Have you ever felt your windows operating system is hung or becoming slow or having a BSOD? Or an application crash or application hang or slow on windows? Have you had to press the restart button of your PC or the windows server to get rid of the problem and had no clue when that issue will happen again? Or you're asked to analyse a memory dump of a compromised system for isolating a malware?. If that bothers you, this training is all about root causing and solving such complicated issues once and for all, among many other topics it covers.
Have you ever felt your windows operating system is hung or becoming slow or having a BSOD? Or an application crash or application hang or slow on windows? Have you had to press the restart button of your PC or the windows server to get rid of the problem and had no clue when that issue will happen again? Or you're asked to analyse a memory dump of a compromised system for isolating a malware?. If that bothers you, this training is all about root causing and solving such complicated issues once and for all, among many other topics it covers.
Windbg is the single most powerful, debugging and reverse engineering tool in windows platform. Windbg is like an x-ray plus mri plus ct scan for programs running on windows operating system, including the operating system itself. It helps us to root cause complicated problems like we discussed in windows ( OS ) and programs running inside the operating system.
Just like the name implies this training has all the details which you need to master windbg. I have spent all my efforts to make sure this is the best and most complete windbg training available right now and I will keep adding topics to make sure that the statement is true in the future as well.
Targeted audience
Due to any reason, if you are trying to use or learn windbg, you already know what you're doing and there is no better place than this course. If you have been following my youtube series, this course is a complete super set of it. Being said that following are some of the categories of students to whom, I strongly recommend this course.
Support engineers
If you are a support engineer or Escalation Engineer who is supporting any product on windows, or Windows itself, I definitely recommend this course.
Malware analyst and cyber security professionals.
If you are into core cyber security especially on windows platform this tool should be definitely in your arsenal. When it comes to reverse engineering, I myself don't prefer to compare ida pro or any other similar tool with windbg but I always found windbg is one of the most, if not THE most powerful and productive tool when it comes to reverse engineering along with debugging.
Windows SysAdmins
Another main targeted set of audience is Windows administrators who always can take leverage from tools like this and know more about the product they are working with and troubleshoot problems they face at a totally different level.
C and C++ Programmers
Last and not least may be the most important category of students - advanced C and C ++ programmers which includes, driver developers, testers, software maintenance engineers and so on. Are you wondering why your application is crashing, hanging, slow or taking too much resources? That too happens once in a blue moon in production and you have no way to reproduce the issue in your dev environment. Are you asked to debug a problem in a code base you have no clue about? Or you just want to see exactly what that latest feature of cpp 20 is doing behind the scenes? This training is for you.
To summarise, this course is for anyone who wants to study windows internals and advanced production debugging on windows. Post this training you don't have to read every single windows internals and debugging books out there but you will debug whatever you want to know whatever you want to know, rather than reading some abstract result from some books.
Post this training you will not have to read and learn OS internals from any books but you will debug and understand it as and when you need it.
Course Structure
This course has 3 chapters
In Chapter 1 we discuss the necessary concepts to get us started and mostly focus on the commands of the debugger.
In Chapter 2 we apply what we have learned in Chapter 1 to different debugging scenarios, like crashes, hangs, slowness, leaks and more. We will be using test applications for this chapter and we will have source code of these test applications. First we will discuss User mode issues and then we will go into Kernel mode.
In chapter 3 we will use the knowledge gained in Chapter 1 and 2 to troubleshoot real production like or production issues. In this chapter we will discuss analysis of memory dumps which we don't have source code or any idea about. We will start with issues from sysinternals notmyfault and slowly get into true production debugging scenarios. I will keep adding lessons to this chapter if there is enough interest from students on this course. Students also can submit dumps to this chapter and they can get the dumps analyzed for free of cost and share the experience with others.
Please refer to the course content and free preview lesson for more details about the structure and content of the course.
This lecture is a brief introduction to the course. In this lecture we will be discussing,
· What is this course about?
· Targeted audience
· Structure of the course
In this lecture we will be discussing some viewing tips for the training.
In this lecture we will be discussing,
· The contents of each chapters in brief to give the overview of the entire course.
· What is a debugger?
· Different types of debuggers
· Whiteboard to explain text editor, compiler, linker and debugger
· What is Windbg?
In this lecture we will be discussing,
· How to install Windbg?
· Different versions of Windbg available.
In this lecture we will be discussing about,
· Different elements in Windbg UI
· How to attach Windbg?
· Different scenarios of debugging
Hi
All course materials current and future, will be available attached to this lecture,
Let me know if I am missing anything which is discussed in the course and will add it.
Mail me at [email protected].
Thank you,
Anand
In this lecture we will seeing the demo of,
· Attaching WinDbg to notepad
· Observing the frozen and unfrozen state of the notepad
In this lecture we will be discussing about,
· What is a dump?
· What information a dump contains?
In this lecture we will be discussing,
· Concept of symbol
· Demo to understand symbols.
· Whiteboard explaining symbols
In this lecture we will be discussing about,
· Call stack
· Global variables
· Local variables
In this lecture we will discuss the concept of,
· Kernel
· Process
· Thread
· Whiteboard to explain the relation between the above entities
In this lecture we will discussing about,
· Types of dump-hang, crash, kernel/user dumps, Time Travel Tracing
This lecture includes,
· Demo to take a dump
· How to open a dump in Windbg?
In this lecture we will be discussing,
· Overview of debugger commands
· Types of debugger commands- native, config and extension
In this lecture we will be discussing,
· What is help command and how to use it?
In this lecture we will see a demo explaining,
· How to set symbol path in Windbg?
In this lecture we will be discussing,
· Mismatched symbols
· Usage of the commands symnoisy and sympath
In this lecture we will be discussing the debugging command,
· !analyze -v
In this lecture we will be seeing a demo on,
· How to use .sympath command to set a symbol path?
In this lecture we will be discussing about,
· Debugger extensions
· How to load and unload debugger extensions using son of strike (sos) .NET extension?
· The commands discussed in this lecture are,
I. .chain
II. .extmatch
III. dbghelp
IV. .unload
V. .load
VI. l
VII. lmvn
VIII. !lmi
In this lecture we will be discussing the native commands,
· x
· ln
In this lecture we will be discussing the native commands,
· r
· k (kvn, kf)
In this lecture we will be discussing the native commands,
· e (ea)
· u (ub)
In this lecture we will be discussing the command,
· dc (dv, dps)
In this lecture we will be discussing the command,
· dt
· How to recursively dump using dt?
In this lecture we will be discussing,
· How to dump a doubly linked list?
In this lecture we will doing a demo to see the practical application of dt command.
Here, we will be discussing the commands,
· dv
· .frame
In this lecture we will be discussing the command,
s-search memory
In this lecture we will be discussing the commands,
· bp
· bm
· bd
· be
· ba
· bpcmds
· bl
In this lecture we will be discussing the commands,
· t
· p
· wt
· .logopen
.logclose
In this lecture we will be discussing about,
* wow64 mode of debugging
In this lecture we will see the demo of,
· 32bit application in 32bit debugger
· 64bit application in 64bit debugger
· 32bit application in 64bit debugger
· .effmach command
· Kernel mode debugging in wow64
In this lecture we will be explaining 32bit stack frame with the help of whiteboard.
In this lecture we will be explaining 32bit assembly language instructions with the help of a demo.
In this lecture we will be explaining 64bit assembly language instructions with the help of a demo.
In this lecture we will be discussing about,
· ChildEBP
· RetAddr
· argstochild
In this lecture we will be doing a demo showing different ways to give address range in commands.
In this lecture we will be discussing about,
· Different variants of foreach command
In this lecture we will discussing the commands,
· version
· vertarget
· pipe
In this lecture we will be discussing about,
· Time Travel Tracing
· Different commands related to time travel tracing
This lecture includes, the overview of what we have seen so far.
In this lecture we will be discussing,
· Overview of chapter 2
· Whiteboard- Generation of a program
· Whiteboard- how a program is loaded into memory
In this lecture we will be discussing the concepts,
· User mode
· Kernel mode (privileged mode)
· Address translation
· Virtual address
· Physical address
· Address space
· Relation between physical and virtual address
· Page table
· Cr3 register
· Interrupts
· Exceptions
In this lecture I will be explaining the concept of objects and handles with the help of whiteboard.
In this lecture we will be using whiteboard to explain the concepts,
· Memory allocation- APIs used to allocate memory like Virtual alloc, malloc, heap alloc
· Different types of memory allocation – committed, reserved
· Access Violation
In this lecture we will try to understand the concept of process and threads with the help of whiteboard.
In this lecture we will be discussing the concepts,
· User mode data structures- peb, teb
· System calls
· Demo to understand how system call is passed to kernel mode, with the help of windbg attached to kernel mode.
In this lecture we will be discussing the concepts,
· exe
· dll
· Driver
· Signature of portable executable (mz)
· Diagram-Second chance exemption handling
· Demo- first and second chance exception for a simple division by zero exception.
· Dump collection using windows error reporting (WER)
· Analyzing the dump
· Signs of crash
· Event Viewer
· Steps to handle a simple crash
· Procdump, debug diag, adplus
In this lecture we will be,
· Collecting dump using Procdump
· Discuss some more facts about WER(Windows Error Reporting).
In this lecture we will be seeing,
· Demo to explain access violation
· Whiteboard
In this lecture we will be explaining different types of exceptions using event filter in Windbg.
In this lecture we will be discussing,
· User mode memory corruption
· Whiteboard to explain:
I. Structure of heap
II. Heap Overrun
III. Heap Underrun
IV. Page Heap
In this lecture we will see a demo on,
· Heap Corruption
· Heap Overrun
· Heap Underrun
· Enabling page heap
In this lecture we will see a demo on,
· Double Free
· Access after free
In this lecture we will see,
· Structure of Stack
· Nature of Corruption
· Demo- Reconstruction of Stack
In this lecture we will see,
· Demo- Stack overflow
· User mode- case of poor exception handling
· !exchain command
In this lecture we will be learning,
· How to recognize a normal dump by collecting dumps of,
I. Scanf console application
II. Semi console application with a message box
III. Full-fledged Windows UI application
IV. Notepad
· !heap command
In this lecture we will explaining the following concepts with the help of whiteboard
· Slow application
· Mutually exclusive locks/mutex
· Deadlock
Also, we will be discussing,
· What is a hang?
In this lecture we will explaining the following concepts,
· Thread
· Scheduler/dispatcher
· Lock
· Wait
· Dispatcher object
· Whiteboard to explain UI Hang
In this lecture we will see a demo of,
· Slow application UI Hang
In this lecture we will see a demo of,
· User mode- critical session deadlock
In this lecture we will see a demo of,
· Collection of hang dump using procdump and task manager
In this lecture we will be discussing,
· What is a loader lock with the help of whiteboard.
· Demo- Loader lock.
· Usage of peb command to dump out loader lock.
· Walking waitchain in user mode.
In this lecture we will be discussing,
· Mutex deadlock
· How a mutex looks in the debugger?
In this lecture we will see a demo of,
· Thread executing an infinite loop
· Taking multiple dumps- idea of snapshot
In this lecture we will be discussing,
· Whiteboard- Explaining the concept of leak.
· Leak Analysis- Obtaining allocation stack- +USD way
· Using UMDH to find the difference between t1 and t2
In this lecture we will be seeing a slow application with the help of umdh.
In this lecture we will be discussing,
. Demo- More than 1 mb memory allocation inside nt Heap
. How a thread leak looks in a debugger?
In this lecture we will be discussing,
· Handle leak
· !htrace command
In this lecture we will see a demo of,
· Demo- Generic way of leak analysis
· Steps for leak analysis
In this lecture we will see a demo of,
· Leak- GDI handle
In this lecture we will see a demo of,
· Leak- Virtual alloc
In this lecture we will see a demo of,
· Dumping down vtable
· Looking at overloading
· Global constructor callback
· Global destructor callback
· Global constructor of a dll
· New
· Deletion of array
In this lecture we will see a demo of,
· Template functions
· Function overloading
· Case study- how dangerous is doing anything in loader lock
In this lecture we will see a demo of,
· Reading and writing to address space with the help of Facebook app using time travel tracing in Windbg preview.
· Security issues related to attaching a debugger to your system by third party.
In this lecture we will be discussing,
· Whiteboard- Kernel Mode/privileged mode
· Handling registers – cr3 register
· Interrupt handling
· Blue screen of death or kernel panic- unhandled exception in kernel mode
In this lecture we will be discussing,
· Difference between minidump, full dump and kernel dump
· Demo- configuring the system for full kernel memory dump
· Crash the system using Not My Fault from sysinternals
· Taking a full memory dump kernel mode.
In this lecture we will be analyzing,
· The kernel mode full memory dump using Windbg
· How to differentiate a kernel dump from user dump?
· What is an Executable search path?
· !thread command to see current process
· Switching into other threads and processes
· Viewing kernel mode process stack using !process 0 17 command
· .process command to switch into the context of a process
In this lecture we will be discussing,
· Kernel mode essential internals
· NMI- Not My Fault & NMI switch
· How to force system crash using keyboard?
· How to crash an EC2 instance in AWS?
· Vmss2core- Collect dump from virtual machines running on VMware workstation
· Trap or interrupt context
· System process- ntokrnl.exe (main process inside system process)
· IRP- IO request packet
In this lecture we will be discussing,
· ALPC- whiteboard explaining ALPC
· Eresource
· Difference between Eresource and critical session
· What is a mutex?
· Spinlocks
In this lecture we will be discussing,
· Timer interrupt handler
· Interrupt mask
· IRQL-passive level, APC level, DPC level
· Dispatcher object- thread, process, eresource, mutex, semaphore
· Concept of wait
· Why do we need to mask interrupt?
· Spinlocks revisited
In this lecture we will be discussing,
· Whiteboard- paging
· Paged and non-paged pool
· SysPTE- system page table entry
In this lecture we will be discussing,
· Implementation of Windows API
In this lecture we will be discussing,
· How to attach kernel debugger to Virtual machine?
· Demo- attaching Windbg to Windows logon UI
In this lecture we will be reviewing,
· The code of sample application which we will be using in the kernel mode with the help of whiteboard.
· Brief discussion on Windows drivers
In this lecture we will see a demo of,
· Kernel mode simple crash
· Usage of .trap command
In this lecture we will see a demo of,
· Kernel mode stack overflow
In this lecture we will see a demo of,
· Kernel mode stack corruption and rebuilding the stack
In this lecture we will see a demo of,
· Pool corruption
· Enabling special pool and trouble shooting pool corruption.
· Using !poolused command to see the pool tag
· Gflags
· Overview of what we have seen so far in kernel mode
In this lecture we will be discussing,
· Different bugcheck codes
· Concept of blue screen of death
In this lecture we will be discussing,
· Why kernel mode crashes are complicated than user mode?
· Tips to handle kernel mode crash
In this lecture we will be discussing,
· Reason for kernel hangs
· What is the difference between hard hang, soft hang & slowness?
· What are the different types of kernel hang?
In this lecture we will see a demo of,
· Spinlock Deadlock
In this lecture we will be discussing,
. Application high CPU-kernel mode
In this lecture we will see a demo of,
· System hang due to pool leak
In this lecture we will see a demo of,
· Eresource deadlock
· !locks command
OpenCourser helps millions of learners each year. People visit us to learn workspace skills, ace their exams, and nurture their curiosity.
Our extensive catalog contains over 50,000 courses and twice as many books. Browse by search, by topic, or even by career interests. We'll match you to the right resources quickly.
Find this site helpful? Tell a friend about us.
We're supported by our community of learners. When you purchase or subscribe to courses and programs or purchase books, we may earn a commission from our partners.
Your purchases help us maintain our catalog and keep our servers humming without ads.
Thank you for supporting OpenCourser.