Pavel Yosifovich

@zodiacon · Twitter · 2026-08-30 20:03 UTC

New video: Process Memory Map in Code (Part 3). MemMap now enumerates threads, finds each TEB via NtQueryInformationThread and PHNT, and reads thread stacks with ReadProcessMemory. Full write-up: https://trainsec.net/library/windows-internals/process-memory-map-in-code-thread-stacks-and-tebs-part-3/