Crash Dump Analysis
Crash dump analysis or bug-check analysis is a necessary part of device driver development. This section discusses the dump generation process, different types of kernel memory dumps and the techniques used to debug them. Attendees learn about the common causes of system crashes, how to categorize them in order to come up with an analysis strategy followed by specific analysis techniques for bug-checks related to incorrect IRQL usage, invalid memory accesses, pool corruption and failures related to hardware.
Calling Convention and Call Stacks
Windows runs on X86 and X64 CPUs, which have very different calling conventions, parameter passing mechanisms and stack layouts. In this section, attendees learn techniques for retrieving parameters and non-volatile registers from the stacks as well as how to debug issues like stack overflows and stack corruption.
Debugging Deadlocks and Hangs
Deadlocks and hangs are much harder to debug than crashes since there is no well-defined starting point for the fault analysis process. In this section, attendees will learn the basics of debugging system level hangs like identifying deadlocked threads, stuck I/O requests and generally narrowing down the scope of hangs. They will also learn about examining vital system health indicators to find common causes of hangs and attribute them to specific components in the system. Performance analysis tools and their usage in debugging high CPU usage and CPU spikes are also covered.
Advanced Analysis Techniques
This section picks up where the crash dump analysis section left off. Debugging strategy and techniques for root cause analysis are discussed. Using carefully selected examples of real world crashes and hangs, attendees will learn how to start from the information displayed by “!analyze -v" and go all the way to root causing the problem while applying kernel internals knowledge and debugging techniques along the way.
Debugging Tools
A low hanging fruit when debugging drivers is to use the myriad of run-time verification, tracking and debugging capabilities provided by the system to nail down subtle bugs in drivers. This section covers some of these tools and mechanisms available to drivers like driver verifier, GFlags, checked build components, object reference counting, run-time stack capture, pool breakpoints and PTE tracking etc. that help with debugging. Attendees learn about the scenarios under which to use these tools, the debugging features they provide and how to use them to pin-point various classes of problems in drivers.
