Windows Internals
Windows internals describes how the Windows operating system organizes processes, threads, memory, objects, input and output, drivers, and security boundaries. This system-level map helps you connect an application symptom to the component that owns the work.
itWindows and Microsoft infrastructure | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Intro
Windows Internals
Windows internals is the study of the operating system beneath its supported application interfaces. It explains how user-mode requests cross into kernel mode, how the executive manages shared resources, and how evidence from traces or dumps maps back to those mechanisms.
Windows uses a layered architecture. Applications and environment subsystems run primarily in user mode. The kernel, executive managers, kernel-mode drivers, and the hardware abstraction layer run in kernel mode. Processor privilege and virtual-memory protection enforce the mode boundary. A user-mode failure normally remains inside one process. A kernel-mode fault can stop the operating system because kernel code shares the trusted address space.
The request path
A typical operation starts in application code and calls a documented Windows API. A user-mode system library prepares the request. A system call transfers execution to a kernel entry point. An executive component validates the request and coordinates the resource. A driver may translate the operation for a file system, network stack, or device. Completion returns through the layers to the requesting thread.
This path is a mental model, not a claim that every request follows identical steps. Cached data, asynchronous input and output, user-mode services, filter drivers, and virtualization can add or skip stages. The key diagnostic question remains: which component owns the request at the point where progress stops?
Processes, threads, and jobs
A process is a resource and isolation container. It has a private virtual address space, a security context, open handles, executable code, and at least one thread. A thread is the unit the scheduler dispatches to a logical processor. Threads in one process share that process's address space and handles, while each thread has its own stacks, register context, and scheduling state.
Continue the course
This section is part of the paid course.
See pricing to subscribe, or log in if you already have access.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://learn.microsoft.com/en-us/sysinternals/resources/windows-internals
Supports
- Windows architecture, processes, threads, memory, input and output, and security scope
- History of the Windows Internals book series and Windows kernel convergence
- Timeline milestones from 1992 through the seventh edition
- https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/
Supports
- Kernel-mode executive managers for objects, memory, processes, input and output, Plug and Play, power, and configuration
- Layered kernel-mode component map
- https://learn.microsoft.com/en-us/windows/win32/procthread/about-processes-and-threads
Supports
- Process resources and virtual address space
- Threads as schedulable execution units with independent context
- Jobs as process-group management objects
- https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/windows-kernel-mode-process-and-thread-manager
Supports
- Kernel process and thread management role
- Process and thread objects used by drivers
- https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/windows-kernel-mode-memory-manager
Supports
- Virtual and physical memory management
- Address-space protection and memory-manager ownership
- https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/windows-kernel-mode-object-manager
Supports
- Common object model and object namespaces
- Handles, references, and object lifetime
- Security checks when objects are opened
- https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/windows-kernel-mode-i-o-manager
Supports
- Input/output request packets and layered driver processing
- Pending and completed request flow
- https://learn.microsoft.com/en-us/windows/win32/secauthz/access-control-components
Supports
- Access tokens, security descriptors, and access-control lists
- Authorization inputs for securable objects
- https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm
Supports
- Hypervisor-backed isolated memory regions
- Security boundary beyond the normal kernel and drivers
- Windows 10 and Windows Server 2016 introduction of VSM-backed features
- https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
Supports
- Live process, account, handle, DLL, and memory-mapped-file inspection
- Handle and DLL search capabilities
- https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
Supports
- File-system, Registry, process, and thread event capture
- Filtering for sequence-based troubleshooting
- https://learn.microsoft.com/en-us/sysinternals/
Supports
- Sysinternals utilities for Windows diagnosis and troubleshooting
- Sysinternals site creation in 1996
- https://learn.microsoft.com/en-us/windows-hardware/test/wpt/
Supports
- WPR capture of ETW recordings
- WPA timeline, graph, table, and search analysis
- Trace evidence for operating-system and application performance
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/getting-started-with-windows-debugging
Supports
- WinDbg host, target, live, and dump debugging path
- Debugger selection by target architecture
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/symbols
Supports
- Symbols mapping addresses to names and available type information
- Symbol path and matching requirements
- https://github.com/sindresorhus/awesome
Supports
- Discovery of the curated Awesome Windows list and reverse-engineering lists
- https://github.com/0PandaDEV/awesome-windows
Supports
- Discovery of Process Hacker or System Informer, NirSoft, and HWiNFO as Windows system utilities
- https://github.com/ReversingID/Awesome-Reversing
Supports
- Discovery of x64dbg and Ghidra for dynamic and static software analysis
- https://github.com/winsiderss/systeminformer
Supports
- System Informer process, resource, debugging, and malware-inspection scope
- Open-source project status
- https://www.nirsoft.net/launcher/
Supports
- Portable suite of focused Windows system, network, browser, and file utilities
- https://www.hwinfo.com/about-software/
Supports
- Windows hardware analysis, monitoring, reporting, and diagnostics
- https://x64dbg.com/
Supports
- Open-source user-mode debugging for 32-bit and 64-bit Windows executables
- Registers, memory maps, symbols, threads, handles, and plugin inspection
- https://www.nsa.gov/ghidra/
Supports
- Static software analysis through disassembly, decompilation, graphing, and scripting
- Open-source multi-platform reverse-engineering framework
- https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/
Supports
- Microsoft debugger documentation and kernel or user-mode analysis role
- https://hex-rays.com/ida-pro
Supports
- Commercial disassembly, decompilation, and debugging for binary analysis