Intro to WinDbg Part 2: Back to the Future Using TTD

Thursday, 29 May 2025 11:00AM EST (29 May 2025 15:00 UTC)
Speaker: Kevin Ott

Following up on part 1 of the series, you now have your basics of WinDbg down. You jump into your first debugging session, stepping over code you do not want to inspect, just to realize that the function you just stepped over was actually important. You restart the debugging session and go again. If only it was possible to go back in time...

This workshop will introduce you to the concept of time travel debugging (TTD) in WinDbg. By recording a debugging session, we are now able to jump back and forth through the debugee and inspecting function calls throughout the lifetime of the program without restarting the program. During the workshop you will learn how to set up a TTD session, the new backwards stepping commands, navigating through the timeline of the session and searching for specific API calls, breakpoints and memory accesses.

System Requirements:

64-bit Windows VM or host with the WinDbg installed (not WinDbg classic). Installation Instructions

This webcast supports content from SANS Institute SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control. To learn more about this course, explore upcoming sessions, and access your FREE demo, click here.

Watch Intro to WinDbg Part 1: The Beginning

Login to Register

Webcast - Intro to WinDbg workshop series

Related Content

emerging threats summit 340x340.png

Digital Forensics, Incident Response & Threat Hunting, Offensive Operations, Pen Testing, and Red Teaming, Cyber Defense, Industrial Control Systems Security, Cybersecurity Leadership

Visual Summary of SANS Emerging Threats Summit 2025

Check out these graphic recordings created in real-time throughout the event for SANS Emerging Threats Summit 2025

Offensive Operations, Pen Testing, and Red Teaming, Penetration Testing and Red Teaming, Cybersecurity and IT Essentials, Cyber Defense

Month of PowerShell: Fileless Malware with Get-Clipboard

Let's take a look at a sneaky attack to use PowerShell maliciously while evading detection (and some ways to detect it).

Cyber Defense, Digital Forensics, Incident Response & Threat Hunting, Cybersecurity and IT Essentials, Offensive Operations, Pen Testing, and Red Teaming

Month of PowerShell - Windows File Server Enumeration

In this Month of PowerShell article we look at several commands to interrogate Windows SMB servers as part of our incident response toolkit.