Thread Navigator

@OSdev_ ↔ @mmoustafa8108 ↔ @ivanrouzanov conversation

@OSdev_
OS Dev@OSdev_
13 views Aug 26, 2026 ~1 min read
Advertisement
@OSdev_
OS Dev@OSdev_
When a Windows process starts, where does the Windows loader actually run, and how does execution reach user code?
@mmoustafa8108
Mohammed Moustafa@mmoustafa8108
the windows loader runs in user mode, in ntdll.dll, the layer between kernel mode and user mode
@OSdev_
OS Dev@OSdev_
If NTDLL contains the loader, who maps NTDLL before the loader is already running?
@ivanrouzanov
Ivan Rouzanov@ivanrouzanov
Process manager in kernel mode orchestrates creation of the process address space and asks mm to map ntdll to the new process. When the first thread is created (in kernel), it is suspended and then resumed to "return" to user mode and start execution in ntdll to run the loader.
@OSdev_
OS Dev@OSdev_
This is answer I was looking for, perfect!
Actions
What You Can Do
  • Export as PDF or Markdown
  • Batch Export to Notion
  • Bookmark & Highlight
  • Screenshot Tweet
Create Free Account

Includes 7-day Premium trial

Advertisement

Save Threads to Notion

Upgrade to Premium to automatically save unrolled threads directly to your Notion workspace. Includes unlimited saves, visual editor, and ad-free experience.

Highlight Key Tweets

Upgrade to Premium to highlight individual tweets in any thread, then export just the highlights to Notion — like Readwise, for threads.

Save to Notion

Pick categories to organize this thread in your Notion database.

Sign Up to Highlight Tweets

Create a free account to get a 7-day Premium trial, including the ability to highlight key tweets in any thread.

Sign Up for Reading Mode

Create a free account for the distraction-free paper view — plus a 7-day Premium trial with full-length exports.

Sign Up to Save to Notion

Create a free account to get a 7-day Premium trial, including saving unrolled threads directly to your Notion workspace.