Windows Internals
A structured path through the Windows kernel and user-mode internals every exploit developer and defender needs — architecture through the object manager. Follow it top to bottom — foundational first (31 tutorials).
Windows InternalsIntegrity Levels and Mandatory Integrity ControlWindows Mandatory Integrity Control tags every process and object with an integrity level, enforcing Biba-style no-write-up before DACLs are ever consulted. Learn…Read →Windows InternalsUAC Internals: Elevation, Consent, and Token FilteringUnderstand how UAC works under the hood - split tokens, Mandatory Integrity Control, and the AppInfo/consent.exe pipeline - then execute a fodhelper…Read →Windows InternalsVirtual Address Descriptors: The VAD Tree and Memory Region TrackingThe VAD tree is the kernel's authoritative memory ledger - immune to user-mode forgery. Learn to walk _MMVAD nodes live in WinDbg,…Read →Windows InternalsPaging Internals: Page Tables, PTEs, and Address TranslationDecompose a 64-bit virtual address through all four paging levels, inspect every hardware PTE field in WinDbg, then flip two bits in…Read →Windows InternalsWorking Sets and the Memory Manager’s Trimming PolicyLearn how Windows trims process working sets via MmWorkingSetManager, why EmptyWorkingSet is an anti-forensics primitive, and how to detect cross-process trimming with…Read →Windows InternalsWindows Heap Internals: NT Heap and Segment Heap ArchitectureDissect Windows NT Heap and Segment Heap internals from root descriptors to size-class components, XOR mitigations, and WinDbg walkthroughs - essential knowledge…Read →Windows InternalsDLL Loading Internals: The Loader, LdrLoadDll, and Load OrderDive deep into Windows DLL loading internals - trace the LdrLoadDll call chain, walk PEB_LDR_DATA by hand, understand loader lock semantics, and…Read →Windows InternalsDLL Search Order and Hijacking PrimitivesLearn how the Windows loader resolves bare DLL names and how attackers exploit the search order for code execution. Covers search-order, phantom,…Read →