Browse by Tags


  • Blog Post: NonPagedPool Depletion

    I recently was engaged on an issue where a server was depleting NonPagedPool over a period of a few days. Ordinarily, we would just use a tool like PoolMon to identify the offending pool tag and then find the driver that uses that pool tag using the method in this article . However, what made this...
  • Blog Post: Disassemble the MBR

    UPDATE: This is why we *LOVE* our readers! After posting a 32-bit disassembly of 16-bit MBR code, I was gently informed of my misstep by three sharp-eyed readers. I’ve corrected the original post below. Thanks go out to Ramon Sola, Jeroen Frijters and 'pedantic gnome' for keeping us honest. Thanks guys...
  • Blog Post: Talkback video: Desktop Heap

    Hello, Matthew here again. Starting today, my team will be bringing you content in the form of videos, as well blog posts. We’ll be hosting these videos on Channel 9 , and we’ll link them from the ntdebugging blog. One way that we’ll be using video is as a means of highlighting topics...
  • Blog Post: How Windows Starts Up (Part the second)

    Howdy folks, David here again with part two of How Windows Starts Up. Today we’ll be covering the Boot Loader Phase . Let’s take a moment to recap where we are at this point. So far, the computer has completed POST, executed the MBR code, located the active partition, executed the Boot Sector code in...
  • Blog Post: How Windows Starts Up (part 1 of 4)

    Hi folks, my name is David and I’m an Escalation Engineer for Microsoft. Since Bryan wrote about How Windows Shuts Down , I thought it would be a good idea to cover How Windows Starts Up. This information applies specifically to Windows 2000, Windows XP, and Windows Server 2003. I will blog separately...
Page 1 of 1 (5 items)