Windows Kernel Introspection (WKI) :: am0nsec
Table of contents Table of contents Introduction User-Mode Application Kernel-Mode Driver Example: Listing Kernel Memory Pool Tag Final Thoughts Introduction Over the last few years that I spent learning more and more about Microsoft Windows, it has been more and more apparent that studying the NT kernel is an incredibly deep and vast subject, nevertheless particularly interesting. A lot of research exists online and Windows Internals books are probably the best allies for this journey.
Tim Misiak Program Database Microsoft Windows Windows Internals Memory Manager Virtual Address Descriptors
Source: amonsec.net