Debugging the Windows 11 Boot Process
Debugging the Windows 11 boot process, walking through the tools and techniques to trace startup from UEFI firmware all the way to the kernel, and the code traced down to the core.
Tag: windbg
Tracing How the Disk Model and Serial Number Get Written into ClipSp.sys
Tracing how the disk serial number gets written into ClipSp.sys, following the value from its hardware query all the way down into the driver, with a full walkthrough of the technique.
Tracing a WMI Query to the Kernel: How Get-PhysicalDisk Reads Serial Number and UID
Tracing a WMI query to the kernel, following the full path end to end from a user-mode WMI call down to the kernel provider that answers it, and the mechanism explained clearly.
How Windows DTrace Works Under the Hood: bcdedit → winload.efi → ntoskrnl → dtrace.sys
How Windows DTrace works under the hood, explaining the tracing architecture and how it hooks into the kernel to instrument code, and the bypass logic broken down.
Tracing Windows Syscalls on 10/11: LSTAR, the SSDT, and Parameter-Count Determination
Tracing Windows syscalls on Windows 10 and 11 via LSTAR and the SSDT, working out parameter counts to hook kernel calls cleanly, and the mechanism explained clearly.
Unpacking a .NET JIT Protector on .NET Framework 4.8+ with WinDbg TTD
Unpacking a .NET JIT protector on .NET Framework 4.8+ with WinDbg TTD, using time-travel debugging to recover JIT-compiled methods, and the gotchas flagged along the way.
Reconstructing RtlCreateHeap: Assembly Optimization Patterns in Windows NTDLL
Reconstructing RtlCreateHeap from Windows NTDLL, decoding the assembly optimization patterns that make the original source hard to follow, with the setup and commands all covered.