Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revision 3, Process User Space
Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revision 3, Process User Space
Training Course Transcript and WinDbg Practice Exercises with Notes
About the Book
This book is a full-color transcript of Software Diagnostics Services training sessions with 20 step-by-step exercises, notes, source code of specially created modeling applications, and more than 60 questions and answers. Covers more than 50 crash dump analysis patterns from x86 and x64 process memory dumps. Learn how to analyze application and service crashes and freezes, navigate through process user space and diagnose heap corruption, memory and handle leaks, CPU spikes, blocked threads, deadlocks, wait chains, and many more patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and an optional Docker image. The current revision 5.7 uses WinDbg Preview for all exercise transcripts.
About the Author
Bundles that include this book
Table of Contents
About the Author 5
Presentation Slides and Transcript 7
Practice Exercises 33
Exercise 0: Download, setup, and verify your WinDbg Preview or WinDbg installation, or Docker Debugging Tools for Windows image 38
Exercise P1: Analysis of a normal application process dump (64-bit notepad) 52
Exercise P2: Analysis of a normal application process dump (32-bit notepad) 62
Exercise P3: Analysis of a normal application process dump (64-bit Microsoft Edge) 64
Exercise P4: Analysis of an application process dump (64-bit AppK, no symbols) 88
Exercise P5: Analysis of an application process dump (64-bit AppK, with application symbols) 98
Exercise P6: Analysis of an application process dump (AppL, 64-bit) 103
Exercise P7: Analysis of an application process dump (AppL2, 64-bit) 113
Exercise P8: Analysis of an application process dump (AppM, 64-bit) 127
Exercise P9: Analysis of an application process dump (AppN, 64-bit) 137
Exercise P10: Analysis of an application process dump (AppO, 64-bit) 147
Exercise P11: Analysis of an application process dump (AppP, 64-bit) 156
Exercise P12: Analysis of an application process dump (AppR2, 64-bit) 168
Exercise P13: Analysis of an application process dump (AppA, WOW64) 187
Exercise P14: Analysis of an application process dump (AppS, 64-bit) 206
Exercise P15: Analysis of an application process dump (notepad, 32-bit) 226
Exercise P16: Analysis of an application process dump (notepad, 64-bit) 231
Exercise P17: Analysis of an application process dump (AppQ, 32-bit) 239
Exercise P18: Analysis of an application process dump (AppQ, 64-bit) 251
Exercise P19: Analysis of an application process dump (AppT, 64-bit) 261
Exercise P20: Analysis of a service process dump (ServiceA, 64-bit) 276
Application Source Code 285
AppA 287
AppK 289
AppL 290
AppL2 291
AppM 292
AppN 293
AppO 294
AppP 296
AppR2 297
AppS 298
AppQ 300
AppT 304
ServiceA 306
Selected Q&A 309
Triple Dereference 345
Large Heap Allocations 348
Other books by this author
The Leanpub 60-day 100% Happiness Guarantee
Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
80% Royalties. Earn $16 on a $20 book.
We pay 80% royalties. That's not a typo: you earn $16 on a $20 sale. If we sell 5000 non-refunded copies of your book or course for $20, you'll earn $80,000.
(Yes, some authors have already earned much more than that on Leanpub.)
In fact, authors have earnedover $12 million USDwriting, publishing and selling on Leanpub.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
