Articles


Command Line Tips
2010.10.31 (updated) | WinVista+
Drivers, Debugger Configuration, Dump Generation and related command line tips.
X64 Deep Dive
2011.06.17 | Vista+ X64
In-depth tutorial on the key aspects of code execution and debugging on X64 like compiler optimizations, exception handling, parameter passing, stack layout and parameter retrieval.
X86 Compiler Optimization: Parameter Reuse
2011.04.13 | All Windows Versions
Describes optimizations performed by the X86 compiler wherein it reuses the stack based parameter space to store local variables.
TDI Overview
2011.03.17 | All Windows Versions
Overview of Windows Transport Driver Interface (TDI).
Windows 7 Object Headers
2011.01.05 | Windows 7 / Server 2008 R2
Describes the changes that have been made to the object header structure in Windows 7.
Prototype PTEs
2010.12.05 | All Windows Versions
Describes Prototype PTEs and how they are used to implement shared memory in Windows.
X64 Kernel Virtual Address Space
2010.09.25 | Windows 7 / Server 2008 R2 X64
Describes the layout and the components of the Kernel Virtual Address Space.
NDIS 6 Net Buffer Lists and Net Buffers
2010.07.23 | WinVista+
Describes internals and usage of NDIS 6 NBLs, NBs and MDLs.
Finding AFD Endpoints
2010.07.01 | WinVista+
Describes a technique to locate AFD socket endpoint structures in a complete or kernel memory dump.
Finding Windows Socket Client (WSK) Client Drivers
2010.07.01 | WinVista+
Describes a technique to locate WSK drivers in a complete or kernel memory dump.
Finding Windows Filtering Platform (WFP) Callouts
2010.07.01 | WinVista+
Describes a technique to locate WFP drivers and the callouts they have established in a complete or kernel memory dump.
System Call Instructions
2010.07.01 | All Windows Versions
Explanation of mechanisms used to perform a user to kernel mode thread transition.
!timer Abnormalities
2010.07.01 | All Windows Versions
Explanation of output and idiosyncrasies of !timer kernel debugger extension command.
Debugger Command and Script Tips
2010.07.01 | All Windows Versions
Debugger command usage, breakpoints, simple debugger scripts