Interactive reference

Understand Windows from the inside out

Start with the map below — each block is a real part of the system. Click to learn what it does, then dive into topics, labs, and guided paths.

Guided paths for beginnersClickable schematicsHands-on labs (EVTX, ACL, DNS)
Click any block to see what it does, then jump into the matching topic in the tree.
Windows system architecturentdll syscalls — user/kernel boundaryUSER MODEKERNEL MODEDRIVERS & PLATFORMDesktop & shelluserApps & runtimeuserVirtualizationuserServices (SCM)userLogon & authuserSecurity policyuserRegistryuserDiagnostics & logsuserIPC (ALPC)userProcesses & threadskernelMemory managerkernelExecutive & objectskernelI/O ManagerkernelStorage & NTFSkernelNetwork stackkernelAccess checks (SRM)kernelDevice driversplatformHAL & platformplatformBoot & firmwareplatform

Start here

A guided path for people who are new to Windows internals.

View full path

Deep-dive paths

Curated sequences that connect multiple topics into one concept journey.

Explore all topics

Diagnostics -> Event Log -> EVTX

Start from Windows telemetry, understand providers and channels, then move into EVTX structure and hands-on parsing.

Processes -> Objects -> Scheduling

Learn how Windows represents running work, how handles and objects fit in, and how the scheduler actually decides what runs.

Memory -> VAD -> Storage Cache

Move from private virtual address spaces into VADs, pools, and then the cache/storage layer that shapes real-world file I/O performance.

Startup -> Logon -> Auth -> Tokens

Follow the path from early session initialization into Winlogon, LSASS, authentication packages, and the tokens that processes actually use.

Processes -> PE -> Loader -> WOW64

Bridge the gap between a running process and the executable/runtime machinery that maps images, loads DLLs, and keeps 32-bit apps working on 64-bit Windows.

Security deep dive

From identity (tokens) to object policy (DACL/SACL), through kernel access checks (SRM), ending with UAC and integrity boundaries.

Networking stack tour

Follow a connection from Winsock and DNS through TCP/IP, filtering (WFP/BFE), down to NDIS and the NIC.

GUI & session UI

Understand sessions, window stations, desktops, USER/GDI objects, and the CSRSS/Win32k plumbing behind the shell.

Memory deep dive

VADs, pools, paging, working sets, and how the cache uses RAM.

I/O & drivers

From I/O Manager and IRPs through driver stacks and PnP power.

Virtualization & VBS

Hyper-V partitions, enlightened I/O, and virtualization-based security.

Authentication path

From Winlogon through LSASS to Kerberos/NTLM and crypto plumbing.

Loader & runtime

PE images, DLL loading, and WOW64 on 64-bit Windows.

Storage path

Volumes, NTFS, cache, and reparse points.

Top-level themes

System architecture

How Windows separates user mode and kernel mode, and why the system is built in layers.

Processes & threads

How Windows represents work, isolates applications, and schedules execution.

Memory management

Virtual address spaces, paging, working sets, and how Windows tracks memory.

Diagnostics & logging

Where Windows records what happened: Event Log, ETW, and crash-oriented clues.

Security

Access tokens, privileges, integrity, and how Windows decides who can do what.

I/O system

How Windows turns API requests into IRPs, driver stack work, and device operations.

Services & background infrastructure

How Windows launches, groups, isolates, and supervises long-running background components.

Registry & configuration

How Windows stores system and application configuration in hierarchical hives.

Storage & file systems

Disks, volumes, cache, and the file-system layers that make persistence usable.

Networking

How Windows moves data through the TCP/IP stack, filtering layers, and endpoint APIs.

Startup & shutdown

How Windows goes from firmware to an interactive session, and how it tears systems down safely.

GUI & windowing

Sessions, desktops, USER/GDI objects, and the Windows-specific UI machinery above the core kernel.

IPC & component boundaries

How Windows components communicate across process boundaries using local RPC, named pipes, and other message channels.

Authentication & logon

How Windows turns credentials into authenticated sessions, security contexts, and usable access tokens.

Executable loading & runtime

PE images, DLL loading, runtime data structures, and compatibility layers such as WOW64.

Virtualization

Hypervisor layers, virtual machines, and how Windows isolates guests from the host.