CodeMachine Training

Course Selection

CodeMachine offers the most comprehensive training in the industry for all things related to Windows security. Courses can be selected individually or combined together depending on the knowledge level of the attendees and their learning goals. Here are some recommendations for course selection.

TrainingProgrammingTarget audience
WININTNoneHave a good understanding of operating systems but new to the world of the Windows.
WINMALWin32, C++, x64 AssemblerWell versed with Windows architecture and Win32 programming and interested in learning about Windows user mode malware and implants.
KERINTNoneHave a good understanding of Windows user mode architecture or Linux kernel architecture and but new to the world of the Windows Kernel.
KERRKTKernel, C++, x64 AssemblerWell versed with the Windows kernel architecture and programming and interested in learning about Windows kernel mode rootkits and implants.

Frequently asked questions (F.A.Q)

How long are the CodeMachine training courses?

All of our training courses are 5-days long.

How much do these courses cost?

CodeMachine uses tiered flat-rate pricing based on the number of attendees. Please contact us for a quote.

What information do you need to provide a quote?

Please use the contact form to provide the following information for a quote:

  • Which courses are you interested in?
  • How many attendees would be taking the training?
  • Which country are the attendees based in?
  • What is the preferred time frame for the training (month and year)?

Are all CodeMachine courses live instructor-led?

Due to the highly technical nature of our courses, they are all taught in a live instructor-led format. This also allows the instructor to adjust the course delivery based on the technical level of the students.

What does a typical training session look like?

All our courses comprise of lecture, live demos, code walkthroughs, hands-on labs, Q&A sessions, and quizzes. At least 50% time dedicated to hands-on labs, instructor-led demos, and code-walkthroughs to ensure that the theory is well understood and retained by the students.

How much content overlap is there between different courses?

There is very little content overlap between the different courses. Many of our clients engage us to deliver all our courses to the same cohort of students who find every single course extremely valuable.

Can CodeMachine customize the training content?

These courses have been carefully designed to have a certain flow of topics and hands-on lab exercises. Limited customization is possible as long as it maintains the integrity of the course.

What platform does CodeMachine use for online training delivery?

CodeMachine uses the GotoTraining platform for all online training delivery. GotoTraining provides native clients for Windows, Mac, and Linux. GotoTraining is a reliable online training platform that provides low latency audio, minimal lag between audio and video, and negligible downtime.

How is the online experience different from an onsite delivery?

CodeMachine has been delivering online training for more than a decade. Our course content has been carefully created with online delivery in mind. From the feedback received from students over the years, the online training experience is as delightful as an onsite one.

Which time-zones are the online courses delivered in?

For all our private training deliveries, the daily training schedule is during normal work hours of the students, irrespective of the time zone they are in. Quite a few of our multi-national clients have employees attending from different time zones in which case we let the students pick a mutually convenient time.

What is your cancellation policy?

CodeMachine's cancellation policy is the best in the industry - if a course is canceled after confirmation, all we request is that we get reimbursed for all out-of-pocket expenses that have been incurred in the preparation of the course i.e. airfare, hotel reservation charges, etc.

What sets CodeMachine apart from the rest?

CodeMachine has been involved in Windows internals, development, and debugging since the inception of Windows NT in 1992 and has delivered related courses all over the world for more than 15 years. CodeMachine instructors bring unmatched historical perspective to design and architectural questions that come up during the training. Moreover, CodeMachine instructors actively work on Windows security software on a regular basis enabling them to convey real-life experiences to attendees. This depth of technical knowledge and architectural insights sets CodeMachine courses apart from other training providers.

Student Feedback


Here is a sample of some of the publicly available feedback from past students provided via


Small sample of the comments provided by students privately through CodeMachine's training feedback platform.

Extremely clear, concise and cool presentation style. One of the best instructors I ever had (and I am 61 years old...).

Windows Kernel Internals and Rootkits Techniques Course

Nobody teaches Windows Internals like T.Roy. Not only does he know this stuff inside out, he is a fantastic and engaging presenter and does an excellent job of teaching, what is otherwise, a very dry topic.

Windows Kernel Internals Course

T.Roy was fantastic. I enjoyed his diatribes and sidebars about current research. He is extremely knowledgeable and intelligent. An entire course could have been based around his treatment of the state of computer security.

Windows Kernel Rootkits Course

His presentation is extremely engaging. He asks questions, he annotates his slides, and he draws diagrams on the whiteboard. All extremely useful.

Windows Kernel Internals Course

T.Roy gave every question a deep dive answer. We could not stump him!

Windows Kernel Internals Course

T.Roy is probably the best Windows Kernel expert I have ever met. He is able to explain tremendously complicated concepts in a manner that anyone can understand. This is probably one of the best courses I have taken.

Windows Kernel Development Course

The most valuable part of this class is the hands on debugging of dumps with T.Roy there to offer insight and give tips. I was very impressed with T.Roy's knowledge of stuff that I wouldn't think anyone outside of Microsoft would know.

Windows Kernel Debugging Course

This was an extremely knowledgeable instructor, and he demonstrated a very high level of presentational skill. I learned a good deal about presentation style simply by observing him.

Windows Internals and Debugging Course