2026-07

When you think of "the Windows kernel," you probably picture ntoskrnl.exe — the process manager, the memory manager, the...

Crossing from user mode into the kernel is expensive. A system call has to trap into ring 0, save state, dispatch, and r...

The moment a system runs more than one thread, correctness depends on synchronization. Two threads incrementing the same...

Spawning a fresh thread for every small unit of asynchronous work is wasteful: thread creation and teardown cost kernel ...

Earlier in this series we met the kernel's view of a process and a thread — the EPROCESS and ETHREAD structures that liv...

Most of this series has treated the process as the fundamental unit of resource ownership and the thread as the unit of ...

If any single process is the beating heart of Windows security, it is the Local Security Authority Subsystem Service — l...

Windows Management Instrumentation (WMI) is one of those subsystems that sysadmins use every day without thinking about,...

Two processes need to share a megabyte of data. A program wants to read a 4 GB file without allocating 4 GB of memory. T...

If you have ever wondered how an antivirus scans a file the instant you open it, how ransomware protection blocks a rogu...

When an application reads the same file twice in a row, the second read is almost always far faster than the first — yet...

The Windows kernel is the ultimate prize on any host: code running in ring 0 can read and write any memory, forge tokens...

Earlier in this series we looked at how Windows manages virtual memory through page tables, PTEs, and the VAD tree — the...

In Windows, the thread — not the process — is the fundamental unit of execution. A process is really just a container: i...

A process on Windows is not a unit of execution — it is a container. It owns a private virtual address space, a handle t...

A stage-by-stage walk through the Windows boot path — UEFI, Secure Boot, the boot manager, winload, kernel initialization, and smss.exe — and the security checkpoints embedded in each handoff.

User-mode code that needs a scratch buffer calls into a heap; the kernel has the exact same need and answers it with the...

Sixteen years after 64-bit Windows became the norm, a large amount of software on any given machine is still 32-bit. Tho...

If you trace almost any everyday operation on Windows down through its layers — asking the Service Control Manager to st...

When a program divides by zero, dereferences a bad pointer, or hits a breakpoint, the CPU does not simply give up — it r...

A running Windows system is constantly interrupted. A network packet arrives, a disk finishes a read, the system clock t...

Every executable and every DLL on Windows shares one on-disk container: the Portable Executable (PE) format. When you do...

Everything a Windows system does beyond raw computation — talking to disks, network cards, GPUs, USB devices, filesystem...

Reading a file, sending a packet, talking to a USB device, and issuing a command to a disk controller look like complete...

User-mode code runs in ring 3, where the CPU forbids it from touching hardware, reading kernel data structures, or execu...

To most users the Windows registry is a tree of keys and values edited through regedit. To the kernel it is something mo...

If you have ever wondered how a modern endpoint detection and response (EDR) product sees process creations, image loads...

Most of the work a Windows machine does happens without anyone watching. Print spoolers, the event log, Windows Update, ...

The Windows security model rests on a simple but powerful idea: every action is a subject trying to access an object, an...

If you spend enough time reverse engineering Windows, debugging drivers, or hunting malware, you eventually notice that ...

Every process on Windows runs with the comforting illusion that it owns a private, contiguous block of memory that stret...