Shlomi Boutnaru, Ph.D.The Windows Process Journey — “MsMpEng.exe” (Antimalware Service Executable)“MsMpEng.exe” is the main binary launched by the “WinDefend” (as shown below) Windows service…8h ago8h ago
Shlomi Boutnaru, Ph.D.The Windows Concept Journey — I/O Manager (Input/Output Manager)The “I/O Manager” is used for managing hardware devices and providing interfaces for applications to access/use those hardware devices…1d ago1d ago
Shlomi Boutnaru, Ph.D.The Portable Executable Journey — Address of Entry PointThe “Address of Entry Point” is a data field in the “Optional Header”…1d ago1d ago
Shlomi Boutnaru, Ph.D.The Windows Security Journey — SEHOP (Structured Exception Handling Overwrite Protection)The goal of the SEHOP (Structured Exception Handling Overwrite Protection) mechanism is to protect stack-based exception chains from…2d ago2d ago
Shlomi Boutnaru, Ph.D.The Windows Forensic Journey — ukg.db (Windows Recall)The “ukg.db” is part of the “Window Recall” feature. It is an SQLite database which is used for storing information as text and mapping it…3d ago3d ago
Shlomi Boutnaru, Ph.D.The Windows Concept Journey — CM (Configuration Manager)The goal of the “Configuration Manager” is to manage the registry…3d ago3d ago
Shlomi Boutnaru, Ph.D.The Windows Concept Journey — Cache ManagerThe “Cache Manager” is Windows works together with the “Memory Manager”…4d ago4d ago
Shlomi Boutnaru, Ph.D.The Windows Concept Journey — Memory ManagerThe goal of the “Memory Manager” is to handle/manage the physical memory of the current system, which is RAM based (Random Access Memory)…5d ago5d ago
Shlomi Boutnaru, Ph.D.The Windows Concept Journey — Executive (The Windows Executive)As detailed in the “Windows NT Architecture”…5d ago5d ago
Shlomi Boutnaru, Ph.D.The Windows Security Journey — SafeSEH (Safe Structured Exception Handling)The goal of the SafeSEH (Safe Structured Exception Handling) mechanism is to protect stack-based SEH…6d ago6d ago