Windows Internals
A structured path through the Windows kernel and user-mode internals every exploit developer and defender needs — architecture through the object manager. Follow it top to bottom — foundational first (29 tutorials).
Windows InternalsHAL and Ntoskrnl: The Kernel Core ComponentsDive deep into hal.dll and ntoskrnl.exe - the two Ring 0 binaries at the foundation of Windows. Learn their architecture, boot handoff,…Read →Windows InternalsSystem Calls and SSDT: How User Mode Reaches the KernelExplore how the SYSCALL instruction, MSR_LSTAR, and the System Service Descriptor Table (SSDT) bridge user mode and the Windows kernel - and…Read →Windows InternalsIRQL Levels: Interrupt Request Priorities ExplainedDeep-dive into Windows Interrupt Request Levels (IRQL): how the HAL arbitrates hardware and software interrupts, which kernel operations are legal at each…Read →Windows InternalsDPCs: Deferred Procedure Calls and Interrupt DeferralDeep dive into Windows Deferred Procedure Calls (DPCs): how the kernel defers ISR work to DISPATCH_LEVEL, the KDPC lifecycle, and how rootkits…Read →Windows InternalsAPCs: Asynchronous Procedure Calls and Thread Hijacking SurfaceDeep-dive into Windows Asynchronous Procedure Calls - from KAPC kernel structures and KiDeliverApc dispatch to classic, early-bird, and special user APC injection…Read →Windows InternalsWindows Scheduler Internals: Priority Levels, Quantum, and Thread SelectionExplore Windows scheduler internals: the 32-level priority model, KPRCB ready queues, quantum mechanics, and boost/decay logic - with defender detection strategies for…Read →Windows InternalsJobs and Silos: Process Grouping and Resource LimitsExplore how the Windows kernel uses job objects and silos to manage process groups, enforce resource limits, and isolate containers - and…Read →Windows InternalsFibers: User-Mode Cooperative ThreadsDeep dive into Windows fibers: how cooperative context switches work entirely in user mode, how the TEB and undocumented FIBER structure tie…Read →Windows InternalsSIDs and Security Descriptors: Identity in Windows SecurityUnderstand how Windows uses Security Identifiers and security descriptors to make every access decision - and how attackers abuse NULL DACLs, SID-History…Read →Windows InternalsAccess Tokens and Privileges: The Kernel’s Security ContextEvery Windows process runs inside a security context defined by its access token. Learn how the kernel builds and enforces that context…Read →Windows InternalsACLs, DACLs, and SACLs: Access Control InternalsUnderstand the kernel-level structures behind every Windows access check - SECURITY_DESCRIPTOR, DACL, SACL, and ACE types - then learn how attackers exploit…Read →Windows InternalsThe Windows Access Check Algorithm: How SeAccessCheck WorksTrace the Windows access check algorithm from DesiredAccess through ObCheckObjectAccess into SeAccessCheck, learn how DACLs are evaluated against a caller's token, and…Read →