Pavel Yosifovich
@zodiacon
Followers
14K
Following
5K
Media
106
Statuses
3K
Windows Internals expert, author, and trainer. Teaching system programming & debugging at TrainSec. Check out my books & courses! đ #WindowsInternals #TrainSec
New Jersey, USA
Joined October 2008
In case you missed it, check out my Youtube channel with videos mostly related to Windows Internals: https://t.co/CNxqmDHhQU.
youtube.com
Pavel Yosifovich's YouTube channel offers concise videos primarily focused on Windows Internals and software development. With over 4,000 subscribers and 80+ videos, the channel serves as a valuable...
1
62
287
đ Itâs official â my new book is live on Amazon: MAoS â Malware Analysis on Steroids This book is not like the others. Itâs built on years of raw, hands-on research, reverse engineering sessions at 3 AM, and real-world incident response cases. Inside, youâll find full AâZ
42
196
1K
Missed the interview with $SNES CEO and CFO? The full interview is now available on @YouTube. Watch here đ https://t.co/hb6ghpNdy4
2
1
7
20 years ago, I read Andre Lamothe's "Tricks of the Windows Game Programming Gurus", the first book of its kind to teach low-level game programming and Windows design. Can AI modernize this code to run on modern Windows PCs? See my blog here: https://t.co/pPOuCumqkL
0
4
12
New blog post of me analyzing a crash dump with the bugcheck 0x9F. Root cause was a power IRP timeout in RAS SSTP during a device removal. The post walks PnP locks, the stuck IRP, and more, including my thought process. Check it out here: https://t.co/Vm2Da3TJXy
3
57
172
Ever wondered how Process Explorer builds the process tree? I wrote a guide on how to code your own in C++. We cover PID reuse, parent vs. creator, recursion, and more. Read it here:
trainsec.net
Learn how Windows builds process trees, why some processes appear parentless, how PIDs are reused, and how to code your own version in C++.
3
89
362
Hailey Bieberâs Rhode couldâve dropped this million-dollar ad (they honestly should). Made on invideo for $100, thatâs IT. Single prompt to million-dollar ad for your business. What are you creating today?
0
1
5
Out-of-process is not feature-complete yet, but it has a very significant impact on performance. When testing startup, I immediately notice if I accidentally switch back to in-process. I hope we can enable it by default soon.
Tried ReSharper 2025.2 out of process yet? Our lab saw a 61% reduction in long startup freezes (100 ms+). Read our blog post to find out how to set it up. Weâd love to hear your results: https://t.co/QkhBdcM9aR
4
4
29
@infoSecSki @zodiacon Yes, we offer Students & Freelancers discounts on all of our on demand products. The EDR Internals workshop specifically is already sold-out for the current dates. You should register to the waitlist and get updates if and when it's scheduled again.
0
1
7
Update #1: Labor Day + September 1st = Double celebration TrainSec students get 35% off all Learning Paths until Sept 14. Code: LABORDAY25. Update #2: EDR Internals sold out â Join the waitlist for more dates: https://t.co/IVEgVbS27p Update #3: New article by @zodiacon:
trainsec.net
This hands-on workshop is designed to give cybersecurity professionals, malware researchers, and detection engineers a rare opportunity to explore how modern Endpoint Detection and Response (EDR)...
2
6
32
I just released a new video: How WSL 1 Works. In this video, I explain how Windows Subsystem for Linux version 1 runs ELF binaries. https://t.co/s47zjYL9md
trainsec.net
Windows Subsystem for Linux (WSL) first appeared in Windows 10 (Anniversary Update, 1607). It enables Linux binaries to run directly on Windows without recompilation. This capability is often...
5
51
192
Hardware Hacking Expert Level 2 led by @The_H1tchH1ker is coming soon, starting with the Advanced UART Hacking module. Students of Level 1 will receive a significant discount when Level 2 launches. https://t.co/UTYlZJbRG7
trainsec.net
Transform yourself from a novice to a seasoned hardware hacking expert with our "Hardware Hacking Expert" course. This comprehensive path, combining dynamic
1
3
17
Kernel allocation tags in Windowsâwhy they exist and how to use them for debugging and forensics. New video + blog post from Pavel Yosifovich, free in the TrainSec Knowledge Library. Watch & read:
0
6
15
Ever wondered what really happens when you delete a file in Windows? In the new video, Pavel Yosifovich traces every step. Watch the deep dive:
trainsec.net
Starting with Windows Vista, Microsoft introduced protected processesâspecial executables the kernel shields from injection, memory reads/writes and handle duplication. Windows 8.1 broadened the idea...
1
8
33
The sunâs still shining and so is our Summer Sale! âď¸ Level up with Update Courses - online programs for .NET developers by .NET developers: @konradkokosa ⢠@Scooletz ⢠@lukaszpyrzyk ⢠@danielmarbach ⢠Stephen Cleary ⢠@marcgravell ⢠Sebastian Solnica ⢠@KooKiz â˘
0
2
5
Windows 10 System Programming, Part 1 by Pavel Yosifovich is on sale on Leanpub! Its suggested price is $37.95; get it for $21.56 with this coupon: https://t.co/IKyUgV8Mjm
@ZODIACON
leanpub.com
null
0
4
18
Hi all - I'm hiring a Principal Security Researcher who has strong knowledge in Active Directory and Entra ID. Are you interested in spending time to find the next ZeroLogon or BadSuccessor equivalent, as well as helping our product to improve? Go apply:
linkedin.com
Posted 11:05:03 AM. About UsAt Netwrix, our mission is to revolutionize data security by placing identity at the core -âŚSee this and similar jobs on LinkedIn.
3
30
95
dear imgui 1.92.2 release https://t.co/PErbkOHthD - improving tab bar resizing logic (combining shrinking and scrolling). - misc keyboard nav fixes, table fixes, font fixes & many others. - backend fixes (vulkan+linux w/ some drivers, SDL_GPU use SDL_GPUTexture* as texture id).
3
46
348
Indiana Hoosiers Shirt of the Month Get officially-licensed Indiana Hoosiers T-shirts, long-sleeve & hoodies monthly
0
6
123
Just published my new article in the TrainSec Knowledge Library: "Two Sides of the Same Coin â From Dissected Malware to EDR Evasion" Understanding how malware works is key to learning how to bypass and defend against EDR. A must-read for TrainSec students. Read here:
0
13
38
New issue of .NET R&D Digest is here! Thanks to @bzogrammer, @damekdavis, @sogrady, @iximiuz, @andrewlocknet, @meziantou, @STeplyakov, @KentBeck and other great and talented authors for making amazing content! https://t.co/rSgWPhkejJ
#dotnet
olegkarasik.wordpress.com
This issue includes bits of hardware, AI, development tools, software development, software design, concurrency, C# (a lot of C#), .NET and .NET Internals.
1
7
21
New video by @zodiacon: set up real kernel debugging for a Windows VM in minutes. From bcdedit to live breakpoints in WinDbgâwatch the walkthrough and start debugging the kernel. Full guide + courses at TrainSec https://t.co/d8PzSvXGw9
trainsec.net
In just 25 minutes the walk-through shows you how Windows Management Instrumentation (WMI) reveals almost every measurable or configurable detail in Windows.
0
5
22