Pavel Yosifovich explains the OBJECT_ATTRIBUTES structure behind every native and kernel create or open call,

Pavel Yosifovich parses PE headers in a remote process to name the section behind every

Pavel Yosifovich extends his MemMap tool to enumerate threads, locate each Thread Environment Block, and

Pavel Yosifovich extends his MemMap tool with GetMappedFileName, then converts raw NT device paths into

Pavel Yosifovich writes a C++ tool that reads a Windows process’s memory map with VirtualQueryEx,

Pavel Yosifovich uses VMMap to break down a process’s memory layout, for developers and researchers

Pavel Yosifovich explains what Windows privileges are, why they live in the token, and how

Pavel Yosifovich explains how Windows App Execution Aliases work, why the alias files are zero

Learn how to use the Windows Application Verifier infrastructure to inject a DLL and hook

Pavel Yosifovich explains Windows logon sessions: what they hold, why tokens exist as separate objects,