<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
<channel>
<title>Icerocket blog search: tag:&quot;Windows Internals&quot;</title>
<link>http://blogs.icerocket.com/search?q=tag%3A%22Windows+Internals%22</link>
<description>Blogs Search from IceRocket.com</description>
<language>en-us</language>
<copyright>Copyright 2009, IceRocket.com</copyright>
<item>
 <title><![CDATA[Custom RtlSetProcessIsCritical Implementation]]></title>
 <description><![CDATA[Project: WinNinja Description: RtlSetProcessIsCritical is an undocumented API that was added in Windows XP. It is a light wrapper around NtSetInformationProcess with the ProcessBreakOnTermination information class. When this flag is enabled on a process, it causes a bugcheck to be raised when the pr <b>...</b> ]]></description>
 <link><![CDATA[http://blog.cypherjb.com/2009/11/custom-rtlsetprocessiscritical.html]]></link>
 <pubDate>Wed, 25 Nov 2009 04:49:00 CST</pubDate>
 <guid isPermaLink="false"><![CDATA[2c3084eb384d8aae2f3c0df4352069f7]]></guid>
 <dc:creator>Cypher </dc:creator>
 <source url="http://blog.cypherjb.com/">Ramblings++</source>
</item>
<item>
 <title><![CDATA[Process directory table base doesn’t match CR3]]></title>
 <description><![CDATA[You might occasionally have seen this error when opening a crash dump file: WARNING: Process directory table base <address> doesn't match CR3 <address> What does it mean and why does it happen? The answer to what it means lies in virtual memory. The page directory table is the term used for the base <b>...</b> ]]></description>
 <link><![CDATA[http://analyze-v.com/?p=410]]></link>
 <pubDate>Wed, 18 Nov 2009 07:42:00 CST</pubDate>
 <guid isPermaLink="false"><![CDATA[14493dd843e1bd820897f07916a89e72]]></guid>
 <dc:creator>snoone</dc:creator>
 <source url="http://analyze-v.com">Analyze -v</source>
</item>
<item>
 <title><![CDATA[Beware using user mode handles in a driver]]></title>
 <description><![CDATA[Driver Verifier has been updated in Win7 and several new checks have been added. One of the more interesting checks is the check for accessing user mode handles for kernel mode access. So, for example, take a handle from a user mode application and call ObReferenceObjectByHandle specifying KernelMod <b>...</b> ]]></description>
 <link><![CDATA[http://analyze-v.com/?p=404]]></link>
 <pubDate>Tue, 17 Nov 2009 07:46:00 CST</pubDate>
 <guid isPermaLink="false"><![CDATA[6673f43914f84eeb5497a56f78a45a3a]]></guid>
 <dc:creator>snoone</dc:creator>
 <source url="http://analyze-v.com">Analyze -v</source>
</item>
<item>
 <title><![CDATA[WinNinja File Hiding Code]]></title>
 <description><![CDATA[Project: WinNinja Description: This is a code example from WinNinja, showing how to hide files by hooking the NtQueryDirectoryFile API. Notes: You will need to provide your own hooking library. I'm not posting mine (yet?). You will need to provide your own "ShouldHideFile" function (and obviously yo <b>...</b> ]]></description>
 <link><![CDATA[http://blog.cypherjb.com/2009/11/winninja-file-hiding-code.html]]></link>
 <pubDate>Sun, 1 Nov 2009 02:27:00 CST</pubDate>
 <guid isPermaLink="false"><![CDATA[64052c95e3aaf1906d9b02da88d716c9]]></guid>
 <dc:creator>Cypher </dc:creator>
 <source url="http://blog.cypherjb.com/">Ramblings++</source>
</item>
<item>
 <title><![CDATA[Microsoft Press Adds Seven Books to Library]]></title>
 <description><![CDATA[Microsoft Press added the following books to the Safari Books Online library: Windows Essential Business Server 2008: Administrator’s Companion By: J. C. Mackin. Charlie Russel. Publisher: Microsoft Press Windows® Internals, Fifth Edition By: Mark E. Russinovich. David A. Solomon. Alex Ionescu. Publ <b>...</b> ]]></description>
 <link><![CDATA[http://safaribooksonline.wordpress.com/2009/10/08/microsoft-press-adds-seven-books-to-library/]]></link>
 <pubDate>Thu, 8 Oct 2009 15:26:00 CDT</pubDate>
 <guid isPermaLink="false"><![CDATA[ca2afeed0dcd584a43c424c201fcb32e]]></guid>
 <dc:creator>Safari Books Online</dc:creator>
 <source url="http://safaribooksonline.wordpress.com">Safari Books Online&#039;s Blog</source>
</item>
<item>
 <title><![CDATA[Install Windows 7/Vista using a Pen Drive / USB Drive]]></title>
 <description><![CDATA[I used this method on one of my machines and installed the Windows 7 RC. The main advantage is that by using USB drive you will be able to install Windows 7/Vista in just 15 minutes. You can also use this bootable USB drive on friend’s computer who doesn’t have a DVD optical drive. The method is ver <b>...</b> ]]></description>
 <link><![CDATA[http://sunny.byethost18.com/WP/?p=56]]></link>
 <pubDate>Thu, 20 Aug 2009 17:27:00 CDT</pubDate>
 <guid isPermaLink="false"><![CDATA[819618c82121b228c42aabf351a840ef]]></guid>
 <dc:creator>Sanil</dc:creator>
 <source url="http://sunny.byethost18.com/WP">Coffee Cup</source>
</item>
<item>
 <title><![CDATA[Merry Christmas everybody!]]></title>
 <description><![CDATA[ ]]></description>
 <link><![CDATA[http://indefinitestudies.org/2009/07/20/merry-christmas-everybody/]]></link>
 <pubDate>Mon, 20 Jul 2009 03:33:00 CDT</pubDate>
 <guid isPermaLink="false"><![CDATA[d06627bc841b9e6d5a38f0496985df79]]></guid>
 <dc:creator>dan</dc:creator>
 <source url="http://indefinitestudies.org">Indefinite Studies</source>
</item>
<item>
 <title><![CDATA[Owning Process vs Attached Process]]></title>
 <description><![CDATA[A change was made to Windows around the Server 2003 timeframe that can make for some confusing information in the !thread output. Specifically, I’m referring to the Owning Process and Attached Process fields: The above output is from an XP machine and indicates that no information is available for t <b>...</b> ]]></description>
 <link><![CDATA[http://analyze-v.com/?p=234]]></link>
 <pubDate>Wed, 15 Jul 2009 23:36:00 CDT</pubDate>
 <guid isPermaLink="false"><![CDATA[689f63536d2536a2d9c77330939e7e4f]]></guid>
 <dc:creator>snoone</dc:creator>
 <source url="http://analyze-v.com">Analyze -v</source>
</item>
<item>
 <title><![CDATA[MmMapLockedPagesSpecifyCache and WOW64]]></title>
 <description><![CDATA[I’ve talked about MmMapLockedPagesSpecifyCache before, but this time I wanted to focus on the AccessMode parameter. If you specify an AccessMode of UserMode, the buffer returned will be a user virtual address. Thus, it will be visible to the user and will only be valid in the context of the process  <b>...</b> ]]></description>
 <link><![CDATA[http://analyze-v.com/?p=227]]></link>
 <pubDate>Sun, 12 Jul 2009 20:58:00 CDT</pubDate>
 <guid isPermaLink="false"><![CDATA[15c5dcb117a68b03040aec04157bc922]]></guid>
 <dc:creator>snoone</dc:creator>
 <source url="http://analyze-v.com">Analyze -v</source>
</item>
<item>
 <title><![CDATA[Windows Internals 5th Edition, at last!]]></title>
 <description><![CDATA[I am very pleased to announce that the 5th Edition of the Windows Internals book series is finally shipping for the past couple of weeks, and hard copies are now arriving in the hands of most customers! As my last blog post indicates, I took a hiatus from most of my typical work in the security and  <b>...</b> ]]></description>
 <link><![CDATA[http://www.alex-ionescu.com/?p=63]]></link>
 <pubDate>Sun, 12 Jul 2009 15:59:00 CDT</pubDate>
 <guid isPermaLink="false"><![CDATA[f04522879499e5e77a4c0cbac74ec981]]></guid>
 <dc:creator>aionescu</dc:creator>
 <source url="http://www.alex-ionescu.com">Alex Ionescu&#039;s Blog</source>
</item>
</channel>
</rss>


