Windows Internals The win32k GUI Subsystem: USER, GDI, and the Kernel Attack Surface
When you think of "the Windows kernel," you probably picture ntoskrnl.exe — the process manager, the memory manager, the...
Windows Internals
Windows Internals 
Windows Internals KUSER_SHARED_DATA and the Shared User Data Page
Crossing from user mode into the kernel is expensive. A system call has to trap into ring 0, save state, dispatch, and r...
Windows Internals Synchronization Primitives and Dispatcher Objects
The moment a system runs more than one thread, correctness depends on synchronization. Two threads incrementing the same...
Windows Internals Windows Thread Pools
Spawning a fresh thread for every small unit of asynchronous work is wasteful: thread creation and teardown cost kernel ...
Windows Internals TEB and PEB: A Deep Dive
Earlier in this series we met the kernel's view of a process and a thread — the EPROCESS and ETHREAD structures that liv...
Windows Internals Job Objects and Server Silos
Most of this series has treated the process as the fundamental unit of resource ownership and the thread as the unit of ...
Windows Internals LSA Internals: Authentication, Logon Sessions, and Credential Guard
If any single process is the beating heart of Windows security, it is the Local Security Authority Subsystem Service — l...
Windows Internals WMI Internals: Providers, the CIM Repository, and Eventing
Windows Management Instrumentation (WMI) is one of those subsystems that sysadmins use every day without thinking about,...
Windows Internals Section Objects and Memory-Mapped Files
Two processes need to share a megabyte of data. A program wants to read a 4 GB file without allocating 4 GB of memory. T...
Windows Internals The Filter Manager and Minifilter Drivers
If you have ever wondered how an antivirus scans a file the instant you open it, how ransomware protection blocks a rogu...
Windows Internals The Windows Cache Manager
When an application reads the same file twice in a row, the second read is almost always far faster than the first — yet...
Windows Internals Modern Windows Kernel Protections: PatchGuard, DSE, and HVCI
The Windows kernel is the ultimate prize on any host: code running in ring 0 can read and write any memory, forge tokens...
Windows Internals Windows Heap Internals: The NT Heap and Segment Heap
Earlier in this series we looked at how Windows manages virtual memory through page tables, PTEs, and the VAD tree — the...
Windows Internals Threads, KTHREAD, and the Windows Scheduler
In Windows, the thread — not the process — is the fundamental unit of execution. A process is really just a container: i...
Windows Internals Processes and the EPROCESS Structure
A process on Windows is not a unit of execution — it is a container. It owns a private virtual address space, a handle t...
Windows Internals The Windows Boot Process: From UEFI to the Session Manager
A stage-by-stage walk through the Windows boot path — UEFI, Secure Boot, the boot manager, winload, kernel initialization, and smss.exe — and the security checkpoints embedded in each handoff.
Windows Internals Kernel Pool Internals: Allocators and Structure
User-mode code that needs a scratch buffer calls into a heap; the kernel has the exact same need and answers it with the...
Windows Internals WoW64: Running 32-bit Processes on 64-bit Windows
Sixteen years after 64-bit Windows became the norm, a large amount of software on any given machine is still 32-bit. Tho...
Windows Internals ALPC: Advanced Local Procedure Call Internals
If you trace almost any everyday operation on Windows down through its layers — asking the Service Control Manager to st...
Windows Internals Structured and Vectored Exception Handling Internals
When a program divides by zero, dereferences a bad pointer, or hits a breakpoint, the CPU does not simply give up — it r...
Windows Internals Interrupts, IRQLs, DPCs, and APCs
A running Windows system is constantly interrupted. A network packet arrives, a disk finishes a read, the system clock t...
Windows Internals The Windows DLL Loader and the PE File Format
Every executable and every DLL on Windows shares one on-disk container: the Portable Executable (PE) format. When you do...
Windows Internals The Windows Driver Model: WDM, KMDF, and Driver Objects
Everything a Windows system does beyond raw computation — talking to disks, network cards, GPUs, USB devices, filesystem...
Windows Internals The Windows I/O Manager, Device Stacks, and IRPs
Reading a file, sending a packet, talking to a USB device, and issuing a command to a disk controller look like complete...
Windows Internals System Calls and the User-to-Kernel Transition
User-mode code runs in ring 3, where the CPU forbids it from touching hardware, reading kernel data structures, or execu...
Windows Internals Windows Registry Internals: Hives, Cells, and the Configuration Manager
To most users the Windows registry is a tree of keys and values edited through regedit. To the kernel it is something mo...
Windows Internals Event Tracing for Windows (ETW) Internals
If you have ever wondered how a modern endpoint detection and response (EDR) product sees process creations, image loads...
Windows Internals Windows Services and the Service Control Manager
Most of the work a Windows machine does happens without anyone watching. Print spoolers, the event log, Windows Update, ...
Windows Internals Windows Security Internals: Access Tokens, SIDs, and DACLs
The Windows security model rests on a simple but powerful idea: every action is a subject trying to access an object, an...
Windows Internals The Windows Object Manager and Handle Tables
If you spend enough time reverse engineering Windows, debugging drivers, or hunting malware, you eventually notice that ...
Windows Internals Windows Virtual Memory: Page Tables, PTEs, and Working Sets
Every process on Windows runs with the comforting illusion that it owns a private, contiguous block of memory that stret...