Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revision 3: Kernel and Complete Spaces

Slides from the training

The full-color transcript of Software Diagnostics Services training sessions with 14 step-by-step exercises, notes, source code of specially created modeling applications, and 45 questions and answers. Covers more than 35 crash dump analysis patterns from x64 kernel and complete (physical) memory dumps. Learn how to analyze system crashes and freezes, navigate through kernel and complete spaces, and diagnose patterns of abnormal software behavior with WinDbg debugger. The training uses a unique and innovative pattern-oriented analysis approach developed by Software Diagnostics Institute to speed up the learning curve. Prerequisites: Basic Windows troubleshooting. Audience: Software technical support and escalation engineers, system administrators, security researchers, reverse engineers, malware and memory forensics analysts, software developers and quality assurance engineers, site reliability engineers. The 5th edition was fully reworked with new memory dumps, additional slides, exercises, and analysis patterns. It was further revised with some exercises updated to Windows 11, expanded Q&A, and optional Docker image. The current revision 5.7 uses WinDbg Preview for all exercise transcripts.

  • Title: Accelerated Windows Memory Dump Analysis, Fifth Edition, Part 2, Revision 3, Kernel and Complete Spaces: Training Course Transcript and WinDbg Practice Exercises with Notes
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (October 2022)
  • Language: English
  • PDF: 372 pages
  • ISBN-13: 978-1912636983
  • Table of Contents and Sample Exercise

When you purchase the PDF book, you additionally get free named Software Diagnostics Library membership with access to more than 370 cross-referenced patterns of memory dump analysis, their classification, and more than 70 case studies.

Download links sent in 24 hours


The full 2-part set is also available with recording: Accelerated Windows Memory Dump Analysis, Fifth Edition, Revision 3