Learning Path

Windows Service Internals

Analyze Windows service DLLs, follow local RPC dispatch, reason about impersonation and access tokens, and understand registry authorization across privilege boundaries.

4 available Start the path
  1. 1 advanced

    Anatomy of a Windows Service DLL in Ghidra

    Load a Windows service DLL with matching public symbols, separate hosting from service logic, and turn decompiler output into a reliable component map.

  2. 2 advanced

    Windows Local RPC and ALPC: From Client Call to Service Dispatcher

    Understand Windows local RPC bindings, interfaces, NDR stubs, endpoints, service dispatch, and the authorization boundaries the transport does not provide.

  3. 3 advanced

    Windows Service Impersonation: Which Token Does an RPC Handler Use?

    Follow process and thread tokens through a Windows service call, then apply impersonation and access checks without creating a confused deputy.

  4. 4 advanced

    Windows Registry Security: DACLs, Access Tokens, and Privileged Services

    Understand how Windows authorizes registry access, how key handles preserve granted rights, and why privileged services can cross a caller boundary.

All tutorials and learning paths