This document provides an overview of analyzing Windows crashes. It discusses introducing the Driver Verifier tool to identify code defects in drivers, using kernel debuggers to view crash dumps and perform basic crash analysis, and advanced debugging techniques like attaching a kernel debugger for debugging initialization failures. The document also covers the author's experience of 7 years at Microsoft and 3 years at Digital Equipment Corporation, as well as instructor experience with David Solomon.

2. Understanding Windows Crashes
Analyzing Windows Crashes
Introducing Driver Verifier
Performing Manual Analysis
Advanced Debugging Techniques

3. 7 years working at Microsoft
3 years at Digital Equipment Corporation
Instructor with David Solomon

4. Why analyze a
Windows crash?

6. The result of an unhandled exception
A device driver detects an unrecoverable
condition
The result of a hardware failure

8. KeBugCheckEx, the Windows kernel API is
called

9. Disables all interrupts
Freezes all CPUs and notifies any registered
drivers
Writes a crash dump to disk and restarts

12. Documented in the Windows Driver Kit
Reference included with the Debugging Tools
Viewable using the kernel debugger

13. Small memory dump
Kernel memory dump
Complete memory dump

15. Use any one of the Microsoft kernel debuggers
Configure the debugger to point to symbols
Troubleshoot symbol loading errors with !sym
noisy

16. The debugger performs basic crash analysis
The result of executing the !analyze command
Can be disabled if desired

17. Demo

18. Registers, small areas of extremely fast storage
Usually measured by the number of bits they hold
x86 architecture provides 16 basic program
registers
x64 adds an additional 8 general–purpose
registers

19. Registers, small areas of extremely fast storage
Usually measured by the number of bits they hold
x86 architecture provides 16 basic program
registers
x64 adds an additional 8 general–purpose
registers

20. Demo

22. Useful for identifying code defects in drivers
Included as part of the operating system
Required for Windows logo certification

23. Configurable using the Driver Verifier tool
Contains standard settings for common defects
Support for using a command line interface

24. Demo

26. !analyze doesn’t always offer results
Several useful commands and techniques
Additional manual analysis techniques

27. Demo

29. Support for attaching a kernel debugger
The system must be started in debugging mode
Required for debugging initialization failures

30. Possible for systems to become unresponsive
Instant system lockup
Slow grinding to a halt

31. Using a PS/2 keyboard
Using a built in NMI button
Using the kernel debugger

32. Demo

33. Windows Internals, 5th Edition
Memory Dump, Software Trace, Debugging,
Malware and Intelligence Analysis Portal
Advanced Windows Debugging and
Troubleshooting