The Share Source Program in Windows CE provides many modules in %_WINCEROOT%\Private\ tree, and the kernel is one of them! Although it is not full source of kernel but it is good enough for tracing it, even tweak the kernel.
Tracing the kernel and see how it works is lots of fun, but it is fascinated to modify and verify the change you made.

So first comes first, where is the source of kernel? It's in your %_WINCEROOT%\private\winceos\COREOS\nk\
And next question will be "How do I build it?", Some of you may say just "build -c" there and it should be good.
If you are the owner of kernel and got full source, that is definitely the right answer, but none of them are applied to our case though. So what should I do? Let's dig deeper into the coreos\nk folder, there are a couples of subfolder, CELOG, KDSTUB, KERNEL and etc. KERNEL\ is the main component of kernel.dll, in the other word, most of the modify to kernel is going to happen here. And the good thing is, you could "build -c" in %_WINCEROOT%\private\winceos\COREOS\nk\kernel\ with no error at all. But before doing that, remember to backup eveything you are going to modify, including the source and binaries; remember, this is not something belong to you, and if you didn't restore them back later, it could end up confuse the subsequence QFE updates!

Here is the steps

1. Backup the source code, I will suggest the whole %_WINCEROOT%\private\winceos\COREOS\nk\
2. Backup the binaries in common\oak\lib\, and again if you are not sure which files, backup the whole %_WINCEROOT%\common\oak\lib\ is the safest way.
3. Do whatever modification you want in %_WINCEROOT%\private\winceos\COREOS\nk\kernel\
4. build -c in %_WINCEROOT%\private\winceos\COREOS\nk\kernel
5. If everything went well so far, you should get a new nkmain.lib,nkmain.pdb, nkprmain.lib and nkprmain.pdb in
   %_WINCEROOT%\public\common\oak\lib\%_TGTCPU%\%WINCEDEBUG%\
6. Basically, you just rebuild your new kernel, the rest is to "blddemo clean -q" to have your new kernel SYSGEN'd and include in your OS Image. Or just "set WINCEREL=1" then "sysgen -p common nk nkprof" and "makeimg" if you can't wait another minutes for "blddemo clean -q"

Tat sounds good, but some of you may not like the idea to alter any code in private folder, and not to mention how annoying to backup/restore files every time. Better idea? Yes, Microsoft provides a tool SYSGEN_CAPTURE (http://msdn.microsoft.com/en-us/library/ee504678.aspx for detail and usage) to creates Sources files for public drivers that you want to modify and build in your platform directory. In fact, not only public drivers, virtually anything in the %_WINCEROOT%\public\<project name>\cesysgen\makefile can be captured, and of course including kernel. So I am going to introduce a second way to build your own kernel by using SYSGEN_CAPTURE tool.

Again the steps

1. Create a folder in your BSP for building kernel, says %_TARGETPLATROOT%\SRC\Kernel.
2. Use "SYSGEN_CAPTURE -p common nk" and then you will get a SOURCES.KERN, you could also "SYSGEN_CAPTURE -p common nkprof" to generate profiler enabled kernel.
3. rename the SOURCE.KERN to SOURCES and copy one of the sample makefile into your kernel directory. For example the one in PRIVATE\WINCEOS\COREOS\NK\KERNEL\NKNORMAL.
4. Copy the source files you want to modify from private\winceos\coreos\nk\kernel\ into your kernel directory.
5. Modifying the SOURCES= macro to the source files you addes in step 4. For example, if you copied the vm.c, it is going to be SOURCES=vm.c
6. Refer to the private\winceos\COREOS\nk\kernel\sources.inc and add macro defines and proper include path in your SOURCES file.
7. "set WINCEREL=1", "build -c" in your kernel directory and "makeimg", voila!

Here is an example for the MACROS you need to add in x86

Here are the macros for x86

CDEFINES=$(CDEFINES) -DIN_KERNEL -DWINCEMACRO -DKERN_CORE

# Machine independent defines
CDEFINES=$(CDEFINES) -DDBGSUPPORT
_COREOSROOT=$(_WINCEROOT)\private\winceos\coreos
INCLUDES=$(_COREOSROOT)\inc;$(_COREOSROOT)\nk\inc

!IFDEF DP_SETTINGS
CDEFINES=$(CDEFINES) -DDP_SETTINGS=$(DP_SETTINGS)
!ENDIF

ASM_SAFESEH=1
CDEFINES=$(CDEFINES) -Gs100000 -DENCODE_GS_COOKIE