Windows Boundaries

It covers the taxonomy from AppContainer up through VTL1, with practical examples for crossing kernel/user boundaries via win32k syscalls and IOCTL fuzzing, escaping browser sandboxes through Mojo IPC bugs, and abusing COM elevation for UAC bypasses. The boundary crossing chains are the most useful part, showing complete attack paths like browser renderer to SYSTEM or phishing to kernel via BYOVD. It assumes you already have initial access and need to understand which boundaries you're hitting and what primitives you need to cross them. More useful as a quick reference than a tutorial, but the diagrams and code snippets give you enough context to know what to research deeper.