Windows System Internals with PowerShell
summary
Module named PoshInternals module exposes internal Windows APIs and implements most features in PowerShell with PInvoke and a few C helpers. Demos show enumeration of system handles via NtQuerySystemInformation and NtQueryObject (PowerShell version is much slower than C), automated mini dump captures, an alternate‑desktop switcher, a blue‑screen screensaver, and a PSExec‑style remote service using named pipes. Some demos intermittently fail (handle resolution and remote process demo had breakage during the session).
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:58Patrick Eternals
- 2:58Managing alternate desktops
- 5:59Streams
- 8:28Pipes
- 12:06Activation Context
- 13:40Unregistered
- 15:07Handle Utility
- 20:47Individual Studio Demo
- 22:25Spending Processes Demo
- 24:20Desktops Demo
- 26:20Memory Map Files
- 29:40Screen Savers
related talks
53mInside Shell: Enhancing PowerShell Visibility Using .NET Hacking Techniques
44mOpenSSH Internals for PowerShell Pros
01h 34mPowerShell remoting - Installing and troubleshooting in a...
44mwhoami priv - show me your privileges and I will lead you to SYSTEM
01h 33mA hands-on lab working
25mInvestigating PowerShell Attacks
49mAdvanced Network Scripting with PowerShell
57mSecuring PowerShell: Hands-On Lab