How to legally blog about Windows internals

Question

In the field of malware analysis and reverse engineering, many job postings call for familiarity with the PE file format, Windows internals, etc. However, Microsoft presumably doesn't want people reversing DLLs and other closed-source binaries.

As someone who may eventually seek an entry level job in this area, I think that my primary way to demonstrate this knowledge is through blog posts, but that seems risky. Would it be better to just disassemble ELF binaries and such, while making vague references in the blog to the analogous Windows constructs?

I know this isn't the place for actual legal advice, but some people here must have experience with how to safely demonstrate their knowledge of proprietary software. I don't think my question is specific enough for legal experts.

Answer 1

Windows is actually quite open about how their operating system constructs work together in the overall system. In fact there are multiple books written to become familiar with Windows Internals, Windows system programming, and even kernel driver development. Companies who develop products for Windows need to understand these aspects of the system so it is completely legal for you to learn about these systems.

Windows Internals (Part 1)

Windows Internals (Part 2)

Windows System Programming

A Guide to Kernel Exploitation

After researching and reading on the topic you could then proceed with your blog. You could also code up your own simple Windows program/DLL, and analyze that within your blog. You'd be able to use and explore different techniques in a legal manner since you have no EULA with yourself.

That's the approach I would take.