Windows Internals
2025
PoolTag is a 4 bytes value (unsigned int value) present in the header (i.e. POOL_HEADER) .Microsoft creates pool tag mostly for debugging purposes. So, whenever Kernel creates any object in pool memory, it creates a POOL_HEADER which contains a PoolTag field which contains information regarding what kind of object is being created.
A deep dive into Windows objects, focusing on their structure, headers, and relationships. This blog covers key components like _OBJECT_HEADER, OBJECT_TYPE, and ObTypeIndexTable, providing insights into how Windows organizes and references objects.
A comprehensive guide to understanding and creating Windows shellcode from scratch for exploit development. This article includes practical insights into using WinDbg for effective debugging and analysis.
A comprehensive guide to understanding and creating Windows shellcode from scratch for exploit development. This article includes practical insights into using WinDbg for effective debugging and analysis.
Hands on parsing PE files with WinDbg and explore their structures for debugging and reverse engineering.
Hands on parsing PE files with WinDbg and explore their structures for debugging and reverse engineering.