The article refers to "by the NT debug symbols that one paper has reproduced", linking to <http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc http://a

The article refers to "by the NT debug symbols that one paper has reproduced", linking to <http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc>, but that link was dead. (If you want your links to be useful to the future, don't title links 'one paper'!) According to the Wayback Machine, it was an M.Sc. thesis by Peter Norris called "The Internal Structure of the Windows Registry" (https://web.archive.org/web/20200808224213/http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc https://web.archive.org/web/20200808224213/http://amnesia.gt...).