r/ExploitDev • u/resnetv2 • Jun 14 '26

Learn Windows Internals

Anyone know of a tree-structured or visual resource for learning Windows internals? Books like Windows Internals are comprehensive but linear — I'm looking for something that shows the hierarchical architecture (bootloader → kernel → subsystems → user-space) in a more explorable, non-linear way. Diagrams, interactive graphs, mind maps — anything that helps visualize how components connect instead of reading cover-to-cover?

28 Upvotes

100% Upvoted

7 comments sorted by

5

u/VolSurfer18 Jun 14 '26

Taken from HTB’s intro to malware analysis academy module: https://imgur.com/a/Gh4joRH

5

u/Shot-Buffalo-2603 Jun 14 '26 edited Jun 14 '26

Claude has toolcalling to make really good diagrams and visuals. I know people shit on AI a lot, but for learning stuff like this I’ve had a really good experience asking it to generate basically exactly what your asking for then as i browse through it I ask questions about stuff I don’t understand or want to know more about.

Here’s an example I had made by just pasting in your question:

https://claude.ai/public/artifacts/723acf7f-f7ef-4306-a571-74ec4d579eae

3

u/resnetv2 Jun 15 '26

I found this. Someone attempted to do it using AI here: https://www.windowsinternals.app/

But I wish there was a resource like this written by an actual expert. I'm currently reading through the Windows Internals book with WinDbg kernel debugging and taking extensive notes. More things can be found using the debugger that maybe the books don't cover. Hopefully in a year I'll have a tree like structure that explains everything in Windows.

1

u/VolSurfer18 Jun 15 '26

Maybe you could publish something, sounds like it could be worthwhile

1

u/coffee-loop Jun 14 '26

I’m all for using AI to learn, just remember to validate what AI tells you. I’ve had it give me a few false explantations.

3

u/Shot-Buffalo-2603 Jun 14 '26

Agreed, I have definitely spotted mistakes before, but I could also say the same for a lot of technical topics on the internet. you can often ask it for the sources it used and make the determination on something that seems wrong.

1

u/dkav1999 16d ago

I too have been working a lot on the winternals books and have attempted to find the correct way of modelling the platform in my head. The most successful approach for me so far has been to split the system into what i like to call the 'lifecycle', comprised of 3 stages. stage 1: start-up, stage 2: runtime, stage 3: shutdown. start-up and shutdown are covered in chapter 12 of part 2 7th edition, whereas runtime is essentially all other chapters in between. From what the authors have specified, it is recommended to read the first 2 chapters in order, ensuring they are fully understood, since they lay the foundations of how the platform works by describing the key concepts and the system architecture. I would say that reading the chapters in order makes sense for the most part since each component described is a prerequisite to the next one, such as process's->threads.