Pavel Yosifovich writes a C++ tool that reads a Windows process’s memory map with VirtualQueryEx,

Pavel Yosifovich uses VMMap to break down a process’s memory layout, for developers and researchers

Pavel Yosifovich explains what Windows privileges are, why they live in the token, and how

Pavel Yosifovich explains how Windows App Execution Aliases work, why the alias files are zero

Learn how to use the Windows Application Verifier infrastructure to inject a DLL and hook

Pavel Yosifovich explains Windows logon sessions: what they hold, why tokens exist as separate objects,

Pavel Yosifovich walks through the full Visual Studio workflow for embedding custom binary resources in

Pavel Yosifovich shows how Windows PE custom resources work — and how Process Explorer bundles

Learn how the COM class moniker and CoGetObject work: registry lookup, MkParseDisplayName, and IMoniker::BindToObject —