title: http.sys implementation
body: <p>We all know that there's a big sweet piece o' binary named http.sys <strong>kernel-mode driver</strong> in our Windows that does HTTP handling for us. That is basically all we know about it. </p>
  
  <p>But today I thought: hey, all our networking stuff like TCP/IP and whatnot is here, in userland -- ws2_32.dll's providers (in mswsock.dll) and all its friends. Since there are userland components, there is no way http.sys uses them. The question is: how do they do it? Any informative links will be greatly appreciated.</p>