Windows Native API

on YouTube ↗01h 24m

" summary

Covers the thin layer under Win32: shows a C program calling Exit/ExitProcess versus calling NTTerminateProcess directly and how that skips Win32 hooks like silent-process-exit monitoring. Explains WoW64 thunking (32-bit apps live in low 4GB and use a 32→64 jump via the Wow64 CPU DLL, aka “Heaven’s Gate”), the \\??\\ object namespace and 32KB UTF‑16 string limit, notes ~500 native functions, cites Sysinternals fuzzing that produced many blue screens, and points to WinDbg, WDK, ReactOS and s-trace/NTTrace as useful tools.

AI-written summary · about

" chapters (17)

1. 0:00Intro
2. 0:16Windows Native API
3. 2:30Applications and the Kernel
4. 8:54A simple example
5. 19:52Inside a native call
6. 26:08Note on kernel development
7. 27:33Inside the kernel
8. 28:15Argument validation
9. 29:39Return codes
10. 33:32Types of arguments
11. 34:12Simple value arguments
12. 40:23Handle arguments
13. 43:13String arguments
14. 45:51Object attributes arguments
15. 54:25Pointer to memory arguments
16. 55:03Access to memory arguments
17. 58:02Object namespace - WinObj

" related talks

• 32mIntroduction to Windows Kernel Mode DebuggingYamin Tian · BSidesSF 2018
• 42mWindows 10 Segment Heap InternalsMark Vincent Yason · Black Hat USA 2016
• 58mDebugging one layer deeperKevin Gosse · NDC Oslo 2021
• 01h 01mInternals of ExceptionsAdam Furmanek · NDC Sydney 2019
• 34mWindows System Internals with PowerShellAdam Driscoll · PowerShell Summit North America 2014
• 40mCommSec D1 - The Life & Death of Kernel Object AbuseSalf ElSherei, Ian Kronquist · Hack In The Box Amsterdam 2018
• 46mFor The Win: The Art Of The Windows Kernel FuzzingGuangming Liu · HITBSecConf 2019 Amsterdam
• 50mThe Beast Within - Evading Dynamic Malware Analysis Using Microsoft COMRalf Hund · Black Hat USA 2016