Pluralsight: Windows Kernel Debugging Fundamentals

Posted By: ParRus

Date: July 12, 2015

Pluralsight: Windows Kernel Debugging Fundamentals

Genre: Video Tutorial / Developer, It-Ops, Debugging

Windows developers and IT admins learn valuable skills on debugging the Windows Blue Screen of Death (BSOD). Learn how to use the Windows Debugger (WinDbg), along with knowledge of the internal workings of the Windows operating system as you analyze crashes and hangs.

Windows kernel debugging is one of the most hardcore skills a system administrator can possess. It provides the ability to peer into the workings of the operating system and determine why a server may have crashed or locked up. This course covers the fundamentals essential for understanding the internal workings of the Windows operating system and how to install and use the Windows Debugger. Strategies are provided for examining crashes that give learners immediate confidence with analyzing crashes and hangs. You will learn about Windows processes and threads, stack traces, processors, synchronization mechanisms, address space layout, drivers and interrupts and much more. You will leave this course with the troubleshooting skills that you can leverage for many years to come.

by Bruce Mackenzie-Low
Duration: 5h 2m

Contents:
Introduction to Windows Crashes and Hangs
Introduction
Windows Crashes and Hangs
Common Causes
Memory Dump Creation
Types of Memory Dumps
Configuring Memory Dumps
Dedicated Dump File
Restrictions and Gotchas

Getting Started With the Windows Debugger
Introducing the Windows Debugger
Live Kernel-mode Debugging
Postmortem Analysis
Installing the Debugging Tools
Starting the Debugger
Debugger Workspaces
Opening a Memory Dump

Getting Help in the Windows Debugger
Introducing the Windows Debugger Help Library
Finding Help on Debugger Operations
Getting Help on Debugger Commands
Using the Bug Checks Code Reference Section
Processor Architectures and Instructions

Configuring the Windows Debugger
What Needs to Be Configured in WinDbg?
Symbols
Configuring the Symbol File Path
Establishing the Source File Path
Configuring the Executable Image Path

Starting Your Crash Dump Analysis
Starting Your Crash Dump Analysis With the !analyze -v Command
Demonstration Using !analyze -v
Strategies for Analyzing System Crashes
Strategies for Analyzing System Hangs

Understanding Stack Traces
Stack Fundamentals
What is a Stack Trace?
Displaying the Stack Trace in WinDbg
WinDbg k Command for Displaying a Stack Trace
WinDbg dds and dqs Commands for Displaying a Stack Trace
WinDbg !stacks Command for Displaying a Stack Trace

Debugging Processes and Threads
Windows Processes
Using the !process Debugger Command
Windows Threads
Using the !thread Debugger Command
Understanding Thread Scheduling and States

Understanding Processors and Disassembled Code
Processors and Registers
Multiprocessor Systems
Sockets, Cores, and Hyper-threading
Unassembling Instruction Streams

Investigating Locks and Spinlocks
Locks and Resources
Debugging Deadlocks
Spinlocks
Analyzing Spinlock Hangs

Exploring Windows Virtual Memory
What is Virtual Memory?
Consumers of Virtual Memory
Windows Virtual Address Space Layouts
Windows Memory Pools
Displaying Memory Contents

Windows Drivers and Interrupts
What is a Driver?
I/O Request Packets (IRP)
Interrupt Request Levels (IRQL)
Deferred Procedure Calls (DPC)

Forcing Windows Memory Dumps
Why do Windows Servers Hang?
Forcing a Memory Dump With NotMyFault
Forcing a Memory Dump With a Keyboard
Forcing a Memory Dump With a Non-maskable Interrupt

MediaInfo:

General
Complete name : 07_03-Windows Threads.mp4
Format : MPEG-4
Format profile : Base Media / Version 2
Codec ID : mp42
File size : 11.2 MiB
Duration : 6mn 16s
Overall bit rate mode : Variable
Overall bit rate : 249 Kbps
Encoded date : UTC 2014-07-03 16:32:25
Tagged date : UTC 2014-07-03 16:32:54
Writing application : HandBrake 0.9.8 2012071700

Video
ID : 1
Format : AVC
Format/Info : Advanced Video Codec
Format profile : Baseline@L3.1
Format settings, CABAC : No
Format settings, ReFrames : 2 frames
Format settings, GOP : M=1, N=50
Codec ID : avc1
Codec ID/Info : Advanced Video Coding
Duration : 6mn 16s
Duration_FirstFrame : 67ms
Bit rate mode : Variable
Bit rate : 119 Kbps
Width : 1 024 pixels
Height : 768 pixels
Display aspect ratio : 4:3
Frame rate mode : Constant
Frame rate : 15.000 fps
Color space : YUV
Chroma subsampling : 4:2:0
Bit depth : 8 bits
Scan type : Progressive
Bits/(Pixel*Frame) : 0.010
Stream size : 5.34 MiB (48%)
Writing library : x264 core 120
Encoding settings : cabac=0 / ref=2 / deblock=1:0:0 / analyse=0x1:0x111 / me=umh / subme=6 / psy=1 / psy_rd=1.00:0.00 / mixed_ref=1 / me_range=16 / chroma_me=1 / trellis=0 / 8x8dct=0 / cqm=0 / deadzone=21,11 / fast_pskip=1 / chroma_qp_offset=-2 / threads=12 / sliced_threads=0 / nr=0 / decimate=1 / interlaced=0 / bluray_compat=0 / constrained_intra=0 / bframes=0 / weightp=0 / keyint=50 / keyint_min=15 / scenecut=40 / intra_refresh=0 / rc_lookahead=40 / rc=crf / mbtree=1 / crf=20.0 / qcomp=0.60 / qpmin=3 / qpmax=69 / qpstep=4 / ip_ratio=1.40 / aq=1:1.00
Encoded date : UTC 2014-07-03 16:32:25
Tagged date : UTC 2014-07-03 16:32:54
Color primaries : BT.709-5, BT.1361, IEC 61966-2-4, SMPTE RP177
Transfer characteristics : BT.709-5, BT.1361
Matrix coefficients : BT.709-5, BT.1361, IEC 61966-2-4 709, SMPTE RP177

Audio
ID : 2
Format : AAC
Format/Info : Advanced Audio Codec
Format profile : LC
Codec ID : 40
Duration : 6mn 16s
Bit rate mode : Variable
Bit rate : 128 Kbps
Maximum bit rate : 175 Kbps
Channel(s) : 2 channels
Channel positions : Front: L R
Sampling rate : 44.1 KHz
Compression mode : Lossy
Stream size : 5.75 MiB (51%)
Language : English
Encoded date : UTC 2014-07-03 16:32:25
Tagged date : UTC 2014-07-03 16:32:53

Screenshots

For more, Visit my AH-blog