The Windows Registry Adventure #6: Kernel-mode objects

This is an in-depth technical analysis of Windows Registry kernel internals (HHIVE/CMHIVE, view maps, cell maps, KCBs, transactions, layered/differencing hives) that documents structure layouts, memory-mapping and synchronization behavior, and highlights security-relevant implementation details and historical vulnerabilities (several CVEs). The author explains how these internals affect reliability and security (e.g., page residency, CoW vs locked pages, small-dir optimization) and points out exploitation primitives and past bugs without reporting an ongoing attack.