Structural and Behavioral Patterns for Diagnostics, Anomaly Detection, Forensics, Prognostics, Root Cause Analysis, Debugging

Our tools are only as good as our pattern language.

Analysis patterns for the quality of software diagnostics in endpoint devices, enterprise, and cloud environments.

Diagnostics Science

Diagnostics is the mother of problem solving.

All areas of human activity involve the use of diagnostics. Proper diagnostics identifies the right problems to solve. We are now a part of a non-profit organization dedicated to the developing and promoting the application of such diagnostics: systemic and pattern-oriented (pattern-driven and pattern-based).

Online Training: Accelerated Linux Core Dump Analysis

Software Diagnostics Services organizes this online training course.

May 24 - May 26 2022 6.30pm - 8.30pm (GMT) Price 99 USD Registration

Learn how to analyze Linux process and kernel crashes and hangs, navigate through core memory dump space and diagnose corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more. This training uses a unique and innovative pattern-oriented diagnostic analysis approach to speed up the learning curve. The training consists of more than 20 practical step-by-step exercises using GDB and WinDbg debuggers highlighting more than 50 memory analysis patterns diagnosed in 64-bit core memory dumps from x64 and ARM64 platforms. The training also includes source code of modeling applications, a catalog of relevant patterns from Software Diagnostics Institute, and an overview of relevant similarities and differences between Windows and Linux memory dump analysis useful for engineers with Wintel background.

Prerequisites: Basic Linux user skills.

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, DevSecOps and SRE, and quality assurance engineers. The training is based on the forthcoming 2nd edition of the bestselling Accelerated Linux Core Dump Analysis book and will be fully containerized.

Slides from the previous version of this training

Training outline:

  • Day 1: Overview. Process core dump analysis.
  • Day 2: Process core dump analysis. Kernel crash dump analysis.
  • Day 3: Kernel crash dump analysis. Additional Q&A and memory dump analysis if necessary. Tests.
  • Before the training you get:

    After the training, you also get:

    • The updated PDF book version of the training.
    • Personalized Certificate of Attendance with unique CID.
    • Optional Personalized Certificate of Completion with unique CID (after the tests).
    • Answers to questions during training sessions.
    • New recording.

Book: Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition

Available in PDF format from Software Diagnostics Services

This training course is a combined, reformatted, improved, and modernized version of the two previous books Windows Debugging: Practical Foundations and x64 Windows Debugging: Practical Foundations, that drew inspiration from the original lectures we developed almost 18 years ago to train support and escalation engineers in debugging and crash dump analysis of memory dumps from Windows applications, services, and systems. At that time, when thinking about what material to deliver, we realized that a solid understanding of fundamentals like pointers is needed to analyze stack traces beyond a few WinDbg commands. Therefore, this book is not about bugs or debugging techniques but about the background knowledge everyone needs to start experimenting with WinDbg and learn from practical experience and read other advanced debugging books. This body of knowledge is what the author of this book possessed before starting memory dump analysis using WinDbg 18 years ago, which resulted in the number one debugging bestseller: multi-volume Memory Dump Analysis Anthology. Now, in retrospection, we see these practical foundations as relevant and necessary to acquire for beginners as they were 18 years ago because operating systems internals, assembly language, and compiler architecture haven't changed much in those years.

The book contains two separate sets of chapters and corresponding illustrations. They are named Chapter x86.NN and Chapter x64.NN respectively. The new format makes switching between and comparing x86 and x64 versions easy. There is some repetition of content due to the shared nature of x64 and x86 platforms. Both sets of chapters can be read independently. We included x86 chapters because many 3rd-party Windows applications are still 32-bit and executed in 32-bit compatibility mode on x64 Windows systems. The course consistently uses WinDbg (X86) for 32-bit examples and WinDbg (X64) for 64-bit examples. The book also has a larger format similar to other training courses from Software Diagnostics Services.

Almost 5 years have passed since the first edition of the combined training course that used the earlier version of Windows 10. Since then, we have also published "Practical Foundations of Linux Debugging, Disassembling, Reversing" and "Practical Foundations of ARM64 Linux Debugging, Disassembling, Reversing" books. At that time, we thought about revising our Windows course. Since then, Windows 11 appeared, and we also added Docker support for most of our Windows memory dump analysis courses. While working on the "Accelerated Windows Debugging 4D "course, we decided to make the second edition of Practical Foundations of Windows Debugging based on WinDbg from Windows 11 SDK and Visual Studio 2022 build tools and an optional Docker support for the exercise environment. We also changed the ":=" operator to "<-" in our pseudo-code for Intel disassembly syntax flavor to align with our recent Linux Practical Foundations books, which use "->" in pseudo-code for x64 AT&T disassembly syntax flavor and "<-" in pseudo-code for ARM64 disassembly syntax. All sample projects were recompiled, and many diagrams were redone for the new edition to reflect changes in code generation. WinDbg syntax and code highlighting were also improved. There are also minor additions for C++11 and C++20.

The book is useful for:

  • Software technical support and escalation engineers
  • Software engineers coming from managed code or JVM background
  • Software testers
  • Engineers coming from non-Wintel environments
  • Windows C/C++ software engineers without assembly language background
  • Security researchers without x86/x64 assembly language background
  • Beginners learning Windows software reverse engineering techniques

This introductory training course can complement the more advanced course Accelerated Disassembly, Reconstruction and Reversing, Revised Edition. It may also help with advanced exercises in Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revised, Process User Space and Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revised, Kernel and Complete Spaces. This book can also be used as an Intel assembly language and Windows debugging supplement for relevant undergraduate-level courses.

Product information:

  • Title: Practical Foundations of Windows Debugging, Disassembling, Reversing: Training Course, Second Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 338 pages
  • Publisher: OpenTask (April 2022)
  • ISBN-13: 978-1-912636-35-8

Table of Contents

REPL Streaming (REPLS)

When we interact with a debugger, we use the so-called REPL, Read-Execute-Print-Loop (where we replace Eval in traditional REPL). We type some command, it is executed by a debugger engine against a memory dump, the results are printed, and we repeat. However, the results can be streamed for further processing, for example, to automate certain analysis patterns, for example, Structure Sheaves (as distributed logs), Region Profiles, and Region Clusters (we list recently added analysis patterns). In the background, the stream processing results are provided back to the debugger Print phase (or in parallel as a further diagnostic aid).

In the case of software traces and logs, streaming is a natural part of processing. But CoTraces fit into REPLS (processed results can also form Message Annotations), and generally, Diags.

REPS is an architectural pattern, and it is now added to our catalog of software diagnostics architecture patterns.

Online Training: Extended Windows Memory Dump Analysis

Extended Windows Memory Dump Analysis Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course:

June 21 - June 23 2022 6.15pm - 8.15pm (GMT) Price 99 USD Registration

Extended Windows Memory Dump Analysis: Using and Writing WinDbg Extensions, Database and Event Stream Processing, Visualization training course extends pattern-oriented analysis introduced in Accelerated Windows Memory Dump Analysis, Accelerated .NET Core Memory Dump Analysis, and Advanced Windows Memory Dump Analysis with Data Structures courses with:

  • Surveying the current landscape of WinDbg extensions with analysis pattern mappings
  • Writing WinDbg extensions in C and C++
  • Connecting WinDbg to NoSQL databases
  • Connecting WinDbg to streaming and log processing platforms
  • Querying and visualizing WinDbg output data

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Prerequisites: Working knowledge of WinDbg. Working knowledge of C or C++ is optional (required only for some exercises). Other concepts are explained when necessary.

Audience: Software developers, software maintenance engineers, escalation engineers, quality assurance engineers, security and vulnerability researchers, malware and memory forensics analysts who want to build memory analysis pipelines.

Online Training: Accelerated Windows Debugging 4D

Accelerated Windows Debugging 4D Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course:

May 17 - May 19 2022 6.15pm - 8.15pm (GMT) Price 99 USD Registration

Learn live local and remote debugging techniques and tricks in the kernel, user process, and managed .NET spaces using WinDbg debugger. The unique and innovative Debugging4 course teaches unified debugging patterns applied to real problems from complex software environments. The training consists of practical step-by-step hands-on exercises. The new version of the training uses Windows 11, WinDbg Preview, and includes exercises for .NET Core and Time Travel Debugging.

Slides from the previous Debugging3 training

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • Accelerated Windows Debugging3 PDF book
  • Access to Software Diagnostics Library

After the training, you also get:

  • The updated PDF book version of the training: Accelerated Windows Debugging4
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Prerequisites: Working knowledge of one of these languages: C, C++, C#. Operating system internals and assembly language concepts are explained when necessary.

Audience: software engineers, software maintenance engineers, escalation engineers, security and vulnerability researchers, malware and memory forensics analysts who want to learn live memory inspection techniques.

If you are interested in Windows postmortem software diagnostics using memory dump files there are other courses available:

Accelerated Windows Memory Dump Analysis

Accelerated .NET Core Memory Dump Analysis

Advanced Windows Memory Dump Analysis with Data Structures

Accelerated Windows Malware Analysis with Memory Dumps

Book: Advanced Windows Memory Dump Analysis with Data Structures, Fourth Edition

Available in PDF and paperback format from Software Diagnostics Technology and Services.

The full transcript of Software Diagnostics Services training course with 15 step-by-step exercises, notes, and selected questions and answers. Learn how to navigate through memory dump space and Windows data structures to diagnose, troubleshoot and debug complex software incidents. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. It consists of practical step-by-step exercises using WinDbg to diagnose structural and behavioral patterns in the 64-bit kernel and complete (physical) memory dumps. Additional topics include memory search, kernel linked list navigation, practical WinDbg scripting, registry, system variables and objects, device drivers, and I/O. Prerequisites are basic and intermediate level Windows memory dump analysis: the ability to list processors, processes, threads, modules, apply symbols, walk through stack traces and raw stack data, diagnose patterns such as heap corruption, CPU spike, memory leaks, access violation, wait chains and deadlocks. If you don't feel comfortable with prerequisites then Accelerated Windows Memory Dump Analysis training book is recommended before purchasing and reading this book course. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers. The 4th edition was fully reworked to use the latest WinDbg and now covers memory dumps from Windows 11. Three new exercises were added and the previous ones now have improved command syntax and color highlighting. This edition also includes a possibility to use a Docker WinDbg image with required symbol files instead of a local Debugging Tools for Windows installation.

  • Title: Advanced Windows Memory Dump Analysis with Data Structures: Training Course Transcript and WinDbg Practice Exercises with Notes, Fourth Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (February 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 293 pages
  • ISBN-13: 978-1912636990

Table of Contents

Online Training: Accelerated Linux Disassembly, Reconstruction, and Reversing

Accelerated Disassembly, Reconstruction and Reversing Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course.

Jul 26 - Jul 28 2022 6.15pm - 8.15pm (GMT) Price 99 USD Registration

Learn disassembly, execution history reconstruction, and binary reversing techniques for better software diagnostics, troubleshooting, debugging, memory forensics, vulnerability and malware analysis on x64 and AMD64 Linux platforms. The course uses a unique and innovative pattern language approach to speed up the learning curve. The training consists of practical step-by-step, hands-on exercises using GDB and Linux core memory dumps. Covered more than 25 ADDR patterns originally introduced for the x64 Windows platform, and many concepts are illustrated with Memory Cell Diagrams. The course builds upon and extends the basic patterns introduced in Practical Foundations of Linux Debugging, Disassembling, Reversing books.

Selected slides of the previous Windows-based training

Level: Intermediate/Advanced.

Prerequisites: Working knowledge of C and C++. Operating system internals and assembly language concepts are explained when necessary.

Audience: Software technical support and escalation engineers who analyze core dumps from complex software environments and need to go deeper in their analysis of abnormal and malicious software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse cloud and endpoint computer environments, SRE and DevSecOps, security and vulnerability researchers, malware and memory forensics analysts who have never used GDB for analysis of computer memory.

The training consists of 3 two-hour sessions.

Before the training, you get:

  • Practical Foundations of Linux Debugging, Disassembling, Reversing PDF book
  • Practical Foundations of ARM64 Linux Debugging, Disassembling, Reversing PDF book
  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Online Training: Advanced Windows Memory Dump Analysis with Data Structures

Software Diagnostics Services organizes this online training course.

Advanced Windows Memory Dump Analysis Logo

Learn how to navigate through memory dump space and Windows data structures to diagnose, troubleshoot and debug complex software incidents. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. It consists of more than 12 practical step-by-step exercises using WinDbg to diagnose structural and behavioral patterns in the 64-bit kernel and complete (physical) memory dumps. Additional topics include memory search, kernel linked list navigation, practical WinDbg scripting including built-in language and JavaScript, registry, system variables and objects, device drivers, I/O, file system filters, and security. The training is based on and extends the 3rd edition of the Advanced Windows Memory Dump Analysis with Data Structures book and is fully revised for the latest Windows 10 and 11 versions. It is also optionally containerized.

Draft Slides

The training consists of 3 two-hour sessions. When you finish the training you additionally get:

  • The updated PDF book version
  • Practical Foundations of Windows Debugging, Disassembling, Reversing PDF book
  • Access to Software Diagnostics Library with more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Prerequisites: Basic and intermediate level Windows memory dump analysis: the ability to list processors, processes, threads, modules, apply symbols, walk through stack traces and raw stack data, diagnose patterns such as heap corruption, CPU spike, memory leaks, access violation, wait chains and deadlocks. If you don't feel comfortable with prerequisites then Accelerated Windows Memory Dump Analysis training or the corresponding book is recommended before attending this training.

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers.

Book: Accelerated .NET Core Memory Dump Analysis

The following direct links can be used to order the book now:

Available in PDF format from Software Diagnostics Technology and Services.

The full transcript of Software Diagnostics Services training with 9 step-by-step exercises, notes, and source code of specially created modeling applications. The course covers 19 .NET memory dump analysis patterns plus additional 19 unmanaged patterns. Learn how to analyze .NET Core 5/6 application and service crashes and freezes, navigate through memory dump space (managed and unmanaged code) and diagnose corruption, leaks, CPU spikes, blocked threads, deadlocks, wait chains, resource contention, and much more. The training consists of practical step-by-step exercises using Microsoft WinDbg debugger to diagnose patterns in 64-bit process memory dumps. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The book is based on the previous fourth edition of Accelerated .NET Memory Dump Analysis that covered .NET Core 5 and Windows 10. It is updated for the latest WinDbg from Windows 11 SDK and has a new .NET Core 6 exercise with a memory dump from Windows 11. This edition also includes a possibility to use a Docker WinDbg image with required symbol files instead of a local Debugging Tools for Windows installation. Prerequisites: Basic .NET programming and debugging. Audience: Software technical support and escalation engineers, system administrators, DevOps, performance and reliability engineers, software developers, and quality assurance engineers. The book may also interest security researchers, reverse engineers, malware and memory forensics analysts.

  • Title: Accelerated .NET Core Memory Dump Analysis: Training Course Transcript and WinDbg Practice Exercises
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (February 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 213 pages
  • ISBN-13: 978-1912636549

Table of Contents

Book: Accelerated Linux Core Dump Analysis, Second Edition

Available in PDF format from Software Diagnostics Technology and Services.

The full transcript of Software Diagnostics Services training. Learn how to analyze Linux process and kernel crashes and hangs, navigate through core memory dump space and diagnose corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more. This training uses a unique and innovative pattern-oriented diagnostic analysis approach to speed up the learning curve. The training consists of 30 practical step-by-step exercises using GDB and WinDbg debuggers highlighting almost 40 memory analysis patterns diagnosed in 64-bit core memory dumps from x64 and ARM64 platforms. The training also includes source code of modeling applications, a catalog of relevant patterns from Software Diagnostics Institute, and an overview of relevant similarities and differences between Windows and Linux memory dump analysis useful for engineers with Wintel background. In addition to the fully revised x64 Linux process dump analysis exercises using GDB, the second edition now includes x64 Linux kernel core dump analysis using crash tool and ARM64 Linux process dump analysis using WinDbg. The new edition also includes a Q&A section from the latest training sessions.

  • Title: Accelerated Linux Core Dump Analysis: Training Course Transcript with GDB and WinDbg Practice Exercises, Second Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (January 2022)
  • Language: English
  • PDF: 418 pages
  • ISBN-13: 978-1912636075

Table of Contents

Systematic Software Diagnostics


Systematic Software Diagnostics attempts to unify various disorganized and fragmentary individual software diagnostic approaches for software construction and post-construction phases.

Initially, when working on software diagnostics foundations, we recognized the need for systematicity by including some of our books and training courses in the Systematic Software Fault Analysis Series. Over the following years, our many practical books became supplemented by theory and a series of seminars.

Now, after more than 15 years, coherent and complete theoretical, practical, and factual knowledge is systematically unified and ordered into pattern catalogs according to first principles after being integrated across individual observations as fully as possible at this time of the discipline development. In addition to systematicity, software diagnostics is also highly interdisciplinary and systemic, crossing boundaries of other disciplines. Its fundamental methodology is a pattern-oriented analysis of artifacts. Every artifact is considered a trace, log, text, and narrative. Diagnostic analysis patterns, common recurrent analysis techniques and methods in specific contexts, organized into catalogs, are used to identify structural and behavioral patterns, common recurrent problems (sets of indicators, symptoms, signs) together with recommendations and possible solutions to apply in specific contexts.

Consider, for example, a typical diagnostic procedure called measurement. It is an analysis pattern itself applied to artifacts or used to generate other artifacts to which analysis patterns are applied. Systematic Software Diagnostics is equally applicable to software development processes where the same analysis patterns are applied to development artifacts, repositories, documentation, management operations, monitoring, team structure, and dynamics. Even a diagnostic analysis is considered an artifact to apply analysis patterns. Where Systematic Software Diagnostic overlaps with other development and engineering activities, it offers additional pattern languages for software data analysis, troubleshooting, debugging, root cause analysis, performance analysis, writing tools, software and memory forensics, memory dump analysis, network trace analysis, static and dynamic malware analysis, reversing, vulnerability analysis, software internals, and cloud computing.

Book: Practical Foundations of ARM64 Linux Debugging, Disassembling, Reversing

The following direct links can be used to order the book now:

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Services

This training course is a Linux ARM64 (A64) version of the previous Practical Foundations of Linux Debugging, Disassembly, Reversing book. It also complements Accelerated Linux Core Dump Analysis training course.

The book skeleton is the same as its x64 Linux predecessor, but the content was revised entirely because of a different Linux distribution and CPU architecture.

The course is useful for:

  • Software support and escalation engineers, cloud security engineers, SRE, and DevSecOps
  • Software engineers coming from JVM background
  • Software testers
  • Engineers coming from non-Linux environments, for example, Windows or Mac OS X
  • Engineers coming from non-ARM environments, for example, x86/x64
  • Linux C/C++ software engineers without assembly language background
  • Security researchers without assembly language background
  • Beginners learning Linux software reverse engineering techniques

This book can also be used as an ARM64 assembly language and Linux debugging supplement for relevant undergraduate-level courses.

Product information:

  • Title: Practical Foundations of ARM64 Linux Debugging, Disassembling, Reversing: Training Course
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 176 pages
  • Publisher: OpenTask (January 2022)
  • ISBN-13: 978-1-912636-37-2

Table of Contents

Book: Accelerated Windows Memory Dump Analysis, Fifth Edition, Revised

The following direct links can be used to order the book now:

Buy PDF from Leanpub

Also available for sale in PDF format from Software Diagnostics Services.

The second edition is available for SkillSoft Books24x7 subscribers

The full-color transcript of Software Diagnostics Services training sessions with 32 step-by-step exercises, notes, source code of specially created modeling applications, and more than 120 questions and answers. Covers more than 65 crash dump analysis patterns from x86 and x64 process, kernel, and complete (physical) memory dumps. Learn how to analyze application, service and system crashes and freezes, navigate through memory dump space and diagnose heap corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and optional Docker image.

The course consists of two parts:

  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revised, Process User Space: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (December 2021)
  • Language: English
  • PDF: 410 pages
  • ISBN-13: 978-1912636051
  • Table of Contents
  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revised, Kernel and Complete Spaces: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (December 2021)
  • Language: English
  • PDF: 370 pages
  • ISBN-13: 978-1912636082
  • Table of Contents

Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revised: Kernel and Complete Spaces

The following direct links can be used to order the book:

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Services

The full-color transcript of Software Diagnostics Services training sessions with 12 step-by-step exercises, notes, source code of specially created modeling applications, and 45 questions and answers. Covers more than 35 crash dump analysis patterns from x64 kernel and complete (physical) memory dumps. Learn how to analyze system crashes and freezes, navigate through kernel and complete spaces, and diagnose patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and optional Docker image.

  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revised, Kernel and Complete Spaces: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (December 2021)
  • Language: English
  • PDF: 370 pages
  • ISBN-13: 978-1912636082

Table of Contents

Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revised: Process User Space

The following direct links can be used to order the book:

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Services

The full-color transcript of Software Diagnostics Services training sessions with 20 step-by-step exercises, notes, source code of specially created modeling applications, and more than 70 questions and answers. Covers more than 50 crash dump analysis patterns from x86 and x64 process memory dumps. Learn how to analyze application and service crashes and freezes, navigate through process user space and diagnose heap corruption, memory and handle leaks, CPU spikes, blocked threads, deadlocks, wait chains, and many more patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and optional Docker image.

  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revised, Process User Space: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (December 2021)
  • Language: English
  • Paperback: 410 pages
  • ISBN-13: 978-1912636051

Table of Contents

Accelerated Software Trace Analysis, Revised Edition, Part 1: Fundamentals and Basic Patterns

The following direct links can be used to order the book:

Buy Kindle print replica from Amazon

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Technology and Services

This book is a revised edition of the original Accelerated Windows Software Trace Analysis training course. General trace and log analysis pattern language covers any execution artifact from a small debugging trace to a distributed log with billions of messages from hundreds of computers, thousands of software components, threads, and processes. It also allows the application of uniform diagnostics and anomaly detection across diverse software environments, troubleshooting and debugging Windows, Mac OS X, Linux, Android, iOS, and any other possible computer platform including networking and IoT. Part 1 covers fundamentals and explains more than 60 basic trace and log analysis patterns, which are now cross-referenced in this improved and less Windows-centric edition. It can also serve as a reference.

  • Title: Accelerated Software Trace Analysis, Revised Edition, Part 1: Fundamentals and Basic Patterns
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (December 2021)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 110 pages
  • ISBN-13: 978-1912636310

Revised slides from the book

The Dream of Quantum Software Diagnostics

We are adding quantum computing to our research agenda now by coining "Quantum Software Diagnostics" as a way to analyze different parts of very large software execution artifacts simultaneously, make sense of entire software traces and logs, and predict software behavior (software prognostics). It contains two adjoint phrases centered around Software: left adjoint Quantum Software Diagnostics and right adjoint Quantum Software Diagnostics. The former is about diagnosing quantum software, and the latter is about applying quantum methods to problems of software diagnostics.

In June 2009, we wrote in Memory Dump Analysis Anthology, Volume 3:

"Quantum computation, quantum memory, and quantum information are hot topics today. Unfortunately, quantum mechanics forbids perfect (ideal) memory dumps due to the so-called no-cloning theorem. Still, it is possible to get inconsistent (imperfect) memory dumps, and perfect memory dumps can be made from quantum computer simulators. The analysis of quantum memory snapshots is the domain of Quantum Memoretics."

Since then, we have added traces and logs, text, narrative, data to our pattern-oriented analysis approach. Now we broaden the application of quantum ideas and algorithms and add quantum information processing to our decades' long interest in contemporary mathematics, quantum theory foundations and applications to various domains, logic, semiotics, categories, and recently, in ML/AI, unconventional computing, conceptual mathematics, topos theory, and functional programming.

Online Training: Accelerated .NET Core Memory Dump Analysis

Software Diagnostics Services organizes this online training course.

Accelerated .NET Memory Dump Analysis Logo

Learn how to analyze .NET Core application and service crashes and freezes, navigate through memory dump space (managed and unmanaged code) and diagnose corruption, leaks, CPU spikes, blocked threads, deadlocks, wait chains, resource contention, and much more. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve, includes 10 practical step-by-step exercises using the latest Microsoft WinDbg debugger to diagnose patterns in 64-bit process memory dumps, notes, source code of specially created modeling applications, and selected Q&A. It covers more than 20 .NET memory dump analysis patterns plus additional 15 unmanaged patterns and is based on the fourth edition of the Accelerated .NET Memory Dump Analysis book with additional and revised exercises updated for Windows 11.

Slides from the previous training version

The training consists of 2 two-hour sessions. When you finish the training you additionally get:

  • The updated PDF book version
  • Practical Foundations of Windows Debugging, Disassembling, Reversing PDF book
  • Access to Software Diagnostics Library with more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Prerequisites: Basic .NET programming and debugging.

Audience: Software technical support and escalation engineers, system administrators, DevOps, performance and reliability engineers, software developers, and quality assurance engineers.

If you are mainly interested in unmanaged Windows desktop and server memory dump analysis there is another course available: Accelerated Windows Memory Dump Analysis training or the corresponding book.

Online Training: Accelerated Windows Memory Dump Analysis

Software Diagnostics Services organizes this online training course.

Accelerated Windows Memory Dump Analysis Logo

This training includes 32 step-by-step exercises and covers more than 65 crash dump analysis patterns from x86 and x64 process, kernel, and complete (physical) memory dumps. Learn how to analyze application, service and system crashes and freezes, navigate through memory dump space and diagnose heap corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve, and it is based on the latest 5th edition of the bestselling Accelerated Windows Memory Dump Analysis book.

Slides from Days 1-2
Slides from Days 3-4

The difference between this training and the current book version:

  • You can ask questions and even bring your own memory dump files for the optional Day 5
  • Fully containerized
  • Some old exercises are updated for Windows 11
  • New additional exercises are based on Windows 11
  • Certificates and tests

Training outline:

  • Day 1 (2 hours): Overview. Process memory dump analysis.
  • Day 2 (2 hours): Process memory dump analysis.
  • Day 3 (2 hours). Kernel memory dump analysis.
  • Day 4 (2 hours). Complete (physical) memory dump analysis.
  • Day 5 (Optional 2 hours): Additional Q&A and memory dump analysis if necessary. Tests.

Before the training:

  • One day before each training day, you get exercise materials

After the training, you also get:

  • The updated book version (+700 pages)
  • Practical Foundations of Windows Debugging, Disassembling, Reversing PDF book
  • Additional slides and exercise transcripts not included in the book
  • Access to Software Diagnostics Library with more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Note: If you are registered you are allowed to optionally submit your memory dumps before the training. This will allow us in addition to the carefully constructed problems tailor extra examples to the needs of the attendees for Day 5.

Prerequisites: Basic Windows troubleshooting

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers.

Previous training testimonials:

I would like to thank you and recommend your training. I think that the “Accelerated Windows Memory Dump Analysis” training is pin-point, well-taught training. I think it’s the leading training in the dump analysis area and I’ve enjoyed it, the books and materials are very detailed and well written and Dmitry answered all of the needed questions. In addition after the training, Dmitry sent a PDF with written answers and more information about the questions that were asked. I will give this training 5/5. Thank you, Dmitry. --Yaniv Miron, Security Researcher, IL.Hack

If you are mainly interested in .NET memory dump analysis there is another course available:

Accelerated .NET Memory Dump Analysis

Visual Category Theory

The current full set in either PDF or paperback or both is available for purchase from Software Diagnostics Services

Download Sample Pages and Index

Concepts from category theory were used as metaphors for some trace and log analysis patterns (see Mathematical Concepts in Software Diagnostics and Software Data Analysis) and also as a foundation of software diagnostics (see Categorical Foundations of Software Diagnostics) as a part of Theoretical Software Diagnostics. However, category theory abstractions are very challenging to apprehend correctly, require a steep learning curve for non-mathematicians, and, for people with traditional naïve set theory education, a paradigm shift in thinking. The book utilizes a novel approach to teach category theory and abstract mathematics in general by using LEGO® bricks. This method was discovered when applying the same technique to teach machine learning, its data structures and algorithms, particularly directed graphs.

Part 0 (ISBN-13: 978-1912636396) covers universe and sets, set-builder notation, set membership, set inclusion, subsets as members, membership vs. subset, powerset, relations, functions, domain, codomain, range, injection, surjection, bijection, product, union, intersection, set difference, symmetric set difference, sets of functions, function composition, inverse functions.


Download Free Part 0

In order to facilitate earlier adoption and feedback, the book was split into small manageable parts. Part 1 (ISBN-13: 978-1912636402) is currently available on Leanpub and Amazon Kindle Store. It covers the definition of categories, arrows, the composition and associativity of arrows, retracts, equivalence, covariant and contravariant functors, natural transformations, and 2-categories.


Book Sample

CoPart 1 (ISBN-13: 978-1912636815) is a dual complement to Visual Category Theory Brick by Brick, Part 1. It is currently available on Leanpub and Amazon Kindle Store. The original series translated abstract categorical concepts into the language of LEGO® bricks, and the CoPart series implement the opposite way of translating brick constructions to the standard diagram language of category theory that should benefit comprehension of definitions. Since usual categorical diagrams are black and white and occupy less space on paper, CoParts include additional color-enhanced diagrams in the spirit of brick constructions when arrow source and target parts use different colors. These CoParts from CoSeries (named after opposite categories with reversed arrows) keep the same 1-to-1 page correspondence between Parts and CoParts. Page layout is also similar: location of explanatory notes (written using standard mathematical notation) is the same — only bricks are replaced by letters, dots, and arrows. Therefore, this CoSeries can be used independently from the original series or together.


Book Sample

Part 2 (ISBN-13: 978-1912636419) is currently available on Leanpub and Amazon Kindle Store. It covers duality, products, coproducts, biproducts, initial and terminal objects, pointed categories, matrix representation of morphisms, and monoids.


Book Sample

CoPart 2 (ISBN-13: 978-1912636822) is a dual complement to Visual Category Theory Brick by Brick, Part 2. It is currently available on Leanpub and Amazon Kindle Store.


Book Sample

Part 3 (ISBN-13: 978-1912636426) is currently available on Leanpub and Amazon Kindle Store. It covers adjoint functors, diagram shapes and categories, cones and cocones, limits and colimits, pullbacks and pushouts.


Book Sample

Part 4 (ISBN-13: 978-1912636433) is currently available on Leanpub and Amazon Kindle Store. It covers non-concrete categories, group objects, monoid, group, opposite, arrow, slice, and coslice categories, forgetful functors, monomorphisms, epimorphisms, and isomorphisms.


Book Sample

Part 5 (ISBN-13: 978-1912636440) is currently available on Leanpub and Amazon Kindle Store. It covers exponentials and evaluation in sets and categories, subobjects, equalizers, equivalence classes and quotients, coequalizers, congruence categories, morphism functors, and presheaves.


Book Sample

Part 6 (ISBN-13: 978-1912636457) is currently available on Leanpub and Amazon Kindle Store. It covers ideas that require a leap of abstraction: vertical and whisker compositions of natural transformations, identity and isomorphism of functors, equivalence, isomorphism, and adjoint equivalence of categories, functor and morphism categories, natural transformations as functors, representable functors, category of presheaves, Yoneda embedding and lemma. It also includes an index for parts 1 - 6.


Book Sample

Part 7 (ISBN-13: 978-1912636464) is currently available on Leanpub and Amazon Kindle Store. It covers ideas related to functional programming: exponentials, disjoint unions, endofunctors and natural transformations, partial and total functions, monads.


Book Sample

The first 5 parts are available as Visual Category Theory bundle on Leanpub.

Amazon 9-book Kindle bundle

All 8 parts together are now available in paperback format:

  • Title: Visual Category Theory Brick by Brick: Diagrammatic LEGO® Reference
  • Authors: Dmitry Vostokov
  • Publisher: OpenTask (October 2021)
  • Language: English
  • Product Dimensions: 16.5 x 16.5 cm (6.5 x 6.5 in)
  • Paperback: 172 pages
  • ISBN-13: 978-1912636389

Also available on Amazon and Barnes&Noble.

Applications of category theory to software diagnostics also include Software Codiagnostics and Diagnostic Operads.

Reviews with author's comments

Accelerated Disassembly, Reconstruction and Reversing, Revised Edition

The following direct links can be used to order the book now:

Buy Kindle print replica edition from Amazon

Buy PDF and EPUB from Leanpub

Also available in PDF and EPUB formats from Software Diagnostics Services.

The original edition is available for SkillSoft Books24x7 subscribers

The book contains the full transcript of Software Diagnostics Services training. Learn disassembly, execution history reconstruction and binary reversing techniques for better software diagnostics, troubleshooting and debugging on x64 Windows platforms. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of practical step-by-step hands-on exercises using WinDbg and memory dumps. Covered more than 25 ADDR patterns, and many concepts are illustrated with Memory Cell Diagrams. The prerequisites for this training are working knowledge of C and C++ programming languages. Operating system internals and assembly language concepts are explained when necessary. The primary audience for this training is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to go deeper in their analysis of abnormal software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse computer environments, security researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory. The revised edition uses the latest WinDbg 10 version, has three exercises completely redone with Windows 10 memory dumps, improved formatting, and also includes reprinted memory analysis patterns and techniques from Memory Dump Analysis Anthology referenced in the book.

  • Title: Accelerated Disassembly, Reconstruction and Reversing: Training Course Transcript and WinDbg Practice Exercises with Memory Cell Diagrams, Revised Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (March 2020)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF + EPUB: 211 pages
  • ISBN-13: 978-1908043757

Table of Contents and sample exercise
Slides from the training

Encyclopedia of Crash Dump Analysis Patterns, Third Edition

The following direct links can be used to order the book now:

Buy PDF from Leanpub

Buy Kindle print replica edition from Amazon

Also available in PDF format from Software Diagnostics Services

The first edition is available for SkillSoft Books24x7 subscribers

This reference reprints with corrections, additional comments, and classification more than 370 alphabetically arranged and cross-referenced memory analysis patterns originally published in Memory Dump Analysis Anthology volumes 1 – 13. This pattern catalog is a part of pattern-oriented software diagnostics, forensics, prognostics, root cause analysis, and debugging developed by Software Diagnostics Institute. Most of the analysis patterns are illustrated with examples for WinDbg from Debugging Tools for Windows with a few examples from Mac OS X and Linux for GDB. The third edition includes more than 40 new analysis patterns, more than 30 new examples and comments for analysis patterns published in the previous editions, updated bibliography and links, improved illustrations and debugger output snippets with extra visual highlighting.

Product information:

  • Title: Encyclopedia of Crash Dump Analysis Patterns: Detecting Abnormal Software Structure and Behavior in Computer Memory, Third Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Institute
  • Language: English
  • Product Dimensions: 24.6 x 18.9
  • PDF: 1,326 pages
  • Publisher: OpenTask (September 2020)
  • ISBN-13: 978-1-912636303

Table of Contents

Book: Accelerated Windows Debugging 3, Second Edition

The following direct links can be used to order the second edition:

Buy Paperback or Kindle print replica edition from Amazon
Buy Paperback from Barnes & Noble
Buy Paperback from Book Depository
Buy PDF and EPUB from Leanpub

Also is available in PDF format from Software Diagnostics Technology and Services.

The first edition is also available for SkillSoft Books24x7 subscribers

The full transcript of Software Diagnostics Services training with 14 step-by-step exercises, notes, and source code of specially created modeling applications. Learn live local and remote debugging techniques in kernel, user process and managed .NET spaces using WinDbg debugger. The unique and innovative course teaches unified debugging patterns applied to real problems from complex software environments. The second edition was fully reworked and updated to use the latest WinDbg version and Windows 10.

  • Title: Accelerated Windows Debugging3: Training Course Transcript and WinDbg Practice Exercises, Second Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (September 2018)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 302 pages
  • ISBN-13: 978-1908043894

Table of Contents

Trace, Log, Text, Narrative: An Analysis Pattern Reference for Data Mining, Diagnostics, Anomaly Detection, Fourth Edition

The Fourth Edition is available in PDF format from Software Diagnostics Services

Other Fourth Edition links:

Buy PDF from Leanpub

The first edition is also available for SkillSoft Books24x7 subscribers

General trace and log analysis patterns allow the application of uniform diagnostics and anomaly detection across diverse software environments. This pattern language covers any execution artifact from a small debugging trace to a distributed log with billions of messages from hundreds of computers, thousands of software components, threads, and processes. Pattern-oriented trace and log analysis is applicable to troubleshooting and debugging Windows, Mac OS X, Linux, FreeBSD, Android, iOS, z/OS, and any other possible computer platform, including networking and IoT. Its pattern catalog is a part of pattern-oriented software data analysis, diagnostics, anomaly detection, forensics, prognostics, root cause analysis, and debugging developed by Software Diagnostics Institute<. Also, the scope of applicability of such analysis patterns is much wider than just software execution artifacts or temporal data and now includes general data, narratives, text, and image analysis (space-like narratology). This reference reprints with corrections almost 200 patterns originally published in Memory Dump Analysis Anthology volumes 3 - 13 and Software Diagnostics Library. It also includes additional 5 analysis patterns from the forthcoming volume 14 bringing the total analysis pattern count to 201. Full-color diagrams accompany almost all pattern descriptions. The fourth edition includes 24 more patterns, updated classification, the bibliography, and the list of narratological and mathematical influences.

Product information:

  • Title: Trace, Log, Text, Narrative: An Analysis Pattern Reference for Data Mining, Diagnostics, Anomaly Detection, Fourth Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Institute
  • Language: English
  • Product Dimensions: 21.6 x 14.0
  • Paperback: 348 pages
  • Publisher: OpenTask (September 2020)
  • ISBN-13: 978-1912636327

Table of Contents
Bird's-eye View of Pages

Book: Accelerated Windows Malware Analysis with Memory Dumps, Second Edition

The following direct links can be used to order the second edition of the book:

Buy PDF and EPUB versions from Leanpub

Buy Kindle version

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Buy Paperback from Book Depository

Also available in PDF and EPUB formats from Software Diagnostics Technology and Services

The first edition is also available for SkillSoft Books24x7 subscribers

The Korean edition is available from Acorn publisher.

The full transcript of Software Diagnostics Services training. Learn how to navigate process, kernel, and physical spaces and diagnose various malware patterns in Windows memory dump files. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of practical step-by-step hands-on exercises using WinDbg, process, kernel and complete memory dumps. Covered more than 20 malware analysis patterns. The main audience is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to check for possible malware presence in cases of abnormal software behavior. The course will also be useful for software engineers, quality assurance and software maintenance engineers, security researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory. The second edition uses the latest WinDbg 10 version and includes malware analysis pattern catalog reprinted from Memory Dump Analysis Anthology volumes.

  • Title: Accelerated Windows Malware Analysis with Memory Dumps: Training Course Transcript and WinDbg Practice Exercises, Second Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2017)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 312 pages
  • ISBN-13: 978-1908043863

Table of Contents

Syndicate content