About the Author 7
Presentation Slides and Transcript 9
Core Dump Collection 31
x64 Disassembly (AT&T GDB Flavor) 43
ARM64 Disassembly 57
x64 Disassembly (Intel WinDbg Flavor) 71
Practice Exercises 85
Exercise 0 (x64, GDB) 90
Exercise 0 (A64, GDB, GDB-Multiarch) 92
Exercise 0 (A64/x64, WinDbg, Classic WinDbg, Docker) 95
Exercise A1 (x64, GDB) 114
Exercise A1 (A64, GDB) 127
Exercise A1 (x64, WinDbg) 142
Exercise A1 (A64, WinDbg) 158
Exercise A2D (x64, GDB) 175
Exercise A2D (A64, GDB) 179
Exercise A2D (x64, WinDbg) 182
Exercise A2D (A64, WinDbg) 186
Exercise A2C (x64, GDB) 190
Exercise A2C (A64, GDB) 193
Exercise A2C (x64, WinDbg) 196
Exercise A2C (A64, WinDbg) 200
Exercise A2S (x64, GDB) 205
Exercise A2S (A64, GDB) 208
Exercise A2S (x64, WinDbg) 211
Exercise A2S (A64, WinDbg) 215
Exercise A3 (x64, GDB) 220
Exercise A3 (A64, GDB) 223
Exercise A3 (x64, WinDbg) 228
Exercise A3 (A64, WinDbg) 233
Exercise A4 (x64, GDB) 239
Exercise A4 (A64, GDB) 245
Exercise A4 (x64, WinDbg) 250
Exercise A4 (A64, WinDbg) 257
Exercise A5 (x64, GDB) 265
Exercise A5 (A64, GDB) 268
Exercise A5 (x64, WinDbg) 271
Exercise A5 (A64, WinDbg) 275
Exercise A6 (x64, GDB) 281
Exercise A6 (A64, GDB) 296
Exercise A6 (x64, WinDbg) 312
Exercise A6 (A64, WinDbg) 325
Exercise A7 (x64, GDB) 337
Exercise A7 (x64, WinDbg) 342
Exercise A8 (x64, GDB) 348
Exercise A8 (A64, GDB) 357
Exercise A8 (x64, WinDbg) 367
Exercise A8 (A64, WinDbg) 374
Exercise A9 (x64, GDB) 387
Exercise A9 (A64, GDB) 394
Exercise A9 (x64, WinDbg) 401
Exercise A9 (A64, WinDbg) 407
Exercise A10 (x64, GDB) 415
Exercise A10 (A64, GDB) 428
Exercise A10 (x64, WinDbg) 435
Exercise A10 (A64, WinDbg) 442
Exercise A11 (x64, GDB) 449
Exercise A11 (A64, GDB) 459
Exercise A11 (x64, WinDbg) 467
Exercise A11 (A64, WinDbg) 476
Exercise A12 (x64, GDB) 486
Exercise A12 (A64, GDB) 497
Exercise A12 (x64, WinDbg) 506
Exercise A12 (A64, WinDbg) 513
Exercise K1 (x64, GDB) 522
Exercise K1 (A64, GDB) 544
Exercise K1 (x64, WinDbg) 568
Exercise K1 (A64, WinDbg) 576
Exercise K2 (x64, GDB) 585
Exercise K2 (A64, GDB) 591
Exercise K2 (x64, WinDbg) 597
Exercise K2 (A64, WinDbg) 602
Exercise K3 (x64, GDB) 613
Exercise K3 (A64, GDB) 617
Exercise K3 (x64, WinDbg) 620
Exercise K3 (A64, WinDbg) 624
Exercise K4 (x64, GDB) 629
Exercise K4 (A64, GDB) 636
Exercise K4 (A64, WinDbg) 641
Exercise K5 (x64, GDB) 644
Exercise K5 (A64, GDB) 649
Exercise K5 (x64, WinDbg) 654
Exercise K5 (A64, WinDbg) 657
Selected Q&A 671
App Source Code 679
App0 681
App1 682
App2D 683
App2C 685
App2S 687
App3 689
App4 691
App5 693
App6 695
App7 697
App8 699
App9 702
App10 704
App11 / App12 706
K2 708
K3 709
K4 711
K5 713
Selected Analysis Patterns 715
NULL Pointer (Data) 717
Incomplete Stack Trace 718
Stack Trace 719
NULL Pointer (Code) 720
Spiking Thread 721
Dynamic Memory Corruption (Process Heap) 722
Execution Residue (User Space) 723
Coincidental Symbolic Information 725
Stack Overflow (User Mode) 726
Divide by Zero (User Mode) 727
Local Buffer Overflow (User Space) 728
C++ Exception 729
Paratext 730
Active Thread 732
Lateral Damage 733
Critical Region 734