- APC Series: KiUserApcDispatcher and Wow64
- APC Series: User APC Internals
- APC Series: User APC API
- Dumping DPC Queues: Adventures in HIGH_LEVEL IRQL
- Reversing DPC: KeInsertQueueDpc
- AuxKlibQueryModuleInformation
- Practical Reverse Engineering Solutions
- Abusing Signed Windows Drivers
- Autochk Rootkit Analysis
- Random PDC Driver