Intro to WinDbg Part 3: Call Me Maybe

Monday, 23 Jun 2025 3:30PM EDT (23 Jun 2025 19:30 UTC)
Speaker: Jonathan Reiter

Watch Intro to WinDbg Part 1: The Beginning and Part 2: Back to the Future Using TTD OnDemand.

By now you have learned how to travel through time using Time Travel Debugging. TTD is such a powerful feature and you’ve only begun to scratch the surface of its use cases.

This portion of the series is going to take a detailed look into calling conventions for a number of calling standards like stdcall, cdecl, thiscall, and fastcall. Calling conventions are not only important in the developer side, as taught in SEC670, but also in the malware analysis side too. It is critical to understand these conventions when performing any kind of analysis at the assembly level. If you can’t track what’s being passed in as the 3rd argument, you could miss a key part in your analysis. After this portion of the series, you will have a solid understanding of the various calling conventions covered.

You won’t need anything from Part 2 of this series other than your personal setup. See you there!

System Requirements:

64-bit Windows VM or host with the WinDbg installed (not WinDbg classic). Installation Instructions, https://learn.microsoft.com/en-us/windows-hardware/drivers/debugger/

This webcast supports content from SANS Institute SEC670: Red Teaming Tools - Developing Windows Implants, Shellcode, Command and Control™. To learn more about this course, explore upcoming sessions, and access your FREE demo, click here.

Login to Register

Webcast - Intro to WinDbg Part 3

Related Content

ransomware 25 340x340.png

Digital Forensics, Incident Response & Threat Hunting, Cyber Defense, Offensive Operations, Pen Testing, and Red Teaming

Visual Summary of SANS Ransomware Summit 2025

Check out these graphic recordings created in real-time throughout the event for SANS Ransomware Summit 2025

emerging threats summit 340x340.png

Digital Forensics, Incident Response & Threat Hunting, Offensive Operations, Pen Testing, and Red Teaming, Cyber Defense, Industrial Control Systems Security, Cybersecurity Leadership

Visual Summary of SANS Emerging Threats Summit 2025

Check out these graphic recordings created in real-time throughout the event for SANS Emerging Threats Summit 2025

Offensive Operations, Pen Testing, and Red Teaming, Penetration Testing and Red Teaming, Cybersecurity and IT Essentials, Cyber Defense

Month of PowerShell: Fileless Malware with Get-Clipboard

Let's take a look at a sneaky attack to use PowerShell maliciously while evading detection (and some ways to detect it).