Windows Internals: Architecture, Processes & Execution

Explore WinDbg, Windows debugger, to analyze Windows applications and the kernel; connect to a VM, configure a serial connection via a named pipe, and load symbols from Microsoft Symbol Server.

Understand what a debugger is and how WinDBG observes and controls program execution, pausing and stepping through instructions to inspect registers, memory, and function calls.

Explore the WinDbg interface by attaching to a notepad process, pausing execution, and using software breakpoints with int3 to give the debugger full control.

Learn how WinDbg uses pdb symbol files to map memory to names. Configure the symbol path with .sympath and reload modules to load symbols from the Microsoft symbol server.

Connect the virtual machine to WinDbg for kernel debugging by configuring VirtualBox serial port com1, enabling serial and debug options, then attach WinDbg, break, and analyze the kernel.

Use the R command in WinDbg to display addresses in registers such as rax, rvx, and rcx, then use R RIP to show a single register at 6E40.

Master essential WinDbg commands for windows internals: list processes with bang, inspect e-process with dt, view stacks with k, and examine memory with dd, dq, plus u and l1.

Trace a fread call from user mode through msvcrtdll to ntos.kernel.exe, where the kernel routes io to a driver and returns data back to the application via sysenter or syscall.

Explore the portable executable format used by Windows to load and execute executables, dlls, and drivers. Learn how Windows uses PE internals to organize memory, dependencies, and execution flow.

Explore the PE structure by examining the DOS header and DOS stub, then follow the e_lfanew offset to the NT header in a loaded executable.

Understand how Windows uses the NT header to load a PE file, including the PE signature, image file header with machine, and optional header with entry point and data directories.

Explore the import directory and image import descriptor to see how the original first thunk points to the import address table, revealing gdi32.dll, user32.dll, and functions like set map mode.

Explore how the export address table defines DLL exports, detailing fields like number of functions, address of function, export name table, and name ordinals, and how Windows resolves exports.

Examine image section headers in PE files, focusing on fields like name, virtual address, size, and characteristics. Identify the .text, .artdata, .data, .resource, and .relocation sections and their roles.

Explore how Windows represents and manages processes as complex execution environments, detailing the E-process and K-process structures, the process environment block, and user and kernel mode interaction during creation.

Understand Windows processes as management and containment objects with private address spaces, memory, and handles, and learn how kernel structures like E-process, K-process, and PEB govern scheduling and execution.

Navigate windows process internals with WinDbg, locate explorer.exe, and inspect eprocess and kprocess structures, tokens, and the process environment block to understand scheduling and CPU usage.

Investigate the PEB in WinDebugger by locating notepad, switching to user mode, and listing the image file name, command line, environment variables, and loaded modules (notepad, ntdll, kernel32).

Discover how Windows uses the create process API to launch Notepad.exe, using startup info and process information structures to return a new process id.

Understand threads as the smallest execution unit inside a process, sharing memory. Windows scheduling, thread priorities, mutexes, events, and critical sections shape how they run.

Explore e-thread and k-thread structures in WinDBG, dump the e-thread and k-thread, and identify fields like tcb, thread and process IDs, priority, state, and dispatcher ready lists.

Explore how Windows creates a thread inside a process, starting from the main thread and using create thread API to print thread ids and coordinate worker execution.

Perform a context switch by saving the old thread context and stack, restoring the new thread after updating the address space with cr3 if needed, and then re-enabling interrupts.

Explore how Windows manages kernel objects and handles with the object manager, header, and body. Understand handle and pointer counts, and access control lists for security.

Understand how a handle maps to a kernel object via the per-process handle table, preventing user-mode from touching raw pointers, enabling isolation, access checks, usage tracking, and safe object lifetime.

Explore how Windows objects and handles are managed with WinDbg, inspecting eprocess, object headers, and handle tables to understand reference counts, type indexes, and process handles.

Learn how to create a file handle with create file API, access a kernel object in Windows, print the handle value, and close the handle to create a simple.txt file.

Learn how syscalls provide a controlled entry into kernel mode for user mode apps, enabling operations like file access, with Windows handling via ntreadfile wrappers in NTDLL.

Trace system calls in x64dbg by inspecting syscall numbers in user mode, identify ntcreate file syscall 55, and map it to the corresponding kernel function using windbg.

Discover how syscall numbers map to nt kernel functions using WinDbg, by inspecting the ki service table and identifying nt create file at index 55.

A syscall switches the cpu from user to kernel mode, loads the kernel entry from ia32lstar, switches GS base, and kiSystemCall64 dispatches ntreadfile via the SSDT, returning to user mode.

Explore how a security descriptor defines who can access an object and how Windows uses DACLs, SACLs, ACLs, and ACEs with token SIDs and privileges to enforce access checks.

Open system informer to view the token, user SID, privileges, and DACL or ACE entries that grant or deny access, plus the SACL for auditing.

Inspect Windows security with WinDbg by tracing an eprocess, unpacking its token, and examining SIDs and privileges; compare token data with the object’s security descriptor to grant access.

Explore interrupts and exceptions in depth, identifying asynchronous hardware-driven interrupts like timer, keyboard, and network events, and synchronous CPU-generated exceptions such as divide-by-zero and page faults, with kernel handling differences.

Explore the interrupt descriptor table and how interrupts are represented, then trace from the k-trap frame through the kernel dispatcher to the MOS interrupt service at vector 0x90.