Windows Internals
A structured path through the Windows kernel and user-mode internals every exploit developer and defender needs — architecture through the object manager. Follow it top to bottom — foundational first (29 tutorials).
Windows InternalsWindows OS ArchitectureUnderstand how Windows is built under the hood - from User Mode to Kernel Mode, system layers, and what makes it tick.…Read →Windows InternalsWindows Boot ProcessUnderstand the internal steps that take place when a Windows machine powers on, leading up to the execution of user-level processes like…Read →Windows InternalsWindows File System Internals (NTFS)The NTFS (New Technology File System) is the default file system for modern Windows versions, designed to be secure, scalable, recoverable, and…Read →Windows InternalsWindows Registry InternalsExplore the internal structure and functionality of the Windows Registry, including its hive-based architecture, key-value model, data types, and how it enables…Read →Windows InternalsWindows Scheduled TasksUnderstand the architecture and internals of Windows Task Scheduler, how scheduled tasks are created and executed, and how adversaries abuse them for…Read →Windows InternalsWindows Services & SCM InternalsUnderstand the architecture and functioning of Windows services, how the Service Control Manager (SCM) manages service lifecycles, service types, and dependencies, and…Read →Windows InternalsPE File Format Deep DiveUnderstand the internal structure of Windows Portable Executable (PE) files, including the DOS and NT headers, section table, and directory structures like…Read →Windows InternalsWindows Process Creation Internals & PEBDeeply understand how Windows creates new processes, detailing the internal workings of the CreateProcess API, kernel object management, memory mapping, and the…Read →Windows InternalsThreads and the TEB (Thread Environment Block)Understand the internal workings of threads on Windows, the lifecycle of a thread from creation to termination, the critical role of the…Read →Windows InternalsMemory Management InternalsUnderstand the internal architecture and functionality of Windows memory management, including virtual memory, physical memory mappings, distinctions between stack and heap allocations,…Read →Windows InternalsHandle Tables & Object ManagerUnderstand the role and internals of the Windows Object Manager, the structure and purpose of handle tables, kernel object creation and management,…Read →Windows InternalsUser Mode vs Kernel Mode: Privilege Rings and the BoundaryExplore how Windows enforces the Ring 3 / Ring 0 boundary using CPU privilege levels, traces the full SYSCALL dispatch path through…Read →