Malware Analysis Space: Windows Internals: Research Notes from the 6th to 7th Edition

Windows Internals: Research Notes from the 6th to 7th Edition

The Path Toward Clarity in the Increasing Complexity, Challenges, and Evolution of Modern Computing

“To understand the immeasurable, the mind must be extraordinarily quiet, still.”
— Jiddu Krishnamurti

Seeker(李标明) · @clibm079

China · Independent Malware Analyst & Researcher

From 2026.07.27 to 2026.08.10

Prologue: Curiosity-driven, keep moving

I had a special feeling during that quite exploration stage about malware samples in history, which let me be aware of my limited knowledge, and I still did not deeply understand the real evolution of modern computing, to me, there was a big challenge without the map of mental model, the profesional knowledge is not systemtical, this mades me continueously explorate the path of clarity.

With the above pure original thinking and to build the mental model, I took a short break and improved and updated my personal website with a dated research archive. and sometimes for making a record with short videos about Windows internals. And then continued to read the books Windows internals 7 Part 1 and Part 2.

In fact, From september 2025, I had aready made a plan and started to learn Windows internals 6 Part 1, it means that by now, It has almost took me one years to read the books from Windows internals 6 (Part 1 and Part 2) to 7 (Part 1 and Part 2), it’s really a long time to study and understand; I had to slow down and follow the pace. And I was happy to gain a lot of things during the time and learn more useful things from other people in the global cyber community. Thanks so much! Besides the knowledge, the one important thing is that I start to form my new reading strategy. The long-term habit of diving deeper details in the past was dangerous, and now I have changed it and improved it.

Here, I would like to make a record with my personal observation and understanding of the process of reading. It is a wide topic, but to pick my personal perspective as a malware analyst and researcher, it’s very limited thinking and exploration.

The Evolution from Traditional to Modern Computing

First, let’s simply have a look at and compare the architecture of the “Windows Internals 6th Edition era” with modern Windows. The most significant evolution is the integration of the hypervisor layer.

Figure 1.1: Simplified Windows architecture comparison (Source from the books Windows Internals 6 and 7).

It is well known that computers are designed with a structured, layered architecture. In my personal perspective, the biggest evolution is from “The operating system controls the computer.” to “The operating system is one layer in a larger computing stack.” as follows:

Figure 1.2: A simplified version: a mental model for the runtime stack from traditional to modern computing.

VBS Architecture and Windows Kernel Security Evolution

And virtualization-based security architecture goes further. The hypervisor is the ultimate authority for memory isolation between VTLs. VL0 is the normal Windows environment, and VL1 is the more trusted environment. The normal Windows kernel (VTL0) cannot directly access VTL1 memory.

Figure 2.1: Source from windows internals 7^th edition part 1: Windows 10 and Server 2016 VBS architecture.

Connecting with the previous mental model, modern computing techniques runtime stack becomes the following:

Figure 2.2: A simplified version: a modern Windows Internals goes beyond the classic architecture.

In my view, the evolution of modern Windows security involves multiple layers of protection, including CFG, HVCI, and Code Integrity. The major architectural change is the introduction of virtualization-based security (VBS), which extends the Windows security architecture by separating normal kernel execution from security-sensitive components through virtualization-based isolation. In short, VBS reorganized the Windows security architecture by placing selected security-critical components into a virtualization-isolated environment while keeping normal Windows execution in VTL0.

The old Windows model: the kernel was the ultimate trust boundary. That is called "game over" if the kernel is compromised. But the modern Windows model is no longer the only highest-trust software layer.

Obviously, that is the awareness of risk, and I would like to describe it this way: Don't put all your eggs in one basket. Yes, the deeper principle is: Do not rely on a single security boundary. Build multiple independent layers of protection.

And one important thing being changing is: the kernel’s knowledge becomes the key fundametal to the modern computing research, not the highest trust layer, it is just one layer’s knowledge need to study, the learning curves are steeper, it menas more challenging, more patience and more time.

Not only that, but when I noted that the tool developed HyprDbg v.01 was released, a list hook like this is a reminder of how much deep knowledge modern systems demand. It demands a solid understanding of:

Ø CPU architecture and privileged instructions

Ø Paging and EPT

Ø VMX/VT-x and the VMCS

Ø Windows kernel internals

Ø Exception handling and interrupt delivery

Figure 2.3: Source from GitHub HyperDbg.

If we are back to the history about “Blue Pill” in 2006, the virtualization technique disscussion, until now, as we know, it is a long time, still exploring. It’s not easy to understand the whole evolution and improvement; it’s not a quick win behind the deeper knowledge and practice.

People often say: security is asymmetric: defenders must protect everything, while attackers need only one path. Yes, the direction of operation and final output are right.

But from the above evolution and observation, in my opinion, mastery in modern computing is symmetric in the deep-dive low-level security research direction—on both sides, it would take many years of study, practice, patience, and continual learning. For this reason, it’s equal.

UEFI: Establishing the Root of Trust and Expanding the Attack Surface

Let’s first have a look at the mental model from legacy BIOS to modern UEFI.

Figure 3.1: A simplified version: a mental model from BIOS to modern UEFI.

The evolution is not only "BIOS was replaced by UEFI." The deeper change is that firmware became part of the trusted computing architecture. The biggest change brought by UEFI is that it transformed firmware from a simple hardware initialization program into a security and platform management layer.

Figure 3.2: Source from windows internals 7^th edition part 2: CHAPTER 12 Startup and shutdown.

As we know, they are two sides of the same coin. The positive side: UEFI improved security. But the negative side: Anything that executes before Windows becomes a high-value target. Let’s have a look at how UEFI bootkits created a new attack surface as follows:

Figure 3.3: Source from Ben Gurion University: UEFI Memory Forensics:A Framework for UEFI Threat Analysis

From the above table we can observe the fact: a new security strategy also creates a new attack surface. When adding a new strategy, the system becomes more sophisticated, and the learning curves also become steeper. And the new attacking method discovered when deeply understanding goes on.

As we know, simple is best, but modern computing, and nowadays become very complex.

CPU Microarchitecture: Expanding the Security Boundary Beyond Software

The part is a really deep concept to study. The two most destructive and effective hardware-side-channel attacks were named Meltdown and Spectre. Let’s simply introduce them.

Meltdown: KVA (kernel virtual address) Shadow is a Windows kernel memory-management mitigation implemented in VTL0. It was introduced to mitigate Meltdown, which allowed a malicious user-mode process to speculatively read privileged kernel memory that should have been inaccessible.

Spectre: Retpoline demonstrates how compiler-generated code can become a critical part of CPU security by mitigating indirect branch attacks in the Windows kernel and drivers.

Maybe many people initially think security is mainly as follows:

Figure 4.1: Maybe many people think security.

Modern Windows security is not only about APIs and kernel objects. It also depends on how the compiler generates instructions and how the CPU executes those instructions internally. This is one of the most important mindset shifts when moving from traditional malware analysis toward systems security research.

Modern security goes further; it starts at the application layer and goes downward and is focused on runtime execution as follows:

Figure 4.2: Modern security goes further about mitigation with Meltdown and Spectre.

As we see, every layer can influence security. Maybe a quick reading might produce: “Spectre abuses speculative execution. Retpoline fixes it.” But deeper understanding requires connecting many concepts as follows:

Figure 4.3: many concepts.

As we see, each step depends on the previous one. That is a major conceptual shift. It took me more than one week to build a deeper model of how computers’ instructions actually execute. This is a major conceptual shift as follows:

Figure 4.4:A mental model of the instruction executes.

In my personal perspective, for low-level topics like Spectre, Meltdown, Retpoline, and CPU speculation, the most valuable outcome is not memorising every technical detail. I may never directly work on microarchitecture analysis or CPU-side-channel research, but understanding these topics can still have significant value because really expand and improve my mental model from software protection to the entire computing stack.

Observation on my personal perspective

From the above observation, modern computing moved from an operating-system-centric model to a platform-security model, where firmware, hardware, virtualization, and the OS cooperate to create a trusted execution environment. Modern Windows security requires understanding not only applications and the kernel, but also compiler behavior and the CPU execution model. The following two-part mental model explains the evolution from Windows Internals 6th Edition to 7th Edition:

Figure 5: A simplified version: A mental model from Windows Internals 6^th edition to 7^th edition.

In my personal view, the security boundary spans multiple layers, for modern low-level security research, cross-layer reasoning ability is becoming essential. But it doesn’t mean that one master each layer; it’s very difficult.

And to face the evolution, one thing must be sure: Modern computing is removing old boundaries; it requires a broader mental model. Making the mental model shift from the legacy to the modern malware era.

The more challenge and value of community

Besides the deeper knowledge, another challenge is: Those elite-tier APT groups had mastered Windows internals very well many years ago in the legacy computing era. And nowadays, to be honest, I’m not sure right now what level they’ve advanced to. But one thing I’m very confident in is that the professional knowledge they deep-dive into would shock most people, as they shocked many experts many years ago. From a purely technical design perspective rather than an attack or destruction perspective, their advanced skill and professional knowledge let me know that I have been far behind them. And the limited knowledge and curiosity makes me learn more and deeper, and one important thing is to keep being humble. Especially moving to modern computing, It is not just about recognising how little I know but also about facing complexity and understanding it takes time and patience.

And now In my personal perspective, AI is on fire; the industry is spending billions on AI-driven tools to speed up observation, It's useful for automated triaging, handling massive attacks, and high-speed incident responses. But human-depth malware reports explored by the public are becoming rare in the global community, which is the new blind spot and challenge and crisis and also creates more opportunities for high-tier threat actors. The balancing between them is not an option.

It’s not too bad; those challenges go with a positive side. I am very happy to see in the global community so many people would like to share what they do, what they discover and more. On the stage of quiet exploration, the community inspires me a lot, and I am lucky to have the chance to touch and connect. One important thing is to observe the changing, which makes me think more and improves myself. Thank you!

And here, thanks to everybody in the windows internals books by Pavel Yosifovich, Mark E. Russinovich, David A. Solomon, Alex Ionescu. I really understood the process of writing a book, each step and every moment, and everything came from their family’s support; it was very important and significant. I think it would be very hard for me to expand the perspective from scratch without their contributions. The study of Windows Internals 6th and 7th Editions shaped my mental model of modern Windows security. I appricated everything. Thank you!

And thanks to the all references, and thanks to everybody from HyperDbg and Ben Gurion University, whose contributions also helped me expand my personal perspective of malware research and became the important part of this article. Thank you!

And finally, to be honest, these research notes are just the limited understanding on the current stage of exploration; I still need to continuously update my knowledge and recognition and hope to learn more and gain practical experience. Yes, it is a continuous journey of understanding.

References

[1]. https://www.amazon.com/Windows-Internals-Part-architecture-management/dp/0735684189

[2]. https://www.amazon.com/Windows-Internals-Part-2-7th/dp/0135462401
[3]. https://github.com/HyperDbg/HyperDbg/releases?page=4
[4]. https://en.wikipedia.org/wiki/Blue_Pill_%28software%29
[5]. https://arxiv.org/html/2501.16962v2

[6]. https://malwareanalysisspace.blogspot.com/2025/10/revisiting-subvirt-blue-pill-from.html

Epilogue: What This Exploration Taught Me

1. Recording complex matters at the right moment—summarizing them and writing them down—helps me save time in the long run.

2. Not every study needs an immediate application. Some studies build the framework or mental model that makes future understanding possible.

3. Sometimes, If Windows Internals feels harder, you would change your reading strategy.

Annotation: In all the sentences I wrote and used the word “you or your or yourself” in, it talked to me or “the malware sample itself, especially in my poem I did”, not the reader. I must clarify my motivation.