Articles Tagged “Kernel”
5 articles tagged “Kernel”, newest first.
-
The Depths of Windows I/O (Part 6, Final) — Filter Drivers and Minifilters: Why Procmon and Antivirus Scanners Can Intercept I/O
The final instalment of a series illustrating Windows filter drivers and minifilters. It covers the Filter Manager and altitudes, pre/post callbacks, how Pro...
-
The Depths of Windows I/O (Part 5) — NTFS Internals: Understanding the File System Through the MFT
Part 5 of a series explaining NTFS internals with diagrams. Covers the MFT and file records, multiple data streams (Zone.Identifier), hard links and 8.3 name...
-
The Depths of Windows I/O (Part 4) — Cache Manager: When Does Your WriteFile Actually Reach the Disk?
Part 4 of an illustrated series on the Windows cache manager. It covers the cache implemented as a file mapping, read-ahead and lazy writing, how to choose b...
-
The Depths of Windows I/O (Part 2) — Synchronous and Asynchronous I/O: What OVERLAPPED Really Means
Part 2 of a series explaining Windows synchronous and asynchronous I/O (overlapped I/O) with diagrams. It covers what FILE_FLAG_OVERLAPPED means, the four wa...
-
The Depths of Windows I/O (Part 1) — Every Read and Write Becomes an IRP: The Big Picture of the I/O System
Part 1 of a series that explains the Windows I/O system from the ground up. We map out the Object Manager namespace, the three kinds of objects (driver, devi...