NEW350+ rooms now have a live terminal, so you can learn by typing the commands, right in your browser.Learn in a live terminal. 350+ rooms.Try a lab♥ Codelivly is 100% free, no paywall. If it helped you, chip in to keep it running.100% free. Help keep it so.Support us
[>_] ROOM · Cybersecurity
Windows Architecture
Explore the core foundations of the Windows OS. Understand User vs. Kernel mode, the boot process, and the critical system processes that keep Windows running.
Room tasks
1User Mode vs. Kernel Mode
2The Windows Boot Process
3Core Windows Processes
4NTFS Architecture & The Master File Table
5Alternate Data Streams (ADS) & Hidden Data
6File Permissions, ACLs, and Ownership
7Volume Shadow Copies & File Recovery
Frequently Asked Questions
What is the difference between user mode and kernel mode?
User mode runs applications with limited access, while kernel mode runs the OS core with full hardware access. A kernel compromise gives an attacker complete control.
What are key Windows system processes?
Examples include smss.exe, csrss.exe, wininit.exe, services.exe, lsass.exe, and svchost.exe. Knowing normal parents and paths helps spot imposters.
Why should security analysts learn Windows internals?
Normal behavior is the baseline for spotting malware. This free Codelivly room gives beginner-friendly foundations for investigating Windows systems.