Tag archive
Everything currently published under the windows-internals tag.
How Superfetch page metadata and an Object Manager redirect turn an NLS section lookup into a privileged, read-only physical-memory view, and where the technique stops.
A kernel-grounded detector for raw and gadgeted direct syscalls using process instrumentation callbacks, runtime syscall catalogs, ThreadLastSystemCall, and return-provenance matching.
A reverse-engineering walk through normal user-mode crash reporting, from kernel exception dispatch through in-process WER state, service coordination, and crash-vertical worker creation.
A Windows Object Manager case study in bypassing named-mutex single-instance checks by enumerating, duplicating, and closing remote handles, with EDR hunting caveats.
