Introduction to Philosophy of Software Diagnostics, Part 1

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

This is a transcript of Software Diagnostics Services Webinar about phenomenological, hermeneutical and analytical approaches to software diagnostics.

  • Title: Philosophy of Software Diagnostics: An Introduction, Part 1
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (September 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 36 pages
  • ISBN-13: 978-1908043571

Victimware: The Missing Part of the Equation

New! Now available for Kindle

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

Some software components are innocent victims of other component coding mistakes or deliberate subversion and some start as a part of crimeware and malware but eventually become victims themselves (they crash, hang, spike, leak, are dumped, subverted, etc.) This is a transcript of Software Diagnostics Services Webinar about unified malware and victimware analysis by using behavioural and structural patterns including a live memory dump analysis example.

  • Title: Victimware: The Missing Part of the Equation
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (August 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 28 pages
  • ISBN-13: 978-1908043634

Introduction to Pattern-Based Software Diagnostics

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

This is a transcript of Software Diagnostics Services Webinar about how pattern-based software diagnostics, troubleshooting and debugging address software post-construction problem solving pattern life cycle: from the discovery of a new pattern through its integration into an existing pattern catalogue and pattern language, testing, packaging and delivering to pattern consumers with subsequent usage, refactoring and writing case studies.

  • Title: Pattern-Based Software Diagnostics: An Introduction
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (August 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 28 pages
  • ISBN-13: 978-1908043498

Agile Software Diagnostics

We introduce this method based on iterative and incremental pattern-oriented diagnostics we founded and developed during the last few years. It is currently based on 5 principles:

  1. Patterns are the principal measure of quality
  2. Attention to detail through checklists
  3. Analysis is done by motivated expertise-driven trusted individuals
  4. Customer satisfaction by useful analysis delivered in the shortest possible time
  5. Analysis audit as a pair diagnostics

Book: Software Diagnostics

The following direct links can be used to order the book now:

Buy Hardcover from Amazon

Buy Hardcover from Barnes & Noble

The book is available for Safari Books Online subscribers

Also available for sale in PDF format from Software Diagnostics Services.

This is a collection of Software Diagnostics Services webinar transcripts about pattern-oriented software diagnostics developed by Software Diagnostics Institute. Includes 9 seminars on pattern-driven software problem solving, software narratology, pattern-driven software diagnostics, systemic software diagnostics, pattern-based software diagnostics, philosophy of software diagnostics, victimware, malware narratives and pattern-oriented network trace analysis.

  • Title: Software Diagnostics: The Collected Seminars
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (September 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Hardback: 302 pages
  • ISBN-13: 978-1908043641

Book: Accelerated .NET Memory Dump Analysis, Second Edition

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

The first edition is also available for Safari Books Online subscribers

The second edition is available for SkillSoft Books24x7 subscribers

The second edition is also available in PDF format from Software Diagnostics Services.

The full transcript of Software Diagnostics Services Training with 9 step-by-step exercises, notes, source code of specially created modeling applications and selected Q&A. Covers 20 .NET memory dump analysis patterns plus additional unmanaged patterns.

  • Title: Accelerated .NET Memory Dump Analysis: Training Course Transcript and WinDbg Practice Exercises, Second Edition
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (August 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 268 pages
  • ISBN-13: 978-1908043597

Table of Contents

Debugging TV

NEW! Now includes Android and Java

Welcome to Debugging TV and Frames series where each episode features some facet of debugging, memory dump, and software trace analysis on Windows, Mac OS X, and Android platforms in 8 slides in 8 minutes including live WinDbg (Windows) or GDB demonstration (Mac OS X, Linux) plus extra 8 minutes for you to ask questions.

New! We are restarting Debugging TV machine in 2014. It will be integrated with renewed Debugging Experts magazine (print and online). We also plan to publish all transcripts of the previous episodes. Happy New Year!

Note: To view previous episodes on your computer you need to install a codec for Windows: http://www.gotomeeting.com/codec

All episodes are also available on YouTube with descriptions: http://www.youtube.com/DebuggingTV

Debugging TV Frame 0x01
Recording: 2011-10-07-Debugging-TV-Frame-0x01.zip
Slides: DebuggingTV_Frame_0x01.pdf
WinDbg log: DebuggingTV_Frame_0x01.txt

Debugging TV Frame 0x02
Recording: 2011-10-14-Debugging-TV-Frame-0x02.zip
Slides: DebuggingTV_Frame_0x02.pdf
From Q&A session: DIA SDK to access PDB symbol files

Debugging TV Frame 0x03
Recording: 2011-10-21-Debugging-TV-Frame-0x03.zip
Slides: DebuggingTV_Frame_0x03.pdf
WinDbg log: DebuggingTV_Frame_0x03.txt

Debugging TV Frame 0x04
Recording: 2011-11-25-Debugging-TV-Frame-0x04.zip
Slides: DebuggingTV_Frame_0x04.pdf
WinDbg log: DebuggingTV_Frame_0x04.txt
Note on Q&A: There was a question about the difference between .symopt-4 and .reload /f and indeed for the exercise purpose there was no difference. However I understood the question incorrectly and when I mentioned about forcing mismatched symbols load I meant .reload /f /i that we covered in the previous Frame Episode 0x02.

Debugging TV Frame 0x05
Recording: 2011-12-02-Debugging-TV-Frame-0x05.zip
Slides: DebuggingTV_Frame_0x05.pdf
WinDbg log: DebuggingTV_Frame_0x05.txt

Debugging TV Frame 0x06
Recording: 2012-01-06-Debugging-TV-Frame-0x06.zip
Slides: DebuggingTV_Frame_0x06.pdf
WinDbg log: DebuggingTV_Frame_0x06.txt

Debugging TV Frame 0x07
Recording: 2012-02-03-Debugging-TV-Frame-0x07.zip
Slides: DebuggingTV_Frame_0x07.pdf
WinDbg log: DebuggingTV_Frame_0x07.txt

Debugging TV Frame 0x08
Recording: 2012-02-17-Debugging-TV-Frame-0x08.zip
Slides: DebuggingTV_Frame_0x08.pdf
WinDbg log: DebuggingTV_Frame_0x08.txt
API description: contexts.h
Modeling application: TestActCtx.zip

Debugging TV Frame 0x09
Recording: 2012-02-24-Debugging-TV-Frame-0x09.zip
Slides: DebuggingTV_Frame_0x09.pdf
WinDbg log 1: DebuggingTV_Frame_0x09-1.txt
WinDbg log 2: DebuggingTV_Frame_0x09-2.txt
Modeling application: MixedBreakpoints.zip

Debugging TV Frame 0x0A (Mac OS X)
Recording: 2012-03-16-Debugging-TV-Frame-0x0A.zip
Slides: DebuggingTV_Frame_0x0A.pdf

Debugging TV Frame 0x0B (Mac OS X)
Recording: 2012-03-30-Debugging-TV-Frame-0x0B.zip
Slides: DebuggingTV_Frame_0x0B.pdf

Debugging TV Frame 0x0C (Mac OS X)
Recording: 2012-04-06-Debugging-TV-Frame-0x0C.zip
Crash report: MultipleThreads_2012-04-06-092234_DumpAnalysis-MacBook-Air.crash
Slides: DebuggingTV_Frame_0x0C.pdf

Debugging TV Frame 0x0D (Mac OS X)
Recording: 2012-05-04-Debugging-TV-Frame-0x0D.zip
Crash report: SpikingThread_2012-05-04-174941_DumpAnalysis-MacBook-Air.crash
Slides: DebuggingTV_Frame_0x0D.pdf

Debugging TV Frame 0x0E (Mac OS X)
Recording: 2012-05-25-Debugging-TV-Frame-0x0E.zip
Crash report: HeapCorruption2_2012-05-24-111258_DumpAnalysis-MacBook-Air.crash
Crash report: DoubleFree_2012-05-24-130929_DumpAnalysis-MacBook-Air.crash
Slides: DebuggingTV_Frame_0x0E.pdf

Debugging TV Frame 0x0F (Mac OS X)
Recording: 2012-06-01-Debugging-TV-Frame-0x0F.zip
Slides: DebuggingTV_Frame_0x0F.pdf

Debugging TV Frame 0x10 (General Software Diagnostics)
Recording: 2012-06-18-Debugging-TV-Frame-0x10.zip
Slides: DebuggingTV_Frame_0x10.pdf

Debugging TV Frame 0x11 (Windows, Mac OS X)
Recording: 2012-07-16-Debugging-TV-Frame-0x11.zip
Slides: DebuggingTV_Frame_0x11.pdf

Debugging TV Frame 0x12 (Mac OS X)
Recording: 2012-08-27-Debugging-TV-Frame-0x12.zip
Slides: DebuggingTV_Frame_0x12.pdf

Debugging TV Frame 0x13 (Mac OS X)
Recording: 2012-09-25-Debugging-TV-Frame-0x13.zip
Slides: DebuggingTV_Frame_0x13.pdf

Debugging TV Frame 0x14 (Windows)
2012-10-15-Debugging-TV-Frame-0x14.zip
Slides: DebuggingTV_Frame_0x14.pdf

Debugging TV Frame 0x15 (Windows)
Recording: 2012-10-22-Debugging-TV-Frame-0x15.zip
Slides: DebuggingTV_Frame_0x15.pdf
MessageHistory x86 log: messages32.txt
MessageHistory x64 log: messages64.txt

Debugging TV Frame 0x16 (Windows)
Recording: 2012-11-01-Debugging-TV-Frame-0x16.zip
Slides: DebuggingTV_Frame_0x16.pdf
WinDbg log (process dump): windbg-old-hangs-on-windows8-dump.txt
WinDbg log (complete dump): memory-windows8.txt

Debugging TV Frame 0x17 (Windows)
Recording: 2012-11-12-Debugging-TV-Frame-0x17.zip
Slides: DebuggingTV_Frame_0x17.pdf

Debugging TV Frame 0x18 (Windows)
Recording: 2012-12-03-Debugging-TV-Frame-0x18.zip
Slides: DebuggingTV_Frame_0x18.pdf
WinDbg log: logfile.txt
Source code: FrameNavigation.txt

Debugging TV Frame 0x19 (Windows)
Recording: 2013-01-07-Debugging-TV-Frame-0x19.zip
Slides: DebuggingTV_Frame_0x19.pdf

Debugging TV Frame 0x1A (Software Diagnostics Architecture)
Recording: 2013-11-04-Debugging-TV-Frame-0x1A.zip
Slides: DebuggingTV_Frame_0x1A.pdf

Debugging TV Frame 0x1B (Windows)
Recording: 2013-11-11-Debugging-TV-Frame-0x1B.zip
Slides: DebuggingTV_Frame_0x1B.pdf
WinDbg log (iexplore memory dump analysis): iexplore-dump-analysis.txt
WinDbg log (iexplore live analysis): iexplore-live-analysis.txt

Debugging TV Frame 0x1C (Windows)
Recording: 2013-12-02-Debugging-TV-Frame-0x1C.zip
Slides: DebuggingTV_Frame_0x1C.pdf
WinDbg log: Episode-0x1C-1-no-lsass.txt
WinDbg log: Episode-0x1C-2-fibre-bundle-user-space.txt
WinDbg log: Episode-0x1C-3-fibre-bundle-kernel-space.txt
WinDbg log: Episode-0x1C-4-file-copy-spike-wrl-symbols.txt

Debugging TV Frame 0x20 (Windows)
Recording: 2013-01-21-Debugging-TV-Frame-0x20.zip
Slides: DebuggingTV_Frame_0x20.pdf
WinDbg log: InjectionResidue.txt

Debugging TV Frame 0x21 (Windows)
Recording: 2013-02-12-Debugging-TV-Frame-0x21.zip
Slides: DebuggingTV_Frame_0x21.pdf

Debugging TV Frame 0x22 (Windows)
Recording: 2013-02-18-Debugging-TV-Frame-0x22.zip
Slides: DebuggingTV_Frame_0x22.pdf

Debugging TV Frame 0x23 (Windows)
Recording: 2013-03-04-Debugging-TV-Frame-0x23.zip
Slides: DebuggingTV_Frame_0x23.pdf

Debugging TV Frame 0x24 (Windows)
Recording: 2013-04-15-Debugging-TV-Frame-0x24.zip
Slides: DebuggingTV_Frame_0x24.pdf
Source code: PastStackTrace.txt
WinDbg log (x86): PastStackTrace32.txt
WinDbg log (x64): PastStackTrace64.txt

Debugging TV Frame 0x25 (Windows)
Recording: 2013-05-06-Debugging-TV-Frame-0x25.zip
Slides: DebuggingTV_Frame_0x25.pdf
WinDbg log: Episode-0x25-windbg-log.txt

Debugging TV Frame 0x26 (Windows)
Recording: 2013-05-22-Debugging-TV-Frame-0x26.zip
Slides: DebuggingTV_Frame_0x26.pdf
Source code: BufferUnderwrite.cpp
WinDbg log 1: NormalHeap.txt
WinDbg log 2: FullPageHeap.txt
WinDbg log 3: FullPageHeapBackwards.txt

Debugging TV Frame 0x27 (Windows)
Recording: 2013-05-28-Debugging-TV-Frame-0x27.zip
Slides: DebuggingTV_Frame_0x27.pdf
WinDbg log: Episode-0x27-windbg-log.txt

Debugging TV Frame 0x28 (Windows)
Recording: 2013-06-04-Debugging-TV-Frame-0x28.zip
Slides: DebuggingTV_Frame_0x28.pdf
WinDbg log: Episode-0x28-windbg-log.txt

Debugging TV Frame 0x29 (Windows)
Recording: 2013-06-10-Debugging-TV-Frame-0x29.zip
Slides: DebuggingTV_Frame_0x29.pdf
WinDbg log: Episode-0x29-windbg-log.txt

Debugging TV Frame 0x30 (Windows)
Recording: 2013-07-15-Debugging-TV-Frame-0x30.zip
Slides: DebuggingTV_Frame_0x30.pdf

Debugging TV Frame 0x31 (Windows)
Recording: 2013-08-12-Debugging-TV-Frame-0x31.zip
Slides: DebuggingTV_Frame_0x31.pdf
WinDbg log: Episode-0x31-WinDbg-log.txt

Debugging TV Frame 0x32 (Android)
Recording: 2013-08-26-Debugging-TV-Frame-0x32.zip
Slides: DebuggingTV_Frame_0x32.pdf
Java code: FullscreenActivityJava.txt
Android log (fragments): StackTraceCollectionLog.txt

Debugging TV Frame 0x33 (Android)
Recording: 2013-09-10-Debugging-TV-Frame-0x33.zip
Slides: DebuggingTV_Frame_0x33.pdf
Java code for SpikingThread app: FullscreenActivitySpikingThreadJava.txt
Java code for Deadlock app: FullscreenActivityDeadlockJava.txt
Android log (fragments) for SpikingThread app: SpikingThreadLog.txt
Android log (fragments) for Deadlock app: DeadlockLog.txt
The output of top command (ADB): top.txt
The output of ps -t command (ADB): ps-t.txt

Debugging TV Frame 0x34 (Android)
Recording: 2013-09-23-Debugging-TV-Frame-0x34.zip
Slides: DebuggingTV_Frame_0x34.pdf

More frames are coming and www.debugging.tv hosts TV programme and recordings of past episodes.

The Structure of Twitter Narrative

This illustrated research monograph analyses Twitter narrative stream from the perspective of trace and log analysis patterns.

  • Title: The Structure of Twitter Narrative: Applied Patterns from Software Narratology and Human-Computer Narratives
  • Authors: Dmitry Vostokov, Software Diagnostics Institute
  • Publisher: OpenTask (September 2013)
  • Language: English
  • Product Dimensions: 21.6 x 14.0
  • Paperback: 120 pages
  • ISBN-13: 978-1908043610

Introduction to Systemic Software Diagnostics

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

This is a transcript of Software Diagnostics Services Webinar about how to apply systems theory and systems thinking for effective and efficient abnormal software behaviour diagnostics: the foundation of software troubleshooting and debugging.

  • Title: Systemic Software Diagnostics: An Introduction
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (July 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 32 pages
  • ISBN-13: 978-1908043399

BugInject Library

Software Diagnostics Services is planning to release BugInject® library modeling abnormal software structure and behaviour based on our pattern catalogues.

Source: http://www.patterndiagnostics.com/buginject

Book: Accelerated Windows Debugging 3

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

Also available in PDF format from Software Diagnostics Services.

The full transcript of Software Diagnostics Services Training.

  • Title: Accelerated Windows Debugging 3: Training Course Transcript and WinDbg Practice Exercises
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (July 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 252 pages
  • ISBN-13: 978-1908043566

Table of Contents

The Structure of Software Problem Solving Organization

Based on the separation of problem solving powers we propose the following software problem solving triangle with a separate software diagnostics department:

In the forthcoming Webinar we outline the benefits of this approach.

Bridging The Great Divide

In Pattern-Based Software Diagnostics presentation we proposed to use pattern catalogues to bridge the separation of software construction and memory dump software diagnostics. With an introduction of Motifs to trace and log analysis pattern catalogue it is now possible (at least conceptually) to bridge construction and trace analysis too:

Elementary Software Diagnostics Patterns

These are patterns of abnormal software behaviour that affect software users and trigger the application of pattern-oriented software diagnostics and debugging if necessary. The initial list of relevant elementary patterns include:

  1. Functional

    • Use-case Deviation
  2. Non-functional
    • Crash
    • Hang (includes delays*)
    • Counter Value (includes resource leaks, CPU spikes)
    • Error Message
  3. * In choosing the pattern vocabulary we decided to use ordinary names, for example, Hang was chosen instead of Response Delay.

Windows Memory Analysis Checklist

General:

  • Symbol servers (.symfix)
  • Internal database(s) search
  • Google or Microsoft search for suspected components as this could be a known issue. Sometimes a simple search immediately points to the fix on a vendor’s site
  • The tool used to save a dump (to flag false positive, incomplete or inconsistent dumps)
  • OS/SP version (version)
  • Language
  • Debug time
  • System uptime
  • Computer name (dS srv!srvcomputername or !envvar COMPUTERNAME)
  • List of loaded and unloaded modules (lmv or !dlls)
  • Hardware configuration (!sysinfo)
  • .kframes 1000

Application or service:

  • Default analysis (!analyze -v or !analyze -v -hang for hangs)
  • Critical sections (!cs -s -l -o, !locks) for both crashes and hangs
  • Component timestamps, duplication and paths. DLL Hell? (lmv and !dlls)
  • Do any newer components exist?
  • Process threads (~*kv or !uniqstack) for multiple exceptions and blocking functions
  • Process uptime
  • Your components on the full raw stack of the problem thread
  • Your components on the full raw stack of the main application thread
  • Process size
  • Number of threads
  • Gflags value (!gflag)
  • Time consumed by threads (!runaway)
  • Environment (!peb)
  • Import table (!dh)
  • Hooked functions (!chkimg)
  • Exception handlers (!exchain)
  • Computer name (!envvar COMPUTERNAME)
  • Process heap stats and validation (!heap -s, !heap -s -v)
  • CLR threads? (mscorwks or clr modules on stack traces) Yes: use .NET checklist below
  • Hidden (unhandled and handled) exceptions on thread raw stacks

System hang:

  • Default analysis (!analyze -v -hang)
  • ERESOURCE contention (!locks)
  • Processes and virtual memory including session space (!vm 4)
  • Important services are present and not hanging
  • Pools (!poolused)
  • Waiting threads (!stacks)
  • Critical system queues (!exqueue f)
  • I/O (!irpfind)
  • The list of all thread stack traces (!process 0 3f)
  • LPC/ALPC chain for suspected threads (!lpc message or !alpc /m after search for "Waiting for reply to LPC" or "Waiting for reply to ALPC" in !process 0 3f output)
  • RPC threads (search for "RPCRT4!OSF" in !process 0 3f output)
  • Mutants (search for "Mutants - owning thread" in !process 0 3f output)
  • Critical sections for suspected processes (!cs -l -o -s)
  • Sessions, session processes (!session, !sprocess)
  • Processes (size, handle table size) (!process 0 0)
  • Running threads (!running)
  • Ready threads (!ready)
  • DPC queues (!dpcs)
  • The list of APCs (!apc)
  • Internal queued spinlocks (!qlocks)
  • Computer name (dS srv!srvcomputername)
  • File cache, VACB (!filecache)
  • File objects for blocked thread IRPs (!irp -> !fileobj)
  • Network (!ndiskd.miniports and !ndiskd.pktpools)
  • Disk (!scsikd.classext -> !scsikd.classext class_device 2)
  • Modules rdbss, mrxdav, mup, mrxsmb in stack traces
  • Functions Ntfs!Ntfs*, nt!Fs* and fltmgr!Flt* in stack traces

BSOD:

  • Default analysis (!analyze -v)
  • Pool address (!pool)
  • Component timestamps (lmv)
  • Processes and virtual memory (!vm 4)
  • Current threads on other processors
  • Raw stack
  • Bugcheck description (including ln exception address for corrupt or truncated dumps)
  • Bugcheck callback data (!bugdump for systems prior to Windows XP SP1)
  • Bugcheck secondary callback data (.enumtag)
  • Computer name (dS srv!srvcomputername)
  • Hardware configuration (!sysinfo)

.NET application or service:

  • CLR module and SOS extension versions (lmv and .chain)
  • Managed exceptions (~*e !pe)
  • Nested managed exceptions (!pe -nested)
  • Managed threads (!Threads -special)
  • Managed stack traces (~*e !CLRStack)
  • Managed execution residue (~*e !DumpStackObjects and !DumpRuntimeTypes)
  • Managed heap (!VerifyHeap, !DumpHeap -stat and !eeheap -gc)
  • GC handles (!GCHandles, !GCHandleLeaks)
  • Finalizer queue (!FinalizeQueue)
  • Sync blocks (!syncblk)

Professional Diagnostics and Debugging Development Program

Software Diagnostics Services is planning to start PD3P in September, 2013. Its curricular combines the best of its software diagnostics and debugging training courses, presentations, webinars, books, Software Diagnostics Library and Debugging TV.

Introduction to Pattern-Driven Software Diagnostics

New! Now available for Kindle

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

This is a transcript of Software Diagnostics Services Webinar about different pattern categories for effective and efficient abnormal software behaviour diagnostics: the foundation of scalable and cost-effective pattern-driven software support.

  • Title: Pattern-Driven Software Diagnostics: An Introduction
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (April 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 32 pages
  • ISBN-13: 978-1908043382

Unified Computer Diagnostics: Incorporating Hardware Narratology

Interpreting hardware signals as messages and messages as signals allows us to apply Software Narratology and software trace analysis patterns to the domain of hardware diagnostics:

Generalized trace analysis patterns and narrative extends the view of hardware-software traces and logs as temporarily ordered event sequences. The time domain is generalized to any arbitrary set such as a list of indexes or pointers or even memory itself. This gives a unification of memory and log analysis and application of Computer Narratology (*) to memory dump analysis as well.

(*) We call the application of methods of literary narratology to computer trace and log analysis and computer-related stories in general as Hardware-Software Narratology or simply Computer Narratology as it was originally done in Memory Dump Analysis Anthology, Volume 3 when we first introduced Software Narratology.

Zero Fault Software Diagnostics

Software diagnostics is used whenever there is a fault that triggers some kind of an artefact such as a memory dump or a software trace. It is also used proactively in software and network monitoring. We combine all these uses with our pattern-oriented approach to anticipate faults before their occurrence:

Such preventive software diagnostics consists from 4 interrelated parts:

  • General software structure and behaviour pattern catalogues
  • Domain, vendor and product specific problem catalogues
  • Live monitoring
  • Pre-mortem analysis

Pre-mortem here means preventive memory dump analysis. It is similar to post-mortem analysis but artefacts are collected and analysed proactively before any actual problem. In some sense pre-mortem analysis is a part of live monitoring but we confine the latter to software trace and log analysis.

Book: Accelerated Windows Malware Analysis with Memory Dumps

The following direct links can be used to order the book now:

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

Also available in PDF format from Software Diagnostics Services.

The full transcript of Software Diagnostics Services Training.

  • Title: Accelerated Windows Malware Analysis with Memory Dumps: Training Course Transcript and WinDbg Practice Exercises
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (February 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 232 pages
  • ISBN-13: 978-1908043443

Table of Contents

Memory Dump Analysis Anthology, Volume 6

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback or Hardcover from Amazon

Buy Paperback or Hardcover from Barnes & Noble

Available for Safari Books Online subscribers

Also available in PDF format from Software Diagnostics Services

Contains revised, edited, cross-referenced, and thematically organized selected DumpAnalysis.org blog posts about memory dump and software trace analysis, software troubleshooting and debugging written in November 2010 - October 2011 for software engineers developing and maintaining products on Windows platforms, quality assurance engineers testing software on Windows platforms, technical support and escalation engineers dealing with complex software issues, and security researchers, malware analysts and reverse engineers. The sixth volume features:

- 56 new crash dump analysis patterns including 14 new .NET memory dump analysis patterns
- 4 new pattern interaction case studies
- 11 new trace analysis patterns
- New Debugware pattern
- Introduction to UI problem analysis patterns
- Introduction to intelligence analysis patterns
- Introduction to unified debugging pattern language
- Introduction to generative debugging, metadefect template library and DNA of software behavior
- The new school of debugging
- .NET memory dump analysis checklist
- Software trace analysis checklist
- Introduction to close and deconstructive readings of a software trace
- Memory dump analysis compass
- Computical and Stack Trace Art
- The abductive reasoning of Philip Marlowe
- Orbifold memory space and cloud computing
- Memory worldview
- Interpretation of cyberspace
- Relationship of memory dumps to religion
- Fully cross-referenced with Volume 1, Volume 2, Volume 3, Volume 4, and Volume 5

Product information:

  • Title: Memory Dump Analysis Anthology, Volume 6
  • Author: Dmitry Vostokov
  • Language: English
  • Product Dimensions: 22.86 x 15.24
  • Paperback: 306 pages
  • Publisher: Opentask (January 2013)
  • ISBN-13: 978-1-908043-19-1
  • Hardcover: 306 pages
  • Publisher: Opentask (January 2013)
  • ISBN-13: 978-1-908043-20-7

Table of Contents
Errata

Back cover features 3d memory space visualization image created with ParaView.

Pattern-Oriented Software Diagnostics

consists of two main parts:

  • Pattern-Driven process of finding patterns from existing pattern catalogs
  • Pattern-Based evolution of pattern catalogs and pattern relationships

Book: Accelerated Windows Software Trace Analysis

The following direct links can be used to order the book now:

Buy Kindle version

Buy Paperback from Amazon

Buy Paperback from Barnes & Noble

Available for SkillSoft Books24x7 subscribers

Also available in PDF format + recording from Software Diagnostics Services.

The full transcript of Software Diagnostics Services Training.

  • Title: Accelerated Windows Software Trace Analysis: Training Course Transcript
  • Authors: Dmitry Vostokov, Software Diagnostics Services
  • Publisher: OpenTask (January 2013)
  • Language: English
  • Product Dimensions: 28.0 x 21.6
  • Paperback: 130 pages
  • ISBN-13: 978-1908043429

Table of Contents

The Exception Point

This is the first novella to be written by applying software narratology and trace analysis patterns to history and is planned for publication in Spring 2015 (ISBN: 978-1908043412). Book description:

Russia, 1908, June 30, 7:14 a.m., the court of Tsar Nicholas II is wiped out by an impact, an enormous explosion over St. Petersburg. In an ensuring chaos State Duma takes power over Imperial Russia changing the course of World history forever. Russia, 2017, an alternative history novella is published about the Tunguska event that missed the capital of Russia...

Software Trace Analysis Problem Domain Pattern Hierarchy

Software log analysis patterns from Software Diagnostics Institute are independent from any OS, platform or product because they are based on viewing software logs as stories of computation and were discovered by application of narratological analysis (software narratology). In addition to these patterns there exist domain specific problem patterns such as wrong hotfix level or specific product error code during software installation or execution. Typical examples of support for such platform and product specific type of patterns include Microsoft Windows Problem Reporting and Citrix Auto Support.

Software Diagnostics Discipline

Let’s define software diagnostics as a discipline studying abnormal software structure and behavior in software execution artifacts (such as memory dumps, software and network traces and logs) using pattern-driven, systemic and pattern-based analysis methodologies.

Pattern-Based v. Pattern-Driven Software Diagnostics

Pattern-driven software post-construction problem solving involves using preexisting pattern languages and pattern catalogs for software diagnostics, troubleshooting and debugging. Pattern-based software post-construction problem solving addresses PLS (Pattern Life Cycle) - from the discovery of a new pattern through its integration into an existing catalog and language, testing, packaging and delivering to pattern consumers with subsequent usage, refactoring and writing case studies:

A Pattern Language for Network Trace Analysis

We propose to use Trace Analysis Patterns (on the right column) in network trace analysis. For details please see this article:

http://www.dumpanalysis.org/blog/index.php/2012/07/19/network-trace-anal...

Software Diagnostics Certifications

The first software diagnostics certification in memory dump analysis starts this September and will be administered by Memory Dump Analysis Services:

http://www.dumpanalysis.com/memory-dump-analysis-certification-outline

We also plan a beta software trace analysis certification by the end of 2012.

For companies there is also available Software Diagnostics Maturity enterprise certification:

http://www.dumpanalysis.com/software-diagnostics-maturity

Syndicate content