Debugging the Windows 11 Boot Process
Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.
Tag: ntoskrnl
How Windows DTrace Works Under the Hood: bcdedit → winload.efi → ntoskrnl → dtrace.sys
How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.
Tracing Windows Syscalls on 10/11: LSTAR, the SSDT, and Parameter-Count Determination
Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.