Windows Internals
A structured path through the Windows kernel and user-mode internals every exploit developer and defender needs — architecture through the object manager. Follow it top to bottom — foundational first (29 tutorials).
Windows InternalsIntegrity Levels and Mandatory Integrity ControlWindows Mandatory Integrity Control tags every process and object with an integrity level, enforcing Biba-style no-write-up before DACLs are ever consulted. Learn…Read →Windows InternalsUAC Internals: Elevation, Consent, and Token FilteringUnderstand how UAC works under the hood - split tokens, Mandatory Integrity Control, and the AppInfo/consent.exe pipeline - then execute a fodhelper…Read →Windows InternalsVirtual Address Descriptors: The VAD Tree and Memory Region TrackingThe VAD tree is the kernel's authoritative memory ledger - immune to user-mode forgery. Learn to walk _MMVAD nodes live in WinDbg,…Read →Windows InternalsPaging Internals: Page Tables, PTEs, and Address TranslationDecompose a 64-bit virtual address through all four paging levels, inspect every hardware PTE field in WinDbg, then flip two bits in…Read →Windows InternalsWorking Sets and the Memory Manager’s Trimming PolicyLearn how Windows trims process working sets via MmWorkingSetManager, why EmptyWorkingSet is an anti-forensics primitive, and how to detect cross-process trimming with…Read →