Debugger and Symbols
This section introduces attendees to WinDBG and walks them through basic debugger operations. It covers the key concepts required to use the debugger effectively for both debugging and reverse engineering like symbols files, symbol server, private and public symbols, symbol file issues and how to troubleshoot and fix them. Different modes in which the debugger can be used like user mode debugging, kernel mode debugging, live debugging and memory dump debugging are discussed. An introduction to CPU registers, their usage and X86/X64 assembly language is also provided.
Data Structures
Being able to display data structures used in high level languages like C/C++ is a critical part of effective debugging. Examining these structures in WinDBG and identifying assembler code patterns that access these structures are discussed in this section. In addition techniques for examining arrays, structure, unions and linked-lists are covered.
PE Files
The structure of Portable Executable (PE) files is discussed along with techniques to navigate through PE files in WinDBG. Concepts such as PE File header, sections, function patching, disassembling functions, examining assembler code, import and export tables, exception tables, packed sections, PE file checksums and memory carving are covered.
Call Stacks
The capability of displaying call stacks is one of the core pieces of debugging functionality offered by WinDBG. This section discusses call stacks on X86 and X64 platforms along with techniques for navigating the stack, retrieving parameters and local variables from the stack and manual stack reconstruction. Concepts related to call stacks such as non-volatile registers, function prolog/epilog, frame pointer omission, exception handling differences on 32 and 64 bit platforms are covered.
Automation
Debugger extensions and debugger scripting are some of the ways of automating debugging and reverse engineering tasks. This section discusses debugger scripting and related topics like scripting language, control flow tokens, operators, pseudo registers, aliases, string operators, expression parsers, built-in iterators etc. and how to use them for automation.
Live Debugging
In this section attendees learn about using the debugger for live debugging and the support provided by the Windows operating system for various live debugging scenarios. Topics like invasive and non-invasive debugging, side effects of debugging, auto-attaching debuggers to processes, just-in-time debugging, techniques for setting breakpoints, conditional breakpoints, process and thread specific breakpoints etc. are discussed.
