Pavel Yosifovich

Pavel Yosifovich unlinks a DLL from the PEB’s loader module list, compares it to EnumProcessModules,

Pavel Yosifovich injects a DLL using SetWinEventHook, the accessibility event hook, covering in-context hooks, the

Pavel Yosifovich explains the OBJECT_ATTRIBUTES structure behind every native and kernel create or open call,

Pavel Yosifovich builds a service DLL that svchost.exe hosts, wiring up ServiceMain, the control handler,

Pavel Yosifovich parses PE headers in a remote process to name the section behind every

Pavel Yosifovich extends his MemMap tool to enumerate threads, locate each Thread Environment Block, and

Pavel Yosifovich extends his MemMap tool with GetMappedFileName, then converts raw NT device paths into

Pavel Yosifovich writes a C++ tool that reads a Windows process’s memory map with VirtualQueryEx,

Pavel Yosifovich uses VMMap to break down a process’s memory layout, for developers and researchers

Pavel Yosifovich explains what Windows privileges are, why they live in the token, and how

Pavel Yosifovich explains how Windows App Execution Aliases work, why the alias files are zero

Learn how to use the Windows Application Verifier infrastructure to inject a DLL and hook

Pavel Yosifovich explains Windows logon sessions: what they hold, why tokens exist as separate objects,

Pavel Yosifovich walks through the full Visual Studio workflow for embedding custom binary resources in

Pavel Yosifovich shows how Windows PE custom resources work — and how Process Explorer bundles

Learn how the COM class moniker and CoGetObject work: registry lookup, MkParseDisplayName, and IMoniker::BindToObject —

Learn how to use TdhGetEventInformation and TdhFormatProperty in C++ to decode ETW event names, keywords,

Learn how to consume real-time ETW events in C++ using Win32 APIs. Pavel walks through

Control Panel is still supported, which means you can still build your own applets. This

In a previous post we hid a Windows service using a UI tool. This post

A Windows service can be running normally and still disappear from Services.msc and sc query.

Thread-Local Storage (TLS) lets each thread keep its own data without sharing state across the

Access masks are the 32-bit “what you can do” values stored in handles and ACE

How to Delete a File in Windows (and What “Delete” Really Means)

Process hollowing is usually described as creating a process in a suspended state, removing its

In this video, I demonstrate how to perform a file scan using Windows AMSI directly

In this session, I wanted to show how AMSI works in practice and how we

Learn how Windows sessions manage processes, desktops, clipboards, and security. Pavel Yosifovich explains Session 0,

When working with processes, we often want to understand what is going on inside them.

Debugging Windows at kernel level lets you watch every CPU instruction, intercept system calls, and

In just 25 minutes the walk-through shows you how Windows Management Instrumentation (WMI) reveals almost

In this video, Pavel walks through how to implement a basic keylogger in Windows using

In this hands-on session, Pavel Yosifovich demonstrates how to launch a process under the SYSTEM

Dive into Pavel’s latest post exploring the Windows Blue Screen of Death—what triggers it, why

In this video, we dive into two powerful Windows API functions—CreateProcessAsUser and CreateProcessWithTokenW—that allow you

Remote Procedure Calls (RPC) are a fundamental mechanism in distributed computing, allowing functions to execute

The NTFS file system, widely used in Windows environments, is packed with fascinating features. Among

We’re talking here about the Windows Performance Analyzer (WPA). The Windows Performance Toolkit can be

There are many processes running on a typical Windows system – here are some of