Articles on Windows Internals, Programming, Security and Debugging

Interrupt Dispatching Internals

2017.03.26 | Windows 10
Details of interrupt dispatching changes in recent versions of Windows.

Kernel Debugging Tricks

2015.07.08 | Windows 7+
Video presentation of the top 10 cool kernel debugging tricks in Windows.

Kernel Callback Functions

2014.12.19 | Windows 8.1
Comprehensive list of documented and undocumented APIs available in the Windows kernel to register callback routines.

How KMDF converts handles to pointers

2014.11.05 | Windows XP+
Algorithms used by the Windows Kernel Mode Driver Framework (KMDF) to convert handles to KMDF objects to raw kernel mode pointers.

EX_FAST_REF Pointers

2014.09.26 | Windows 7
Details of EX_FAST_REF pointer implementation in the Windows Kernel.

Usage of TEB ArbitraryUserPointer

2014.09.09 | Windows 7+
Describes the various uses of the ArbitraryUserPointer field in the Thread Environment Block (TEB) data structure.

Useful Build Macros

2014.04.30 | Windows XP - Windows 7
Useful macros for use in the sources file for building kernel drivers using the Windows 7 WDK command line build environment.

NTOSKRNL Component List

2013.11.04 | Windows 8.1
List of components within NTOSKRNL along with their respective function prefixes.
Describes how Windows selects the pool type to allocate objects from and which pool types are used to allocate various objects.

Windows 8 Kernel Thread List

2013.01.31 | Windows 8
Lists all the threads created by the Kernel and a brief description of the functionality they each one provides.

New thread creation API in Windows 8

2013.01.09 | Windows 8
Describes a new system thread creation API which solves a very common problem with drivers wherein a driver unloads before all the threads created by the driver are terminated.

How Windows Sets the Default Audio Device

2012.12.09 | Windows Vista+
Describes the mechanism used by Windows to select the default device for audio playback.
Describes a debugger technique to obtain the addresses and lengths of various physical memory ranges in use on a Windows system.

WinDBG : A rodent killer

2014.11.20 | Windows XP+
Step by step description for getting rid of Poison IVY RAT using just WinDBG.
Tutorial on ARM architecture, assembly language, calling convention, exceptions, interrupts, system calls, interlocked operations etc. on Windows 8.
Kernel Mode Driver Framework debugger extension command list thematically grouped.
Analysis of an application hang caused by chain of RPC calls.
Debugging power IRP watchdog timeouts on Vista and later versions of windows.

Catalog of key Windows kernel data structures

2012.04.14 | Windows 7 / Server 2008 R2
Explanation of key data strcutures used by Windows device drivers, kernel and HAL.

Command Line Tips

2011.10.31 (updated) | WinVista+
Drivers, Debugger Configuration, Dump Generation and related command line tips.

X64 Deep Dive

2011.06.17 | Vista+ X64
In-depth tutorial on the key aspects of code execution and debugging on X64 like compiler optimizations, exception handling, parameter passing, stack layout and parameter retrieval.

X86 Compiler Optimization: Parameter Reuse

2011.04.13 | All Windows Versions
Describes optimizations performed by the X86 compiler wherein it reuses the stack based parameter space to store local variables.

TDI Overview

2011.03.17 | All Windows Versions
Overview of Windows Transport Driver Interface (TDI).

Windows 7 Object Headers

2011.01.05 | Windows 7 / Server 2008 R2
Describes the changes that have been made to the object header structure in Windows 7.

Prototype PTEs

2010.12.05 | All Windows Versions
Describes Prototype PTEs and how they are used to implement shared memory in Windows.

X64 Kernel Virtual Address Space

2010.09.25 | Windows 7 / Server 2008 R2 X64
Describes the layout and the components of the Kernel Virtual Address Space.
Describes internals and usage of NDIS 6 NBLs, NBs and MDLs.

Finding AFD Endpoints

2010.07.01 | WinVista+
Describes a technique to locate AFD socket endpoint structures in a complete or kernel memory dump.
Describes a technique to locate WSK drivers in a complete or kernel memory dump.
Describes a technique to locate WFP drivers and the callouts they have established in a complete or kernel memory dump.

System Call Instructions

2010.07.01 | All Windows Versions
Explanation of mechanisms used to perform a user to kernel mode thread transition.

timer Abnormalities

2010.07.01 | All Windows Versions
Explanation of output and idiosyncrasies of !timer kernel debugger extension command.

Debugger Command and Script Tips

2010.07.01 | All Windows Versions
Debugger command usage, breakpoints, simple debugger scripts.