Black Friday deal for the course Mastering Windows Internals by Grzegorz Tworek #windowsinternals
gtworek.com/mastering-wi...
gtworek.com/mastering-wi...
Mastering Windows Internals
The
gtworek.com
November 21, 2024 at 6:08 PM
Black Friday deal for the course Mastering Windows Internals by Grzegorz Tworek #windowsinternals
gtworek.com/mastering-wi...
gtworek.com/mastering-wi...
New video out!
Security analyst John Ostrowski show the hands-on process behind discovering CVE-2025-24076 and CVE-2025-24994 described in our recent blog post.
Watch here: youtu.be/YwNcTuHxnAI
#security #pentest #windowsinternals #vulnresearch
Security analyst John Ostrowski show the hands-on process behind discovering CVE-2025-24076 and CVE-2025-24994 described in our recent blog post.
Watch here: youtu.be/YwNcTuHxnAI
#security #pentest #windowsinternals #vulnresearch
300 Milliseconds to Admin: Mastering DLL Hijacking and Hooking to Win the Race
YouTube video by Compass Security
youtu.be
December 2, 2025 at 9:45 AM
New video out!
Security analyst John Ostrowski show the hands-on process behind discovering CVE-2025-24076 and CVE-2025-24994 described in our recent blog post.
Watch here: youtu.be/YwNcTuHxnAI
#security #pentest #windowsinternals #vulnresearch
Security analyst John Ostrowski show the hands-on process behind discovering CVE-2025-24076 and CVE-2025-24994 described in our recent blog post.
Watch here: youtu.be/YwNcTuHxnAI
#security #pentest #windowsinternals #vulnresearch
Want to understand how Windows handles authentication and access tokens? Security analyst @emanuelduss.ch explains how they’re created, used, and abused - with live demos.
🎥Presentation: youtu.be/_ODdwpxXRR4?...
#Security #Pentest #WindowsInternals
🎥Presentation: youtu.be/_ODdwpxXRR4?...
#Security #Pentest #WindowsInternals
Windows Access Tokens - From Authentication to Exploitation
YouTube video by Compass Security
youtu.be
November 4, 2025 at 12:37 PM
Want to understand how Windows handles authentication and access tokens? Security analyst @emanuelduss.ch explains how they’re created, used, and abused - with live demos.
🎥Presentation: youtu.be/_ODdwpxXRR4?...
#Security #Pentest #WindowsInternals
🎥Presentation: youtu.be/_ODdwpxXRR4?...
#Security #Pentest #WindowsInternals
Windows Internals - I have just completed this room! Check it out: tryhackme.com/room/windows... #tryhackme #Windows #Processes #Threads #PEFormat #DLL #WindowsAPI #windowsinternals via
@realtryhackme
@realtryhackme
TryHackMe | Cyber Security Training
An online platform for learning and teaching cyber security, all through your browser.
tryhackme.com
December 28, 2023 at 8:53 PM
Windows Internals - I have just completed this room! Check it out: tryhackme.com/room/windows... #tryhackme #Windows #Processes #Threads #PEFormat #DLL #WindowsAPI #windowsinternals via
@realtryhackme
@realtryhackme
Finally ı released Biber :)
ELF32 / ELF64 parsing
PE32 / PE32+ parsing
32 / 64 bit detection
Headers, sections, symbols and relocations
PE imports and exports
Basic disassembler view
github:
github.com/hrasityilmaz...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
ELF32 / ELF64 parsing
PE32 / PE32+ parsing
32 / 64 bit detection
Headers, sections, symbols and relocations
PE imports and exports
Basic disassembler view
github:
github.com/hrasityilmaz...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
June 2, 2026 at 10:18 AM
Finally ı released Biber :)
ELF32 / ELF64 parsing
PE32 / PE32+ parsing
32 / 64 bit detection
Headers, sections, symbols and relocations
PE imports and exports
Basic disassembler view
github:
github.com/hrasityilmaz...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
ELF32 / ELF64 parsing
PE32 / PE32+ parsing
32 / 64 bit detection
Headers, sections, symbols and relocations
PE imports and exports
Basic disassembler view
github:
github.com/hrasityilmaz...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
Does anyone know something about this book "COM and DCOM Demystified: Comprehensive Guide to Component-Based and Distributed Windows Programming" ? #windowsinternals
www.amazon.de/dp/B0FW49ZMC5
www.amazon.de/dp/B0FW49ZMC5
Amazon.de
www.amazon.de
December 14, 2025 at 1:07 PM
Does anyone know something about this book "COM and DCOM Demystified: Comprehensive Guide to Component-Based and Distributed Windows Programming" ? #windowsinternals
www.amazon.de/dp/B0FW49ZMC5
www.amazon.de/dp/B0FW49ZMC5
I finally got my books from @nostarchpress.bsky.social my favorite tech book publisher. I will be working on my Malware analysis skills. I also need to pick up some of their Python books #Malware #WindowsInternals #Assembly #InfoSec #Android
September 11, 2025 at 4:27 AM
I finally got my books from @nostarchpress.bsky.social my favorite tech book publisher. I will be working on my Malware analysis skills. I also need to pick up some of their Python books #Malware #WindowsInternals #Assembly #InfoSec #Android
While building Biber, I spent some time exploring PE32+ internals.
This post walks through the DOS Header, PE Signature, COFF Header, Optional Header, and Entry Point.
www.auctra.app/post-pe32-wa...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
This post walks through the DOS Header, PE Signature, COFF Header, Optional Header, and Entry Point.
www.auctra.app/post-pe32-wa...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
Walking a PE32+ File by Hand
PE32+ parsing notes while building Biber: DOS header, PE signature, COFF, Optional Header, RVA to raw offset and section table.
www.auctra.app
May 31, 2026 at 2:00 PM
While building Biber, I spent some time exploring PE32+ internals.
This post walks through the DOS Header, PE Signature, COFF Header, Optional Header, and Entry Point.
www.auctra.app/post-pe32-wa...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
This post walks through the DOS Header, PE Signature, COFF Header, Optional Header, and Entry Point.
www.auctra.app/post-pe32-wa...
#pe #windowsinternals #reverseengineering #systemsprogramming #opensource
New blog post: Dumping LSASS Without Touching Disk
Improved LSASS dumping in SpecterInsight’s dumper module, focusing on stealthy, in-memory techniques.
Read it here:
practicalsecurityanalytics.com/dumping-lsas...
#RedTeam #CyberSecurity #WindowsInternals #ThreatEmulation
Improved LSASS dumping in SpecterInsight’s dumper module, focusing on stealthy, in-memory techniques.
Read it here:
practicalsecurityanalytics.com/dumping-lsas...
#RedTeam #CyberSecurity #WindowsInternals #ThreatEmulation
Dumping LSASS Without Touching Disk: Improvements to ShadowDumper
While integrating LSASS dumping techniques into SpecterInsight’s dumper module, I used Offensive-Panda’s ShadowDumper as a reference point. That tool is great collection of LSASS dump techniques, b…
practicalsecurityanalytics.com
June 29, 2026 at 11:47 AM
New blog post: Dumping LSASS Without Touching Disk
Improved LSASS dumping in SpecterInsight’s dumper module, focusing on stealthy, in-memory techniques.
Read it here:
practicalsecurityanalytics.com/dumping-lsas...
#RedTeam #CyberSecurity #WindowsInternals #ThreatEmulation
Improved LSASS dumping in SpecterInsight’s dumper module, focusing on stealthy, in-memory techniques.
Read it here:
practicalsecurityanalytics.com/dumping-lsas...
#RedTeam #CyberSecurity #WindowsInternals #ThreatEmulation
Hypervisor-enforced Paging Translation - The end of non data-driven Kernel Exploits (Recon2024)
https://github.com/AaLl86/WindowsInternals/blob/master/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%2...
Original post
https://github.com/AaLl86/WindowsInternals/blob/master/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%2...
Original post
July 3, 2024 at 5:19 PM
Hypervisor-enforced Paging Translation - The end of non data-driven Kernel Exploits (Recon2024)
https://github.com/AaLl86/WindowsInternals/blob/master/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%2...
Original post
https://github.com/AaLl86/WindowsInternals/blob/master/Slides/Hypervisor-enforced%20Paging%20Translation%20-%20The%20end%20of%20non%20data-driven%20Kernel%2...
Original post
My GitHub repo summarizes different learning resources about Windows Internals. github.com/patrickmatul...
If you're missing a course or something that feels "course-like", let me know and I'll add it.
#windowsinternals
If you're missing a course or something that feels "course-like", let me know and I'll add it.
#windowsinternals
October 29, 2025 at 7:39 PM
My GitHub repo summarizes different learning resources about Windows Internals. github.com/patrickmatul...
If you're missing a course or something that feels "course-like", let me know and I'll add it.
#windowsinternals
If you're missing a course or something that feels "course-like", let me know and I'll add it.
#windowsinternals
www.youtube.com/@NT-dd8rw/fe... is a curated list of Windows NT internals videos. #windowsinternals
August 5, 2025 at 8:36 AM
www.youtube.com/@NT-dd8rw/fe... is a curated list of Windows NT internals videos. #windowsinternals
Integrity levels by Pavel Yosifovich
It's been a very important security concept since Windows Vista. If you're not familiar with it yet, check out the video.
www.youtube.com/watch?v=Vknn...
#windowsinternals #windows
It's been a very important security concept since Windows Vista. If you're not familiar with it yet, check out the video.
www.youtube.com/watch?v=Vknn...
#windowsinternals #windows
Integrity Levels
YouTube video by Pavel Yosifovich
www.youtube.com
June 7, 2025 at 6:56 PM
Integrity levels by Pavel Yosifovich
It's been a very important security concept since Windows Vista. If you're not familiar with it yet, check out the video.
www.youtube.com/watch?v=Vknn...
#windowsinternals #windows
It's been a very important security concept since Windows Vista. If you're not familiar with it yet, check out the video.
www.youtube.com/watch?v=Vknn...
#windowsinternals #windows
Bring your own vulnerable DLL by @itm4n.bsky.social
#windowsinternals #windows #ppl
itm4n.github.io/ghost-in-the...
#windowsinternals #windows #ppl
itm4n.github.io/ghost-in-the...
Ghost in the PPL Part 1: BYOVDLL
In this series of blog posts, I will explore yet another avenue for bypassing LSA Protection in Userland. I will also detail the biggest challenges I faced while developing a proof-of-concept, and dis...
itm4n.github.io
August 25, 2024 at 9:20 AM
Bring your own vulnerable DLL by @itm4n.bsky.social
#windowsinternals #windows #ppl
itm4n.github.io/ghost-in-the...
#windowsinternals #windows #ppl
itm4n.github.io/ghost-in-the...
I added the category Windows Programming: github.com/pmatula/Wind... #windowsinternals
GitHub - pmatula/Windows-Internals-Learning-Resources
Contribute to pmatula/Windows-Internals-Learning-Resources development by creating an account on GitHub.
github.com
July 7, 2024 at 2:38 PM
I added the category Windows Programming: github.com/pmatula/Wind... #windowsinternals
The Final Windows Handle Leak Guide aloiskraus.wordpress.com/2024/06/24/t... by Alois Kraus. #windowsinternals #windowsperformanceanalyzer #etl #WPA
The Final Windows Handle Leak Guide
One of the harder lesson during development is how to deal with leaks. Most of the time you are leaking memory but sometimes also OS resources like Handles. These are more difficult to detect because ...
aloiskraus.wordpress.com
June 30, 2024 at 2:52 PM
The Final Windows Handle Leak Guide aloiskraus.wordpress.com/2024/06/24/t... by Alois Kraus. #windowsinternals #windowsperformanceanalyzer #etl #WPA
Hybrid CPU Performance on Windows 10 and 11 by Alois Kraus #windowsinternals aloiskraus.wordpress.com/2024/02/08/h...
February 10, 2024 at 11:16 AM
Hybrid CPU Performance on Windows 10 and 11 by Alois Kraus #windowsinternals aloiskraus.wordpress.com/2024/02/08/h...
Code Execution Inside PID 0
Achieving kernel-level code execution in the System Idle Process by hooking power management routines in nt!PoIdle.
https://archie-osu.github.io/2025/04/13/powerhook.html
#KernelExploitation #WindowsInternals
Achieving kernel-level code execution in the System Idle Process by hooking power management routines in nt!PoIdle.
https://archie-osu.github.io/2025/04/13/powerhook.html
#KernelExploitation #WindowsInternals
April 26, 2025 at 5:30 AM
Code Execution Inside PID 0
Achieving kernel-level code execution in the System Idle Process by hooking power management routines in nt!PoIdle.
https://archie-osu.github.io/2025/04/13/powerhook.html
#KernelExploitation #WindowsInternals
Achieving kernel-level code execution in the System Idle Process by hooking power management routines in nt!PoIdle.
https://archie-osu.github.io/2025/04/13/powerhook.html
#KernelExploitation #WindowsInternals
(recommended reading) Introducing Early Cascade Injection: From Windows Process Creation to Stealthy Injection:
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #potatosecurity
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #potatosecurity
October 15, 2024 at 5:55 PM
(recommended reading) Introducing Early Cascade Injection: From Windows Process Creation to Stealthy Injection:
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #potatosecurity
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #potatosecurity
(recommended reading) Introducing Early Cascade Injection: From Windows Process Creation to Stealthy Injection:
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #cybersecurity
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #cybersecurity
Introducting Early Cascade Injection | Outflank Blog
Get an introdcution to Early Cascade, a novel process injection technique that is effective against top tier EDRs while avoiding detection.
www.outflank.nl
October 15, 2024 at 5:28 PM
(recommended reading) Introducing Early Cascade Injection: From Windows Process Creation to Stealthy Injection:
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #cybersecurity
www.outflank.nl/blog/2024/10...
#codeinject #reverseengineering #programming #windowsinternals #cprogramming #informationsecurity #cybersecurity