Windows Internals

In this hands-on session, Pavel Yosifovich demonstrates how to launch a process under the SYSTEM account without relying on external tools like PsExec. You’ll learn how to:
Identify SYSTEM processes and extract their access tokens, Use Windows APIs like OpenProcessToken, DuplicateTokenEx, and CreateProcessWithTokenW, Troubleshoot access denial issues, deal with protected processes, and understand session contexts

Dive into Pavel’s latest post exploring the Windows Blue Screen of Death—what triggers it, why it’s actually a safeguard rather than a punishment, and how to investigate crashes with powerful tools like WinDbg and Driver Verifier. This guide offers invaluable insights for TrainSec students, especially those following the Windows Internals Master path, looking to sharpen their debugging skills and elevate their mastery of the Windows kernel.

In this video, we dive into two powerful Windows API functions—CreateProcessAsUser and CreateProcessWithTokenW—that allow you to start a new process under a different user context. You’ll learn when to use each function, what privileges and services they depend on, and how to overcome common pitfalls. The video demonstration includes live coding examples, troubleshooting steps, and insights into managing tokens, sessions, and user profiles.

Remote Procedure Calls (RPC) are a fundamental mechanism in distributed computing, allowing functions to execute seamlessly across different systems or processes as if they were local. This post walks you through creating a basic RPC server and client using Microsoft’s RPC framework, focusing on clarity and simplicity.

Note: This blog post is designed to complement the accompanying