Structural and Behavioral Patterns for Diagnostics, Anomaly Detection, Forensics, Prognostics, Root Cause Analysis, Debugging

Our tools are only as good as our pattern language.

Analysis patterns for the quality of software diagnostics in endpoint devices, enterprise, and cloud environments.

Diagnostics Science

Diagnostics is the mother of problem solving.

All areas of human activity involve the use of diagnostics. Proper diagnostics identifies the right problems to solve. We are now a part of a non-profit organization dedicated to the developing and promoting the application of such diagnostics: systemic and pattern-oriented (pattern-driven and pattern-based).

Online Training: Accelerated Windows Trace and Log Analysis

Software Diagnostics Services organizes this online training course.

February 20 - 24 2023 6.30pm - 7.30pm (GMT) Price 99 USD Registration

Accelerated Software Trace Analysis Logo

Feel frustrated when opening a software trace with millions of messages from hundreds of software components, threads, and processes? Go beyond simple CPU and disk hog monitoring or searching for errors in a text and learn how to efficiently and effectively analyze software traces and logs from complex software environments. In addition to a theoretical part, practical illustrations, examples, and exercises include Microsoft Event Tracing for Windows (ETW) and Procmon. This course teaches trace and log analysis using pioneering and innovative pattern-oriented analysis of abnormal software behavior incidents developed by Software Diagnostics Institute.

Sample slides from a theoretical part

The training consists of 5 one-hour sessions. Before the training, you get:

  1. Accelerated Software Trace Analysis, Revised Edition, Part 1: Fundamentals and Basic Patterns (PDF)
  2. The current version of Malware Narratives (PDF).
  3. Trace, Log, Text, Narrative: An Analysis Pattern Reference for Data Mining, Diagnostics, Anomaly Detection, Fourth Edition (PDF).
  4. Access to Software Diagnostics Library.

After the training, you also get:

  1. The new edition of Accelerated Windows Software Trace Analysis: Training Course Transcript (PDF).
  2. The revised edition of Malware Narratives (PDF).
  3. The new edition of Trace, Log, Text, Narrative (PDF).
  4. Personalized Certificate of Attendance with unique CID.
  5. Optional Personalized Certificate of Completion with unique CID (after the tests).
  6. Answers to questions during training sessions.
  7. Recording.

Prerequisites: Basic Windows troubleshooting.

Audience: Software technical support and escalation engineers, system administrators, security researchers, incident response professionals, software developers, platform engineers, DevSecOps and SRE, and quality assurance engineers.

Online Training: Accelerated Windows API for Software Diagnostics: With Category Theory in View

Software Diagnostics Services organizes this online training course.

November 1, 8, 15, 22, 29 2022 6.30pm - 7.30pm (GMT) Price 99 USD Registration

Draft slides from the first session
Draft slides from the second session
Draft slides from the third session
Draft slides from the fourth session

Knowledge of Windows API is necessary for:

  • Development
  • Malware analysis
  • Vulnerability analysis and exploitation
  • Reversing
  • Diagnostics
  • Debugging
  • Memory forensics
  • Crash and hang analysis
  • Secure coding
  • Static code analysis
  • Trace and log analysis

The training uses a unique and innovative pattern-oriented analysis approach and provides:

  • Overview
  • Classification
  • Patterns
  • Internals
  • Development examples
  • Analysis examples

Before the training you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Pattern-Oriented Memory Forensics

The following direct links can be used to order the book now:

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Services as a part of Accelerated Windows Memory Forensics and Malware Analysis with Memory Dumps training course and Pattern-Oriented Windows Memory Forensics Training Pack

The original edition is available for SkillSoft Books24x7 subscribers

This short book is a fully revised transcript of a lecture introducing a pattern language for memory forensics - an investigation of past software behavior in memory snapshots. It provides a unified language for discussing and communicating detection and analysis results despite the proliferation of operating systems and tools, a base language for checklists, and aid in accelerated learning. The lecture has a short theoretical part and then illustrates various patterns seen in crash dumps by using WinDbg debugger from Microsoft Debugging Tools for Windows.

  • Title: Pattern-Oriented Memory Forensics: A Pattern Language Approach, Revised Edition
  • Author: Dmitry Vostokov, Software Diagnostics Institute, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 97 pages
  • ISBN-13: 978-1912636761

Presentation Slides

Book: Advanced Windows Memory Dump Analysis with Data Structures, Fourth Edition, Revised

Available in PDF and paperback format from Software Diagnostics Technology and Services.

The full transcript of Software Diagnostics Services training course with 15 step-by-step exercises, notes, and selected questions and answers. Learn how to navigate through memory dump space and Windows data structures to diagnose, troubleshoot and debug complex software incidents. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. It consists of practical step-by-step exercises using WinDbg to diagnose structural and behavioral patterns in the 64-bit kernel and complete (physical) memory dumps. Additional topics include memory search, kernel linked list navigation, practical WinDbg scripting, registry, system variables and objects, device drivers, and I/O. Prerequisites are basic and intermediate level Windows memory dump analysis: the ability to list processors, processes, threads, modules, apply symbols, walk through stack traces and raw stack data, diagnose patterns such as heap corruption, CPU spike, memory leaks, access violation, wait chains and deadlocks. If you don't feel comfortable with prerequisites then Accelerated Windows Memory Dump Analysis training book is recommended before purchasing and reading this book course. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers. The 4th edition was fully reworked to use the latest WinDbg and now covers memory dumps from Windows 11. Three new exercises were added and the previous ones now have improved command syntax and color highlighting. This edition also includes a possibility to use a Docker WinDbg image with required symbol files instead of a local Debugging Tools for Windows installation. The current revision 4.1 uses WinDbg Preview for all exercise transcripts.

  • Title: Advanced Windows Memory Dump Analysis with Data Structures: Training Course Transcript and WinDbg Practice Exercises with Notes, Fourth Edition, Revised
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 293 pages
  • ISBN-13: 978-1912636778

Table of Contents and Sample Exercise

Online Training: Accelerated Linux Core Dump Analysis

Software Diagnostics Services organizes this online training course.

January 17 - 19 2023 6.30pm - 8.30pm (GMT) Price 99 USD Registration

Learn how to analyze Linux process and kernel crashes and hangs, navigate through core memory dump space and diagnose corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more. This training uses a unique and innovative pattern-oriented diagnostic analysis approach to speed up the learning curve. The training consists of more than 20 practical step-by-step exercises using GDB and WinDbg debuggers highlighting more than 50 memory analysis patterns diagnosed in 64-bit core memory dumps from x64 and ARM64 platforms. The training also includes source code of modeling applications, a catalog of relevant patterns from Software Diagnostics Institute, and an overview of relevant similarities and differences between Windows and Linux memory dump analysis useful for engineers with Wintel background. The training is based on the 2nd revised and extended edition of the bestselling Accelerated Linux Core Dump Analysis book. There will be additional material added related to x64 and ARM64 disassembly.

Prerequisites: Basic Linux user skills.

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, DevSecOps and SRE, and quality assurance engineers.

Slides from the training

Training outline:

  • Day 1: Overview. Process core dump analysis.
  • Day 2: Process core dump analysis.
  • Day 3: Kernel core dump analysis.
  • Before the training you get:

    • The current PDF book version of the training.
    • Access to Software Diagnostics Library.
    • Past recording.

    After the training, you also get:

    • The new 3rd edition PDF book version of the training.
    • Personalized Certificate of Attendance with unique CID.
    • Optional Personalized Certificate of Completion with unique CID (after the tests).
    • Answers to questions during training sessions.
    • New recording.

Book: Accelerated .NET Core Memory Dump Analysis, Revised Edition

The following direct links can be used to order the book now:

Available in PDF format from Software Diagnostics Technology and Services.

The full transcript of Software Diagnostics Services training with 9 step-by-step exercises, notes, and source code of specially created modeling applications. The course covers 19 .NET memory dump analysis patterns plus additional 19 unmanaged patterns. Learn how to analyze .NET Core 5/6 application and service crashes and freezes, navigate through memory dump space (managed and unmanaged code) and diagnose corruption, leaks, CPU spikes, blocked threads, deadlocks, wait chains, resource contention, and much more. The training consists of practical step-by-step exercises using Microsoft WinDbg debugger to diagnose patterns in 64-bit process memory dumps. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The book is based on the previous fourth edition of Accelerated .NET Memory Dump Analysis that covered .NET Core 5 and Windows 10. It is updated for the latest WinDbg from Windows 11 SDK and has a new .NET Core 6 exercise with a memory dump from Windows 11. This edition also includes a possibility to use a Docker WinDbg image with required symbol files instead of a local Debugging Tools for Windows installation. Prerequisites: Basic .NET programming and debugging. Audience: Software technical support and escalation engineers, system administrators, DevOps, performance and reliability engineers, software developers, and quality assurance engineers. The book may also interest security researchers, reverse engineers, malware and memory forensics analysts. The revised edition uses the latest WinDbg Preview for all exercise transcripts.

  • Title: Accelerated .NET Core Memory Dump Analysis, Revised Edition: Training Course Transcript and WinDbg Practice Exercises
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 203 pages
  • ISBN-13: 978-1912636648

Table of Contents and Sample Exercise

Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revision 3: Kernel and Complete Spaces

The following direct links can be used to order the book:

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Services

The full-color transcript of Software Diagnostics Services training sessions with 14 step-by-step exercises, notes, source code of specially created modeling applications, and 45 questions and answers. Covers more than 35 crash dump analysis patterns from x64 kernel and complete (physical) memory dumps. Learn how to analyze system crashes and freezes, navigate through kernel and complete spaces, and diagnose patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and optional Docker image. The current revision 5.7 uses WinDbg Preview for all exercise transcripts.

  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revision 3, Kernel and Complete Spaces: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • PDF: 372 pages
  • ISBN-13: 978-1912636983

Table of Contents and Sample Exercise

Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revision 3: Process User Space

The following direct links can be used to order the book:

Buy PDF from Leanpub

Also available in PDF format from Software Diagnostics Services

The full-color transcript of Software Diagnostics Services training sessions with 20 step-by-step exercises, notes, source code of specially created modeling applications, and more than 70 questions and answers. Covers more than 50 crash dump analysis patterns from x86 and x64 process memory dumps. Learn how to analyze application and service crashes and freezes, navigate through process user space and diagnose heap corruption, memory and handle leaks, CPU spikes, blocked threads, deadlocks, wait chains, and many more patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and an optional Docker image. The current revision 5.7 uses WinDbg Preview for all exercise transcripts.

  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revision 3, Process User Space: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • Paperback: 350 pages
  • ISBN-13: 978-1912636976

Table of Contents and Sample Exercise

Training: Accelerated Mac OS X Core Dump Analysis (M2 Version)

Accelerated Mac OS X Core Dump Analysis Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course:

December 6 - 7 2022 6.30pm - 8.30pm (GMT) Price 99 USD Registration

Learn how to analyze app crashes and freezes, navigate through process core memory dump space and diagnose corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more. We use a unique and innovative pattern-driven analysis approach to speed up the learning curve. The training consists of practical step-by-step exercises using Xcode and LLDB environments highlighting more than 30 patterns diagnosed in 64-bit process core memory dumps. The training also includes an overview of relevant similarities and differences between Windows and Mac OS X user space memory dump analysis useful for engineers with a Wintel background. The course is thoroughly updated for the latest Mac OS X version and M2 platform.

Slides from the previous x64-based training

Level: Beginner/Intermediate.

Prerequisites: Prerequisites: Basic Mac OS X troubleshooting and debugging.

Audience: Audience: Software technical support and escalation engineers, system administrators, software developers, security professionals, and quality assurance engineers.

The training consists of 2 two-hour sessions. Before the training, you get:

  • The previous PDF edition of this course (Intel x64 LLDB and GDB)
  • Access to Software Diagnostics Library

After the training, you also get:

  • The new PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Accelerated Linux Disassembly, Reconstruction and Reversing

Available in PDF format from Software Diagnostics Services.

The book contains the full transcript of Software Diagnostics Services training. Learn disassembly, execution history reconstruction, and binary reversing techniques for better software diagnostics, troubleshooting, debugging, memory forensics, vulnerability and malware analysis on x64 and AMD64 Linux platforms. The course uses a unique and innovative pattern language approach to speed up the learning curve. The training consists of practical step-by-step, hands-on exercises using GDB and Linux core memory dumps. Covered more than 25 ADDR patterns originally introduced for the x64 Windows platform, and many concepts are illustrated with Memory Cell Diagrams. The prerequisites for this training are working knowledge of C and C++ programming languages. Operating system internals and assembly language concepts are explained when necessary. The primary audience for this training is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to go deeper in their analysis of abnormal software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse cloud and endpoint computer environments, SRE and DevSecOps, security and vulnerability researchers, malware and memory forensics analysts who have never used GDB for analysis of computer memory. The book also features ADDR pattern descriptions summarized after each exercise.

  • Title: Accelerated Linux Disassembly, Reconstruction and Reversing: Training Course Transcript and GDB Practice Exercises with Memory Cell Diagrams
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 248 pages
  • ISBN-13: 978-1912636785

Table of Contents and sample exercise
Slides from the training

Online Training: Accelerated Linux Disassembly, Reconstruction, and Reversing (WinDbg Version)

Accelerated Disassembly, Reconstruction and Reversing Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course.

New dates/times TBD

Learn disassembly, execution history reconstruction, and binary reversing techniques for better software diagnostics, troubleshooting, debugging, memory forensics, vulnerability and malware analysis on x64 and AMD64 Linux platforms. The course uses a unique and innovative pattern language approach to speed up the learning curve. The training consists of practical step-by-step, hands-on exercises using WinDbg and Linux core memory dumps. Covered more than 25 ADDR patterns originally introduced for the x64 Windows platform, and many concepts are illustrated with Memory Cell Diagrams. The training also features additional diagrams adapted from Linux Practical Foundations books to WinDbg context.

Selected slides of the previous Windows-based training

Level: Intermediate/Advanced.

Prerequisites: Working knowledge of C and C++. Operating system internals and assembly language concepts are explained when necessary.

Audience: Software technical support and escalation engineers who analyze core dumps from complex software environments and need to go deeper in their analysis of abnormal and malicious software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse cloud and endpoint computer environments, SRE and DevSecOps, security and vulnerability researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory.

The training consists of 3 two-hour sessions.

Before the training, you get:

  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Extended Windows Memory Dump Analysis: Using and Writing WinDbg Extensions, Database and Event Stream Processing, Visualization

Available in PDF format from Software Diagnostics Services.

The book contains the full transcript of Software Diagnostics Services training with 16 hands-on exercises. This training course extends pattern-oriented analysis introduced in Accelerated Windows Memory Dump Analysis, Accelerated .NET Core Memory Dump Analysis, and Advanced Windows Memory Dump Analysis with Data Structures courses with:

  • Surveying the current landscape of WinDbg extensions with analysis pattern mappings
  • Writing WinDbg extensions in C and C++
  • Connecting WinDbg to NoSQL databases
  • Connecting WinDbg to streaming and log processing platforms
  • Querying and visualizing WinDbg output data

Prerequisites: Working knowledge of WinDbg. Working knowledge of C or C++ is optional (required only for some exercises). Other concepts are explained when necessary.

Audience: Software developers, software maintenance engineers, escalation engineers, quality assurance engineers, security and vulnerability researchers, malware and memory forensics analysts who want to build memory analysis pipelines.

  • Title: Extended Windows Memory Dump Analysis: Using and Writing WinDbg Extensions, Database and Event Stream Processing, Visualization
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (September 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 274 pages
  • ISBN-13: 978-1912636686

Table of Contents and sample exercise
Slides from the training

Online Training: Extended Windows Memory Dump Analysis

Extended Windows Memory Dump Analysis Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course:

New dates/times TBD

Extended Windows Memory Dump Analysis: Using and Writing WinDbg Extensions, Database and Event Stream Processing, Visualization training course extends pattern-oriented analysis introduced in Accelerated Windows Memory Dump Analysis, Accelerated .NET Core Memory Dump Analysis, and Advanced Windows Memory Dump Analysis with Data Structures courses with:

  • Surveying the current landscape of WinDbg extensions with analysis pattern mappings
  • Writing WinDbg extensions in C and C++
  • Connecting WinDbg to NoSQL databases
  • Connecting WinDbg to streaming and log processing platforms
  • Querying and visualizing WinDbg output data

Slides from the previous training

Before the training, you get:

  • The current PDF book version and recording of the training
  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • New recording

Prerequisites: Working knowledge of WinDbg. Working knowledge of C or C++ is optional (required only for some exercises). Other concepts are explained when necessary.

Audience: Software developers, software maintenance engineers, escalation engineers, quality assurance engineers, security and vulnerability researchers, malware and memory forensics analysts who want to build memory analysis pipelines.

Online Training: Accelerated Linux Disassembly, Reconstruction, and Reversing

Accelerated Disassembly, Reconstruction and Reversing Logo

Software Diagnostics Services (PatternDiagnostics.com) organizes a training course.

New dates/times TBD

Learn disassembly, execution history reconstruction, and binary reversing techniques for better software diagnostics, troubleshooting, debugging, memory forensics, vulnerability and malware analysis on x64 and AMD64 Linux platforms. The course uses a unique and innovative pattern language approach to speed up the learning curve. The training consists of practical step-by-step, hands-on exercises using GDB and Linux core memory dumps. Covered more than 25 ADDR patterns originally introduced for the x64 Windows platform, and many concepts are illustrated with Memory Cell Diagrams. The course builds upon and extends the basic patterns introduced in Practical Foundations of Linux Debugging, Disassembling, Reversing books.

Selected slides of the previous Windows-based training

Level: Intermediate/Advanced.

Prerequisites: Working knowledge of C and C++. Operating system internals and assembly language concepts are explained when necessary.

Audience: Software technical support and escalation engineers who analyze core dumps from complex software environments and need to go deeper in their analysis of abnormal and malicious software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse cloud and endpoint computer environments, SRE and DevSecOps, security and vulnerability researchers, malware and memory forensics analysts who have never used GDB for analysis of computer memory.

The training consists of 4 two-hour sessions.

Before the training, you get:

  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Book: Accelerated Disassembly, Reconstruction and Reversing, Second Revised Edition

Available in PDF format from Software Diagnostics Services.

The original first edition is available for SkillSoft Books24x7 subscribers

The book contains the full transcript of Software Diagnostics Services training. Learn disassembly, execution history reconstruction, and binary reversing techniques for better software diagnostics, troubleshooting, debugging, memory forensics, vulnerability and malware analysis on x64 Windows platforms. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of practical step-by-step hands-on exercises using WinDbg and memory dumps. Covered more than 25 ADDR patterns, and many concepts are illustrated with Memory Cell Diagrams. The prerequisites for this training are working knowledge of C and C++ programming languages. Operating system internals and assembly language concepts are explained when necessary. The primary audience for this training is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to go deeper in their analysis of abnormal software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse computer environments, security researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory. The second revised edition uses the latest WinDbg Preview version, is optionally containerized, has three exercises completely redone with Windows 10 memory dumps, includes full source code projects ported to Visual Studio 2022 with corresponding additional Windows 11 process dumps, and also includes reprinted memory and trace analysis patterns and techniques from Memory Dump Analysis Anthology referenced in the book. This new edition also features ADDR pattern descriptions summarized after each exercise.

  • Title: Accelerated Disassembly, Reconstruction and Reversing: Training Course Transcript and WinDbg Practice Exercises with Memory Cell Diagrams, Second Revised Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (September 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 253 pages
  • ISBN-13: 978-1912636693

Table of Contents and sample exercise
Slides from the training

Online Training: Accelerated Linux Debugging 4D

Software Diagnostics Services organizes this online training course.

March 28 - 29 2023 6.30pm - 8.30pm (GMT+1) Price 99 USD Registration

Learn live local and remote debugging techniques and tricks in the kernel and user process spaces using the GDB debugger. The unique and innovative Debugging 4D course teaches unified debugging patterns applied to real problems from complex software environments. The training consists of practical step-by-step hands-on exercises.

Before the training, you get:

  • Practical Foundations of Linux Debugging, Disassembling, Reversing PDF book
  • Practical Foundations of ARM64 Linux Debugging, Disassembling, Reversing PDF book
  • Access to Software Diagnostics Library

After the training, you also get:

  • The PDF book version of the training: Accelerated Linux Debugging 4D
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Prerequisites:

Working knowledge of one of these languages: C, C++. Operating system internals and assembly language concepts are explained when necessary.

Audience:

Software engineers, software maintenance engineers, escalation engineers, security and vulnerability researchers, malware and memory forensics analysts who want to learn live memory inspection techniques.

If you are interested in live Windows debugging there is another training course available.

Online Training: Accelerated Windows Memory Forensics and Malware Analysis with Memory Dumps

Software Diagnostics Services organizes this online training course.

New dates/times TBD

Accelerated Windows Memory Forensics Logo

Learn how to navigate the process, kernel, physical memory spaces, and corresponding Windows data structures, discover forensic artifacts and diagnose structural and behavioral patterns in Windows memory dump files. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of more than 20 practical step-by-step, hands-on exercises using WinDbg, process, kernel, and complete memory dumps. In addition to malware patterns, topics include process and thread navigation, past execution, memory search, kernel linked list navigation, practical WinDbg scripting including built-in language and JavaScript, registry, system variables and objects, device drivers, I/O, file system filters, and security. The training is based on the Pattern-Oriented Memory Forensics: A Pattern Language Approach, the 3rd edition of Accelerated Windows Malware Analysis with Memory Dumps, and the 4th edition of Advanced Windows Memory Dump Analysis with Data Structures books. This course also covers patterns of memory acquisition. It uses the latest WinDbg Preview and is optionally containerized.

Example slides for days 1-3
Example slides for days 4-5

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • Pattern-Oriented Memory Forensics: A Pattern Language Approach PDF book
  • Advanced Windows Memory Dump Analysis with Data Structures, Fourth Edition PDF book
  • Accelerated Windows Malware Analysis with Memory Dumps, Third Edition PDF book
  • The previous training recording
  • Access to Software Diagnostics Library with more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies

After the training, you also get:

  • The updated PDF books
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Current training sessions recording

Prerequisites: Working knowledge of Windows troubleshooting. Operating system internals concepts are explained when necessary.

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers.

Book: Accelerated Linux Core Dump Analysis, Second Edition, Revised and Extended

Available in PDF format from Software Diagnostics Technology and Services.

The full transcript of Software Diagnostics Services training. Learn how to analyze Linux process and kernel crashes and hangs, navigate through core memory dump space and diagnose corruption, memory leaks, CPU spikes, blocked threads, deadlocks, wait chains, and much more. This training uses a unique and innovative pattern-oriented diagnostic analysis approach to speed up the learning curve. The training consists of 30 practical step-by-step exercises using GDB and WinDbg debuggers highlighting almost 40 memory analysis patterns diagnosed in 64-bit core memory dumps from x64 and ARM64 platforms. The training also includes source code of modeling applications, a catalog of relevant patterns from Software Diagnostics Institute, and an overview of relevant similarities and differences between Windows and Linux memory dump analysis useful for engineers with Wintel background. In addition to the fully revised x64 Linux process dump analysis exercises using GDB, the second edition now includes x64 Linux kernel core dump analysis using crash tool and ARM64 Linux process dump analysis using WinDbg. The new revised and extended edition includes additional kernel core dump analysis exercises.

  • Title: Accelerated Linux Core Dump Analysis: Training Course Transcript with GDB and WinDbg Practice Exercises, Second Edition, Revised and Extended
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (July 2022)
  • Language: English
  • PDF or Paperback: 493 pages
  • ISBN-13: 978-1912636792

Table of Contents and Sample Exercise

Book: Accelerated Windows Malware Analysis with Memory Dumps, Third Edition

Available in PDF format from Software Diagnostics Technology and Services

The first edition is also available for SkillSoft Books24x7 subscribers

The Korean second edition is available from Acorn publisher.

The full transcript of Software Diagnostics Services training. Learn how to navigate process, kernel, and physical spaces and diagnose various malware patterns in Windows memory dump files. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of practical step-by-step hands-on exercises using WinDbg, process, kernel and complete memory dumps. Covered more than 20 malware analysis patterns. The main audience is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to check for possible malware presence in cases of abnormal software behavior. The course will also be useful for software engineers, quality assurance and software maintenance engineers, security researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory. The third edition uses the latest WinDbg Preview version with some exercises updated to Windows 11 and is optionally containerized.

  • Title: Accelerated Windows Malware Analysis with Memory Dumps: Training Course Transcript and WinDbg Practice Exercises, Third Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (July 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 324 pages
  • ISBN-13: 978-1912636969

Table of Contents

Online Training: Accelerated Disassembly, Reconstruction and Reversing

Software Diagnostics Services organizes this online training course.

New dates/times TBD

Accelerated Windows Disassembly, Reconstruction, and Reversing Logo

Learn disassembly, execution history reconstruction and binary reversing techniques for better software diagnostics, troubleshooting and debugging on x64 Windows platforms. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of practical step-by-step hands-on exercises using WinDbg and memory dumps. Covered more than 25 ADDR patterns, and many concepts are illustrated with Memory Cell Diagrams. The prerequisites for this training are working knowledge of C and C++ programming languages. Operating system internals and assembly language concepts are explained when necessary. The primary audience for this training is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to go deeper in their analysis of abnormal and malicious software structure and behavior. The course is also useful for software engineers, quality assurance and software maintenance engineers who debug software running on diverse cloud and endpoint computer environments, security and vulnerability researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory. The new training uses the latest WinDbg Preview, optionally containerized, and has several exercises completely redone with Windows 11 memory dumps. The course builds upon and extends the basic patterns introduced in the Practical Foundations of Windows Debugging, Disassembling, Reversing book.

Slides from the previous training

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • The previous PDF book version of the training
  • Access to Software Diagnostics Library

After the training, you also get:

  • The new 2nd edition PDF book of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Online Training: Accelerated Windows Postmortem Diagnostics and Debugging

Software Diagnostics Services organizes this online training course.

Accelerated Windows Postmortem Diagnostics and Debugging Logo

This comprehensive training includes more than 40 step-by-step exercises and covers more than 85 crash dump analysis patterns from x86 and x64 process, kernel, and complete (physical) memory dumps. Learn how to analyze application (native and .NET Core), service, and system crashes and freezes, navigate through memory dump space (managed and unmanaged code) and diagnose corruption, memory and handle leaks, CPU spikes, blocked threads, deadlocks, wait chains, resource contention, and much more with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute< to speed up the learning curve, and it is based on the latest edition of Accelerated Windows Memory Dump Analysis and Accelerated .NET Core Memory Dump Analysis books. It uses the latest WinDbg Preview and is optionally containerized.

Outline slides
Slides from Days 1-3
Slides from Days 4-6
Slides from Days 7-8

The difference between this training and the current book version:

  • You can ask questions
  • .NET Core exercises use the latest WinDbg Preview
  • Certificates and tests

Training outline:

  • Day 1 (2 hours): Overview. Native process memory dump analysis.
  • Day 2 (2 hours): Native process memory dump analysis.
  • Day 3 (2 hours): Native process memory dump analysis.
  • Day 4 (2 hours): .NET Core process memory dump analysis.
  • Day 5 (2 hours): .NET Core process memory dump analysis.
  • Day 6 (2 hours). Kernel memory dump analysis.
  • Day 7 (2 hours). Complete (physical) memory dump analysis.
  • Day 8 (Optional 2 hours): Additional Q&A and memory dump analysis if necessary. Tests.

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book (+300 pages)
  • The current PDF books (+900 pages)
  • The previous training recording
  • Access to Software Diagnostics Library with more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies

After the training, you also get:

  • The updated PDF books (including the new edition of .NET Core book)
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Current training sessions recording

Prerequisites: Basic Windows troubleshooting

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers.

If you are interested in Linux memory dump analysis there is another forthcoming training: Accelerated Linux Core Dump Analysis

Training: Accelerated Windows Malware Analysis with Memory Dumps

Software Diagnostics Services organizes this online training course.

Accelerated Windows Malware Analysis Logo

New dates/times TBD

Learn how to navigate process, kernel, and physical spaces and diagnose various malware patterns in Windows memory dump files. The course uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. The training consists of practical step-by-step, hands-on exercises using WinDbg, process, kernel, and complete memory dumps. The training covers more than 20 malware analysis patterns. The main audience is software technical support and escalation engineers who analyze memory dumps from complex software environments and need to check for possible malware presence in cases of abnormal software behavior. The course will also be useful for software engineers, quality assurance and software maintenance engineers, security researchers, malware and memory forensics analysts who have never used WinDbg for analysis of computer memory. The new version uses the latest WinDbg Preview and is optionally containerized.

Slides from the previous training

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book
  • The previous PDF book version of the training
  • Access to Software Diagnostics Library

After the training, you also get:

  • The new 3rd edition PDF book of the training
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Recording

Book: Accelerated Windows Debugging 4D, Third Edition

The following direct links can be used to order the third edition:

Buy PDF from Leanpub

Also is available in PDF format from Software Diagnostics Technology and Services.

The first edition is also available for SkillSoft Books24x7 subscribers

The full transcript of Software Diagnostics Services training with 15 step-by-step exercises, notes, and source code of specially created modeling applications. Learn live local and remote debugging techniques in kernel, user process, and managed .NET spaces using WinDbg debugger. The unique and innovative course teaches unified debugging patterns applied to real problems from complex software environments. The third edition was fully reworked and updated to use Windows 11, Hyper-V, WinDbg Preview, and includes exercises for .NET Core and Time Travel Debugging.

Prerequisites: Working knowledge of one of these languages: C, C++, C#. Operating system internals and assembly language concepts are explained when necessary.

Audience: Software engineers, software maintenance engineers, escalation engineers, security and vulnerability researchers, malware and memory forensics analysts who want to learn live memory inspection techniques.

  • Title: Accelerated Windows Debugging4: Training Course Transcript and WinDbg Practice Exercises, Third Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (May 2022)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • PDF: 332 pages
  • ISBN-13: 978-1912636532

Table of Contents

Online Training: Advanced Windows Memory Dump Analysis with Data Structures

Software Diagnostics Services organizes this online training course.

Advanced Windows Memory Dump Analysis Logo

New dates/times TBD

Learn how to navigate through memory dump space and Windows data structures to diagnose, troubleshoot and debug complex software incidents. The training uses a unique and innovative pattern-oriented analysis approach to speed up the learning curve. It consists of more than 15 practical step-by-step exercises using WinDbg to diagnose structural and behavioral patterns in the 64-bit kernel and complete (physical) memory dumps. Additional topics include memory search, kernel linked list navigation, practical WinDbg scripting including built-in language and JavaScript, registry, system variables and objects, device drivers, I/O, file system filters, and security. The training is based on the 4th edition of the Advanced Windows Memory Dump Analysis with Data Structures book. It is also optionally containerized.

Course Slides

The difference between this training and the current book version:

  • Uses WinDbg Preview instead of WinDbg from SDK
  • You can ask questions
  • New additional exercises are based on Windows 11
  • Certificates and tests

Before the training, you get:

  • Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition PDF book (+300 pages)
  • The current PDF book version
  • The previous training recording
  • Access to Software Diagnostics Library with more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies
  • On some days before training sessions, you also get new exercise materials not included in the current book version

After the training, you also get:

  • The updated PDF book version
  • Additional slides and updated exercise transcripts not included in the book
  • Personalized Certificate of Attendance with unique CID
  • Optional Personalized Certificate of Completion with unique CID (after the tests)
  • Answers to questions during training sessions
  • Current training sessions recording

Prerequisites: Basic and intermediate level Windows memory dump analysis: the ability to list processors, processes, threads, modules, apply symbols, walk through stack traces and raw stack data, diagnose patterns such as heap corruption, CPU spike, memory leaks, access violation, wait chains and deadlocks. If you don't feel comfortable with prerequisites then Accelerated Windows Memory Dump Analysis training or the corresponding book is recommended before attending this training.

Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers, and quality assurance engineers.

Book: Practical Foundations of Windows Debugging, Disassembling, Reversing, Second Edition

Available in PDF format from Software Diagnostics Services

This training course is a combined, reformatted, improved, and modernized version of the two previous books Windows Debugging: Practical Foundations and x64 Windows Debugging: Practical Foundations, that drew inspiration from the original lectures we developed almost 18 years ago to train support and escalation engineers in debugging and crash dump analysis of memory dumps from Windows applications, services, and systems. At that time, when thinking about what material to deliver, we realized that a solid understanding of fundamentals like pointers is needed to analyze stack traces beyond a few WinDbg commands. Therefore, this book is not about bugs or debugging techniques but about the background knowledge everyone needs to start experimenting with WinDbg and learn from practical experience and read other advanced debugging books. This body of knowledge is what the author of this book possessed before starting memory dump analysis using WinDbg 18 years ago, which resulted in the number one debugging bestseller: multi-volume Memory Dump Analysis Anthology. Now, in retrospection, we see these practical foundations as relevant and necessary to acquire for beginners as they were 18 years ago because operating systems internals, assembly language, and compiler architecture haven't changed much in those years.

The book contains two separate sets of chapters and corresponding illustrations. They are named Chapter x86.NN and Chapter x64.NN respectively. The new format makes switching between and comparing x86 and x64 versions easy. There is some repetition of content due to the shared nature of x64 and x86 platforms. Both sets of chapters can be read independently. We included x86 chapters because many 3rd-party Windows applications are still 32-bit and executed in 32-bit compatibility mode on x64 Windows systems. The course consistently uses WinDbg (X86) for 32-bit examples and WinDbg (X64) for 64-bit examples. The book also has a larger format similar to other training courses from Software Diagnostics Services.

Almost 5 years have passed since the first edition of the combined training course that used the earlier version of Windows 10. Since then, we have also published "Practical Foundations of Linux Debugging, Disassembling, Reversing" and "Practical Foundations of ARM64 Linux Debugging, Disassembling, Reversing" books. At that time, we thought about revising our Windows course. Since then, Windows 11 appeared, and we also added Docker support for most of our Windows memory dump analysis courses. While working on the "Accelerated Windows Debugging 4D "course, we decided to make the second edition of Practical Foundations of Windows Debugging based on WinDbg from Windows 11 SDK and Visual Studio 2022 build tools and an optional Docker support for the exercise environment. We also changed the ":=" operator to "<-" in our pseudo-code for Intel disassembly syntax flavor to align with our recent Linux Practical Foundations books, which use "->" in pseudo-code for x64 AT&T disassembly syntax flavor and "<-" in pseudo-code for ARM64 disassembly syntax. All sample projects were recompiled, and many diagrams were redone for the new edition to reflect changes in code generation. WinDbg syntax and code highlighting were also improved. There are also minor additions for C++11 and C++20.

The book is useful for:

  • Software technical support and escalation engineers
  • Software engineers coming from managed code or JVM background
  • Software testers
  • Engineers coming from non-Wintel environments
  • Windows C/C++ software engineers without assembly language background
  • Security researchers without x86/x64 assembly language background
  • Beginners learning Windows software reverse engineering techniques

This introductory training course can complement the more advanced course Accelerated Disassembly, Reconstruction and Reversing, Revised Edition. It may also help with advanced exercises in Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 1, Revised, Process User Space and Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revised, Kernel and Complete Spaces. This book can also be used as an Intel assembly language and Windows debugging supplement for relevant undergraduate-level courses.

Product information:

  • Title: Practical Foundations of Windows Debugging, Disassembling, Reversing: Training Course, Second Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 338 pages
  • Publisher: OpenTask (April 2022)
  • ISBN-13: 978-1-912636-35-8

Table of Contents

Syndicate content