Table Of ContentPublished by OpenTask, Republic of Ireland
Copyright © 2022 by OpenTask
Copyright © 2022 by Software Diagnostics Services
Copyright © 2022 by Dmitry Vostokov
All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or
transmitted, in any form or by any means, without the publisher’s prior written permission.
Product and company names mentioned in this book may be trademarks of their owners.
OpenTask books and magazines are available through booksellers and distributors worldwide.
For further information or comments, send requests to press@opentask.com.
A CIP catalog record for this book is available from the British Library.
ISBN-l3: 978-1-912636-63-1 (Paperback)
Revision 1.01 (December 2022)
2
Contents
About the Author.............................................................................................................................................................. 5
Introduction ...................................................................................................................................................................... 7
Exercise W0: Download, setup, and verify your WinDbg Preview or WinDbg installation, or Docker Debugging
Tools for Windows image ........................................................................................................................................... 21
General Windows API Aspects ....................................................................................................................................... 37
Exercise W1 ................................................................................................................................................................ 56
Exercise W2 ................................................................................................................................................................ 71
Exercise W3 ................................................................................................................................................................ 93
Exercise W4 .............................................................................................................................................................. 136
Exercise W5 .............................................................................................................................................................. 160
Exercise W6 .............................................................................................................................................................. 175
Exercise W7 .............................................................................................................................................................. 218
Exercise W8 .............................................................................................................................................................. 227
Windows API Formalization.......................................................................................................................................... 233
Windows API and Languages ........................................................................................................................................ 247
Exercise W9 .............................................................................................................................................................. 254
Windows API Classes .................................................................................................................................................... 261
Exercise W10 ............................................................................................................................................................ 284
References and Resources............................................................................................................................................ 297
3
4
About the Author
5
Dmitry Vostokov is an internationally recognized expert, speaker,
educator, scientist, inventor, and author. He is the founder of the
pattern-oriented software diagnostics, forensics, and prognostics
discipline (Systematic Software Diagnostics), and Software Diagnostics
Institute (DA+TA: DumpAnalysis.org + TraceAnalysis.org). Vostokov has
also authored more than 50 books on software diagnostics, anomaly
detection and analysis, software and memory forensics, root cause
analysis and problem solving, memory dump analysis, debugging,
software trace and log analysis, reverse engineering, and malware
analysis. He has over 25 years of experience in software architecture, design, development, and
maintenance in various industries, including leadership, technical, and people management roles.
Dmitry also founded Syndromatix, Anolog.io, BriteTrace, DiaThings, Logtellect, OpenTask Iterative
and Incremental Publishing (OpenTask.com), Software Diagnostics Technology and Services (former
Memory Dump Analysis Services) PatternDiagnostics.com, and Software Prognostics. In his spare
time, he presents various topics on Debugging.TV and explores Software Narratology, its further
development as Narratology of Things and Diagnostics of Things (DoT), Software Pathology, and
Quantum Software Diagnostics. His current interest areas are theoretical software diagnostics and its
mathematical and computer science foundations, application of formal logic, artificial intelligence,
machine learning and data mining to diagnostics and anomaly detection, software diagnostics
engineering and diagnostics-driven development, diagnostics workflow and interaction. Recent
interest areas also include cloud native computing, security, automation, functional programming, and
applications of category theory to software development and big data.
6
Introduction
7
8
Hello everyone, my name is Dmitry Vostokov, and I teach this training course.
9
To get most of this training, you are expected to have basic development experience and optional
basic memory dump analysis experience. I assume you know what types, functions, and their
parameters are. If you don’t have a memory dump analysis experience, then you also learn some
basics too because we use the Microsoft debugger, WinDbg from Debugging Tools for Windows, or
WinDbg Preview app for some exercises. If you haven’t got the Practical Foundations of Windows
Debugging, Disassembling, and Reversing book, which also uses WinDbg, or haven’t had a chance to
read it, I explain some concepts when necessary during the course.
10
