus Binary Mode |
|
|
427 | (1) |
|
Jumping around with seek() and tell() |
|
|
428 | (2) |
|
|
430 | (1) |
|
|
431 | (1) |
|
|
432 | (1) |
|
Chapter 14 Handling Errors |
|
|
433 | (40) |
|
|
434 | (2) |
|
What Are Exceptions, Anyway? |
|
|
434 | (1) |
|
Why Exceptions in C++ Are a Good Thing |
|
|
434 | (2) |
|
|
436 | (1) |
|
|
436 | (10) |
|
Throwing and Catching Exceptions |
|
|
437 | (2) |
|
|
439 | (1) |
|
Catching Exception Objects by const Reference |
|
|
440 | (1) |
|
Throwing and Catching Multiple Exceptions |
|
|
441 | (3) |
|
|
443 | (1) |
|
|
443 | (1) |
|
|
444 | (1) |
|
|
445 | (1) |
|
Throw Lists (Deprecated/Removed) |
|
|
446 | (1) |
|
Exceptions and Polymorphism |
|
|
446 | (8) |
|
The Standard Exception Hierarchy |
|
|
446 | (2) |
|
Catching Exceptions in a Class Hierarchy |
|
|
448 | (1) |
|
Writing Your Own Exception Classes |
|
|
449 | (3) |
|
|
452 | (2) |
|
|
454 | (2) |
|
Stack Unwinding and Cleanup |
|
|
456 | (3) |
|
|
457 | (1) |
|
Catch, Cleanup, and Rethrow |
|
|
458 | (1) |
|
Common Error-Handling Issues |
|
|
459 | (9) |
|
|
459 | (3) |
|
|
460 | (1) |
|
Customizing Memory Allocation Failure Behavior |
|
|
460 | (2) |
|
|
462 | (2) |
|
Function-Try-Blocks for Constructors |
|
|
464 | (3) |
|
|
467 | (1) |
|
|
468 | (4) |
|
|
472 | (1) |
|
Chapter 15 Overloading C++ Operators |
|
|
473 | (34) |
|
Overview of Operator Overloading |
|
|
474 | (9) |
|
|
474 | (1) |
|
Limitations to Operator Overloading |
|
|
474 | (1) |
|
Choices in Operator Overloading |
|
|
475 | (2) |
|
Method or Global Function |
|
|
475 | (1) |
|
|
476 | (1) |
|
|
477 | (1) |
|
|
477 | (1) |
|
Operators You Shouldn't Overload |
|
|
477 | (1) |
|
Summary of Overloadable Operators |
|
|
478 | (3) |
|
|
481 | (1) |
|
|
482 | (1) |
|
Overloading the Arithmetic Operators |
|
|
483 | (1) |
|
Overloading Unary Minus and Unary Plus |
|
|
483 | (1) |
|
Overloading Increment and Decrement |
|
|
483 | (1) |
|
Overloading the Bitwise and Binary Logical Operators |
|
|
484 | (1) |
|
Overloading the Insertion and Extraction Operators |
|
|
485 | (1) |
|
Overloading the Subscripting Operator |
|
|
486 | (5) |
|
Providing Read-Only Access with operator[ ] |
|
|
489 | (1) |
|
Non-integral Array Indices |
|
|
490 | (1) |
|
Overloading the Function Call Operator |
|
|
491 | (1) |
|
Overloading the Dereferencing Operators |
|
|
492 | (4) |
|
|
494 | (1) |
|
|
494 | (1) |
|
What in the World Are operator.* and operator->*? |
|
|
495 | (1) |
|
Writing Conversion Operators |
|
|
496 | (4) |
|
Solving Ambiguity Problems with Explicit Conversion Operators |
|
|
497 | (1) |
|
Conversions for Boolean Expressions |
|
|
498 | (2) |
|
Overloading the Memory Allocation and Deallocation Operators |
|
|
500 | (6) |
|
How new and delete Really Work |
|
|
500 | (1) |
|
The New-Expression and operator new |
|
|
501 | (1) |
|
The Delete-Expression and operator delete |
|
|
501 | (1) |
|
Overloading operator new and operator delete |
|
|
501 | (3) |
|
Explicitly Deleting/Defaulting operator new and operator delete |
|
|
504 | (1) |
|
Overloading operator new and operator delete with Extra Parameters |
|
|
504 | (1) |
|
Overloading operator delete with Size of Memory as Parameter |
|
|
505 | (1) |
|
|
506 | (1) |
|
Chapter 16 Overview Of The C++ Standard Library |
|
|
507 | (28) |
|
|
508 | (1) |
|
|
508 | (1) |
|
Use of Operator Overloading |
|
|
509 | (1) |
|
Overview of the C++ Standard Library |
|
|
509 | (24) |
|
|
509 | (1) |
|
|
510 | (1) |
|
|
510 | (1) |
|
|
510 | (1) |
|
|
510 | (1) |
|
|
511 | (1) |
|
|
512 | (1) |
|
|
512 | (1) |
|
|
512 | (1) |
|
|
512 | (1) |
|
optional, variant, and any |
|
|
512 | (1) |
|
|
513 | (1) |
|
|
513 | (1) |
|
|
513 | (1) |
|
|
513 | (1) |
|
|
514 | (1) |
|
|
514 | (8) |
|
|
514 | (1) |
|
|
515 | (1) |
|
|
515 | (1) |
|
|
516 | (1) |
|
|
516 | (1) |
|
|
516 | (1) |
|
|
516 | (1) |
|
|
517 | (1) |
|
|
517 | (1) |
|
|
518 | (1) |
|
Unordered Associative Containers/Hash Tables |
|
|
518 | (1) |
|
|
519 | (1) |
|
Summary of Standard Library Containers |
|
|
519 | (3) |
|
|
522 | (10) |
|
Non-modifying Sequence Algorithms |
|
|
523 | (2) |
|
Modifying Sequence Algorithms |
|
|
525 | (2) |
|
|
527 | (1) |
|
Swap and Exchange Algorithms |
|
|
527 | (1) |
|
|
527 | (1) |
|
|
528 | (1) |
|
|
529 | (1) |
|
|
529 | (1) |
|
|
529 | (1) |
|
Minimum/Maximum Algorithms |
|
|
530 | (1) |
|
Numerical Processing Algorithms |
|
|
530 | (2) |
|
|
532 | (1) |
|
|
532 | (1) |
|
What's Missing from the Standard Library |
|
|
532 | (1) |
|
|
533 | (2) |
|
Chapter 17 Understanding Containers And Iterators |
|
|
535 | (72) |
|
|
536 | (6) |
|
|
537 | (2) |
|
Exceptions and Error Checking |
|
|
539 | (1) |
|
|
539 | (3) |
|
|
542 | (27) |
|
|
542 | (19) |
|
|
542 | (2) |
|
|
544 | (12) |
|
vector Example: A Round-Robin Class |
|
|
556 | (5) |
|
The vector<bool> Specialization |
|
|
561 | (1) |
|
|
562 | (1) |
|
|
562 | (4) |
|
|
562 | (1) |
|
|
562 | (1) |
|
Adding and Removing Elements |
|
|
563 | (1) |
|
|
563 | (1) |
|
|
563 | (2) |
|
list Example: Determining Enrollment |
|
|
565 | (1) |
|
|
566 | (2) |
|
|
568 | (1) |
|
|
569 | (7) |
|
|
570 | (2) |
|
|
570 | (1) |
|
queue Example: A Network Packet Buffer |
|
|
570 | (2) |
|
|
572 | (3) |
|
priority_queue Operations |
|
|
573 | (1) |
|
priority_queue Example: An Error Correlator |
|
|
573 | (2) |
|
|
575 | (1) |
|
|
575 | (1) |
|
stack Example: Revised Error Correlator |
|
|
575 | (1) |
|
Ordered Associative Containers |
|
|
576 | (15) |
|
|
576 | (1) |
|
|
577 | (8) |
|
|
577 | (1) |
|
|
578 | (2) |
|
|
580 | (1) |
|
|
581 | (1) |
|
|
582 | (1) |
|
|
582 | (1) |
|
map Example: Bank Account |
|
|
583 | (2) |
|
|
585 | (4) |
|
multimap Example: Buddy Lists |
|
|
586 | (3) |
|
|
589 | (1) |
|
set Example: Access Control List |
|
|
589 | (1) |
|
|
590 | (1) |
|
Unordered Associative Containers or Hash Tables |
|
|
591 | (7) |
|
|
591 | (2) |
|
|
593 | (4) |
|
unordered_map Example: Phone Book |
|
|
596 | (1) |
|
|
597 | (1) |
|
unordered_set/unordered_multiset |
|
|
598 | (1) |
|
|
598 | (7) |
|
|
598 | (1) |
|
|
599 | (1) |
|
|
600 | (1) |
|
|
600 | (8) |
|
|
600 | (1) |
|
|
601 | (1) |
|
bitset Example: Representing Cable Channels |
|
|
601 | (4) |
|
|
605 | (2) |
|
Chapter 18 Mastering Standard Library Algorithms |
|
|
607 | (56) |
|
|
608 | (4) |
|
The find and find_if Algorithms |
|
|
608 | (3) |
|
|
611 | (1) |
|
Move Semantics with Algorithms |
|
|
612 | (1) |
|
|
612 | (2) |
|
|
614 | (6) |
|
|
614 | (3) |
|
Generic Lambda Expressions |
|
|
617 | (1) |
|
Lambda Capture Expressions |
|
|
618 | (1) |
|
Lambda Expressions as Return Type |
|
|
618 | (1) |
|
Lambda Expressions as Parameters |
|
|
619 | (1) |
|
Examples with Standard Library Algorithms |
|
|
619 | (1) |
|
|
619 | (1) |
|
|
620 | (1) |
|
|
620 | (10) |
|
Arithmetic Function Objects |
|
|
621 | (1) |
|
Transparent Operator Functors |
|
|
622 | (1) |
|
Comparison Function Objects |
|
|
622 | (1) |
|
|
623 | (1) |
|
|
624 | (1) |
|
|
624 | (5) |
|
|
624 | (2) |
|
|
626 | (2) |
|
|
628 | (1) |
|
|
629 | (1) |
|
Writing Your Own Function Objects |
|
|
629 | (1) |
|
|
630 | (27) |
|
|
631 | (1) |
|
Non-modifying Sequence Algorithms |
|
|
631 | (5) |
|
|
631 | (2) |
|
|
633 | (1) |
|
|
634 | (2) |
|
|
636 | (1) |
|
Modifying Sequence Algorithms |
|
|
636 | (8) |
|
|
637 | (1) |
|
|
638 | (2) |
|
|
640 | (1) |
|
|
641 | (1) |
|
|
641 | (2) |
|
|
643 | (1) |
|
|
643 | (1) |
|
|
644 | (1) |
|
|
644 | (1) |
|
|
644 | (2) |
|
|
644 | (2) |
|
|
646 | (1) |
|
Swap and Exchange Algorithms |
|
|
646 | (1) |
|
|
646 | (1) |
|
|
647 | (1) |
|
|
647 | (2) |
|
|
649 | (1) |
|
|
649 | (1) |
|
|
650 | (3) |
|
Minimum/Maximum Algorithms |
|
|
653 | (2) |
|
|
655 | (1) |
|
Numerical Processing Algorithms |
|
|
655 | (2) |
|
|
656 | (1) |
|
|
656 | (1) |
|
|
656 | (1) |
|
|
656 | (1) |
|
|
657 | (1) |
|
|
657 | (1) |
|
Algorithms Example: Auditing Voter Registrations |
|
|
657 | (4) |
|
The Voter Registration Audit Problem Statement |
|
|
658 | (1) |
|
The auditVoterRolls Function |
|
|
658 | (1) |
|
The getDuplicates Function |
|
|
659 | (1) |
|
Testing the auditVoterRolls Function |
|
|
660 | (1) |
|
|
661 | (2) |
|
Chapter 19 String Localization And Regular Expressions |
|
|
663 | (28) |
|
|
663 | (8) |
|
Localizing String Literals |
|
|
664 | (1) |
|
|
664 | (1) |
|
Non-Western Character Sets |
|
|
665 | (2) |
|
|
667 | (1) |
|
|
668 | (3) |
|
|
668 | (1) |
|
|
669 | (1) |
|
|
670 | (1) |
|
|
670 | (1) |
|
|
671 | (19) |
|
|
672 | (6) |
|
|
673 | (1) |
|
|
673 | (1) |
|
|
673 | (1) |
|
|
673 | (1) |
|
|
673 | (1) |
|
|
674 | (1) |
|
|
674 | (2) |
|
|
676 | (1) |
|
|
677 | (1) |
|
|
677 | (1) |
|
Regular Expressions and Raw String Literals |
|
|
677 | (1) |
|
|
678 | (1) |
|
|
679 | (3) |
|
|
680 | (2) |
|
|
682 | (1) |
|
|
683 | (1) |
|
|
683 | (2) |
|
|
684 | (1) |
|
|
685 | (2) |
|
regex_token_iterator Examples |
|
|
685 | (2) |
|
|
687 | (7) |
|
|
688 | (2) |
|
|
690 | (1) |
|
Chapter 20 Additional Library Utilities |
|
|
691 | (36) |
|
|
691 | (3) |
|
|
694 | (8) |
|
|
694 | (4) |
|
|
698 | (2) |
|
|
700 | (2) |
|
|
702 | (9) |
|
|
703 | (2) |
|
Random Number Engine Adaptors |
|
|
705 | (1) |
|
Predefined Engines and Engine Adaptors |
|
|
705 | (1) |
|
Generating Random Numbers |
|
|
706 | (2) |
|
Random Number Distributions |
|
|
708 | (3) |
|
|
711 | (1) |
|
|
712 | (1) |
|
|
713 | (1) |
|
|
714 | (6) |
|
|
717 | (1) |
|
|
717 | (1) |
|
|
717 | (1) |
|
|
718 | (1) |
|
|
718 | (1) |
|
|
719 | (1) |
|
|
719 | (1) |
|
Filesystem Support Library |
|
|
720 | (3) |
|
|
720 | (1) |
|
|
721 | (1) |
|
|
721 | (1) |
|
|
722 | (1) |
|
|
723 | (4) |
Part IV: Mastering Advanced Features Of C++ |
|
|
Chapter 21 Customizing And Extending The Standard Library |
|
|
727 | (48) |
|
|
728 | (1) |
|
|
729 | (1) |
|
|
729 | (1) |
|
|
730 | (1) |
|
|
730 | (5) |
|
|
730 | (1) |
|
|
731 | (2) |
|
|
733 | (2) |
|
Extending the Standard Library |
|
|
735 | (38) |
|
Why Extend the Standard Library? |
|
|
735 | (1) |
|
Writing a Standard Library Algorithm |
|
|
735 | (2) |
|
|
735 | (2) |
|
|
737 | (1) |
|
Writing a Standard Library Container |
|
|
737 | (39) |
|
|
738 | (9) |
|
Making hash_map a Standard Library Container |
|
|
747 | (13) |
|
|
760 | (1) |
|
Note on Reversible Containers |
|
|
760 | (1) |
|
Making hash_map an Unordered Associative Container |
|
|
760 | (13) |
|
Note on Sequential Containers |
|
|
773 | (1) |
|
|
773 | (2) |
|
Chapter 22 Advanced Templates |
|
|
775 | (38) |
|
More about Template Parameters |
|
|
776 | (6) |
|
More about Template Type Parameters |
|
|
776 | (2) |
|
Introducing Template Template Parameters |
|
|
778 | (2) |
|
More about Non-type Template Parameters |
|
|
780 | (2) |
|
Class Template Partial Specialization |
|
|
782 | (4) |
|
Emulating Function Partial Specialization with Overloading |
|
|
786 | (1) |
|
|
787 | (5) |
|
An N-Dimensional Grid: First Attempt |
|
|
788 | (1) |
|
A Real N-Dimensional Grid |
|
|
789 | (3) |
|
|
792 | (5) |
|
Type-Safe Variable-Length Argument Lists |
|
|
792 | (3) |
|
Variable Number of Mixin Classes |
|
|
795 | (1) |
|
|
796 | (1) |
|
|
797 | (15) |
|
Factorial at Compile Time |
|
|
798 | (1) |
|
|
799 | (1) |
|
|
800 | (3) |
|
|
802 | (1) |
|
Using a Compile-Time Integer Sequence with Folding |
|
|
803 | (1) |
|
|
803 | (8) |
|
|
805 | (2) |
|
|
807 | (1) |
|
|
808 | (2) |
|
Using constexpr if to Simplify enable_if Constructs |
|
|
810 | (1) |
|
|
811 | (1) |
|
Metaprogramming Conclusion |
|
|
811 | (1) |
|
|
812 | (1) |
|
Chapter 23 Multithreaded Programming With C++ |
|
|
813 | (46) |
|
|
814 | (5) |
|
|
815 | (2) |
|
|
817 | (1) |
|
|
817 | (1) |
|
|
818 | (1) |
|
|
819 | (8) |
|
Thread with Function Pointer |
|
|
819 | (1) |
|
Thread with Function Object |
|
|
820 | (2) |
|
|
822 | (1) |
|
Thread with Member Function |
|
|
823 | (1) |
|
|
823 | (1) |
|
|
824 | (1) |
|
Retrieving Results from Threads |
|
|
824 | (1) |
|
Copying and Rethrowing Exceptions |
|
|
824 | (3) |
|
Atomic Operations Library |
|
|
827 | (4) |
|
|
828 | (2) |
|
|
830 | (1) |
|
|
831 | (9) |
|
|
831 | (2) |
|
|
832 | (1) |
|
|
832 | (1) |
|
|
833 | (3) |
|
|
833 | (1) |
|
|
834 | (1) |
|
|
835 | (1) |
|
Acquiring Multiple Locks at Once |
|
|
835 | (1) |
|
|
835 | (1) |
|
|
836 | (1) |
|
Examples Using Mutual Exclusion Objects |
|
|
837 | (3) |
|
Thread-Safe Writing to Streams |
|
|
837 | (1) |
|
|
838 | (1) |
|
|
839 | (1) |
|
|
840 | (3) |
|
|
841 | (1) |
|
Using Condition Variables |
|
|
841 | (2) |
|
|
843 | (5) |
|
std::promise and std::future |
|
|
843 | (1) |
|
|
844 | (1) |
|
|
845 | (1) |
|
|
846 | (1) |
|
|
847 | (1) |
|
Example: Multithreaded Logger Class |
|
|
848 | (5) |
|
|
853 | (1) |
|
Threading Design and Best Practices |
|
|
853 | (2) |
|
|
855 | (4) |
Part V: C++ Software Engineering |
|
|
Chapter 24 Maximizing Software Engineering Methods |
|
|
859 | (22) |
|
|
860 | (1) |
|
Software Life Cycle Models |
|
|
861 | (6) |
|
|
861 | (2) |
|
Benefits of the Waterfall Model |
|
|
862 | (1) |
|
Drawbacks of the Waterfall Model |
|
|
862 | (1) |
|
|
863 | (1) |
|
|
863 | (3) |
|
Benefits of a Spiral-Like Model |
|
|
864 | (2) |
|
Drawbacks of a Spiral-Like Model |
|
|
866 | (1) |
|
|
866 | (1) |
|
Software Engineering Methodologies |
|
|
867 | (10) |
|
|
867 | (1) |
|
The Rational Unified Process |
|
|
868 | (1) |
|
|
868 | (1) |
|
|
869 | (1) |
|
|
869 | (1) |
|
|
869 | (3) |
|
|
870 | (1) |
|
|
870 | (1) |
|
|
871 | (1) |
|
|
872 | (1) |
|
|
872 | (4) |
|
|
872 | (4) |
|
|
876 | (1) |
|
|
876 | (1) |
|
Building Your Own Process and Methodology |
|
|
877 | (1) |
|
|
877 | (1) |
|
Bring New Ideas to the Table |
|
|
877 | (1) |
|
Recognize What Works and What Doesn't Work |
|
|
877 | (1) |
|
|
878 | (1) |
|
|
878 | (2) |
|
|
880 | (1) |
|
Chapter 25 Writing Efficient C++ |
|
|
881 | (28) |
|
Overview of Performance and Efficiency |
|
|
882 | (1) |
|
Two Approaches to Efficiency |
|
|
882 | (1) |
|
|
882 | (1) |
|
Is C++ an Inefficient Language? |
|
|
882 | (1) |
|
Language-Level Efficiency |
|
|
883 | (6) |
|
Handle Objects Efficiently |
|
|
884 | (4) |
|
|
884 | (2) |
|
|
886 | (1) |
|
Catch Exceptions by Reference |
|
|
886 | (1) |
|
|
886 | (1) |
|
Avoid Creating Temporary Objects |
|
|
886 | (1) |
|
The Return-Value Optimization |
|
|
887 | (1) |
|
|
888 | (1) |
|
Use Inline Methods and Functions |
|
|
888 | (1) |
|
|
889 | (5) |
|
|
889 | (1) |
|
|
890 | (4) |
|
An Object Pool Implementation |
|
|
891 | (2) |
|
|
893 | (1) |
|
|
894 | (13) |
|
Profiling Example with gprof |
|
|
895 | (7) |
|
|
895 | (3) |
|
Profiling the First Design Attempt |
|
|
898 | (2) |
|
|
900 | (1) |
|
Profiling the Second Design Attempt |
|
|
901 | (1) |
|
Profiling Example with Visual C++ 2017 |
|
|
902 | (5) |
|
|
907 | (2) |
|
Chapter 26 Becoming Adept At Testing |
|
|
909 | (24) |
|
|
910 | (3) |
|
Whose Responsibility Is Testing? |
|
|
910 | (1) |
|
|
910 | (2) |
|
|
912 | (1) |
|
|
913 | (14) |
|
Approaches to Unit Testing |
|
|
914 | (1) |
|
|
915 | (4) |
|
Define the Granularity of Your Tests |
|
|
915 | (2) |
|
Brainstorm the Individual Tests |
|
|
917 | (1) |
|
Create Sample Data and Results |
|
|
918 | (1) |
|
|
918 | (1) |
|
|
919 | (1) |
|
|
919 | (8) |
|
Introducing the Microsoft Visual C++ Testing Framework |
|
|
920 | (1) |
|
|
921 | (1) |
|
Building and Running Tests |
|
|
922 | (1) |
|
|
923 | (1) |
|
|
923 | (4) |
|
|
927 | (1) |
|
Basking in the Glorious Light of Unit Test Results |
|
|
927 | (1) |
|
|
927 | (3) |
|
|
928 | (1) |
|
|
928 | (1) |
|
Methods of Integration Testing |
|
|
929 | (1) |
|
|
929 | (1) |
|
|
930 | (1) |
|
Tips for Successful Testing |
|
|
930 | (1) |
|
|
931 | (2) |
|
Chapter 27 Conquering Debugging |
|
|
933 | (38) |
|
The Fundamental Law of Debugging |
|
|
934 | (1) |
|
|
934 | (1) |
|
|
934 | (1) |
|
|
935 | (12) |
|
|
935 | (2) |
|
|
937 | (8) |
|
|
937 | (5) |
|
|
942 | (3) |
|
|
945 | (1) |
|
|
946 | (1) |
|
|
947 | (1) |
|
|
948 | (21) |
|
|
948 | (1) |
|
Debugging Reproducible Bugs |
|
|
949 | (1) |
|
Debugging Nonreproducible Bugs |
|
|
950 | (1) |
|
|
951 | (1) |
|
Debugging Memory Problems |
|
|
951 | (5) |
|
Categories of Memory Errors |
|
|
952 | (2) |
|
Tips for Debugging Memory Errors |
|
|
954 | (2) |
|
Debugging Multithreaded Programs |
|
|
956 | (1) |
|
Debugging Example: Article Citations |
|
|
957 | (12) |
|
Buggy Implementation of an ArticleCitations Class |
|
|
957 | (3) |
|
Testing the ArticleCitations class |
|
|
960 | (9) |
|
Lessons from the ArticleCitations Example |
|
|
969 | (1) |
|
|
969 | (2) |
|
Chapter 28 Incorporating Design Techniques And Frameworks |
|
|
971 | (20) |
|
"I Can Never Remember How to..." |
|
|
972 | (7) |
|
|
972 | (2) |
|
...Derive from an Existing Class |
|
|
974 | (1) |
|
...Use the Copy-and-Swap Idiom |
|
|
975 | (1) |
|
...Throw and Catch Exceptions |
|
|
976 | (1) |
|
|
976 | (1) |
|
|
977 | (1) |
|
...Write a Template Class |
|
|
977 | (2) |
|
There Must Be a Better Way |
|
|
979 | (9) |
|
Resource Acquisition Is Initialization |
|
|
979 | (2) |
|
|
981 | (4) |
|
|
982 | (1) |
|
Attempt #2: Single Polymorphism with Overloading |
|
|
983 | (1) |
|
Attempt #3: Double Dispatch |
|
|
984 | (1) |
|
|
985 | (3) |
|
|
986 | (1) |
|
Implementing a Mixin Class |
|
|
987 | (1) |
|
|
988 | (1) |
|
Object-Oriented Frameworks |
|
|
988 | (2) |
|
|
988 | (1) |
|
The Model-View-Controller Paradigm |
|
|
989 | (1) |
|
|
990 | (1) |
|
Chapter 29 Applying Design Patterns |
|
|
991 | (26) |
|
|
992 | (1) |
|
|
993 | (4) |
|
Example: A Logging Mechanism |
|
|
993 | (1) |
|
Implementation of a Singleton |
|
|
994 | (3) |
|
|
997 | (1) |
|
The Abstract Factory Pattern |
|
|
997 | (7) |
|
Example: A Car Factory Simulation |
|
|
998 | (1) |
|
Implementation of a Factory |
|
|
999 | (3) |
|
|
1002 | (1) |
|
|
1003 | (1) |
|
|
1004 | (2) |
|
Example: Hiding Network Connectivity Issues |
|
|
1004 | (1) |
|
Implementation of a Proxy |
|
|
1004 | (1) |
|
|
1005 | (1) |
|
|
1006 | (2) |
|
Example: Adapting a Logger Class |
|
|
1006 | (1) |
|
Implementation of an Adaptor |
|
|
1007 | (1) |
|
|
1008 | (1) |
|
|
1008 | (2) |
|
Example: Defining Styles in Web Pages |
|
|
1008 | (1) |
|
Implementation of a Decorator |
|
|
1009 | (1) |
|
|
1010 | (1) |
|
The Chain of Responsibility Pattern |
|
|
1010 | (4) |
|
|
1011 | (1) |
|
Implementation of a Chain of Responsibility |
|
|
1011 | (1) |
|
Chain of Responsibility without Hierarchy |
|
|
1012 | (2) |
|
|
1014 | (2) |
|
Implementation of an Observer |
|
|
1014 | (1) |
|
Implementation of an Observable |
|
|
1015 | (1) |
|
|
1016 | (1) |
|
|
1016 | (1) |
|
Chapter 30 Developing Cross-Platform And Cross-Language Applications |
|
|
1017 | |
|
Cross-Platform Development |
|
|
1018 | (6) |
|
|
1018 | (3) |
|
|
1018 | (1) |
|
|
1019 | (1) |
|
|
1020 | (1) |
|
|
1020 | (1) |
|
|
1021 | (1) |
|
Compiler Quirks and Extensions |
|
|
1021 | (1) |
|
|
1022 | (1) |
|
Platform Specific Features |
|
|
1022 | (2) |
|
Cross-Language Development |
|
|
1024 | (14) |
|
|
1024 | (1) |
|
|
1024 | (4) |
|
|
1028 | (2) |
|
|
1030 | (1) |
|
Calling C++ Code from Java with JNI |
|
|
1031 | (2) |
|
Calling Scripts from C++ Code |
|
|
1033 | (1) |
|
Calling C++ Code from Scripts |
|
|
1034 | (2) |
|
A Practical Example: Encrypting Passwords |
|
|
1034 | (2) |
|
Calling Assembly Code from C++ |
|
|
1036 | (2) |
|
|
1038 | (1) |
Appendix A: C++ Interviews |
|
1039 | (24) |
Appendix B: Annotated Bibliography |
|
1063 | (12) |
Appendix C: Standard Library Header Files |
|
1075 | (8) |
Appendix D: Introduction To UML |
|
1083 | (4) |
Index |
|
1087 | |
9781119390640 |
|
Introduction |
|
xxix | |
Part I: Introduction to Windows Security Monitoring |
|
1 | (10) |
|
Chapter 1 Windows Security Logging and Monitoring Policy |
|
|
3 | (8) |
|
|
3 | (4) |
|
|
4 | (3) |
|
|
5 | (1) |
|
|
5 | (1) |
|
Availability and Protection |
|
|
5 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
6 | (1) |
|
|
7 | (1) |
|
|
7 | (1) |
|
|
7 | (6) |
|
|
8 | (1) |
|
Audit Tool and Technologies |
|
|
8 | (1) |
|
Network Intrusion Detection Systems |
|
|
8 | (1) |
|
Host-based Intrusion Detection Systems |
|
|
8 | (1) |
|
|
9 | (1) |
|
|
9 | (2) |
Part II: Windows Auditing Subsystem |
|
11 | (70) |
|
Chapter 2 Auditing Subsystem Architecture |
|
|
13 | (34) |
|
|
13 | (9) |
|
Advanced Auditing Settings |
|
|
16 | (2) |
|
Set Advanced Audit Settings via Local Group Policy |
|
|
18 | (1) |
|
Set Advanced Audit Settings via Domain Group Policy |
|
|
19 | (1) |
|
Set Advanced Audit Settings in the Local Security Authority (LSA) Policy Database |
|
|
19 | (1) |
|
Read Current LSA Policy Database Advanced Audit Policy Settings |
|
|
20 | (1) |
|
Advanced Audit Policies Enforcement and Legacy Policies Rollback |
|
|
20 | (2) |
|
Switch from Advanced Audit Settings to Legacy Settings |
|
|
21 | (1) |
|
Switch from Legacy Audit Settings to Advanced Settings |
|
|
22 | (1) |
|
Windows Auditing Group Policy Settings |
|
|
22 | (11) |
|
Manage Auditing and Security Log |
|
|
22 | (1) |
|
|
23 | (1) |
|
Security Auditing Policy Security Descriptor |
|
|
23 | (1) |
|
Group Policy: "Audit: Shut Down System Immediately If Unable to Log Security Audits" |
|
|
24 | (1) |
|
Group Policy: Protected Event Logging |
|
|
25 | (1) |
|
Group Policy: "Audit: Audit the Use of Backup and Restore Privilege" |
|
|
25 | (1) |
|
Group Policy: "Audit: Audit the Access of Global System Objects" |
|
|
26 | (1) |
|
Audit the Access of Global System Container Objects |
|
|
26 | (1) |
|
Windows Event Log Service: Security Event Log Settings |
|
|
27 | (6) |
|
Changing the Maximum Security Event Log File Size |
|
|
28 | (1) |
|
Group Policy: Control Event Log Behavior When the Log File Reaches Its Maximum Size |
|
|
29 | (1) |
|
Group Policy: Back Up Log Automatically When Full |
|
|
29 | (1) |
|
Group Policy: Control the Location of the Log File |
|
|
30 | (1) |
|
Security Event Log Security Descriptor |
|
|
31 | (2) |
|
Guest and Anonymous Access to the Security Event Log |
|
|
33 | (1) |
|
Windows Auditing Architecture |
|
|
33 | (5) |
|
Windows Auditing Policy Flow |
|
|
34 | (2) |
|
LsaSetlnformationPolicy and LsaQuerylnformationPolicy Functions Route |
|
|
35 | (1) |
|
Windows Auditing Event Flow |
|
|
36 | (11) |
|
LSASS.EXE Security Event Flow |
|
|
37 | (1) |
|
NTOSKRNL.EXE Security Event Flow |
|
|
37 | (1) |
|
|
38 | (9) |
|
Chapter 3 Auditing Subcategories and Recommendations |
|
|
47 | (34) |
|
|
47 | (7) |
|
Audit Credential Validation |
|
|
47 | (3) |
|
Audit Kerberos Authentication Service |
|
|
50 | (3) |
|
Audit Kerberos Service Ticket Operations |
|
|
53 | (1) |
|
Audit Other Account Logon Events |
|
|
54 | (1) |
|
|
54 | (4) |
|
Audit Application Group Management |
|
|
54 | (1) |
|
Audit Computer Account Management |
|
|
54 | (1) |
|
Audit Distribution Group Management |
|
|
55 | (1) |
|
Audit Other Account Management Events |
|
|
56 | (1) |
|
Audit Security Group Management |
|
|
57 | (1) |
|
Audit User Account Management |
|
|
57 | (1) |
|
|
58 | (2) |
|
|
58 | (1) |
|
|
58 | (1) |
|
|
58 | (1) |
|
Audit Process Termination |
|
|
59 | (1) |
|
|
59 | (1) |
|
|
60 | (1) |
|
Audit Detailed Directory Service Replication |
|
|
60 | (1) |
|
Audit Directory Service Access |
|
|
60 | (1) |
|
Audit Directory Service Changes |
|
|
61 | (1) |
|
Audit Directory Service Replication |
|
|
61 | (1) |
|
|
61 | (5) |
|
|
61 | (1) |
|
|
62 | (1) |
|
|
62 | (1) |
|
Audit IPsec Extended Mode/Audit IPsec Main Mode/Audit IPsec Quick Mode |
|
|
63 | (1) |
|
|
63 | (1) |
|
|
64 | (1) |
|
Audit Network Policy Server |
|
|
65 | (1) |
|
Audit Other Logon/Logoff Events |
|
|
65 | (1) |
|
|
66 | (1) |
|
|
66 | (7) |
|
Audit Application Generated |
|
|
67 | (1) |
|
Audit Certification Services |
|
|
67 | (1) |
|
Audit Detailed File Share |
|
|
67 | (1) |
|
|
67 | (1) |
|
|
68 | (1) |
|
Audit Filtering Platform Connection |
|
|
68 | (1) |
|
Audit Filtering Platform Packet Drop |
|
|
69 | (1) |
|
Audit Handle Manipulation |
|
|
69 | (1) |
|
|
70 | (1) |
|
Audit Other Object Access Events |
|
|
71 | (1) |
|
|
71 | (1) |
|
|
72 | (1) |
|
|
72 | (1) |
|
Audit Central Policy Staging |
|
|
73 | (1) |
|
|
73 | (3) |
|
|
73 | (1) |
|
Audit Authentication Policy Change |
|
|
74 | (1) |
|
Audit Authorization Policy Change |
|
|
74 | (1) |
|
Audit Filtering Platform Policy Change |
|
|
75 | (1) |
|
Audit MPSSVC Rule-Level Policy Change |
|
|
75 | (1) |
|
Audit Other Policy Change Events |
|
|
75 | (1) |
|
|
76 | (1) |
|
Audit Non Sensitive Privilege Use |
|
|
76 | (1) |
|
Audit Other Privilege Use Events |
|
|
77 | (1) |
|
Audit Sensitive Privilege Use |
|
|
77 | (1) |
|
|
77 | (6) |
|
|
78 | (1) |
|
Audit Other System Events |
|
|
78 | (1) |
|
Audit Security State Change |
|
|
78 | (1) |
|
Audit Security System Extension |
|
|
79 | (1) |
|
|
79 | (2) |
Part III: Security Monitoring Scenarios |
|
81 | (504) |
|
|
83 | (58) |
|
|
85 | (27) |
|
Successful Local User Account Interactive Logon |
|
|
85 | (21) |
|
Step 1: Winlogon Process Initialization |
|
|
85 | (2) |
|
Step 1: LSASS Initialization |
|
|
87 | (1) |
|
Step 2: Local System Account Logon |
|
|
88 | (4) |
|
Step 3: ALPC Communications between Winlogon |
|
|
|
|
92 | (1) |
|
Step 4: Secure Desktop and SAS |
|
|
92 | (1) |
|
Step 5: Authentication Data Gathering |
|
|
92 | (2) |
|
Step 6: Send Credentials from Winlogon to LSASS |
|
|
94 | (1) |
|
Step 7: LSA Server Credentials Flow |
|
|
95 | (1) |
|
Step 8: Local User Scenario |
|
|
96 | (3) |
|
Step 9: Local User Logon: MSV1_0 Answer |
|
|
99 | (5) |
|
Step 10: User Logon Rights Verification |
|
|
104 | (1) |
|
Step 11: Security Token Generation |
|
|
105 | (1) |
|
|
105 | (1) |
|
Step 13: LSASS Replies to Winlogon |
|
|
105 | (1) |
|
Step 14: Userinit and Explorer.exe |
|
|
105 | (1) |
|
Unsuccessful Local User Account Interactive Logon |
|
|
106 | (6) |
|
Successful Domain User Account Interactive Logon |
|
|
110 | (1) |
|
Steps 1-7: User Logon Process |
|
|
110 | (1) |
|
Step 8: Authentication Package Negotiation |
|
|
110 | (1) |
|
|
111 | (1) |
|
Step 10: Credentials Validation on the Domain Controller |
|
|
112 | (1) |
|
Steps 11-16: Logon Process |
|
|
112 | (1) |
|
Unsuccessful Domain User Account Interactive Logon |
|
|
112 | (1) |
|
|
112 | (6) |
|
Successful User Account RemoteInteractive Logon |
|
|
112 | (2) |
|
Successful User Account RemoteInteractive Logon Using Cached Credentials |
|
|
114 | (1) |
|
Unsuccessful User Account RemoteInteractive Logon-NLA Enabled |
|
|
115 | (2) |
|
Unsuccessful User Account RemoteInteractive Logon-NLA Disabled |
|
|
117 | (1) |
|
|
118 | (5) |
|
Successful User Account Network Logon |
|
|
118 | (2) |
|
Unsuccessful User Account Network Logon |
|
|
120 | (3) |
|
Unsuccessful User Account Network Logon-NTLM |
|
|
121 | (1) |
|
Unsuccessful User Account Network Logon-Kerberos |
|
|
122 | (1) |
|
|
123 | (4) |
|
Successful Service/Batch Logon |
|
|
123 | (2) |
|
Unsuccessful Service/Batch Logon |
|
|
125 | (2) |
|
|
127 | (2) |
|
Successful User Account NetworkCleartext Logon -IIS Basic Authentication |
|
|
127 | (2) |
|
Unsuccessful User Account NetworkCleartext Logon -IIS Basic Authentication |
|
|
129 | (1) |
|
|
129 | (4) |
|
Interactive and RemoteInteractive Session Lock Operations and Unlock Logon Type |
|
|
132 | (1) |
|
Account Logoff and Session Disconnect |
|
|
133 | (2) |
|
Terminal Session Disconnect |
|
|
134 | (1) |
|
|
135 | (1) |
|
|
136 | (5) |
|
Default ANONYMOUS LOGON Logon Session |
|
|
136 | (2) |
|
Explicit Use of Anonymous Credentials |
|
|
138 | (1) |
|
Use of Account That Has No Network Credentials |
|
|
139 | (1) |
|
Computer Account Activity from Non-Domain-Joined Machine |
|
|
139 | (1) |
|
Allow Local System to Use Computer Identity for NTLM |
|
|
140 | (1) |
|
Chapter 5 Local User Accounts |
|
|
141 | (60) |
|
Built-in Local User Accounts |
|
|
142 | (4) |
|
|
142 | (2) |
|
|
144 | (1) |
|
|
145 | (1) |
|
|
145 | (1) |
|
|
146 | (1) |
|
Built-in Local User Accounts Monitoring Scenarios |
|
|
146 | (55) |
|
New Local User Account Creation |
|
|
146 | (22) |
|
Successful Local User Account Creation |
|
|
147 | (17) |
|
Unsuccessful Local User Account Creation: Access Denied |
|
|
164 | (1) |
|
Unsuccessful Local User Account Creation: Other |
|
|
165 | (1) |
|
Monitoring Scenarios: Local User Account Creation |
|
|
166 | (2) |
|
Local User Account Deletion |
|
|
168 | (9) |
|
Successful Local User Account Deletion |
|
|
169 | (4) |
|
Unsuccessful Local User Account Deletion-Access Denied |
|
|
173 | (2) |
|
Unsuccessful Local User Account Deletion-Other |
|
|
175 | (1) |
|
Monitoring Scenarios: Local User Account Deletion |
|
|
176 | (1) |
|
Local User Account Password Modification |
|
|
177 | (7) |
|
Successful Local User Account Password Reset |
|
|
178 | (1) |
|
Unsuccessful Local User Account Password Reset-Access Denied |
|
|
179 | (1) |
|
Unsuccessful Local User Account Password Reset-Other |
|
|
180 | (1) |
|
Monitoring Scenarios: Password Reset |
|
|
181 | (1) |
|
Successful Local User Account Password Change |
|
|
182 | (1) |
|
Unsuccessful Local User Account Password Change |
|
|
183 | (1) |
|
Monitoring Scenarios: Password Change |
|
|
184 | (1) |
|
Local User Account Enabled/Disabled |
|
|
184 | (3) |
|
Local User Account Was Enabled |
|
|
184 | (2) |
|
Local User Account Was Disabled |
|
|
186 | (1) |
|
Monitoring Scenarios: Account Enabled/Disabled |
|
|
186 | (1) |
|
Local User Account Lockout Events |
|
|
187 | (4) |
|
Local User Account Lockout |
|
|
188 | (1) |
|
Local User Account Unlock |
|
|
190 | (1) |
|
Monitoring Scenarios: Account Enabled/Disabled |
|
|
191 | (1) |
|
Local User Account Change Events |
|
|
191 | (12) |
|
Local User Account Change Event |
|
|
192 | (4) |
|
Local User Account Name Change Event |
|
|
196 | (2) |
|
Monitoring Scenarios: Account Changes |
|
|
198 | (1) |
|
Blank Password Existence Validation |
|
|
199 | (2) |
|
Chapter 6 Local Security Groups |
|
|
201 | (36) |
|
Built-in Local Security Groups |
|
|
203 | (8) |
|
Access Control Assistance Operators |
|
|
205 | (1) |
|
|
205 | (1) |
|
|
205 | (1) |
|
Certificate Service DCOM Access |
|
|
205 | (1) |
|
|
205 | (1) |
|
|
206 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
207 | (1) |
|
|
208 | (1) |
|
Network Configuration Operators |
|
|
208 | (1) |
|
|
209 | (1) |
|
Performance Monitor Users |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
209 | (1) |
|
|
210 | (1) |
|
|
210 | (1) |
|
Storage Replica Administrators |
|
|
210 | (1) |
|
System Managed Accounts Group |
|
|
210 | (1) |
|
|
210 | (1) |
|
|
211 | (1) |
|
Built-in Local Security Groups Monitoring Scenarios |
|
|
211 | (26) |
|
Local Security Group Creation |
|
|
212 | (6) |
|
Successful Local Security Group Creation |
|
|
212 | (5) |
|
Unsuccessful Local Security Group Creation-Access Denied |
|
|
217 | (1) |
|
Monitoring Scenarios: Local Security Group Creation |
|
|
218 | (1) |
|
Local Security Group Deletion |
|
|
218 | (5) |
|
Successful Local Security Group Deletion |
|
|
219 | (2) |
|
Unsuccessful Local Security Group Deletion-Access Denied |
|
|
221 | (1) |
|
Unsuccessful Local Security Group Deletion-Other |
|
|
222 | (1) |
|
Monitoring Scenarios: Local Security Group Deletion |
|
|
223 | (1) |
|
Local Security Group Change |
|
|
223 | (4) |
|
Successful Local Security Group Change |
|
|
224 | (2) |
|
Unsuccessful Local Security Group Change-Access Denied |
|
|
226 | (1) |
|
Monitoring Scenarios: Local Security Group Change |
|
|
227 | (1) |
|
Local Security Group Membership Operations |
|
|
227 | (7) |
|
Successful New Local Group Member Add Operation |
|
|
228 | (3) |
|
Successful Local Group Member Remove Operation |
|
|
231 | (1) |
|
Unsuccessful Local Group Member Remove/Add Operation-Access Denied |
|
|
232 | (1) |
|
Monitoring Scenarios: Local Security Group Members Changes |
|
|
233 | (1) |
|
Local Security Group Membership Enumeration |
|
|
234 | (3) |
|
Monitoring Scenarios: Local Security Group Membership Enumeration |
|
|
235 | (2) |
|
Chapter 7 Microsoft Active Directory |
|
|
237 | (48) |
|
Active Directory Built-in Security Groups |
|
|
237 | (6) |
|
|
238 | (1) |
|
|
238 | (1) |
|
Incoming Forest Trust Builders |
|
|
238 | (1) |
|
Pre-Windows 2000 Compatible Access |
|
|
238 | (1) |
|
|
239 | (1) |
|
Terminal Serves License Servers |
|
|
239 | (1) |
|
Windows Authorization Access |
|
|
239 | (1) |
|
Allowed RODC Password Replication Group |
|
|
240 | (1) |
|
Denied RODC Password Replication Group |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
240 | (1) |
|
|
241 | (1) |
|
Cloneable Domain Controllers |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
241 | (1) |
|
|
242 | (1) |
|
|
242 | (1) |
|
Group Policy Creator Owners |
|
|
242 | (1) |
|
|
242 | (1) |
|
Read-Only Domain Controllers |
|
|
242 | (1) |
|
Enterprise Read-Only Domain Controllers |
|
|
242 | (1) |
|
|
243 | (1) |
|
|
243 | (1) |
|
Built-in Active Directory Accounts |
|
|
243 | (2) |
|
|
243 | (1) |
|
|
244 | (1) |
|
Directory Services Restore Mode (DSRM) Account |
|
|
244 | (1) |
|
Active Directory Accounts Operations |
|
|
245 | (14) |
|
Active Directory User Accounts Operations |
|
|
245 | (8) |
|
Successful Active Directory User Creation |
|
|
245 | (5) |
|
Unsuccessful Active Directory User Creation |
|
|
250 | (1) |
|
Successful Active Directory User Deletion |
|
|
251 | (1) |
|
Unsuccessful Active Directory User Deletion |
|
|
252 | (1) |
|
Other Active Directory User Account Operations |
|
|
252 | (1) |
|
Successful Active Directory User SID History Addition |
|
|
252 | (1) |
|
Active Directory Computer Account Operations |
|
|
253 | (6) |
|
Successful Computer Account Creation-Joining a Domain |
|
|
253 | (2) |
|
Successful Computer Account Creation-Manual Creation |
|
|
255 | (1) |
|
Unsuccessful Computer Account Creation |
|
|
256 | (1) |
|
Successful Computer Account Deletion |
|
|
257 | (1) |
|
Unsuccessful Computer Account Deletion |
|
|
257 | (1) |
|
Successful Computer Account Modification |
|
|
257 | (2) |
|
Unsuccessful Computer Account Modification |
|
|
259 | (1) |
|
Active Directory Group Operations |
|
|
259 | (8) |
|
Active Directory Group Creation |
|
|
260 | (1) |
|
Active Directory Group Deletion |
|
|
261 | (1) |
|
Active Directory Group Modification |
|
|
262 | (1) |
|
Active Directory Group New Member Added |
|
|
263 | (2) |
|
Active Directory Group Member Removed |
|
|
265 | (1) |
|
Group Type and Scope Type Changes |
|
|
266 | (1) |
|
Active Directory Trust Operations |
|
|
267 | (12) |
|
Active Directory Trust Creation Operations |
|
|
267 | (5) |
|
Active Directory Trust Modification Operations |
|
|
272 | (1) |
|
Active Directory Trust Deletion Operations |
|
|
273 | (1) |
|
Operations with Forest Trust Records |
|
|
274 | (5) |
|
Active Directory Forest Trust Record Creation Operations |
|
|
274 | (3) |
|
Active Directory Forest Trust Record Modification Operations |
|
|
277 | (1) |
|
Active Directory Forest Trust Record Remove Operations |
|
|
278 | (1) |
|
|
279 | (3) |
|
Password and Account Lockout Policies |
|
|
279 | (1) |
|
|
280 | (2) |
|
Account Password Migration |
|
|
282 | (3) |
|
Chapter 8 Active Directory Objects |
|
|
285 | (38) |
|
Active Directory Object SACL |
|
|
286 | (18) |
|
Child Object Creation and Deletion Permissions |
|
|
291 | (1) |
|
|
292 | (2) |
|
|
294 | (1) |
|
|
295 | (1) |
|
|
296 | (8) |
|
Active Directory Object Change Auditing |
|
|
304 | (9) |
|
Active Directory Object Creation |
|
|
305 | (1) |
|
Active Directory Object Deletion |
|
|
306 | (1) |
|
Active Directory Object Undeletion |
|
|
307 | (2) |
|
Active Directory Object Movement |
|
|
309 | (1) |
|
Active Directory Object Modification |
|
|
310 | (3) |
|
|
310 | (3) |
|
|
313 | (1) |
|
Active Directory Object Operation Attempts |
|
|
313 | (7) |
|
Successful Active Directory Object Operation Attempts |
|
|
313 | (5) |
|
Unsuccessful Active Directory Object Operation Attempts |
|
|
318 | (2) |
|
Active Directory Objects Auditing Examples |
|
|
320 | (3) |
|
Organizational Unit Creation/Deletion |
|
|
320 | (1) |
|
Organizational Unit Child Object Creation/Deletion |
|
|
320 | (1) |
|
adminCount Attribute Modification for User Accounts |
|
|
320 | (1) |
|
Group Policy Link/Unlink Operations |
|
|
321 | (2) |
|
Chapter 9 Authentication Protocols |
|
|
323 | (44) |
|
|
323 | (25) |
|
Challenge-Response Basics |
|
|
323 | (2) |
|
|
325 | (4) |
|
|
325 | (2) |
|
LM Challenge-Response Mechanism |
|
|
327 | (2) |
|
|
329 | (1) |
|
|
329 | (1) |
|
NTLM Challenge-Response Mechanism |
|
|
330 | (1) |
|
|
330 | (3) |
|
NTLMv2 Challenge-Response Mechanism |
|
|
330 | (3) |
|
NTLMSSP and Anonymous Authentication |
|
|
333 | (2) |
|
NTLMv1 Session Security and NTLMv2 Session Security |
|
|
333 | (1) |
|
|
334 | (1) |
|
|
335 | (1) |
|
NTLM-family Protocols Monitoring |
|
|
335 | (13) |
|
Network Security: Restrict NTLM Security Group Policy Settings |
|
|
335 | (1) |
|
Local Account Authentication |
|
|
336 | (8) |
|
Domain Account Authentication |
|
|
344 | (3) |
|
Cross-Domain Challenge-Response |
|
|
347 | (1) |
|
|
348 | (10) |
|
Ticket-Granting Ticket (TGT) |
|
|
348 | (4) |
|
Successful AS_REQ Message |
|
|
352 | (2) |
|
Unsuccessful AS_REQ Message-Password Expired, Wrong Password, Smart Card Logon Issues |
|
|
354 | (2) |
|
Unsuccessful AS_REQ Message-Other Scenarios |
|
|
356 | (1) |
|
|
357 | (1) |
|
Ticket-Granting Service (TGS) Ticket |
|
|
358 | (9) |
|
Successful TGS_REQ Message |
|
|
362 | (2) |
|
Unsuccessful TGS_REQ and AP REQ Messages |
|
|
364 | (3) |
|
Chapter 10 Operating System Events |
|
|
367 | (52) |
|
|
368 | (4) |
|
Successful Normal System Shutdown |
|
|
368 | (2) |
|
Unsuccessful Normal System Shutdown-Access Denied |
|
|
370 | (1) |
|
Successful System Startup |
|
|
371 | (1) |
|
Monitoring Scenarios: System Startup/Shutdown |
|
|
371 | (1) |
|
|
372 | (4) |
|
Successful System Time Zone Change |
|
|
373 | (1) |
|
Unsuccessful System Time Zone Change |
|
|
374 | (1) |
|
Successful System Clock Settings Change |
|
|
374 | (2) |
|
Unsuccessful System Clock Settings Change |
|
|
376 | (1) |
|
Monitoring Scenarios: System Time Changes |
|
|
376 | (1) |
|
System Services Operations |
|
|
376 | (10) |
|
Successful Service Installation-Prior to Windows 10/2016 |
|
|
377 | (2) |
|
Successful Service Installation-Windows 10/2016 |
|
|
379 | (1) |
|
Unsuccessful Service Installation-Access Denied |
|
|
380 | (2) |
|
System Service State Changes |
|
|
382 | (1) |
|
Unsuccessful Service Stop Operation-Access Denied |
|
|
383 | (1) |
|
Monitoring Scenarios: System Services Operations |
|
|
384 | (2) |
|
Security Event Log Operations |
|
|
386 | (2) |
|
Successful Security Event Log Erase Operation |
|
|
386 | (1) |
|
Unsuccessful Security Event Log Erase Operation |
|
|
387 | (1) |
|
Successful Security Event Log Service Shutdown |
|
|
387 | (1) |
|
Unsuccessful Security Event Log Service Shutdown |
|
|
388 | (1) |
|
Monitoring Scenarios: Security Event Log Operations |
|
|
388 | (1) |
|
Changes in Auditing Subsystem Settings |
|
|
388 | (13) |
|
Successful Auditing Subsystem Security Descriptor Change |
|
|
388 | (6) |
|
Unsuccessful Auditing Subsystem Security Descriptor Change |
|
|
394 | (1) |
|
Successful System Audit Policy Changes |
|
|
395 | (5) |
|
Unsuccessful System Audit Policy Changes |
|
|
400 | (1) |
|
Monitoring Scenarios: Changes in Auditing Subsystem Settings |
|
|
400 | (1) |
|
Per-User Auditing Operations |
|
|
401 | (4) |
|
Successful Per-User Auditing Policy Changes |
|
|
402 | (2) |
|
Unsuccessful Per-User Auditing Policy Changes |
|
|
404 | (1) |
|
Per-User Auditing Database Initialization |
|
|
404 | (1) |
|
Monitoring Scenarios: Per-User Auditing Operations |
|
|
404 | (1) |
|
|
405 | (8) |
|
Successful Scheduled Task Creation |
|
|
406 | (2) |
|
Unsuccessful Scheduled Task Creation-Access Denied |
|
|
408 | (2) |
|
Successful Scheduled Task Deletion |
|
|
410 | (1) |
|
Unsuccessful Scheduled Task Deletion |
|
|
410 | (1) |
|
Successful Scheduled Task Change |
|
|
410 | (1) |
|
Unsuccessful Scheduled Task Change |
|
|
411 | (1) |
|
Successful Scheduled Task Enable/Disable Operations |
|
|
411 | (2) |
|
Monitoring Scenarios: Scheduled Tasks |
|
|
413 | (1) |
|
Boot Configuration Data Changes |
|
|
413 | (6) |
|
Monitoring Scenarios: Boot Configuration Data |
|
|
417 | (2) |
|
Chapter 11 Logon Rights and User Privileges |
|
|
419 | (18) |
|
|
419 | (3) |
|
Logon Rights Policy Modification |
|
|
420 | (2) |
|
Logon Rights Policy Settings-Member Added |
|
|
421 | (1) |
|
Logon Rights Policy Settings-Member Removed |
|
|
421 | (1) |
|
Unsuccessful Logons Due to Lack of Logon Rights |
|
|
422 | (1) |
|
|
422 | (5) |
|
User Privileges Policy Modification |
|
|
427 | (2) |
|
User Privileges Policy Settings-Member Added |
|
|
427 | (1) |
|
User Privileges Policy Settings-Member Removed |
|
|
428 | (1) |
|
Special User Privileges Assigned at Logon Time |
|
|
429 | (1) |
|
Logon Session User Privileges Operations |
|
|
430 | (5) |
|
|
431 | (6) |
|
Successful Call of a Privileged Service |
|
|
431 | (1) |
|
Unsuccessful Call of a Privileged Service |
|
|
432 | (1) |
|
Successful Operation with a Privileged Object |
|
|
433 | (2) |
|
Unsuccessful Operation with a Privileged Object |
|
|
435 | (1) |
|
Backup and Restore Privilege Use Auditing |
|
|
435 | (2) |
|
Chapter 12 Windows Applications |
|
|
437 | (48) |
|
New Application Installation |
|
|
437 | (16) |
|
Application Installation Using Windows Installer |
|
|
440 | (3) |
|
Application Removal Using Windows Installer |
|
|
443 | (1) |
|
Application Installation Using Other Methods |
|
|
444 | (4) |
|
Application Installation-Process Creation |
|
|
444 | (1) |
|
Application Installation-Software Registry Keys |
|
|
445 | (3) |
|
Application Installation-New Folders in Program Files and Program Files (x86) Folders |
|
|
448 | (1) |
|
Application Removal Using Other Methods |
|
|
448 | (5) |
|
Application Removal-Process Creation |
|
|
448 | (1) |
|
Application Removal-Software Registry Keys |
|
|
449 | (2) |
|
Application Removal-Folder Removal in the Program Files and Program Files (x86) Folders |
|
|
451 | (2) |
|
Application Execution and Termination |
|
|
453 | (11) |
|
Successful Process Creation |
|
|
455 | (6) |
|
Successful Process Creation-CreateProcessWithLogonW initiated |
|
|
460 | (1) |
|
Unsuccessful Process Creation |
|
|
461 | (2) |
|
|
463 | (1) |
|
Application Crash Monitoring |
|
|
464 | (7) |
|
|
467 | (4) |
|
|
471 | (1) |
|
Windows AppLocker Auditing |
|
|
471 | (9) |
|
|
471 | (1) |
|
|
472 | (8) |
|
|
474 | (5) |
|
|
479 | (1) |
|
Packaged app-Execution and Packaged app-Deployment |
|
|
480 | (1) |
|
Process Permissions and LSASS.exe Access Auditing |
|
|
480 | (5) |
|
LSASS's Process Default SACL |
|
|
482 | (3) |
|
Chapter 13 Filesystem and Removable Storage |
|
|
485 | (38) |
|
|
486 | (9) |
|
NTFS Security Descriptors |
|
|
487 | (8) |
|
|
493 | (1) |
|
|
494 | (1) |
|
File and Folder Operations |
|
|
495 | (20) |
|
|
495 | (8) |
|
|
495 | (3) |
|
Unsuccessful File Creation |
|
|
498 | (3) |
|
Successful Folder Creation |
|
|
501 | (1) |
|
Unsuccessful Folder Creation |
|
|
502 | (1) |
|
|
503 | (2) |
|
|
503 | (1) |
|
Unsuccessful File Deletion |
|
|
504 | (1) |
|
Successful Folder Deletion |
|
|
504 | (1) |
|
Unsuccessful Folder Deletion |
|
|
505 | (1) |
|
File Content Modification |
|
|
505 | (1) |
|
Successful File Content Modification |
|
|
505 | (1) |
|
Unsuccessful File Content Modification |
|
|
506 | (1) |
|
|
506 | (1) |
|
Successful File Read Data Operations |
|
|
506 | (1) |
|
Unsuccessful File Read Data Operations |
|
|
507 | (1) |
|
File/Folder Attribute Changes |
|
|
507 | (1) |
|
Successful File/Folder Attribute Changes |
|
|
507 | (1) |
|
Unsuccessful File/Folder Attribute Changes |
|
|
508 | (1) |
|
|
508 | (2) |
|
Successful File/Folder Owner Change |
|
|
508 | (1) |
|
Unsuccessful File/Folder Owner Change |
|
|
509 | (1) |
|
File/Folder Access Permissions Change |
|
|
510 | (1) |
|
Successful Access Permissions Changes |
|
|
510 | (1) |
|
Unsuccessful Access Permissions Changes |
|
|
511 | (1) |
|
|
511 | (6) |
|
Successful Auditing Settings (SACL) Change |
|
|
511 | (3) |
|
Unsuccessful Auditing Settings Change |
|
|
514 | (1) |
|
|
515 | (1) |
|
Global Object Access Auditing: Filesystem |
|
|
516 | (1) |
|
File System Object Integrity Levels |
|
|
517 | (3) |
|
File System Object Integrity Level Modification |
|
|
518 | (2) |
|
File System Object Access Attempt-Access Denied by Integrity Policy Check |
|
|
520 | (1) |
|
Monitoring Recommendations |
|
|
520 | (3) |
|
|
521 | (2) |
|
Chapter 14 Windows Registry |
|
|
523 | (36) |
|
|
523 | (5) |
|
|
526 | (2) |
|
Registry Operations Auditing |
|
|
528 | (25) |
|
|
528 | (4) |
|
Successful Registry Key Creation |
|
|
528 | (3) |
|
Unsuccessful Registry Key Creation |
|
|
531 | (1) |
|
|
532 | (1) |
|
Successful Registry Key Deletion |
|
|
532 | (1) |
|
Unsuccessful Registry Key Deletion |
|
|
533 | (1) |
|
Operations with Registry Key Values |
|
|
533 | (6) |
|
Successful Registry Value Creation |
|
|
534 | (1) |
|
Unsuccessful Registry Key Value Creation |
|
|
535 | (1) |
|
Successful Registry Key Value Deletion |
|
|
536 | (2) |
|
Unsuccessful Registry Key Value Deletion |
|
|
538 | (1) |
|
Successful Registry Key Value Modification |
|
|
538 | (1) |
|
Unsuccessful Registry Value Modification |
|
|
539 | (1) |
|
Registry Key Read and Enumerate Operations |
|
|
539 | (6) |
|
Successful Registry Key Read Operation |
|
|
539 | (1) |
|
Unsuccessful Registry Key Read Operation |
|
|
540 | (1) |
|
Successful Registry Key Subkeys Enumeration |
|
|
541 | (1) |
|
Unsuccessful Registry Key Subkeys Enumeration |
|
|
542 | (1) |
|
Successful Registry Key Access Permissions Read |
|
|
542 | (1) |
|
Unsuccessful Registry Key Access Permissions Read |
|
|
543 | (1) |
|
Successful Registry Key Audit Permissions Read |
|
|
543 | (2) |
|
Unsuccessful Registry Key Audit Permissions Read |
|
|
545 | (1) |
|
DACL, SACL, and Ownership Change Operations |
|
|
545 | (9) |
|
Successful Registry Key Access Permissions Change |
|
|
546 | (1) |
|
Unsuccessful Registry Key Access Permissions Change |
|
|
547 | (1) |
|
Successful Registry Key Audit Permissions Change |
|
|
548 | (3) |
|
Unsuccessful Registry Key Audit Permissions Change |
|
|
551 | (1) |
|
Successful Registry Key Owner Change |
|
|
551 | (2) |
|
Global Object Access Auditing: Registry |
|
|
553 | (1) |
|
Registry Key Integrity Levels |
|
|
554 | (2) |
|
Registry Key Integrity Level Modification |
|
|
554 | (2) |
|
Monitoring Recommendations |
|
|
556 | (3) |
|
|
557 | (2) |
|
Chapter 15 Network File Shares and Named Pipes |
|
|
559 | (26) |
|
|
559 | (18) |
|
Network File Share Access Permissions |
|
|
563 | (1) |
|
|
564 | (2) |
|
Successful File Share Creation |
|
|
564 | (1) |
|
Monitoring Recommendations |
|
|
565 | (1) |
|
|
566 | (1) |
|
Successful File Share Deletion |
|
|
566 | (1) |
|
Unsuccessful File Share Deletion |
|
|
567 | (1) |
|
Monitoring Recommendations |
|
|
567 | (1) |
|
|
567 | (3) |
|
Successful File Share Modification |
|
|
568 | (2) |
|
Unsuccessful File Share Deletion |
|
|
570 | (1) |
|
Monitoring Recommendations |
|
|
570 | (1) |
|
|
570 | (7) |
|
Successful File Share Session Creation |
|
|
570 | (2) |
|
Successful File Share File/Folder Operations |
|
|
572 | (2) |
|
Unsuccessful Admin File Share Session Creation |
|
|
574 | (1) |
|
Unsuccessful File Share Access-File Share Permissions |
|
|
574 | (1) |
|
Unsuccessful File Share Access-File System Permissions |
|
|
575 | (1) |
|
Monitoring Recommendations |
|
|
576 | (1) |
|
|
577 | (8) |
|
Successful Named Pipe Auditing Settings Changes |
|
|
578 | (2) |
|
Unsuccessful Named Pipe Auditing Settings Changes |
|
|
580 | (1) |
|
Successful Named Pipe Access Permissions Changes |
|
|
581 | (1) |
|
Named Pipe Access Attempts |
|
|
582 | (1) |
|
IPC$ Share Access Attempts |
|
|
582 | (2) |
|
Monitoring Recommendations |
|
|
584 | (1) |
Appendix A: Kerberos AS_REQ, TGS_REQ, and AP REQ Messages Ticket Options |
|
585 | (4) |
Appendix B: Kerberos AS_REQ, TGS_REQ, and AP REQ Messages Result Codes |
|
589 | (8) |
Appendix C: SDDL Access Rights |
|
597 | (1) |
Object-Specific Access Rights |
|
598 | (5) |
Index |
|
603 | |