Windows Kernel Internals 2 - Architecture 2821

Explore advanced Windows operating system concepts in this comprehensive course covering both user and kernel space fundamentals. Master core Windows internals including system components, mechanisms, processes, threads, and kernel memory pools through hands-on laboratories using tools like Vergilius, Process Explorer, and WinObj. Dive deep into system calls, executive and kernel structures, IRQL concepts, and pool tags while learning practical debugging and analysis techniques. Examine kernel security concepts including bug exploitation, information disclosure vulnerabilities, and modern mitigations like SMEP. Develop skills in creating kernel payloads and privilege escalation techniques through guided exercises and solutions. Build upon x86-64 OS internals knowledge to understand Windows-specific architecture and prepare for advanced kernel exploitation topics. Practice with real-world scenarios including race conditions and use-after-free vulnerabilities in the Kernel Transaction Manager (KTM) to establish a solid foundation for Windows kernel security research and exploitation.

Syllabus

Arch2821 Windows Kernel Internals 2: 00 Introduction
Arch2821 Windows Kernel Internals 2: 01 1 Generalities
Arch2821 Windows Kernel Internals 2: 01 2 Lab Userland Tooling
Arch2821 Windows Kernel Internals 2: 01 3 Lab Userland Tooling Solution Vergilius
Arch2821 Windows Kernel Internals 2: 01 4 Lab Userland Tooling Solution Process Explorer
Arch2821 01 5 Lab Userland Tooling Solution WinObj
Arch2821 Windows Kernel Internals 2: 02 1 System Components
Arch2821 Windows Kernel Internals 2: 02 2 Lab Syscall
Arch2821 Windows Kernel Internals 2: 02 3 Lab Syscall Solution
Arch2821 Windows Kernel Internals 2: 03 1 System Mechanisms
Arch2821 Windows Kernel Internals 2: 03 2 Lab System
Arch2821 Windows Kernel Internals 2: 03 3 Lab Syscall Number Solution
Arch2821 Windows Kernel Internals 2: 03 4 Lab Executive and Kernel Structures Solution
Arch2821 Windows Kernel Internals 2: 03 5 Lab IRQL Solution
Arch2821 Windows Kernel Internals 2: 04 Processes and Threads
Arch2821 Windows Kernel Internals 2: 05 1 Kernel Memory Pools
Arch2821 Windows Kernel Internals 2: 05 2 Lab Pool Tags
Arch2821 Windows Kernel Internals 2: 05 3 Lab Pool Tags Solution
Arch2821 Windows Kernel Internals 2: 06 1 Kernel Bugs Exploitation
Arch2821 Windows Kernel Internals 2: 06 2 Lab Information Disclosure
Arch2821 Windows Kernel Internals 2: 06 3 Lab Information Disclosure Solution
Arch2821 Windows Kernel Internals 2: 07 1 Mitigations
Arch2821 Windows Kernel Internals 2: 07 2 Lab SMEP Mitigation
Arch2821 Windows Kernel Internals 2: 07 3 Lab SMEP Mitigation Solution
Arch2821 Windows Kernel Internals 2: 08 Security Concepts
Arch2821 Windows Kernel Internals 2: 09 1 Kernel Payloads
Arch2821 Windows Kernel Internals 2: 09 2 Lab Kernel Payload EoP
Arch2821 Windows Kernel Internals 2: 09 3 Lab Kernel Payload EoP Solution