Pavel Yosifovich

In case you missed it, check out my Youtube channel with videos mostly related to Windows Internals: @zodiacon" target="_blank" rel="nofollow noopener">youtube.com/@zodiacon.

One week to go for the WinDbg mini masterclass! The session will be recorded and provided to the participants - consider attending even if the time or time zone is not ideal. trainsec.net/library/window…

When I became a citizen of the United States in 2014, on the basis of political asylum from the Gaza Strip and escaping Jihadi Islamism, I sincerely and seriously never thought that pro-Jihad, pro-Hamas, pro-terror, fascist, pro-Iran, pro-Hezbollah, anti-civilizational dark forces would become a mainstream staple in American politics and discourse. Having a group of ignorant domestic terrorists with Hamas and Palestinian flags, hiding their faces and taking over public space outside the City Hall of Philadelphia, the birthplace of America, is not only a grotesque sight, but it also demonstrates so much that has gone wrong. It is a condemnation of our country's higher education institutes, which have normalized violence, anti-Western ideologies, and embarrassing “post-colonial” narratives. This is a condemnation of a failed revisionist, neo-liberal immigration approach in which assimilation is frowned upon and viewed as bad and negative, coddling people with truly horrendous beliefs, ideologies, cultures, and backgrounds, instead of seeking to uplift and elevate them and their status. This is a condemnation of failed parenting, nonexistent community infrastructure to educate young people, failed leftist discourses, and moral bankruptcy. Remember that this has nothing to do with Palestine, for these “activists” ruined the “pro-Palestine” cause and are now seeking to latch on to any and every remaining filth that can vector their anti-human, anti-America, anti-Western, and anti-decent discourse and value system that can produce anything of meaning. Burning the American flag, while exercising your right to free speech, is the ultimate irony that only the United States of America affords to literal domestic terrorists, who are engaged in a subversive act against the very country and patriotic values that they seek to “dismantle.” Still, freedom of choice does not equal freedom from consequences. This cannot be normalized, as it unfortunately has been over the past two and a half years since Hamas’s October 7th attack. This is a domestic battle for our country’s values and future – it’s time to choose the direction you want this country to head in.

I'll be teaching a 2-day Rust course at NDC Toronto, and also give a talk at that conference on Writing a Windows Kernel Driver in an hour. Perhaps I'll see you there! ndctoronto.com/workshops/rust…

A Windows list pointer often isn’t pointing where you think it is. This post from @zodiacon explains LIST_ENTRY, circular lists, CONTAINING_RECORD, and why the same pattern shows up in processes, threads, and loaded modules. trainsec.net/library/window…

If you want a clean Win32 exercise that’s practical and still relevant on modern Windows, this is a great one from @zodiacon. Control Panel is still supported, which means you can still build your own .cpl applets. This post shows the DLL approach in C++: implement CPlApplet, add resources (name/description/icon), install/register the applet, and debug it using the right host process. Read: trainsec.net/library/window…

I recently came across the need to obtain logging into WSL2 and was forced to look into function hooking. However, this was my first time dealing with a COM server that didn't symbols, so I had to learn about a C++ feature - RTTI. I decided to write a blog on this in case anyone else runs into or has run into this: jonny-johnson.medium.com/wsl-com-hookin… POC: github.com/jonny-jhnson/R…

Many developers and researchers view WinDbg as the tool of last resort. Something crashes, nothing else helps, and eventually someone opens WinDbg and starts digging. But that mindset misses the real power of the tool. WinDbg is not just a debugger used in emergencies. It is one of the most powerful research tools available for understanding how Windows actually works. Microsoft engineers use it to debug the operating system itself. With the right setup and workflow, it becomes a microscope for exploring Windows internals. On April 7th, 2026, @zodiacon will be running a LIVE 4-hour masterclass where he will use WinDbg specifically as a research platform for exploring Windows components. trainsec.net/windows-resear…

I’ll be running a live session: “Live Windows Research Using WinDbg.” We’ll explore how to investigate Windows internals in real time using WinDbg, inspecting kernel structures, processes, and system behavior live. If you're into Windows internals, debugging, or security research, this session is for you. Details: trainsec.net/library/window… #windbg #windowsinternals #cybersecurity

October 7, 2023 marked a day that showed the world the depths of human evil. Israel was attacked. Women were sexually assaulted and murdered. Children and men were slaughtered. People were kidnapped and dragged into tunnels. The sheer barbarity of the attack shocked much of the world. But not everyone was horrified. A part of the world celebrated. Not because they misunderstood what happened, but because they hate Jews. Strip away the slogans, the hashtags, the theatrics and that is what remains: hatred of Jews. Among those cheering the brutality was the wife of New York’s current mayor, Zohran Mamdani, Rama Duwaji. She happily “liked” posts celebrating the massacre. And the mayor’s defense? “She is the love of my life. She is a very private person. She holds no public office.” Apparently applauding the slaughter of civilians is now considered a private activity. And in some political circles, loving someone who cheers terrorism is not a moral dilemma. It is simply called being progressive.

Holy shit. Wow. This is HANDS DOWN the best take I’ve heard. If there is one video you listen to today it’s this one. Every single word of this and it’s a huge “f*ck you” to @antonioguterres for propping up the barbaric terrorist Islamic Regime in Iran. Must be shared everywhere in my opinion. Unfortunately I have no idea who this young British woman is to credit her, if you know who it is feel free to tag below.

Ever wanted to write a Control Panel app? No, Control Panel is not dead yet :) youtu.be/TsrQr9tqPUw

@KooKiz @NicolasDorier @chnasarre My todo list has a Windows API monitoring tool in it (modern, fast)... unfortunately, it's a long todo list :(

@NicolasDorier Wow I never heard of it. It's really good, I'm adding it to my toolbox. I wish it was opensource though. cc @chnasarre @zodiacon

Write an article that took hours of research and get 10 likes and 3 retweets. Randomly complain about a quirk in Windows and get 2.4k like and 122 retweets (and counting). I mean, I fully understand why that happens, but it still feels a bit disheartening 😅

It's crazy that Windows will post notifications for the most unsignificant stuff (like the unfamous "Windows Defender Antivirus did not find any threats"), but I had to check my event viewer for completely unrelated reasons to randomly discover that one of my HDDs is dying.

ClipPing got a major update! The tool displays a visual notification whenever the content of the clipboard changes, for all of you who are tired of ctrl+c not working. I added configurable overlays, and some QoL improvements (like automatically starting the tool with Windows).

New issue of .NET R&D Digest! Thx to @konradkokosa, @MatKainer, @spolsky, @AntonMartyniuk, @stevejgordon, @KooKiz, @lemire, @zodiacon, @STeplyakov and other g8 authors for g8 content! olegkarasik.wordpress.com/2026/03/02/net… #dotnet

A message from Iranians amid full Internet blackout to western liberals, progressives, the woke left as well as woke right: If you've never lived in or have never been to Iran, have no ties to Iran or Iranians, haven't deeply studied the coutnry, its culture or history, and your knowledge of it is limited to stuff you see on the news or social media, please kindly shut the fuck up about the situation in Iran. You're only showing how ignorant and absolutely stupid you actually are with your "hAnDS oFf iRaN" and "nO wAR WiTh iRAn" nonsense. Your hate for Trump/Israel is blinding you. It is preventing you from seeing how milions upon milions of us across Iran and all over the world can't stop tears of joy for seeing our tormentors' house of cards being brought down before our eyes. Your hate for Trump/Israel is making you side with the most barbaric murderers of our time. You are not actually anti-war or pro-peace. You are pro-killing children. You're pro-killing teenage girls for not covering their hair. You're pro-executing homosexuals. You're even pro-providing drones to Putin to blow up Ukraine. Sit this one out. Trump and Netanyahu are doing the entire world a service. Once this regime is fully brought down and the people of Iran are free and can reclaim their land and their destiny, you can continue your stupid infightings. You'll have all the time in the world to resume hating Trump and Israel for whatever reason you think you hate them for. In the meantime, please, kindly, shut the fuck up and let us enjoy the fall of our oppressor in peace.

As an Iranian who came to the West, one of the biggest shocks that still hits me every day is the deep antisemitism I see, especially among white people here. It just keeps surprising me more and more. With Muslims, I can understand where a lot of the hatred toward Jews comes from. It's not even hidden, it's built right into the core of Islam, and plenty don't bother denying it. But white Westerners, they try so hard to pretend it's not there, to deny it, or to reframe it as criticism of something else. Yet it keeps coming out anyway, and almost always from the same type: people who have failed in life, who refuse to take responsibility for their own messes, and who need a scapegoat to feel less worthless. You rarely see successful, smart, capable people pushing this garbage. It's the bitter, resentful failures who grab onto it like a lifeline. The most frustrating and ridiculous part is how Muslims, especially the ones who are openly the West's worst enemies, have figured out how to exploit this exact weakness. Muslims in the West steal tax money, rape daughters, terrorize and kill people, intimidate everyone, and make no secret that they want to dominate, take away freedoms, and conquer from within. But muslims have learned the trick: just press the Israel button, frame anything as connected to Israel, and suddenly a ton of Americans and Canadians have their brains reset. They start screaming "Israel! Israel!" and completely forget about the real crimes and threats right in front of them. It's like watching a switch flip, and it's absurd. Take Tucker Carlson as a perfect example: His antisemitism was spotted right away as a vulnerability, and suddenly Qatar rolls out the red carpet for him. It's no coincidence; they detect the weakness and move in to use it. They welcomed him warmly, and now you see him pushing their agenda hard, criticizing Israel relentlessly, spreading narratives that align exactly with what Qatar wants: keeping the regime alive in Iran. For us Iranians, this whole situation is honestly laughable and exhausting at the same time. Every day under my posts, these lunatics swarm in calling me a Mossad agent or saying I'm paid by Israel. It's so stupid it's hard to believe people actually type it out. There are 90 million Iranians fighting this regime for our own damn good reasons, real, deep, legitimate ones that have zero to do with Israel. Yeah, getting rid of the regime would help Israel too, but that's not why I'm saying what I say. I have more than enough of my own reasons; no one needs to pay me or brainwash me. I’m Iranian, I grow up in Iran moron. I know what I am talking about when I say this regime is an existential threat to the US, not Israel. These people's minds are so warped they can't see reality anymore. It's twisted, dangerous, and one of the biggest cracks in Western society. The US and Canada have to confront this antisemitism directly and stop it. Letting it go unchecked just lets real enemies exploit the divisions and get away with everything while the actual threats keep growing. This madness needs to end.

Incredibly proud of the team over here at @HuntressLabs as we announce a new really cool feature in our EDR - the “Attack Disruption Engine”. This new capability allows us to identify threats quicker on the endpoint and change response time from minutes to seconds. Full blog: huntress.com/blog/disruptin…

Many years ago we found a race condition in Windows and the size of the race window was one x86 instruction, a very short one. An engineer in my team wrote a reproducer to see how long it will take us to hit it. It took 4 seconds. :)

In case you missed the live stream with @zodiacon (Pavel Yosifovich), you can catch the recording on YouTube: 🔗 youtube.com/live/HtyQZBLzK… We talk EDR development, limitations, bypasses and more!