Tag
A deep-dive technical article explaining how the Windows kernel I/O Manager initializes read I/O requests, from resolving the target file object via NtReadFile to choosing the request path and dispatching to drivers.
Raymond Chen explains why Windows hot-patching exists for x86-32, x86-64, 64-bit ARM, and Itanium but not for older or other architectures like 32-bit ARM, MIPS, Alpha AXP, PowerPC, and SH-3: most predated the hot-patching rules, while 32-bit ARM was excluded because hot-patching is a Windows Server feature and no Server version existed for that architecture.
Raymond Chen explains how Windows on AArch64 implements function hot-patching more simply than on x86, using a 12-byte patch space and a three-instruction trampoline via the xip0 scratch register, noting that pointer authentication (pacibsp) usually guards the function entry.
RPISEC released the full materials from its university-level Malware Analysis course for free on GitHub, covering 12 lectures, 10 labs, and 4 projects on reverse engineering, malware analysis, and anti-analysis techniques. The materials are based on the Practical Malware Analysis book and designed for beginners with zero reverse engineering experience.
Raymond Chen explains how he identified CcNamespace.dll as the key DLL in a chain of prematurely unloaded DLLs by analyzing the debugger's unloaded DLL list and noting naming patterns and order.
A technical debugging story from Microsoft's Raymond Chen about a Windows Explorer crash caused by a thread executing from an unloaded third-party DLL, highlighting how developers investigate such issues.