Advanced Windows Memory Dump Analysis with Data Structures
This book is 100% complete
Completed on 2020-02-10
About the Book
About the Author 5
Presentation Slides and Transcript 7
Practice Exercises 13
Exercise 0: Download, setup and verify your WinDbg installation 18
Exercise C1: Stack Trace Collection (64-bit) 25
Exercise C2: Memory Search (64-bit) 66
Exercise C3: Linked Lists (64-bit) 80
Exercise C4A: WinDbg Built-in Scripting (64-bit) 133
Exercise C5: Registry (64-bit) 167
Exercise C6: Module Variables (64-bit) 176
Exercise C7: System Objects (64-bit) 181
Exercise C8: Network (64-bit) 191
Exercise C9: Device Drivers (64-bit) 205
Exercise C10: Storage and File System (64-bit) 221
Exercise C11: Window Messaging (64-bit) 226
Legacy Exercises 239
Exercise Legacy.0: Download, setup and verify your WinDbg installation 241
Exercise Legacy.C1: Stack Trace Collection (64-bit) 246
Exercise Legacy.C2: Memory Search (64-bit) 271
Exercise Legacy.C3: Linked Lists (64-bit) 282
Exercise Legacy.C4: Scripting (64-bit) 311
Exercise Legacy.C5: Registry (64-bit) 328
Exercise Legacy.C6: Module Variables (64-bit) 336
Exercise Legacy.C7: System Objects (64-bit) 340
Exercise Legacy.C8: Network (64-bit) 346
Exercise Legacy.C9: Device Drivers (64-bit) 354
Selected Q&A 365
The Leanpub 45-day 100% Happiness Guarantee
Within 45 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers), EPUB (for phones and tablets) and MOBI (for Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.