Intro to WinDbg Part 2: Back to the Future Using TTD

Following up on part 1 of the series, you now have your basics of WinDbg down. You jump into your first debugging session, stepping over code you do not want to inspect, just to realize that the function you just stepped over was actually important. You restart the debugging session and go again. If only it was possible to go back in time...

This workshop will introduce you to the concept of time travel debugging (TTD) in WinDbg. By recording a debugging session, we are now able to jump back and forth through the debugee and inspecting function calls throughout the lifetime of the program without restarting the program. During the workshop you will learn how to set up a TTD session, the new backwards stepping commands, navigating through the timeline of the session and searching for specific API calls, breakpoints and memory accesses.

System Requirements:

• 64-bit Windows VM or host with the WinDbg installed (not WinDbg classic). Installation Instructions

This webcast supports content from SANS Institute SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control. To learn more about this course, explore upcoming sessions, and access your FREE demo, click here.

Watch Intro to WinDbg Part 1: The Beginning