Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revision 3, Process User Space
Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revision 3, Process User Space
Training Course Transcript and WinDbg Practice Exercises with Notes
About the Book
This book is a full-color transcript of Software Diagnostics Services training sessions with 20 step-by-step exercises, notes, source code of specially created modeling applications, and more than 60 questions and answers. Covers more than 50 crash dump analysis patterns from x86 and x64 process memory dumps. Learn how to analyze application and service crashes and freezes, navigate through process user space and diagnose heap corruption, memory and handle leaks, CPU spikes, blocked threads, deadlocks, wait chains, and many more patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and an optional Docker image. The current revision 5.7 uses WinDbg Preview for all exercise transcripts.
About the Author
Bundles that include this book
Table of Contents
About the Author 5
Presentation Slides and Transcript 7
Practice Exercises 33
Exercise 0: Download, setup, and verify your WinDbg Preview or WinDbg installation, or Docker Debugging Tools for Windows image 38
Exercise P1: Analysis of a normal application process dump (64-bit notepad) 52
Exercise P2: Analysis of a normal application process dump (32-bit notepad) 62
Exercise P3: Analysis of a normal application process dump (64-bit Microsoft Edge) 64
Exercise P4: Analysis of an application process dump (64-bit AppK, no symbols) 88
Exercise P5: Analysis of an application process dump (64-bit AppK, with application symbols) 98
Exercise P6: Analysis of an application process dump (AppL, 64-bit) 103
Exercise P7: Analysis of an application process dump (AppL2, 64-bit) 113
Exercise P8: Analysis of an application process dump (AppM, 64-bit) 127
Exercise P9: Analysis of an application process dump (AppN, 64-bit) 137
Exercise P10: Analysis of an application process dump (AppO, 64-bit) 147
Exercise P11: Analysis of an application process dump (AppP, 64-bit) 156
Exercise P12: Analysis of an application process dump (AppR2, 64-bit) 168
Exercise P13: Analysis of an application process dump (AppA, WOW64) 187
Exercise P14: Analysis of an application process dump (AppS, 64-bit) 206
Exercise P15: Analysis of an application process dump (notepad, 32-bit) 226
Exercise P16: Analysis of an application process dump (notepad, 64-bit) 231
Exercise P17: Analysis of an application process dump (AppQ, 32-bit) 239
Exercise P18: Analysis of an application process dump (AppQ, 64-bit) 251
Exercise P19: Analysis of an application process dump (AppT, 64-bit) 261
Exercise P20: Analysis of a service process dump (ServiceA, 64-bit) 276
Application Source Code 285
AppA 287
AppK 289
AppL 290
AppL2 291
AppM 292
AppN 293
AppO 294
AppP 296
AppR2 297
AppS 298
AppQ 300
AppT 304
ServiceA 306
Selected Q&A 309
Triple Dereference 345
Large Heap Allocations 348
Other books by this author
The Leanpub 60-day 100% Happiness Guarantee
Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms
Do Well. Do Good.
Authors have earned$12,151,660writing, publishing and selling on Leanpub, earning 80% royalties while saving up to 25 million pounds of CO2 and up to 46,000 trees.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Top Books
- #1
Ansible for DevOps
Jeff GeerlingAnsible is a simple, but powerful, server and configuration management tool. Learn to use Ansible effectively, whether you manage one server—or thousands.
- #2
CCIE Service Provider Version 4 Written and Lab Exam Comprehensive Guide
Nicholas RussoThe service provider landscape has changed rapidly over the past several years. Networking vendors are continuing to propose new standards, techniques, and procedures for overcoming new challenges while concurrently reducing costs and delivering new services. Cisco has recently updated the CCIE Service Provider track to reflect these changes; this book represents the author's personal journey in achieving that certification.
- #3
CCIE SP v5.0
Łukasz Bromirski, Piotr Jablonski, and Nicholas RussoAre you striving to prepare to and pass CCIE SP lab exam? Take the opportunity and get this workbook! With the attached initial cfg files you will prepare yourself for the CCIE SP exam as well as learn SP technologies applicable to all kinds of today modern networks! This workbook covers blueprint topics and provides challenging examples.
- #4
Functional Programming Made Easier
Charles ScalfaniA Functional Programming book from beginner to advanced without skipping a single step along the way.
In my 40 years of programming, I've felt that programming books always let me down, especially Functional Programming books. So, I wrote the book I wish I had 5 years ago.
Functional Programming will never be easy, but it can be easier.
- #5
C++20 - The Complete Guide
Nicolai M. JosuttisAll new language and library features of C++20 (for those who know previous C++ versions).
The book presents all new language and library features of C++20. Learn how this impacts day-to-day programming, to benefit in practice, to combine new features, and to avoid all new traps.
Buy early, pay less, free updates.
Other books:
- #6
Windows 11 Field Guide
Rafael Rivera and Paul ThurrottThe Windows 11 Field Guide is a full-length e-book about the latest version of Microsoft Windows, aimed at those users who will upgrade from Windows 10 or acquire Windows 11 with a new PC.
- #7
Production Haskell
Matt ParsonsAre you excited about Haskell, but don't know where to begin? Are you thrilled by the technical advantages, but worried about the unknown pitfalls? This book has you covered.
- #8
The PowerShell Scripting and Toolmaking Book
Don Jones and Jeff HicksLearn the patterns, practices, and details of PowerShell Scripting and Toolmaking from the industry's two most recognized experts on the subject.
- #9
Jetpack Compose internals
Jorge CastilloJetpack Compose is the future of Android UI. Master how it works internally and become a more efficient developer with it. You'll also find it valuable if you are not an Android dev. This book provides all the details to understand how the Compose compiler & runtime work, and how to create a client library using them.
- #10
The Art of Functional Programming
Minh Quang Tran, PhDA master class on the fundamentals and principles of functional programming. It contains 20 programming challenges with detailed solutions and 44 quizzes with answers and explanations. Moreover, 84 diagrams graphically illustrate how concepts and techniques work. Two real-world use cases show how to apply functional programming in practice.
Top Bundles
- #1
CCIE Service Provider Ultimate Study Bundle
2 Books
Piotr Jablonski, Lukasz Bromirski, and Nick Russo have joined forces to deliver the only CCIE Service Provider training resource you'll ever need. This bundle contains a detailed and challenging collection of workbook labs, plus an extensively detailed technical reference guide. All of us have earned the CCIE Service Provider certification... - #3
1500 QUIZ COMMENTATI (3 libri)
3 Books
Tre libri dei QUIZ MMG Commentati al prezzo di DUE! I QUIZ dei concorsi ufficiali di Medicina Generale relativi agli anni: 2000-2001-2003-2012-2013-2014-2015-2016-2017-2018-2019-2020-2021 +100 inediti Raccolti in unico bundle per aiutarvi nello studio e nella preparazione al concorso. All'interno di ogni libro i quiz sono stati suddivisi per... - #4
Pattern-Oriented Memory Forensics and Malware Detection
2 Books
This training bundle for security engineers and researchers, malware and memory forensics analysts includes two accelerated training courses for Windows memory dump analysis using WinDbg. It is also useful for technical support and escalation engineers who analyze memory dumps from complex software environments and need to check for possible... - #5
Growing Agile: The Complete Coach's Guide
7 Books
Growing Agile: Coach's Guide Series This bundle provides a collection of training and workshop plans for a variety of agile topics. The series is aimed at agile coaches, trainers and ScrumMasters who often find themselves needing to help teams understand agile concepts. Each book in the series provides the plans, slides, handouts and activity... - #9
Statistics - All Lee Baker's Books
10 Books
This bundle includes all of the statistics books that Lee Baker has published at LeanPub 13 Statistics Books*1 PlaceNo Hassle! All in both epub and mobi formats - perfect for all devices and screen sizes. --------------------------------------------------------- *The book listed as Getting Started With Statistics is a bundle of 4 books...
