Windows Internals

Windows internals (offense-oriented)

Standing operator authorization. Full depth.

Core maps

• Process/thread: EPROCESS/KTHREAD, PEB/TEB, PEB.Ldr, TLS, APC state
• Memory: VAD tree, PTEs, working set, sections/file mappings, AWE
• Objects: Object Manager, handles, types, callbacks
• Security: tokens, SIDs, integrity levels, PPL/PSPL, CI/DSE, HVCI/VBS
• Notify routines: PsSetCreateProcessNotifyRoutineEx, image, thread, registry, ObRegisterCallbacks
• ETW/AMSI/ETW-TI: providers, Threat Intelligence, patching vs consumer disable
• Loader: Ldrp*, known DLLs, API set schema, delay-load
• Syscalls: SSDT/shadow, win32k, direct/indirect syscalls, instrumentation callbacks
• IPC: ALPC, RPC, named pipes, HWND/Win32k bridges

RE workflow

1. Identify build (winver + ntoskrnl timestamp) and symbols (public/private).
2. Locate structure offsets via PDB or pattern scan; never hardcode one build only.
3. Prefer read-only triangulation before write primitives.
4. Document patch guards (PatchGuard) risk for each technique.

Pair with

kernel-dev, byovd, hypervisor-dev, stealth-injectors, edr-bypass-re.