Abstract

This course is planned and organized to provide class attendees with practical experience on WinDbg and offer an appropriate coverage on its resources.

We offers an intensive course where we explain main resources of WinDbg for analyzing live systems and crash dumps, followed by a few concepts of Windows Internals. Throughout this class we will show how to setup an appropriate environment, including kernel debugging, and explain main concepts and fundamentals of WinDbg. At the second part of the course, we will explain Windows 10/11 heap memory management, and delve into details of WinDbg. Afterwards, we finish this part using learned commands to inspect a Windows system. At the third part of the course we teach how to use the Time Travel Debugging and provide students with important extensions that can be used during any analysis, mainly in Incident Response cases. Finally, the fourth and last part we provide an introduction to WinDbg Data Model and analyze a few crash dumps.

This class will focus on Windows operating system, exclusively.

Who Should Attend

This class should be attended by professionals interested in learning Incident Response, reverse engineering and malware analysis on Windows as well as professionals who want to expand their current knowledge on the referred topic. Class attendees from different areas such as exploit development, incident response, threat hunting, reverse engineering, pentesting and cyber defense will enjoy and benifit from this training.

Key Learning Objectives

This class has the following goals:

  • Show how to setup and use WinDbg.
  • Present different resources and commands offered by WinDbg.
  • Provide students with concepts on Windows 11 Heap structure.
  • Use TTD and main WinDbg extensions to analyze incidents.
  • Provide students with fundamentals of Data Model.
  • Explain and demonstrate how to analyze crash dumps.

Prerequisite Knowledge

Students should be have:

  • Previous experience on Windows operating systems.
  • Previous experience with any other debugger.
  • Basic knowledge on reverse engineering or malware analysis.
  • Previous experience programming might be useful.
  • Attended previous courses of Incident Response and/or Malware Analysis.

Lab Requirements

Students must prepare the following lab configuration:

  • Having VMware Workstation, Oracle VirtualBox or Microsoft Hyper-V installed on the system.
  • Two virtual machines running Windows 11 x64.
  • Visual Studio and SDK installed (with WinDbg) on both Windows machines.
  • IDA Pro (preferred) or IDA Free installed on all system.

Additional lab instructions will be sent to students prior the class.

Summary of Training Topics

  • Introduction
  • Lab Setup
  • WinDbg Operationsm, TTD and Data Model
  • Kernel Debugging
  • Windows 10/11 HEAP
  • Debugging Live Systems
  • IR Using WinDbg Extensions
  • Crash Dump Analysis

Note: Topics can be added, merged or removed without prior notice! Additional lab instructions will be sent to students prior the class.