Today, while doing some testing around prefetch entries i decided to have a closer look to the layout.ini file in /windows/prefetch/. I thought this file was a kind of plaintext version of all the informations contained in the .pf files,...

Last week we detailed the interrupt dispatch internals, today we will focus on the syscall mechanism.

System overview

The diagram below shows a very high level and simplified view of the Windows architecture (I have omitted subsystem and GDI...

This is the first article of a serie about Windows kernel architecture. Goal is to give a basic ovebitrview of the kernel space, just enough to be able to start developing a simple driver and debug it. It does not...

If you want to get in the driver development area and/or kernel debugging there is a few must read.

First know the OS architecture, you don’t want to write drivers without this knowledge, and in this area the reference is...

As i intend to spend quite some time speaking about Windows kernel debugging here, i figured giving up a cool link would be a good start.

Since not anyone has a MSDN subscription at home, getting access to a bunch...