Skip to content

Commit a13fe07

Browse files
AdminSam313qwencoder
AdminSam313
and
qwencoder
committed
Add detailed explanations for each source file - how it helps Windows internals learners
Co-authored-by: Qwen-Coder <qwen-coder@alibabacloud.com>
1 parent 5166f6e commit a13fe07

1 file changed

Lines changed: 45 additions & 27 deletions

File tree

‎index.html‎

Lines changed: 45 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -475,6 +475,12 @@ <h2 id="source-files" class="mono"><span class="mono" style="color: var(--text-m
475475
</div>
476476

477477
<h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span> Wine_HQ_Files</h3>
478+
<div class="callout callout-info" style="margin-bottom: 1rem;">
479+
<div class="callout-header mono">
480+
<span class="callout-title">🍷 Wine HQ</span>
481+
</div>
482+
<p style="font-size: 0.85rem;">Wine provides the most complete open-source Windows API implementation. Study these files to understand Windows internals without NDAs.</p>
483+
</div>
478484
<div class="table-wrapper">
479485
<table>
480486
<thead>
@@ -483,37 +489,43 @@ <h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span>
483489
<tbody>
484490
<tr>
485491
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/include/ntdef.h" target="_blank">ntdef.h</a></td>
486-
<td>Core Windows NT type definitions, PEB/TEB structures, LIST_ENTRY macros</td>
492+
<td>Core NT structures: PEB, TEB, LIST_ENTRY. Essential for understanding process memory layout and thread environment blocks used by all Windows programs.</td>
487493
</tr>
488494
<tr>
489495
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/include/winternl.h" target="_blank">winternl.h</a></td>
490-
<td>Undocumented NTAPI functions, Rtl* APIs, internal kernel structures</td>
496+
<td>Undocumented NTAPI functions and Rtl* APIs. Critical for reverse engineering — reveals functions Microsoft never documents publicly.</td>
491497
</tr>
492498
<tr>
493499
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/dlls/ntdll/processenv.c" target="_blank">processenv.c</a></td>
494-
<td>Process environment block access, CreateProcess internals, handle inheritance</td>
500+
<td>Process creation internals, environment block setup, handle inheritance. Learn how CreateProcess actually works under the hood.</td>
495501
</tr>
496502
<tr>
497503
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/dlls/ntdll/virtual.c" target="_blank">virtual.c</a></td>
498-
<td>Virtual memory management, VAD tree implementation, page fault handling</td>
504+
<td>Virtual memory management, VAD trees, page protection. Essential for understanding memory allocation, VirtualProtect, and memory-mapped files.</td>
499505
</tr>
500506
<tr>
501507
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/dlls/ntdll/thread.c" target="_blank">thread.c</a></td>
502-
<td>Thread creation/scheduling, TLS implementation, APC queue management</td>
508+
<td>Thread creation, TLS implementation, APC queues. Learn how Windows schedules threads and manages thread-local storage for malware analysis.</td>
503509
</tr>
504510
<tr>
505511
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/dlls/kernel32/sync.c" target="_blank">sync.c</a></td>
506-
<td>Synchronization primitives: mutexes, semaphores, events, critical sections</td>
512+
<td>Synchronization primitives: mutexes, semaphores, events, critical sections. Essential for understanding race conditions and concurrent code.</td>
507513
</tr>
508514
<tr>
509515
<td class="mono"><a href="https://github.com/wine-mirror/wine/blob/master/include/winnt.h" target="_blank">winnt.h</a></td>
510-
<td>Complete Windows structure definitions, exception handling, security descriptors</td>
516+
<td>Complete Windows structure definitions, EXCEPTION_RECORD, SECURITY_DESCRIPTOR. The foundation for exception handling and access control.</td>
511517
</tr>
512518
</tbody>
513519
</table>
514520
</div>
515521

516522
<h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span> ReactOS_Files</h3>
523+
<div class="callout callout-info" style="margin-bottom: 1rem;">
524+
<div class="callout-header mono">
525+
<span class="callout-title">⚛️ ReactOS</span>
526+
</div>
527+
<p style="font-size: 0.85rem;">ReactOS implements the Windows NT kernel from scratch. Study these files to see actual kernel-mode code for process, memory, and object management.</p>
528+
</div>
517529
<div class="table-wrapper">
518530
<table>
519531
<thead>
@@ -522,41 +534,47 @@ <h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span>
522534
<tbody>
523535
<tr>
524536
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/ke/process.c" target="_blank">ke/process.c</a></td>
525-
<td>Process object creation, address space switching, process attachment</td>
537+
<td>Process object creation, address space switching, process attachment. Learn kernel-side process management used by task managers and debuggers.</td>
526538
</tr>
527539
<tr>
528540
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/ke/thread.c" target="_blank">ke/thread.c</a></td>
529-
<td>KTHREAD structure, thread scheduling, wait blocks, context switching</td>
541+
<td>KTHREAD structure layout, thread scheduling, wait blocks, context switching. Essential for understanding how the scheduler manages CPU time.</td>
530542
</tr>
531543
<tr>
532544
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/mm/ARM3/virtual.c" target="_blank">mm/ARM3/virtual.c</a></td>
533-
<td>Windows NT memory manager, section objects, memory-mapped files</td>
545+
<td>Windows NT memory manager, section objects, memory-mapped files. Critical for understanding file mapping, shared memory, and page faults.</td>
534546
</tr>
535547
<tr>
536548
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/ob/objdir.c" target="_blank">ob/objdir.c</a></td>
537-
<td>Object manager namespace, directory structure, object parsing</td>
549+
<td>Object manager namespace, directory structure, object parsing. Learn how Windows organizes all kernel objects in a hierarchical filesystem-like structure.</td>
538550
</tr>
539551
<tr>
540552
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/ob/obhandle.c" target="_blank">ob/obhandle.c</a></td>
541-
<td>Handle table implementation, reference counting, handle inheritance</td>
553+
<td>Handle table implementation, reference counting, handle inheritance. Foundation for understanding handle leaks and privilege escalation.</td>
542554
</tr>
543555
<tr>
544556
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/io/iomgr/device.c" target="_blank">io/iomgr/device.c</a></td>
545-
<td>Device object creation, driver dispatch, IRP handling basics</td>
557+
<td>Device object creation, driver dispatch, IRP handling basics. Essential for driver development and understanding I/O completion ports.</td>
546558
</tr>
547559
<tr>
548560
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/ps/create.c" target="_blank">ps/create.c</a></td>
549-
<td>Process/thread creation, PEB/TEB initialization, image loading</td>
561+
<td>Process/thread creation, PEB/TEB initialization, image loading. See how Windows loads executables and sets up the initial thread context.</td>
550562
</tr>
551563
<tr>
552564
<td class="mono"><a href="https://github.com/reactos/reactos/blob/master/ntoskrnl/include/internal/ob.h" target="_blank">include/internal/ob.h</a></td>
553-
<td>Object header structure, object type objects, callback mechanisms</td>
565+
<td>Object header structure, object type objects, callback mechanisms. Learn the internal structure preceding every kernel object for forensics.</td>
554566
</tr>
555567
</tbody>
556568
</table>
557569
</div>
558570

559571
<h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span> SystemInformer_Files</h3>
572+
<div class="callout callout-info" style="margin-bottom: 1rem;">
573+
<div class="callout-header mono">
574+
<span class="callout-title">🔍 SystemInformer</span>
575+
</div>
576+
<p style="font-size: 0.85rem;">SystemInformer (Process Hacker) shows how to query and analyze live Windows systems. Study these to build system monitoring and forensics tools.</p>
577+
</div>
560578
<div class="table-wrapper">
561579
<table>
562580
<thead>
@@ -565,31 +583,31 @@ <h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span>
565583
<tbody>
566584
<tr>
567585
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/phlib/native.c" target="_blank">phlib/native.c</a></td>
568-
<td>Native API wrappers, NtQuery* functions, system information classes</td>
586+
<td>Native API wrappers, NtQuery* functions, system information classes. Learn to query kernel data without documented APIs for security tools.</td>
569587
</tr>
570588
<tr>
571589
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/Windows/ntos.h" target="_blank">Windows/ntos.h</a></td>
572-
<td>Comprehensive NT kernel structures, exported function prototypes</td>
590+
<td>Comprehensive NT kernel structures, exported function prototypes. The most complete public header set for Windows kernel reverse engineering.</td>
573591
</tr>
574592
<tr>
575593
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/Plugins/ProcessHacker/procprp.c" target="_blank">procprp.c</a></td>
576-
<td>Process property enumeration, EPROCESS field parsing, handle counting</td>
594+
<td>Process property enumeration, EPROCESS field parsing, handle counting. Learn to extract process information for task managers and AV scanners.</td>
577595
</tr>
578596
<tr>
579597
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/Plugins/ProcessHacker/thrdprp.c" target="_blank">thrdprp.c</a></td>
580-
<td>Thread enumeration, KTHREAD analysis, wait reason, stack walking</td>
598+
<td>Thread enumeration, KTHREAD analysis, wait reason, stack walking. Essential for building debuggers and thread analyzers.</td>
581599
</tr>
582600
<tr>
583601
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/Plugins/ProcessHacker/memprp.c" target="_blank">memprp.c</a></td>
584-
<td>Memory map enumeration, VAD walk, protection flags, private bytes</td>
602+
<td>Memory map enumeration, VAD walk, protection flags, private bytes. Learn to analyze process memory for malware detection and forensics.</td>
585603
</tr>
586604
<tr>
587605
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/Plugins/ProcessHacker/hndltree.c" target="_blank">hndltree.c</a></td>
588-
<td>Handle tree visualization, object reference tracking, handle leaks</td>
606+
<td>Handle tree visualization, object reference tracking, handle leaks. Critical for debugging resource leaks and rootkit detection.</td>
589607
</tr>
590608
<tr>
591609
<td class="mono"><a href="https://github.com/winsiderss/systeminformer/blob/master/Plugins/ProcessHacker/drvprp.c" target="_blank">drvprp.c</a></td>
592-
<td>Driver enumeration, module base addresses, driver memory regions</td>
610+
<td>Driver enumeration, module base addresses, driver memory regions. Learn to detect kernel modules for anti-rootkit and security auditing.</td>
593611
</tr>
594612
</tbody>
595613
</table>
@@ -604,23 +622,23 @@ <h3 class="mono"><span class="mono" style="color: var(--text-muted);">//</span>
604622
<tbody>
605623
<tr>
606624
<td class="mono"><a href="https://github.com/microsoft/Windows-driver-samples" target="_blank">microsoft/Windows-driver-samples</a></td>
607-
<td>Official WDF/KMDF examples, driver templates, best practices from Microsoft</td>
625+
<td>Official WDF/KMDF examples, driver templates, best practices from Microsoft. Start here for legitimate driver development patterns and APIs.</td>
608626
</tr>
609627
<tr>
610628
<td class="mono"><a href="https://github.com/ionescu007/ntoskrnl" target="_blank">ionescu007/ntoskrnl</a></td>
611-
<td>Windows 10 kernel headers, structure definitions, research notes by Alex Ionescu</td>
629+
<td>Windows 10 kernel headers, structure definitions, research notes by Alex Ionescu. Advanced kernel internals from a Microsoft engineer.</td>
612630
</tr>
613631
<tr>
614632
<td class="mono"><a href="https://github.com/tandasat/Complete-Pe-Parse" target="_blank">tandasat/Complete-Pe-Parse</a></td>
615-
<td>PE file format parsing, section headers, import/export table resolution</td>
633+
<td>PE file format parsing, section headers, import/export table resolution. Essential for malware analysis and understanding executable loading.</td>
616634
</tr>
617635
<tr>
618636
<td class="mono"><a href="https://github.com/j00ru/windows_kernel_types" target="_blank">j00ru/windows_kernel_types</a></td>
619-
<td>Accurate kernel structure offsets for multiple Windows versions</td>
637+
<td>Accurate kernel structure offsets for multiple Windows versions. Critical for reverse engineering across different Windows builds.</td>
620638
</tr>
621639
<tr>
622640
<td class="mono"><a href="https://github.com/Mandiant/flare-vm" target="_blank">Mandiant/flare-vm</a></td>
623-
<td>Reverse engineering VM setup, kernel debugging tools, analysis environment</td>
641+
<td>Reverse engineering VM setup, kernel debugging tools, analysis environment. Professional malware analysis toolkit configuration.</td>
624642
</tr>
625643
</tbody>
626644
</table>

0 commit comments

Comments
 (0)