Teach on Udemy

Turn what you know into an opportunity and reach millions around the world.

Learn More

Your cart is empty.

Keep shopping

Windbg - A complete guide for Advanced Windows Debugging

Name: Windbg - A complete guide for Advanced Windows Debugging
Rating: 4.7 (130 reviews)

This course has everything you need to master Windbg as well as, debugging and reverse engineering Windows OS using it.

Bestseller

Highest Rated

Created byAnand George

Last updated 6/2025

English

What you'll learn

Advanced Windows Debugging
Windbg
Windows internals
Dump Analysis
Post-mortem debugging
Core dump analysis in windows
Debugging system crash
Debugging BSOD
Debugging process hang
Debebugging system hang
Reverse Engineering
Malware Analysis
Debugging Slow Systems
Debugging Slow Applications
Windows Usermode internals
Windows Kernel mode internals

Course content

3 sections • 127 lectures • 26h 30m total length

Introduction8:21
This lecture is a brief introduction to the course. In this lecture we will be discussing,
· What is this course about?
· Targeted audience
· Structure of the course
Viewing Tips1:47
In this lecture we will be discussing some viewing tips for the training.
Update3:18
Introduction to debugger9:43
In this lecture we will be discussing,
· The contents of each chapters in brief to give the overview of the entire course.
· What is a debugger?
· Different types of debuggers
· Whiteboard to explain text editor, compiler, linker and debugger
· What is Windbg?
Installation ofWindbg4:17
In this lecture we will be discussing,
· How to install Windbg?
· Different versions of Windbg available.
Debugging a simple program16:33
In this lecture we will be discussing about,
· Different elements in Windbg UI
· How to attach Windbg?
· Different scenarios of debugging
Course Materials for Download0:10
Hi
All course materials current and future, will be available attached to this lecture,
Let me know if I am missing anything which is discussed in the course and will add it.
Mail me at sourcelens@gmail.com.
Thank you,
Anand
Concept of program execution5:18
In this lecture we will seeing the demo of,
· Attaching WinDbg to notepad
· Observing the frozen and unfrozen state of the notepad
Memorydump4:54
In this lecture we will be discussing about,
· What is a dump?
· What information a dump contains?
Debug symbols with demo6:52
In this lecture we will be discussing,
· Concept of symbol
· Demo to understand symbols.
· Whiteboard explaining symbols
Callstack, global and local variables8:02
In this lecture we will be discussing about,
· Call stack
· Global variables
· Local variables
Kernel, process, thread and stack5:32
In this lecture we will discuss the concept of,
· Kernel
· Process
· Thread
· Whiteboard to explain the relation between the above entities
Some more concepts2:40
In this lecture we will discussing about,
· Types of dump-hang, crash, kernel/user dumps, Time Travel Tracing
Demo-how to take a dump3:50
This lecture includes,
· Demo to take a dump
· How to open a dump in Windbg?
Debugger Commands2:24
In this lecture we will be discussing,
· Overview of debugger commands
· Types of debugger commands- native, config and extension
Help command1:49
In this lecture we will be discussing,
· What is help command and how to use it?
Setting symbol path9:23
In this lecture we will see a demo explaining,
· How to set symbol path in Windbg?
Mismatched symbols, symnoisy and symquiet6:30
In this lecture we will be discussing,
· Mismatched symbols
· Usage of the commands symnoisy and sympath
!analyze -v and stack commands10:16
In this lecture we will be discussing the debugging command,
· !analyze -v
Sympath command1:18
In this lecture we will be seeing a demo on,
· How to use .sympath command to set a symbol path?
Debugger Extensions9:55
In this lecture we will be discussing about,
· Debugger extensions
· How to load and unload debugger extensions using son of strike (sos) .NET extension?
· The commands discussed in this lecture are,
I. .chain
II. .extmatch
III. dbghelp
IV. .unload
V. .load
VI. l
VII. lmvn
VIII. !lmi
Native commands- x,ln6:15
In this lecture we will be discussing the native commands,
· x
· ln
Native commands -r, k7:25
In this lecture we will be discussing the native commands,
· r
· k (kvn, kf)
Native commands- e, u7:13
In this lecture we will be discussing the native commands,
· e (ea)
· u (ub)
Native commands- dc4:47
In this lecture we will be discussing the command,
· dc (dv, dps)
dt command and recursive dumping6:57
In this lecture we will be discussing the command,
· dt
· How to recursively dump using dt?
Doubly linked list12:13
In this lecture we will be discussing,
· How to dump a doubly linked list?
Real life application of doubly linked list6:55
In this lecture we will doing a demo to see the practical application of dt command.
dv command5:51
Here, we will be discussing the commands,
· dv
· .frame
's' command3:37
In this lecture we will be discussing the command,
s-search memory
Live debugging commands – bp commands30:45
In this lecture we will be discussing the commands,
· bp
· bm
· bd
· be
· ba
· bpcmds
· bl
t,p, .logopen commands6:16
In this lecture we will be discussing the commands,
· t
· p
· wt
· .logopen
.logclose
wow64 Debugging4:31
In this lecture we will be discussing about,
* wow64 mode of debugging
Demo – debugging 32bit, 64 bit and wow64bit23:07
In this lecture we will see the demo of,
· 32bit application in 32bit debugger
· 64bit application in 64bit debugger
· 32bit application in 64bit debugger
· .effmach command
· Kernel mode debugging in wow64
Assembly Language 32bit- whiteboard6:13
In this lecture we will be explaining 32bit stack frame with the help of whiteboard.
Assembly Language 32bit- demo33:30
In this lecture we will be explaining 32bit assembly language instructions with the help of a demo.
Assembly language 64bit15:31
In this lecture we will be explaining 64bit assembly language instructions with the help of a demo.
ChildEBP, retAddr, argstochild2:45
In this lecture we will be discussing about,
· ChildEBP
· RetAddr
· argstochild
Address Range3:57
In this lecture we will be doing a demo showing different ways to give address range in commands.
Looping- foreach command20:26
In this lecture we will be discussing about,
· Different variants of foreach command
pipe, version, vertarget commands1:23
In this lecture we will discussing the commands,
· version
· vertarget
· pipe
Time Travel Tracing13:41
In this lecture we will be discussing about,
· Time Travel Tracing
· Different commands related to time travel tracing
Conclusion of Chapter 11:03
This lecture includes, the overview of what we have seen so far.

Introduction to chapter213:05
In this lecture we will be discussing,
· Overview of chapter 2
· Whiteboard- Generation of a program
· Whiteboard- how a program is loaded into memory
User mode internals-address translation34:24
In this lecture we will be discussing the concepts,
· User mode
· Kernel mode (privileged mode)
· Address translation
· Virtual address
· Physical address
· Address space
· Relation between physical and virtual address
· Page table
· Cr3 register
· Interrupts
· Exceptions
Objects and Handles4:53
In this lecture I will be explaining the concept of objects and handles with the help of whiteboard.
User Mode-Memory management6:54
In this lecture we will be using whiteboard to explain the concepts,
· Memory allocation- APIs used to allocate memory like Virtual alloc, malloc, heap alloc
· Different types of memory allocation – committed, reserved
· Access Violation
User mode- Process and Threads11:55
In this lecture we will try to understand the concept of process and threads with the help of whiteboard.
Data structures, Win32 API and System calls12:39
In this lecture we will be discussing the concepts,
· User mode data structures- peb, teb
· System calls
· Demo to understand how system call is passed to kernel mode, with the help of windbg attached to kernel mode.
Portable Executable10:08
In this lecture we will be discussing the concepts,

· exe
· dll
· Driver
· Signature of portable executable (mz)
User Mode-Simple Crash30:27
· Diagram-Second chance exemption handling
· Demo- first and second chance exception for a simple division by zero exception.
· Dump collection using windows error reporting (WER)
· Analyzing the dump
· Signs of crash
· Event Viewer
· Steps to handle a simple crash
· Procdump, debug diag, adplus
Dump Collection using Procdump by sysinternals7:19
In this lecture we will be,
· Collecting dump using Procdump
· Discuss some more facts about WER(Windows Error Reporting).
Internals of Access Violation33:03
In this lecture we will be seeing,
· Demo to explain access violation
· Whiteboard
Different Types of Exception8:59
In this lecture we will be explaining different types of exceptions using event filter in Windbg.
User mode Memory Corruption-Heap Corruption19:39
In this lecture we will be discussing,
· User mode memory corruption
· Whiteboard to explain:
I. Structure of heap
II. Heap Overrun
III. Heap Underrun
IV. Page Heap
Demo- Heap Corruption16:31
In this lecture we will see a demo on,
· Heap Corruption
· Heap Overrun
· Heap Underrun
· Enabling page heap
Double Free10:36
In this lecture we will see a demo on,
· Double Free
· Access after free
User Mode- Stack Corruption22:40
In this lecture we will see,
· Structure of Stack
· Nature of Corruption
· Demo- Reconstruction of Stack
Stack Overflow13:39
In this lecture we will see,

· Demo- Stack overflow
· User mode- case of poor exception handling
· !exchain command
Examining Normal dumps27:48
In this lecture we will be learning,
· How to recognize a normal dump by collecting dumps of,
I. Scanf console application
II. Semi console application with a message box
III. Full-fledged Windows UI application
IV. Notepad

· !heap command
User Mode Hang18:02
In this lecture we will explaining the following concepts with the help of whiteboard
· Slow application
· Mutually exclusive locks/mutex
· Deadlock
Also, we will be discussing,
· What is a hang?
Concepts related to hang18:29
In this lecture we will explaining the following concepts,
· Thread
· Scheduler/dispatcher
· Lock
· Wait
· Dispatcher object
· Whiteboard to explain UI Hang
Demo-Hang slow application21:58
In this lecture we will see a demo of,
· Slow application UI Hang
Critical session deadlock19:03
In this lecture we will see a demo of,
· User mode- critical session deadlock
Dump collection- procdump &task manager6:47
In this lecture we will see a demo of,
· Collection of hang dump using procdump and task manager
Loader Lock23:26
In this lecture we will be discussing,
· What is a loader lock with the help of whiteboard.
· Demo- Loader lock.
· Usage of peb command to dump out loader lock.
· Walking waitchain in user mode.
Mutex deadlock9:56
In this lecture we will be discussing,
· Mutex deadlock
· How a mutex looks in the debugger?
Slow Application- High CPU28:44
In this lecture we will see a demo of,
· Thread executing an infinite loop
· Taking multiple dumps- idea of snapshot
User Mode- Leaks41:47
In this lecture we will be discussing,
· Whiteboard- Explaining the concept of leak.
· Leak Analysis- Obtaining allocation stack- +USD way
· Using UMDH to find the difference between t1 and t2
Slow application- UMDH8:04
In this lecture we will be seeing a slow application with the help of umdh.
Large allocation inside nt heap & Thread Leak16:46
In this lecture we will be discussing,
. Demo- More than 1 mb memory allocation inside nt Heap
. How a thread leak looks in a debugger?
Handle Leak & htrace command5:09
In this lecture we will be discussing,
· Handle leak
· !htrace command
30. Leak Analysis- The generic way51:01
In this lecture we will see a demo of,
· Demo- Generic way of leak analysis
· Steps for leak analysis
Handle object leaks- GDI handle25:50
In this lecture we will see a demo of,
· Leak- GDI handle
Handle object leaks- virtual alloc15:16
In this lecture we will see a demo of,
· Leak- Virtual alloc
C++ Runtime, new & delete49:11
In this lecture we will see a demo of,
· Dumping down vtable
· Looking at overloading
· Global constructor callback
· Global destructor callback
· Global constructor of a dll
· New
· Deletion of array
Template functions and function overloading19:49
In this lecture we will see a demo of,
· Template functions
· Function overloading
· Case study- how dangerous is doing anything in loader lock
Security implication of allowing some one to debug a process19:28
In this lecture we will see a demo of,
· Reading and writing to address space with the help of Facebook app using time travel tracing in Windbg preview.
· Security issues related to attaching a debugger to your system by third party.
Kernel Mode- Basics9:41
In this lecture we will be discussing,
· Whiteboard- Kernel Mode/privileged mode
· Handling registers – cr3 register
· Interrupt handling
· Blue screen of death or kernel panic- unhandled exception in kernel mode
Demo- full memory dump kernel mode9:41
In this lecture we will be discussing,

· Difference between minidump, full dump and kernel dump
· Demo- configuring the system for full kernel memory dump
· Crash the system using Not My Fault from sysinternals
· Taking a full memory dump kernel mode.
Analyzing the Full memory dump22:47
In this lecture we will be analyzing,
· The kernel mode full memory dump using Windbg
· How to differentiate a kernel dump from user dump?
· What is an Executable search path?
· !thread command to see current process
· Switching into other threads and processes
· Viewing kernel mode process stack using !process 0 17 command
· .process command to switch into the context of a process
Kernel Mode Internals9:01
In this lecture we will be discussing,
· Kernel mode essential internals
· NMI- Not My Fault & NMI switch
· How to force system crash using keyboard?
· How to crash an EC2 instance in AWS?
· Vmss2core- Collect dump from virtual machines running on VMware workstation
· Trap or interrupt context
· System process- ntokrnl.exe (main process inside system process)
· IRP- IO request packet
Kernel Mode Internals- part 210:40
In this lecture we will be discussing,
· ALPC- whiteboard explaining ALPC
· Eresource
· Difference between Eresource and critical session
· What is a mutex?
· Spinlocks
Operating system scheduler/ dispatcher27:26
In this lecture we will be discussing,
· Timer interrupt handler
· Interrupt mask
· IRQL-passive level, APC level, DPC level
· Dispatcher object- thread, process, eresource, mutex, semaphore
· Concept of wait
· Why do we need to mask interrupt?
· Spinlocks revisited
Memory management12:36
In this lecture we will be discussing,
· Whiteboard- paging
· Paged and non-paged pool
· SysPTE- system page table entry
ALPC & implementation of some API's15:47
In this lecture we will be discussing,
· Implementation of Windows API
Debugging Windows logon UI17:14
In this lecture we will be discussing,
· How to attach kernel debugger to Virtual machine?
· Demo- attaching Windbg to Windows logon UI
Sample application Kernel Mode40:59
In this lecture we will be reviewing,
· The code of sample application which we will be using in the kernel mode with the help of whiteboard.
· Brief discussion on Windows drivers
Kernel Mode- Simple Crash8:39
In this lecture we will see a demo of,
· Kernel mode simple crash
· Usage of .trap command
Stack overflow- kernel mode11:06
In this lecture we will see a demo of,
· Kernel mode stack overflow
Stack corruption- kernel mode10:22
In this lecture we will see a demo of,
· Kernel mode stack corruption and rebuilding the stack
Pool Corruption21:20
In this lecture we will see a demo of,
· Pool corruption
· Enabling special pool and trouble shooting pool corruption.
· Using !poolused command to see the pool tag
· Gflags
· Overview of what we have seen so far in kernel mode
Bugcheck codes3:18
In this lecture we will be discussing,
· Different bugcheck codes
· Concept of blue screen of death
Why kernel mode crashes are complicated than user mode?6:07
In this lecture we will be discussing,
· Why kernel mode crashes are complicated than user mode?
· Tips to handle kernel mode crash
Operating system Hangs15:19
In this lecture we will be discussing,

· Reason for kernel hangs
· What is the difference between hard hang, soft hang & slowness?
· What are the different types of kernel hang?
Spinlock Deadlock14:08
In this lecture we will see a demo of,
· Spinlock Deadlock
High CPU- Kernel mode12:28
In this lecture we will be discussing,
. Application high CPU-kernel mode
Pool Leak22:57
In this lecture we will see a demo of,
· System hang due to pool leak
Eresource deadlock10:45
In this lecture we will see a demo of,
· Eresource deadlock
· !locks command
Waiting for IRP4:21
In this lecture we will see a demo,
· Waiting for IRP- Device IO control from user mode application
Thread leak and process leak29:19
In this lecture we will see a demo,
· Creating infinite amount of process and causing system hang
· Analyzing the hung system in Windbg
Kernel mode myths4:27
In this lecture we will be addressing some kernel mode myths like,
· Kernel can interrupt a user mode thread
· Hang in any kernel mode thread halt the system etc.
Demo- Suspend process LSAS21:22
In this lecture we will see a demo,
· Suspending LSAS using process explorer
Suspend process CSRSS25:21
In this lecture we will see a demo,
· Suspending process CSRSS
· Crash the system from the live debugging session- .crash command
SVC host hang5:26
In this lecture we will see a demo,
· SVC host hang
Suspending Winlogon & chapter 2 conclusion7:13
In this lecture we will see a demo,
· Suspending Winlogon and analyzing it.
· Summary of chapter 2.
· Overview of what we will be seeing in chapter 3.

Introduction to chapter-33:56
In this lecture we will be discussing,
· What are the contents of chapter-3?
· Trouble shooting NotMyFault issues one by one
Notmyfault- High IRQL kernel mode-32bit6:41
In this lecture we will be seeing the demo,
· High IRQL
Buffer Overflow and code override-32bit10:46
In this lecture we will be seeing the demo,
· Buffer Overflow
· Code Override- writing to a read only page
· !pte command
· Read, write, valid, dirty flags
Stack Trash-32bit12:34
In this lecture we will be seeing the demo,
· Stack trash/ stack corruption
. Rebuilding the stack
High IRQL- User Mode 32bit13:01
In this lecture we will be seeing the demo,
· High IRQL- User Mode
Stack Overflow- 32bit4:25
In this lecture we will be seeing the demo,
· Stack Overflow
Hard Coded Breakpoint- 32bit1:44
In this lecture we will be seeing the demo,
· Hard Coded Breakpoint
Double Free- 32bit1:52
In this lecture we will be seeing the demo,
· Double Free
IRP Hang- 32bit10:52
In this lecture we will be seeing the demo,
· IRP Hang
DPC Hang- 32bit11:29
In this lecture we will be seeing the demo,
· DPC Hang
Deadlock- 32bit14:58
In this lecture we will be seeing the demo,
· Fast Mutex
Paged pool Leak- 32bit8:15
In this lecture we will be seeing the demo,
· Paged pool Leak
High IRQL(km)- 64 bit5:26
In this lecture we will be seeing the demo,
· High IRQL Kernel mode- 64 bit
Buffer Overflow-64 bit10:22
In this lecture we will be seeing the demo,
· Buffer Overflow-64 bit
Code Overwrite and Stack Corruption- 64bit14:19
In this lecture we will be seeing the demo,
· Code Overwrite
. Stack Corruption
High IRQL(um) & Stack Overflow- 64 bit3:23
In this lecture we will be seeing the demo,
· High IRQL in user mode 64 bit
· Stack Overflow 64 bit
Hard Coded Breakpoint & Double Free- 64bit1:31
In this lecture we will be seeing the demo,
· Hard Coded Breakpoint
· Double Free
Hang - 64 bit8:11
In this lecture we will be seeing the demo,
· Hang with IRP
· Hang with DPC
· Deadlock
Leak Non-Paged Pool- 64bit4:16
In this lecture we will be seeing the demo,
· Leak Non-Paged Pool- 64bit
Waiting on NDA0:59
Conclusion of Course0:47

Requirements

C programming
1 to 2 year of IT experience on Windows

Description

Have you ever felt your windows operating system is hung or becoming slow or having a BSOD? Or an application crash or application hang or slow on windows? Have you had to press the restart button of your PC or the windows server to get rid of the problem and had no clue when that issue will happen again? Or you're asked to analyse a memory dump of a compromised system for isolating a malware?. If that bothers you, this training is all about root causing and solving such complicated issues once and for all, among many other topics it covers.

Windbg is the single most powerful, debugging and reverse engineering tool in windows platform. Windbg is like an x-ray plus mri plus ct scan for programs running on windows operating system, including the operating system itself. It helps us to root cause complicated problems like we discussed in windows ( OS ) and programs running inside the operating system.

Just like the name implies this training has all the details which you need to master windbg. I have spent all my efforts to make sure this is the best and most complete windbg training available right now and I will keep adding topics to make sure that the statement is true in the future as well.

Targeted audience

Due to any reason, if you are trying to use or learn windbg, you already know what you're doing and there is no better place than this course. If you have been following my youtube series, this course is a complete super set of it. Being said that following are some of the categories of students to whom, I strongly recommend this course.

Support engineers

If you are a support engineer or Escalation Engineer who is supporting any product on windows, or Windows itself, I definitely recommend this course.

Malware analyst and cyber security professionals.

If you are into core cyber security especially on windows platform this tool should be definitely in your arsenal. When it comes to reverse engineering, I myself don't prefer to compare ida pro or any other similar tool with windbg but I always found windbg is one of the most, if not THE most powerful and productive tool when it comes to reverse engineering along with debugging.

Windows SysAdmins

Another main targeted set of audience is Windows administrators who always can take leverage from tools like this and know more about the product they are working with and troubleshoot problems they face at a totally different level.

C and C++ Programmers

Last and not least may be the most important category of students - advanced C and C ++ programmers which includes, driver developers, testers, software maintenance engineers and so on. Are you wondering why your application is crashing, hanging, slow or taking too much resources? That too happens once in a blue moon in production and you have no way to reproduce the issue in your dev environment. Are you asked to debug a problem in a code base you have no clue about? Or you just want to see exactly what that latest feature of cpp 20 is doing behind the scenes? This training is for you.

To summarise, this course is for anyone who wants to study windows internals and advanced production debugging on windows. Post this training you don't have to read every single windows internals and debugging books out there but you will debug whatever you want to know whatever you want to know, rather than reading some abstract result from some books.

Post this training you will not have to read and learn OS internals from any books but you will debug and understand it as and when you need it.

Course Structure

This course has 3 chapters

In Chapter 1 we discuss the necessary concepts to get us started and mostly focus on the commands of the debugger.

In Chapter 2 we apply what we have learned in Chapter 1 to different debugging scenarios, like crashes, hangs, slowness, leaks and more. We will be using test applications for this chapter and we will have source code of these test applications. First we will discuss User mode issues and then we will go into Kernel mode.

In chapter 3 we will use the knowledge gained in Chapter 1 and 2 to troubleshoot real production like or production issues. In this chapter we will discuss analysis of memory dumps which we don't have source code or any idea about. We will start with issues from sysinternals notmyfault and slowly get into true production debugging scenarios. I will keep adding lessons to this chapter if there is enough interest from students on this course. Students also can submit dumps to this chapter and they can get the dumps analyzed for free of cost and share the experience with others.

Please refer to the course content and free preview lesson for more details about the structure and content of the course.

Who this course is for:

Anyone who want to learn advanced windows debugging and Reverse engineering with Windbg
Security Specialists
Reverse engineers
Malware analysts
Support engineers
Software developers
Software Sustenance Engineers
Windows Admins
Escalation Engineers

Windbg - A complete guide for Advanced Windows Debugging

What you'll learn

Explore related topics

Course content

Windbg Basics43 lectures • 5hr 47min

User and Kernel mode Debugging63 lectures • 18hr 13min

Debugging Real Production Issues21 lectures • 2hr 30min

Requirements

Description

Who this course is for: