Andrey PautovSecurity research

External source integration · reviewed 3 August 2026

TrainSec Knowledge Library

Published · Last updated

A permitted integration of TrainSec’s Knowledge Library. Read the complete original text with screenshots, infographics, and embedded videos in the original order, then follow the attribution link to TrainSec.net.

Rights and attribution. All rights reserved by TrainSec.net and the named author. 1200km.com is the publishing platform; these articles are published with permission from the TrainSec rights holders. Original text, screenshots, infographics, videos, and author biographies remain attributed to their source pages.
84 source articles3 authors7 domainsJuly 2024–August 2026

Catalogue

Windows internals · Technical walkthrough

VMMap Basics: How to Read a Windows Process's Memory Layout ↗

Pavel Yosifovich uses VMMap to break down a process's memory layout, for developers and researchers who want to see what memory a process really uses.

Windowsinternals

Author: Pavel Yosifovich · Published: August 2, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Meet TrainSec Co-Founder Uriel Kosayev at DEF CON 34 ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: July 20, 2026

Source: TrainSec Knowledge Library ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Windows Privileges Explained: SeDebugPrivilege and AdjustTokenPrivileges in C++ ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: July 19, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

How Windows App Execution Aliases Work (and How to Read Them in C++) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: July 12, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Malware Analysis in the Age of AI: What Still Requires Human Skill? ↗

AI is starting to change malware analysis in ways that are hard to ignore. Some

malwarereverse engineering

Author: Uriel Kosayev · Published: June 25, 2026

Source: TrainSec Knowledge Library ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

DLL Injection with Windows Application Verifier ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: June 22, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Video / workshop

What Are Windows Logon Sessions and How Do They Relate to Tokens? ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: June 21, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

WannaCry Dropper Analysis: Itsy Bitsy Tricks That Break Your Tools ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: June 10, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

How to Embed and Extract Custom PE Resources in C++ ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: June 1, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

How Windows PE Files Use Custom Resources to Embed Anything ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: May 25, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

NTFS Transactions in Windows: Kernel Transaction Manager, CreateFileTransacted, and Process Doppelganging ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: May 17, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: May 10, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Creating COM Objects with the Class Moniker (CoGetObject) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: April 29, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Launch WSL Applications from Windows with WslLaunch ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: April 21, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Hardware hacking · Hardware security research

The Hitchhiker's Guide to Breaking Secure Boot ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

hardware securityembedded

Author: Amichai Yifrach · Published: April 19, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Amichai Yifrach. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Career guidance · Career guide

Is Malware Analysis Right for You? ↗

A lot of people are drawn to malware analysis because it sounds advanced, technical, and

careerprofessional development

Author: Uriel Kosayev · Published: April 14, 2026

Source: TrainSec Knowledge Library ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Capture ETW events with C++ (Part 2) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: April 13, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Capture ETW events with C++ (Part 1) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: April 13, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Linked Lists in the Windows Kernel ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: March 25, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Writing Control Panel Applications ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: March 23, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Hiding a Service with C++ ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: March 16, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Hiding A Windows Service From Enumeration ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: March 12, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Windows System Programming In Rust ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: March 12, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Video / workshop

Windows Research with WinDBG - 4H Live (7th April) masterclass with Pavel ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: March 9, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Windows TLS (Thread-Local Storage) Explained ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: February 13, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Looking into Windows Access Masks ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: February 13, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

How to Delete a File in Windows (and What “Delete” Really Means) ↗

How to Delete a File in Windows (and What “Delete” Really Means)

Windowsinternals

Author: Pavel Yosifovich · Published: February 8, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

When Process Hollowing Isn’t Process Hollowing ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: January 27, 2026

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

How Malware Really Works (What Most People Miss) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: December 28, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

SOC & DFIR · Malware / security research

You Can’t Sleep in the AI Era: The Brutal Reality of Securing Modern Data Centers ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

SOCDFIR

Author: Uriel Kosayev · Published: December 25, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

AMSI Scanning in C#: P/Invoke, Memory-Mapped Files, and Safe Interop ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: November 10, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Malware / security research

How to scan files with the Anti-Malware Scan Interface in Windows? ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: November 10, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

SOC & DFIR · Video / workshop

Cyber & AI – Friend or Foe? Lessons from the Orange Systems Inspiration Session ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

SOCDFIR

Author: Uriel Kosayev · Published: November 10, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Video / workshop

Inside Windows Sessions: A Deep Dive with Pavel ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: September 22, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

How to Capture a Process Snapshot in Windows ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: September 16, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

MAoS – Malware Analysis on Steroids book released ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: September 11, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows programming · Technical walkthrough

How to Build a Process Tree in Windows with Code ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windows programmingC/C++

Author: Pavel Yosifovich · Published: September 5, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

How does Windows Subsystem for Linux (Version 1) actually work? ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: August 27, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Kernel Allocation Tags in Windows Explained ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: August 21, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Inside the Windows Recycle Bin - What Really Happens When You Delete a File? ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: August 13, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

SOC & DFIR · Malware / security research

Two Sides of The Same Coin - From Dissected Malware to EDR Evasion ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

SOCDFIR

Author: Uriel Kosayev · Published: August 10, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Protected Processes & PPL: keeping Windows’ heart safe ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: August 7, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Kernel Debugging Windows VMs – A Practical Walk-Through ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: July 31, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Introduction to Windows Management Instrumentation (WMI) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: July 20, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Writing a Simple Key Logger ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: June 2, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Running an Executable as SYSTEM: Unlocking Windows Privilege Escalation Techniques ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: April 17, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Hardware hacking · Hardware security research

Reinventing UART Security: Leveraging the Parity Bit for Robust Protection in OT Networks ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

hardware securityembedded

Author: Amichai Yifrach · Published: April 1, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Amichai Yifrach. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows programming · Technical walkthrough

Writing a WinDbg Extension: Streamline Your Debugging Workflow ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windows programmingC/C++

Author: Pavel Yosifovich · Published: March 17, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows programming · Technical walkthrough

Understanding UAC Virtualization: A Security Mechanism for Legacy Applications ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windows programmingC/C++

Author: Pavel Yosifovich · Published: March 17, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Reverse Engineering ARM based Mirai Botnet ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: February 17, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Exploring the Blue Screen of Death: A Practical Deep Dive ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: February 17, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Video / workshop

Live Workshop: Attack and Defense: Remote Thread Injection and Detection (Recorded) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Uriel Kosayev · Published: January 28, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Understanding RunDLL32: Leveraging Dynamic Function Invocation ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: January 13, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Dissecting the BlackByte Ransomware ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: January 9, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Shell Icon Handler extension ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: January 9, 2025

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Understanding the Differences Between CreateProcessAsUser and CreateProcessWithTokenW in Windows ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: December 17, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Building a Simple RPC Client and Server: A Step-by-Step Guide ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: November 20, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Exploring NTFS Alternate Streams: A Hidden Gem of the Windows File System ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: November 20, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Debugging DLL Files with IDA Disassembler ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: November 10, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Writing a Windows Service ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: November 10, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Introduction to Windows Services ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: November 10, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

Introduction to the Windows Performance Analyzer (WPA) ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: November 10, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Back to the Future of the Cyber Landscape ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: October 2, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

MuddyWater Initial Access Trojan ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: September 29, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Hardware hacking · Hardware security research

Trojan Horse Implementation in Hardware ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

hardware securityembedded

Author: Amichai Yifrach · Published: September 16, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Amichai Yifrach. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Sharing Kernel Objects by Name - Perks and Perils ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: September 13, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows programming · Technical walkthrough

Keyboard Hook with Image File Execution Options ↗

Keyboard hooking using Image File Execution Options and pretending to be a debugger.

Windows programmingC/C++

Author: Pavel Yosifovich · Published: August 25, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows kernel · Technical walkthrough

Maximum Handles in a process ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowskernel

Author: Pavel Yosifovich · Published: August 13, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Hardware hacking · Hardware security research

Best starter Hardware Hacking Toolkit ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

hardware securityembedded

Author: Amichai Yifrach · Published: July 30, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Amichai Yifrach. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Intel® Audio Driver Unquoted Service Path Vulnerability ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: July 21, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

MSI TrueColor Unquoted Service Path ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: July 21, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

The Malware Shlayer ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: July 8, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows internals · Technical walkthrough

“Application Types” on Windows ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windowsinternals

Author: Pavel Yosifovich · Published: July 8, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Windows programming · Technical walkthrough

Code Injection with Image File Execution Options ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

Windows programmingC/C++

Author: Pavel Yosifovich · Published: July 8, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Pavel Yosifovich. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Microsoft WslService Unquoted Service Path Vulnerability ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: July 8, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗

Malware analysis · Malware / security research

Dissecting Ardamax Keylogger ↗

Open the original TrainSec page for the complete article, screenshots, diagrams, and any embedded video.

malwarereverse engineering

Author: Uriel Kosayev · Published: July 4, 2024

Source: TrainSec Knowledge Library ↗ · Original media ↗

All rights reserved. Rights belong to TrainSec.net and Uriel Kosayev. 1200km.com is the publishing platform. Published with permission from the TrainSec rights holders. Original source ↗