MmScrubMemory
The Nemesis of Virtual Machine Introspection
A story about how one scary function accompanied me for more than 5 years.
[Read More]
-
-
WoW64 internals
...re-discovering Heaven's Gate on ARM
WoW64 - aka Windows (32-bit) on Windows (64-bit) - is a subsystem that enables 32-bit Windows applications to run on 64-bit Windows. Most people today are familiar with WoW64 on Windows x64, where they can run x86 applications. WoW64 has been with us since Windows XP, and x64 wasn’t the... [Read More] -
KDNET over USB
Remote kernel debugging (not only) your Windows on ARM
Windows on ARM is slowly getting its way on the market (again). Some Windows internals enthusiasts can’t wait to peek under the hood, which goes hand-in-hand with question whether attaching remote kernel debugger - and disabling Secure Boot - is possible. Of course, it is. [Read More]