Talk With an Expert

Intro to WinDbg Part 2: Back to the Future Using TTD

  • Thu, May 29, 2025
  • 11:00AM - 12:00PM UTC
  • English
  • Kevin Ott
  • Technical Presentation
Webcast Hero

Following up on part 1 of the series, you now have your basics of WinDbg down. You jump into your first debugging session, stepping over code you do not want to inspect, just to realize that the function you just stepped over was actually important. You restart the debugging session and go again. If only it was possible to go back in time...

This workshop will introduce you to the concept of time travel debugging (TTD) in WinDbg. By recording a debugging session, we are now able to jump back and forth through the debugee and inspecting function calls throughout the lifetime of the program without restarting the program. During the workshop you will learn how to set up a TTD session, the new backwards stepping commands, navigating through the timeline of the session and searching for specific API calls, breakpoints and memory accesses.

System Requirements:

This webcast supports content from SANS Institute SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control. To learn more about this course, explore upcoming sessions, and access your FREE demo, click here.

Watch Intro to WinDbg Part 1: The Beginning

Meet the speaker

Kevin Ott
Kevin Ott

Kevin Ott

Principal Consultant, Red Team

Kevin is a seasoned red team professional experienced in running attack simulations across different industries, including finance, retail, manufacturing, and energy sectors. His focus is to develop offensive capabilities and tooling for engagements.

Read more about Kevin Ott